Parsers and Generated Fields
Tag Fields Created by Parser fortinet-fortigate
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser fortinet-fortigate
| Source Field | CPS Field | Description | Mapping |
|---|---|---|---|
| Vendor.eventtime, Vendor.date, Vendor.time, Vendor.tz, _ts | @timestamp | Primary timestamp field for events | Parsed from eventtime with conditional format handling or CEF header timestamp |
| Vendor.eventtime | @timestamp.nanos | Nanosecond precision timestamp | Extracted from eventtime when parsing nanosecond precision |
| source.address | client.address | Client address | Conditionally mapped from source.address |
| source.domain | client.domain | Client domain | Conditionally mapped from source.domain |
| source.ip | client.ip | Client IP address | Conditionally mapped from source.ip |
| source.mac | client.mac | Client MAC address | Conditionally mapped from source.mac |
| source.port | client.port | Client port | Conditionally mapped from source.port |
| Vendor.dstip, Vendor.remip, Vendor.dst_host, Vendor.dstname, Vendor.dst | destination.address | Destination address | Copied using coalesce from multiple fields with conditional logic for login events and lowercase normalization |
| Vendor.rcvdbyte | destination.bytes | Bytes received by destination | Copied from Vendor.rcvdbyte |
| Vendor.dst_host, Vendor.dstname | destination.domain | Destination domain | Copied using coalesce with lowercase conversion |
| Vendor.dstcity | destination.geo.city_name | Destination city | Copied from Vendor.dstcity |
| Vendor.dstcountry | destination.geo.country_name | Destination country | Copied from Vendor.dstcountry if not "Reserved" |
| Vendor.dstregion | destination.geo.region_name | Destination region | Copied from Vendor.dstregion |
| Vendor.dstip, Vendor.remip | destination.ip | Destination IP address | Copied using coalesce with CIDR validation |
| Vendor.dstmac, Vendor.destination_mac | destination.mac | Destination MAC address | Copied using coalesce with formatting |
| Vendor.tranip | destination.nat.ip | Destination NAT IP | Copied from Vendor.tranip |
| Vendor.tranport | destination.nat.port | Destination NAT port | Copied from Vendor.tranport |
| Vendor.rcvdpkt | destination.packets | Packets received by destination | Copied from Vendor.rcvdpkt |
| Vendor.dstport, Vendor.remport, Vendor.dst_port, Vendor.dpt | destination.port | Destination port number | Copied using coalesce from multiple fields including Vendor.dpt |
| Vendor.dstuser | destination.user.name | Destination user name | Copied from Vendor.dstuser |
| Vendor.xid | dns.id | DNS transaction ID | Copied from Vendor.xid |
| Vendor.qclass | dns.question.class | DNS query class | Copied from Vendor.qclass |
| Vendor.qname | dns.question.name | DNS query name | Copied from Vendor.qname |
| Vendor.qtype | dns.question.type | DNS query type | Copied from Vendor.qtype |
| Vendor.ipaddr | dns.resolved_ip[] | DNS resolved IP addresses | Array from split Vendor.ipaddr |
| None | ecs.version | ECS schema version | Static value: 9.2.0 |
| Vendor.cc | email.cc.address[] | Email CC addresses | Array populated from Vendor.cc for emailfilter subtype |
| Vendor.collectedemail, Vendor.from | email.from.address[] | Email from addresses | Array populated from multiple fields for emailfilter subtype |
| Vendor.sender | email.sender.address | Email sender address | Copied from Vendor.sender for emailfilter subtype |
| Vendor.subject | email.subject | Email subject | Copied from Vendor.subject for emailfilter subtype |
| Vendor.dstcollectedemail, Vendor.recipient | email.to.address[] | Email to addresses | Array populated from multiple fields for emailfilter subtype |
| Vendor.error_num | error.code | Error code | Copied from Vendor.error_num |
| Vendor.error | error.message | Error message | Copied from Vendor.error |
| Vendor.utmaction, Vendor.action, Vendor.logdesc, Vendor.eventtype, Vendor.act | event.action | Action performed | Copied using coalesce with priority order, special handling for UTM block actions |
| Vendor.type, Vendor.subtype, Vendor.action, Vendor.logdesc | event.category[] | Event category classification | Array populated based on event subtype and conditions |
| Vendor.type, Vendor.subtype | event.dataset | Dataset classification | Conditional based on event type and subtype |
| Vendor.sess_duration, Vendor.duration | event.duration | Session duration | Copied using coalesce from multiple fields |
| Vendor.event_id, Vendor.eventid, Vendor.event_class_id | event.id | Event identifier | Copied using coalesce from multiple fields |
| Vendor.type, log.level, Vendor.severity | event.kind | Event classification | Static value: event, conditionally set to alert for UTM events |
| None | event.module | Module identifier | Static value: fortigate |
