[fortigate_logs]
TRANSFORMS-force_sourcetype_fortigate = force_sourcetype_fortigate
SHOULD_LINEMERGE = false
EVENT_BREAKER_ENABLE = true

[fgt_log]
TRANSFORMS-force_sourcetype_fgt = force_sourcetype_fortigate
SHOULD_LINEMERGE = false
EVENT_BREAKER_ENABLE = true

[fortigate_traffic]
TIME_PREFIX = ^
SHOULD_LINEMERGE = false
EVENT_BREAKER_ENABLE = true
KV_MODE = none
REPORT-field_extract				= field_extract
ANNOTATE_PUNCT = false
EVAL-vendor					= "Fortinet"
EVAL-product					= "Firewall"
EVAL-vendor_product = "Fortinet Firewall"
EVAL-product_version				= coalesce(logver, "50")
EVAL-devname                                    = coalesce(devname, devid)
FIELDALIAS-fortigate_traffic_dvc 			= devname as dvc
FIELDALIAS-fortigate_traffic_vendor_eventtype		= eventtype as vendor_eventtype
FIELDALIAS-fortigate_traffic_vendor_transport		= transport as vendor_transport
FIELDALIAS-vendor_action                        = action as vendor_action
FIELDALIAS-vendor_status                        = status as vendor_status
EVAL-ftnt_action				= coalesce(utmaction, vendor_action, vendor_status) 
LOOKUP-fortigate_traffic_action			= ftnt_action_lookup ftnt_action OUTPUT action
EVAL-sentbyte                                   = coalesce(sentdelta, sentbyte)
EVAL-rcvdbyte                                   = coalesce(rcvddelta, rcvdbyte)
EVAL-bytes 					= coalesce(rcvddelta + sentdelta, rcvdbyte + sentbyte)
EVAL-bytes_in         	= coalesce(rcvddelta, rcvdbyte)
EVAL-bytes_out        	= coalesce(sentdelta, sentbyte)
FIELDALIAS-fortigate_traffic_dest_ip                  = dstip as dest_ip
FIELDALIAS-fortigate_traffic_dest             	= dstip as dest
FIELDALIAS-fortigate_traffic_dest_interface   	= dstintf as dest_interface
FIELDALIAS-fortigate_traffic_dst_mac         		= dstmac as dest_mac
FIELDALIAS-fortigate_traffic_dest_port        	= dstport as dest_port
FIELDALIAS-fortigate_traffic_dest_translated_ip	= tranip as dest_translated_ip
FIELDALIAS-fortigate_traffic_dest_translated_port	= tranport as dest_translated_port
EVAL-packets					= (rcvdpkt + sentpkt)
EVAL-protocol_version = case(isnotnull(srcip), if(match(srcip,":"), "ipv6", "ipv4"), isnotnull(dstip), if(match(dstip,":"), "ipv6", "ipv4"))
EVAL-wifi = if(isnotnull(radioband), replace(radioband,",.*",""), null)
EVAL-tcp_flag = if(vendor_action IN("server-rst","client-rst"), "RST", tcp_flag)
FIELDALIAS-fortigate_traffic_packets_in		= rcvdpkt as packets_in
FIELDALIAS-fortigate_traffic_packets_out		= sentpkt as packets_out
FIELDALIAS-fortigate_traffic_rule			= poluuid as rule
FIELDALIAS-fortigate_traffic_rule_id          	= policyid as rule_id
FIELDALIAS-fortigate_traffic_session_id       	= sessionid as session_id
FIELDALIAS-fortigate_traffic_src              	= srcip as src
FIELDALIAS-fortigate_traffic_src_interface    	= srcintf as src_interface
FIELDALIAS-fortigate_traffic_src_ip			= srcip as src_ip
FIELDALIAS-fortigate_traffic_src_mac          	= srcmac as src_mac
FIELDALIAS-fortigate_traffic_src_port			= srcport as src_port
FIELDALIAS-fortigate_traffic_src_translated_ip 	= transip as src_translated_ip
FIELDALIAS-fortigate_traffic_src_translated_port 	= srcport as src_translated_port
FIELDALIAS-fortigate_traffic_src_zone                             = srcintfrole as src_zone
FIELDALIAS-fortigate_traffic_dest_zone                            = dstintfrole as dest_zone
EVAL-ssid = coalesce(srcssid, dstssid)
LOOKUP-fortigate_traffic_ftnt_protocol_lookup		= ftnt_protocol_lookup proto OUTPUT transport,protocol
EVAL-app					= coalesce(app, service, transport)
EVAL-user					= coalesce(user, unauthuser)

