IDS events need to match with corresponding firewall traffic logs.

Forum|Forum|7 years ago
October 23, 2018
5 replies
5435 views

Hi Forum, I am a bit new to Fortisiem. Here is my query. I am analyzing the IDS events and I have the incidents generated. Now I want to get the corresponding Firewall events related to this particular IDS event. Is there a way I can correlate these two events. Is there a better solution?

Thanks and regards

Anis

tanr

New Member

How are you viewing the events (ie, in FortiView > Threats?), and are you viewing it on a FortiGate, in FortiCloud, or on a FortiAnalyzer? What sort of event is it? Usually there are easy ways to drill down to the associated logs.

darwin_FTNT

Staff

serial or session id field links both multiple utm logs (generated per utm event, e.g., virus, ips, dlp, webfilter, within a current session) with traffic log (generated at start or/and at end of a session). A session is uniquely identified as src/dst/sport/dport connection. traffic log contains info about the session (policy id, protocol, username,...), while utm log contains info about security event details (utm profile name, url, filename, service,...)

Mohammed_AnisAuthor

New Member

darwin wrote:
serial or session id field links both multiple utm logs (generated per utm event, e.g., virus, ips, dlp, webfilter, within a current session) with traffic log (generated at start or/and at end of a session). A session is uniquely identified as src/dst/sport/dport connection. traffic log contains info about the session (policy id, protocol, username,...), while utm log contains info about security event details (utm profile name, url, filename, service,...)

Thank you for the reply Darwin , Ill check on those fields to match.

Sign up

Login with SSO

Login to the community

Login with SSO