########################
#
# Base Macros
#
########################


[fortigate_traffic]
definition = eventtype=ftnt_fortigate_traffic

[fortigate_utm]
definition = eventtype=ftnt_fortigate_utm

[fortigate_event]
definition = eventtype=ftnt_fortigate_event

[fortigate_logs]
definition = `fortigate_traffic` OR `fortigate_utm` OR `fortigate_event`

[fortigate_virus]
definition = `fortigate_utm` subtype=virus

[fortigate_ips]
definition = `fortigate_utm` (subtype=ips OR subtype=anomaly)

[fortigate_anomaly]
definition = `fortigate_utm` subtype=anomaly

[fortigate_appctrl]
definition = `fortigate_utm` subtype=app-ctrl

[fortigate_webfilter]
definition = `fortigate_utm` subtype=webfilter

[fortigate_spam]
definition = `fortigate_utm` subtype=spam

[fortigate_netscan]
definition = `fortigate_utm` subtype=netscan

[fortigate_dlp]
definition = `fortigate_utm` subtype=dlp

[fortigate_vpn]
definition = `fortigate_event` subtype=vpn

[fortigate_wireless]
definition = `fortigate_event` subtype=wireless

[fortigate_auth]
definition = `fortigate_event` subtype=user

[fortigate_system]
definition = `fortigate_event` subtype=system