[fgt_traffic]
rename = fortigate_traffic

[fortigate_utm]
#subtype app-ctrl webfilter virus voip ips
TIME_PREFIX = ^
SHOULD_LINEMERGE = false
EVENT_BREAKER_ENABLE = true
KV_MODE = none
REPORT-field_extract                            = field_extract, extract_file_and_file_path, extract_url_domain
ANNOTATE_PUNCT = false
FIELDALIAS-fortigate_utm_dest_ip                  = dstip as dest_ip
FIELDALIAS-fortigate_utm_vendor_eventtype		= eventtype as vendor_eventtype
FIELDALIAS-fortigate_utm_vendor_url			= url as vendor_url
FIELDALIAS-vendor_action                        = action as vendor_action
FIELDALIAS-vendor_status                        = status as vendor_status
EVAL-severity					= coalesce(severity, crlevel, apprisk, "informational")
EVAL-vendor					= "Fortinet"
EVAL-product					= "Firewall"
EVAL-vendor_product         = "Fortinet Firewall"
EVAL-ids_type					= "network"
EVAL-product_version				= coalesce(logver, "50")
EVAL-devname					= coalesce(devname, devid)
FIELDALIAS-fortigate_utm_dvc				= devname as dvc
EVAL-ftnt_action				= coalesce(vendor_action, vendor_status)
EVAL-protocol_version = case(isnotnull(srcip), if(match(srcip,":"), "ipv6", "ipv4"), isnotnull(dstip), if(match(dstip,":"), "ipv6", "ipv4"))
LOOKUP-fortigate_utm_action				= ftnt_action_lookup ftnt_action OUTPUT action
FIELDALIAS-fortigate_utm_rule_id          	= policyid as rule_id
FIELDALIAS-fortigate_utm_src_zone           = srcintfrole as src_zone
FIELDALIAS-fortigate_utm_dest_zone          = dstintfrole as dest_zone
FIELDALIAS-fortigate_utm_dest_interface		= dstintf as dest_interface
FIELDALIAS-fortigate_utm_dest				= dstip as dest
FIELDALIAS-fortigate_utm_dest_port			= dstport as dest_port
FIELDALIAS-fortigate_utm_dst_mac			= dstmac as dst_mac
FIELDALIAS-fortigate_utm_session_id			= sessionid as session_id
FIELDALIAS-fortigate_utm_src_interface		= srcintf as src_interface
FIELDALIAS-fortigate_utm_src_ip			    = srcip as src_ip
FIELDALIAS-fortigate_utm_src			    = srcip as src
FIELDALIAS-fortigate_utm_src_port			= srcport as src_port
FIELDALIAS-fortigate_utm_src_mac			= srcmac as src_mac
EVAL-bytes					= (rcvdbyte + sentbyte)
FIELDALIAS-fortigate_utm_bytes_in			= rcvdbyte as bytes_in
FIELDALIAS-fortigate_utm_bytes_out      		= sentbyte as bytes_out
FIELDALIAS-fortigate_utm_http_referrer		= referralurl as http_referrer
FIELDALIAS-http_user_agent				= agent as http_user_agent
FIELDALIAS-fortigate_utm_site				= hostname as site
FIELDALIAS-fortigate_utm_file_hash			= analyticscksum as file_hash
EVAL-file_name                              = coalesce(filename,file_name)
EVAL-file_path                              = if(match(vendor_url,"^\/"),hostname+file_path,file_path) 
EVAL-url					= if(match(vendor_url,"^\/"),hostname+vendor_url,vendor_url)
EVAL-url_domain                             = coalesce(url_domain,if(match(hostname,"^(?:\d+\.){3}\d+"),null(),hostname))
EVAL-signature                              = coalesce(attack, attackname, virus)
FIELDALIAS-signature_id                     = attackid as signature_id
EVAL-category                               = coalesce(attack, attackname, virus, catdesc, dtype,case(subtype=="app-ctrl", appcat, subtype=="webfilter", urlsource))
EVAL-app                                    = coalesce(app,service)      
LOOKUP-fortigate_protocol_lookup		= ftnt_protocol_lookup proto OUTPUT transport,protocol

