IDS events need to match with corresponding firewall traffic logs.

[Mohammed_Anis]

Hi Forum, I am a bit new to Fortisiem. Here is my query. I am analyzing the IDS events and I have the incidents generated. Now I want to get the corresponding Firewall events related to this particular IDS event. Is there a way I can correlate these two events. Is there a better solution?

Thanks and regards

Anis

[tanr]

How are you viewing the events (ie, in FortiView > Threats?), and are you viewing it on a FortiGate, in FortiCloud, or on a FortiAnalyzer?   What sort of event is it?  Usually there are easy ways to drill down to the associated logs.

[darwin_FTNT]

serial or session id field links both multiple utm logs (generated per utm event, e.g., virus, ips, dlp, webfilter, within a current session) with traffic log (generated at start or/and at end of a session).  A session is uniquely identified as src/dst/sport/dport connection. traffic log contains info about the session (policy id, protocol, username,...), while utm log contains info about security event details (utm profile name, url, filename, service,...)

[Mohammed_Anis]

darwin wrote:

serial or session id field links both multiple utm logs (generated per utm event, e.g., virus, ips, dlp, webfilter, within a current session) with traffic log (generated at start or/and at end of a session).  A session is uniquely identified as src/dst/sport/dport connection. traffic log contains info about the session (policy id, protocol, username,...), while utm log contains info about security event details (utm profile name, url, filename, service,...)

Thank you for the reply Darwin ,  Ill check on those fields to match.

[Mohammed_Anis]

tanr wrote:

How are you viewing the events (ie, in FortiView > Threats?), and are you viewing it on a FortiGate, in FortiCloud, or on a FortiAnalyzer?   What sort of event is it?  Usually there are easy ways to drill down to the associated logs.

I am viewing the events in FortiSiem. I am working on two types of events currently. Cisco firepower firewall events and Cisco Sourcefire IDS events. When I analyze the IDS events , I need to drill down to the corresponding firewall event to check if the traffic was allowed or blocked. There was no options to drill down. Thats why I am looking for any field or any matching data between the logs of both devices for a similar event.

[FSM_FTNT]

One approach could be from the Incident list view, select the incident, then hover over either the Source or Target, then click the dropdown Arrow and select Related Historical Events.