Dataset mappings for ArcSight

[john_robinson2]

Trying to take some of the reports generated in fortianalyzer and create them in ArcSight.  My issue is that I am unable to verify what fields are used in the Fortinet dataset query.  Some are self explanatory (catdesc, rcvbyte, sentbyte, etc.) But there are others such as "browsetime" or "bandwidth" or "logid_to_int(logid) not in (4, 7, 14)". Does anyone have any insight on what these fields mean or have a reference guide or way to see what field in fortianalyzer maps to the dataset in the reports?  When I look at the query below from fortinanaylzer, I want to know all of the fields from the log file are used in the query.....

select hostname, string_agg(distinct catdesc, ', ') as agg_catdesc, sum(delta) as browsetime, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from ###(select hostname, catdesc, sum($browse_time) as delta, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and hostname is not null group by hostname, catdesc having sum($browse_time)>0 order by delta desc)### t group by hostname order by browsetime desc

[hzhao_FTNT]

Hi there, those log fields are sent from FortiGate, please search "FortiOS Log Message Reference" in Fortinet Document Library and choose your FOS version.

Regards,

HZ

[john_robinson2]

Hello HZ,

Thank you for your reply.  I have viewed the Log Message Reference but it does not give an explanation on the events.  Such as, what is the difference between: where name = "traffic: forward" vs "traffic: close" vs "traffic: deny" vs "traffic: timeout"? Or status = "close", "passthrough", "deny", "blocked", "accept".......The reference guide only states "The status of the traffic." But what does that and other categories actually mean? At least Cisco provided a link that broke down the actual event and dissected it for you.  

Also, I am seeing in ArcSight that the events which give a catdesc ("utm:http") do not give a duration value, but "traffic: forward" or "traffic: close" events that do give a duration value; do not give a catdesc.  The report I referenced above gives an output of catdesc and duration. (how long a user is browsing the categorized sites.)  Yet there is no log or event which provides catdesc and duration together.  This is why I am trying to break down the SQL query provided in the dataset of the report.

My only conclusion is that Fortianalyzer is combining information on the back-end not visible to us or represented in the SQL query.  Any additional input to my question is appreciated.

Thanks!