[fgt_utm]
rename = fortigate_utm

[fortigate_anomaly]
TIME_PREFIX = ^
SHOULD_LINEMERGE = false
EVENT_BREAKER_ENABLE = true
KV_MODE = none
REPORT-field_extract                            = field_extract
ANNOTATE_PUNCT = false
FIELDALIAS-fortigate_utm_vendor_eventtype             = eventtype as vendor_eventtype
FIELDALIAS-fortigate_utm_vendor_url                   = url as vendor_url
FIELDALIAS-vendor_action                        = action as vendor_action
FIELDALIAS-vendor_status                        = status as vendor_status
EVAL-severity                                   = coalesce(severity, crlevel, apprisk, "informational")
EVAL-vendor                                     = "Fortinet"
EVAL-product                                    = "Firewall"
EVAL-ids_type                                   = "network"
EVAL-product_version                            = coalesce(logver, "50")
EVAL-devname                                    = coalesce(devname, devid)
FIELDALIAS-fortigate_utm_dvc                          = devname as dvc
EVAL-ftnt_action                                = coalesce(vendor_action, vendor_status)
LOOKUP-fortigate_utm_action                           = ftnt_action_lookup ftnt_action OUTPUT action
FIELDALIAS-fortigate_utm_dest_interface               = dstintf as dest_interface
FIELDALIAS-fortigate_utm_dest                         = dstip as dest
FIELDALIAS-fortigate_utm_dest_port                    = dstport as dest_port
FIELDALIAS-fortigate_utm_dst_mac                      = dstmac as dst_mac
FIELDALIAS-fortigate_utm_session_id                   = sessionid as session_id
FIELDALIAS-fortigate_utm_src_interface                = srcintf as src_interface
FIELDALIAS-fortigate_utm_src_ip                       = srcip as src
FIELDALIAS-fortigate_utm_src_port                     = srcport as src_port
FIELDALIAS-fortigate_utm_src_mac                      = srcmac as src_mac
EVAL-bytes                                      = (rcvdbyte + sentbyte)
FIELDALIAS-fortigate_utm_bytes_in                     = rcvdbyte as bytes_in
FIELDALIAS-fortigate_utm_bytes_out                    = sentbyte as bytes_out
FIELDALIAS-fortigate_utm_http_method                  = reqtype as http_method
FIELDALIAS-fortigate_utm_http_referrer                = referralurl as http_referrer
FIELDALIAS-fortigate_utm_http_status                  = vendor_action as status
FIELDALIAS-http_user_agent                            = agent as http_user_agent 
FIELDALIAS-fortigate_utm_site                         = hostname as site
FIELDALIAS-fortigate_utm_file_hash                    = analyticscksum as file_hash
FIELDALIAS-fortigate_utm_file_name                    = filename as file_name
FIELDALIAS-fortigate_utm_file_path                    = vendor_url as file_path
EVAL-url                                        = coalesce(hostname + vendor_url, vendor_url)
EVAL-signature                                  = coalesce(attack, attackname, virus)
EVAL-category                                   = coalesce(attack, attackname, virus, catdesc, dtype)