| Vendor.type, Vendor.action, Vendor.status, Vendor.result, Vendor.logdesc, Vendor.reason | event.outcome | Success or failure outcome determination | Conditional based on event type and action values |
| Vendor.reason, Vendor.logdesc | event.reason | Event reason | Copied using coalesce from multiple fields |
| Vendor.ref | event.reference | Event reference | Copied from Vendor.ref |
| Vendor.severity | event.severity | Event severity level | Mapped from Vendor.severity to numeric values with support for numeric and text values |
| Vendor.start | event.start | Event start time | Copied from Vendor.start |
| Vendor.type, Vendor.action, Vendor.subtype | event.type[] | Event type categorization | Array populated based on event type and action |
| Vendor.filetype, Vendor.infectedfiletype, Vendor.matchedfiletype | file.extension | File extension | Copied using coalesce from multiple fields |
| Vendor.filename, Vendor.infectedfilename, Vendor.matchedfilename, Vendor.fname | file.name | File name | Copied using coalesce from multiple fields including CEF fields |
| Vendor.file | file.path | File path | Copied from Vendor.file |
| Vendor.filesize, Vendor.infectedfilesize | file.size | File size | Copied using coalesce from multiple fields |
| Vendor.srcname, Vendor.dvchost | host.name | Host name | Copied using coalesce from multiple fields including CEF fields |
| Vendor.crlevel | host.risk.calculated_level | Risk level | Copied from Vendor.crlevel |
| Vendor.crscore | host.risk.calculated_score | Risk score | Copied from Vendor.crscore |
| Vendor.httpmethod, Vendor.method | http.request.method | HTTP request method | Copied from Vendor.httpmethod or extracted from Vendor.method |
| Vendor.status | http.response.status_code | HTTP response status code | Extracted from Vendor.status |
| Vendor.level, Vendor.deviceSeverity | log.level | Log level | Copied using coalesce from multiple fields |
| @rawstring | log.syslog.hostname | Syslog hostname from CEF format | Extracted from CEF header |
| @rawstring | log.syslog.priority | Syslog priority number | Extracted from syslog priority header |
| Vendor.msg | message | Alert message | Copied from Vendor.msg for alert events |
| Vendor.app | network.application | Network application | Copied from Vendor.app with lowercase conversion |
| Vendor.sentbyte, Vendor.rcvdbyte | network.bytes | Total network bytes | Calculated from source.bytes + destination.bytes |
| Vendor.dir, Vendor.direction | network.direction | Network direction | Mapped from Vendor.dir or Vendor.direction |
| Vendor.proto | network.iana_number | IANA protocol number | Copied from Vendor.proto |
| Vendor.vpntunnel | network.name | Network name | Copied from Vendor.vpntunnel |
| Vendor.sentpkt, Vendor.rcvdpkt | network.packets | Total network packets | Calculated from source.packets + destination.packets |
| Vendor.service, Vendor.subtype, Vendor.method | network.protocol | Network protocol | Extracted from Vendor.service with conditional logic |
| Vendor.proto | network.transport | Transport protocol | Mapped from network.iana_number |
| Vendor.dstintf, Vendor.dst_int, Vendor.outintf | observer.egress.interface.name | Egress interface name | Copied using coalesce from multiple fields |
| Vendor.dstintfrole | observer.egress.zone | Egress zone | Copied from Vendor.dstintfrole |
| Vendor.dvchost | observer.hostname | Observer hostname | Copied from Vendor.dvchost |
| Vendor.srcintf, Vendor.src_int, Vendor.interface | observer.ingress.interface.name | Ingress interface name | Copied using coalesce from multiple fields |
| Vendor.srcintfrole | observer.ingress.zone | Ingress zone | Copied from Vendor.srcintfrole |
| Vendor.devname | observer.name | Observer device name | Copied from Vendor.devname |
| None | observer.product | Observer product | Static value: fortigate |
| Vendor.devid, Vendor.device_id, Vendor.deviceExternalId | observer.serial_number | Observer serial number | Copied using coalesce from multiple fields |
| None | observer.type | Observer type | Static value: firewall |
| None | observer.vendor | Observer vendor | Static value: fortinet |
| Vendor.app | process.name | Process name | Copied from Vendor.app |
| Vendor.catdesc, Vendor.filtertype, Vendor.filtercat, Vendor.policymode | rule.category | Rule category | Copied using coalesce from multiple fields |
| Vendor.logdesc, Vendor.comment, Vendor.msg | rule.description | Rule description | Conditional based on event type |
| Vendor.policyid, Vendor.policy_id, Vendor.filteridx | rule.id | Rule ID | Copied using coalesce from multiple fields |
| Vendor.policyname, Vendor.constraint, Vendor.dlpextra | rule.name | Rule name | Copied using coalesce from multiple fields |
| Vendor.policytype, Vendor.applist, Vendor.profile | rule.ruleset | Rule ruleset | Conditional based on event type with coalesce |
| Vendor.poluuid | rule.uuid | Rule UUID | Copied from Vendor.poluuid |
