FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
Article Id 198194

When configuring an event handler, the generic filter allows more precise and flexible control over which logs trigger an event.

FortiAnalyzer supports multiple operators and logic in Generic filters.

The operators currently supported by FortiAnalyzer are as follows:

Operator Meaning
== Equal (Exact match)
!= Not equal  (Not matching)
< Smaller than
<= Smaller than or equal
> Greater than
>= Greater than or equal
~ Contained (Included somewhere in the string)
!~ Not contained (Not included)

Tokens: '(', ')', '&', '|', 'and', 'or',  'not'

Example:  type=='traffic' AND ((dstport>=80 AND srcip= OR (subtype='local' AND NOT action='timeout'))

The use of multiple operators is supported starting in FortiAnalyzer v5.0.3 and up.

Note: Starting in FortiAnalyzer 5.2.2, logs of type syslog can also trigger events.

Related Articles

Technical Note: How to configure an Event Handler with a generic text filter