Description
When configuring an event handler, the generic filter allows more precise and flexible control over which logs trigger an event.
FortiAnalyzer supports multiple operators and logic in Generic filters.
The operators currently supported by FortiAnalyzer are as follows:
| Operator |
Meaning |
| == |
Equal (Exact match) |
| != |
Not equal (Not matching) |
| < |
Smaller than |
| <= |
Smaller than or equal |
| > |
Greater than |
| >= |
Greater than or equal |
| ~ |
Contained (Included somewhere in the string) |
| !~ |
Not contained (Not included) |
Tokens: '(', ')', '&', '|', 'and', 'or', 'not'
Example: type=='traffic' AND ((dstport>=80 AND srcip=192.168.1.12) OR (subtype='local' AND NOT action='timeout'))
Scope
The use of multiple operators is supported starting in FortiAnalyzer v5.0.3 and up.
Note: Starting in FortiAnalyzer 5.2.2, logs of type syslog can also trigger events.
Related Articles
Technical Note: How to configure an Event Handler with a generic text filter