[fgt_anomaly]
rename = fortigate_anomaly

[fortigate_event]
TIME_PREFIX = ^
SHOULD_LINEMERGE = false
EVENT_BREAKER_ENABLE = true
KV_MODE = none
REPORT-field_extract                            = field_extract, extract_cim_fields_for_user
ANNOTATE_PUNCT = false
EVAL-vendor					= "Fortinet"
EVAL-product					= "Firewall"
EVAL-vendor_product         = "Fortinet Firewall"
FIELDALIAS-vendor_action                        = action as vendor_action
FIELDALIAS-vendor_status                        = status as vendor_status
## Don't remove unknown from vendor_status eval because of lookup dependency.
EVAL-vendor_status				= coalesce(vendor_status, "unknown")
EVAL-status                     = if(logid IN("0100041000","0102043039","0100032132"),"success",coalesce(status, case(logid IN("0100032141","0100044547","0104043575","0104043588","0104043594","0104043591","0104043593","0104043551","0104043597","0100032301","0104043612","0104043611","0100022016","0100022015","0100032130","0100032102","0100022813","0100022815"),"success")))
FIELDALIAS-fortigate_event_vendor_url                 = url as vendor_url
FIELDALIAS-fortigate_event_vendor_eventtype           = eventtype as vendor_eventtype
FIELDALIAS-mem_used                             = mem as mem_used
EVAL-mem_free                                   = 100 - mem_used
EVAL-log_action                                 = case(logid IN("0101041984","0100022815","0100022813"), "read", logid IN("0101041987","0100032141","0100041000","0100032102"), "modified", logid=="0100026001", "added", logid=="0100032132", "Local user added", logid=="0100032130", "User changed", true(), action)
LOOKUP-fortigate_event_action				= ftnt_event_action_lookup subtype vendor_action as log_action vendor_status OUTPUT action, change_type
LOOKUP-fortigate_severity                   = ftnt_severity_lookup level OUTPUT severity,severity_id
EVAL-product_version                            = coalesce(logver, "50")
EVAL-devname                                    = coalesce(devname, devid)
FIELDALIAS-fortigate_event_dvc                        = devname as dvc
EVAL-user                               	= coalesce(user_name, if(xauthuser=="N/A",null(),xauthuser))
EVAL-user_name                               	= coalesce(user_name, if(xauthuser=="N/A",null(),xauthuser))