| destination.address | server.address | Server address | Conditionally mapped from destination.address |
| destination.domain | server.domain | Server domain | Conditionally mapped from destination.domain |
| destination.ip | server.ip | Server IP address | Conditionally mapped from destination.ip |
| destination.mac | server.mac | Server MAC address | Conditionally mapped from destination.mac |
| destination.port | server.port | Server port | Conditionally mapped from destination.port |
| source.address, Vendor.srcip, Vendor.locip, Vendor.src, Vendor.srcname, Vendor.authserver, Vendor.srcdomain | source.address | Source address | Copied using coalesce from multiple fields with conditional logic and lowercase normalization |
| Vendor.sentbyte | source.bytes | Bytes sent from source | Copied from Vendor.sentbyte |
| Vendor.srcname, Vendor.authserver, Vendor.srcdomain, source.address | source.domain | Source domain | Copied using coalesce with lowercase conversion or assigned from source.address for non-IP values |
| Vendor.srccountry | source.geo.country_name | Source country | Copied from Vendor.srccountry if not "Reserved" |
| Vendor.srcip, Vendor.locip | source.ip | Source IP address | Copied using coalesce with CIDR validation |
| Vendor.srcmac, Vendor.source_mac | source.mac | Source MAC address | Copied using coalesce with formatting |
| Vendor.transip | source.nat.ip | Source NAT IP | Copied from Vendor.transip |
| Vendor.transport | source.nat.port | Source NAT port | Copied from Vendor.transport |
| Vendor.sentpkt | source.packets | Packets sent from source | Copied from Vendor.sentpkt |
| Vendor.srcport, Vendor.locport, Vendor.src_port, Vendor.spt | source.port | Source port number | Copied using coalesce from multiple fields including CEF fields |
| Vendor.unauthuser | source.user.name | Source user name | Copied from Vendor.unauthuser |
| Vendor.crlevel, Vendor.severity, Vendor.apprisk | threat.enrichments[0].indicator.confidence | Threat indicator confidence | Conditional based on UTM subtype |
| Vendor.filetype | threat.enrichments[0].indicator.file.extension | Threat indicator file extension | Conditional based on UTM subtype |
| Vendor.analyticscksum | threat.enrichments[0].indicator.file.hash.sha256 | Threat indicator file hash | Conditional based on UTM subtype |
| Vendor.filename | threat.enrichments[0].indicator.file.name | Threat indicator file name | Conditional based on UTM subtype |
| Vendor.filesize | threat.enrichments[0].indicator.file.size | Threat indicator file size | Conditional based on UTM subtype |
| Vendor.virus, Vendor.attack, Vendor.app | threat.enrichments[0].indicator.name | Threat indicator name | Conditional based on UTM subtype |
| Vendor.domainfilterlist | threat.enrichments[0].indicator.provider | Threat indicator provider | Conditional based on UTM subtype |
| Vendor.ref | threat.enrichments[0].indicator.reference | Threat indicator reference | Conditional based on UTM subtype |
| Vendor.dtype, Vendor.appcat, Vendor.eventsubtype | threat.enrichments[0].indicator.type | Threat indicator type | Conditional based on UTM subtype |
| Vendor.qname, Vendor.sni | threat.enrichments[0].indicator.url.domain | Threat indicator domain | Conditional based on UTM subtype |
| Vendor.url | threat.enrichments[0].indicator.url.full | Threat indicator URL | Conditional based on UTM subtype |
| Vendor.ccertissuer | tls.client.issuer | TLS client certificate issuer | Copied from Vendor.ccertissuer |
| Vendor.ccertissuer | tls.client.x509.issuer.common_name[] | TLS client certificate issuer common name | Array populated from tls.client.issuer |
| Vendor.scertissuer | tls.server.issuer | TLS server certificate issuer | Copied from Vendor.scertissuer |
| Vendor.scertissuer | tls.server.x509.issuer.common_name[] | TLS server certificate issuer common name | Array populated from tls.server.issuer |
| Vendor.scertcname | tls.server.x509.subject.common_name[] | TLS server certificate common name | Array populated from Vendor.scertcname |
| Vendor.hostname | url.domain | URL domain | Copied from Vendor.hostname with lowercase conversion |
| Vendor.url | url.original | Original URL | Copied from Vendor.url |
| Vendor.url | url.query | URL query parameters | Extracted from url.original using regex |
| Vendor.hostname | url.top_level_domain | Top level domain | Extracted from url.domain using string manipulation |
| Vendor.group | user.group.name | User group name | Copied from Vendor.group |
| Vendor.user, Vendor.suser, Vendor.duser | user.name | User name | Conditional mapping with priority for duser over suser |
| Vendor.duser | user.target.name | Target user name | Copied from Vendor.duser when both suser and duser exist |
| Vendor.agent | user_agent.original | User agent string | Copied from Vendor.agent |
| Vendor.dtype | vulnerability.category[] | Vulnerability category | Array populated from Vendor.dtype |