Dataset mappings for ArcSight
Trying to take some of the reports generated in fortianalyzer and create them in ArcSight. My issue is that I am unable to verify what fields are used in the Fortinet dataset query. Some are self explanatory (catdesc, rcvbyte, sentbyte, etc.) But there are others such as "browsetime" or "bandwidth" or "logid_to_int(logid) not in (4, 7, 14)". Does anyone have any insight on what these fields mean or have a reference guide or way to see what field in fortianalyzer maps to the dataset in the reports? When I look at the query below from fortinanaylzer, I want to know all of the fields from the log file are used in the query.....
select hostname, string_agg(distinct catdesc, ', ') as agg_catdesc, sum(delta) as browsetime, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from ###(select hostname, catdesc, sum($browse_time) as delta, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and hostname is not null group by hostname, catdesc having sum($browse_time)>0 order by delta desc)### t group by hostname order by browsetime desc