FIELDALIAS-fortigate_system_cpu			= cpu as cpu_load_percent
EVAL-object = coalesce(cfgobj,case(logid IN("0100022016","0100022015"), poolname, logid IN("0101041984","0101041987","0100032130","0100032132"), name, logid=="0100032141", field, logid IN ("0104043551","0104043597"), replace(msg,"^AP\s*(.*?)\s(?:joined\.|added)","\1"), match(logdesc,"^Physical AP radio"), "radio", logid=="0104043575", "client-"+stamac, logid IN("0100032003","0102043039"), user, logid=="0100032301", replace(msg,"Virtual\sdomain\s(.*?)\sis\sadded","\1"), logid=="0104043612", "wireless controller cfg", logid=="0100041000", "FortiGate", logid=="0104043611", "wireless controller", logid=="0100032102", replace(msg,"Configuration\sis\schanged\sin\sthe\s(.*)","\1"), logid IN("0100022813","0100022815"), "Scanunit"))
EVAL-object_attrs = coalesce(cfgattr, case(vendor_action=="oper-channel", "channel", vendor_action=="oper-txpower", "txpower", vendor_action=="config-txpower", "cfgtxpower",vendor_action=="country-config-success", "country " + configcountry, logid IN("0100022813","0100022815"), "AV Database", logid IN("0101041984","0101041987"), "cert-type"))
EVAL-object_category            		= case(logid IN("0104043575","0100032003","0100032130","0102043039","0100032132"), "user", match(logdesc,"^Physical AP radio") OR logid IN("0100032141","0100044547","0104043551","0104043597","0100032301","0104043611","0100022016","0100022015","0100041000","0100032102","0100022813","0100022815"), "configuration",logid IN("0101041984","0101041987","0104043612"), "file")
EVAL-object_id                          = coalesce(cfortigateid, cfgtid, case(logid IN("0104043551","0104043597"), ap,logid=="0104043575", stamac, match(logdesc,"^Physical AP radio"), radioid))
EVAL-object_path                        = coalesce(cfgpath,case(match(logdesc,"^Physical AP radio"),replace(msg,"\sradio.*","")))
EVAL-result                                 = coalesce(result, logdesc)
EVAL-user_type                              = case(match(logdesc,"^Admin log(?:out|in)"), "Admin", logid=="0104043575", "Wireless client") 
EVAL-src_user_type                              = case(match(logdesc,"^Admin log(?:out|in)"), "Admin", logid=="0104043575", "Wireless client") 
EVAL-tunnelname					= coalesce(vpntunnel,tunnelid)
REPORT-src_ip_from_ui          = src_ip_from_ui
EVAL-src					= coalesce(srcip, remip, src_ip_from_ui, case(logid IN("0104043588","0104043594","0104043591","0104043593","0104043551"),ip))
EVAL-src_ip					= coalesce(srcip, remip, src_ip_from_ui, case(logid IN("0104043588","0104043594","0104043591","0104043593","0104043551"),ip))
EVAL-dest					= coalesce(if(dstip=="N/A",null(),dstip), locip, ssid, case(logid IN("0100032141","0100032301","0100044547","0101039426","0104043588","0104043594","0104043591","0104043593","0104043551","0104043597","0101041984","0101041987","0101041990","0100022952","0101041992","0104043612","0104043611","0100040705","0100022016","0100022015","0100041000","0100032130","0100022918","0100040704","0100022949","0100036883","0100032102","0101039944","0102043039","0100032132","0100022813","0100022815","0100032001","0100032003"),dvc, logid=="0100026001", ip))
EVAL-dest_ip                = coalesce(if(dstip=="N/A",null(),dstip), locip, case(logid=="0100026001", ip))
EVAL-signature              = case(logid IN("0104043579","0101041990","0100022952","0101041992","0101039946","0100046600","0101053103","0100032006","0100022918","0100040704","0100026001","0101039425","0100022949","0100036883","0101039944","0100040704","0101039940","0101037135","0101039948","0101037133"), logdesc, logid IN("0101039424","0101039938"), tunneltype, logid=="0101039943", tunneltype+" "+subtype, logid=="0107045061", connection_type)
EVAL-dest_mac               = coalesce(dest_mac,case(logid=="0100026001", mac))
EVAL-resource_type          = coalesce(resource_type, case(logid IN("0100040704","0100040705"),"system"))
EVAL-src_port_range         = case(logid IN("0100022015","0100022016"), portbegin+"-"+portend)
EVAL-src_ip_range           = if(logid=="0100022015",saddr,null()) 
EVAL-dest_ip_range          = if(logid=="0100022015",saddr,null())
FIELDALIAS-body                             = msg as body
FIELDALIAS-id                               = logid as id
FIELDALIAS-fortigate_wireless_src_mac			= stamac as src_mac
FIELDALIAS-fortigate_wireless_src_interface		= vap as src_interface
FIELDALIAS-lease_duration                       = lease as lease_duration
EVAL-wifi = if(isnotnull(radioband), replace(radioband,",.*",""), null)
EVAL-app = case(logid=="0101039944", tunneltype+" vpn", logid=="0101039946", "vpn", true(), coalesce(authproto,tunneltype,security,case(logid IN("0101041990","0101041992","0101053103","0101037127","0101037121"), "vpn", logid=="0100022918", "FortiGuard",logid IN("0100022952","0100022949"), "FortiCloud",logid IN("0100046600","0100032006","0100036883"), "system", logid IN("0100032002","0100032001"), "FortiOS")))
FIELDALIAS-authentication_service = security as authentication_service

[fgt_event]
rename = fortigate_event
