Technical Tip: FortiAnalyzer log forwarding CEF version

RuiChang · ‎12-08-2022

Description

This article explains the CEF (Common Event Format) version in log forwarding by FortiAnalyzer.

Scope

FortiAnalyzer.

Solution

By default, FortiAnalyzer forwards log in CEF version 0 (CEF:0) when configured to forward log in Common Event Format (CEF) type. It is forwarded in version 0 format as shown below:

Sample log:

Dec 08 17:00:55 Alza-kvm41 CEF:0|Fortinet|FortiGate-VM64|6.4.8,build1914 (GA)|0201009238|virus utm monitored|5|start=Dec 08 2022 17:00:55 logver=604081914 deviceExternalId=FGVM01000010XXXX dvchost=Alza-kvm41 ad.vd=root ad.eventtime=1670490056812274807 ad.tz=+0800 ad.logid=0201009238 cat=utm ad.subtype=virus ad.eventtype=analytics deviceSeverity=notice src=1.1.1.1 dst=2.2.2.2 spt=23456 dpt=80 act=monitored app=http fname=test-fsa.exe ad.fsaverdict=malicious ad.analyticscksum=47fd6cadce503e53ad2c543eb728ae2d017277afb3db6b16954e49ac1cf4cc20 ad.dtype=fortisandbox tz="+0800"...

Configuration Example:

CLI:

config system log-forward
edit 1
set mode forwarding
set fwd-max-delay realtime
set server-name "log_server"
set server-addr "10.219.2.63"
set fwd-server-type cef
set fwd-reliable enable
set signature 902148044239999678

next
end

GUI: