Skip to main content
dmontgomery
dmontgomery
Explorer
April 3, 2024
Solved

Fortisiem raw events

  • April 3, 2024
  • 2 replies
  • 2876 views

We are doing analytics on ADFS logon failures - Windows event ID 364. We are interested the Relying Party specifically. We want to get counts of the logon failures by the Relying Party. We can see the relying party in the raw event message but it cannot be queried on in the analytics or selected as a display column. Does anybody know how to handle this situation?

Best answer by dmontgomery

After opening a ticket with Fortinet support this has classified as a bug: bug report #1028529

 

 

2 replies

cdurkin_FTNT
Staff
cdurkin_FTNT
Staff
April 3, 2024

Can you post a sanitized raw message from FortiSIEM and I can take a look?

dmontgomery
dmontgomeryAuthor
Explorer
April 3, 2024

Here is the raw message format:

"

2024-04-03T15:05:04Z ADFS.ABDEF.com 192.168.194.244 celOps-WUA-WinLog-AD xx/xxxx [phCustId]="1" [customer]="super" [monitorStatus]="Success" [Locale]="en-US" [MachineGuid]="92bb4a15-e201-4a1c-a415-db27b1ec3e32" [timeZone]="-0500" [eventName]="AD xx/xxxx" [eventSource]="AD FS" [eventId]="364" [eventType]="Warning" [domain]="abcdefg" [computer]="ADFS.ABDEF.com" [user]="bob" [userSID]="S-1-5-21-1960408961-1303643608-1801674531-49031" [userSIDAcctType]="User" [eventTime]="Apr 03 2024 15:05:03" [deviceTime]="Apr 03 2024 15:05:03" [msg]="Encountered error during federation passive request.

Additional Data

Protocol Name:
Saml

Relying Party:
https://app.company.com/application

Exception details:
Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSignatureAlgorithmMismatchException: MSIS7093: The message is not signed with expected signature algorithm."

cdurkin_FTNT
Staff
cdurkin_FTNT
Staff
April 3, 2024

Thank you.

 

If you are using ClickHouse as the database you can use the EXTRACT function as follows in a Display Field..

 

EXTRACT(Raw Event Log, "Relying Party: (.*?\n)")

This should give you what you need in a field, and then you can add the COUNT.

dmontgomery
dmontgomeryAuthorAnswer
Explorer
May 21, 2024

After opening a ticket with Fortinet support this has classified as a bug: bug report #1028529

 

 

Terms & ConditionsAccessibility statement