[ftnt_fortigate]
search = sourcetype=fgt_traffic OR sourcetype=fgt_utm OR sourcetype=fgt_event OR sourcetype=fgt_anomaly OR sourcetype=fortigate_traffic OR sourcetype=fortigate_utm OR sourcetype=fortigate_event OR sourcetype=fortigate_anomaly

[ftnt_fortigate_traffic]
search = sourcetype=fgt_traffic OR sourcetype=fortigate_traffic

#[ftnt_fgt_traffic_start]
#search = sourcetype=fgt_traffic

#[ftnt_fgt_traffic_end]
#search = sourcetype=fgt_traffic 

[ftnt_fortigate_utm]
search = sourcetype=fortigate_utm OR sourcetype=fortigate_anomaly OR sourcetype = fgt_utm OR sourcetype=fgt_anomaly

[ftnt_fortigate_ips]
search = (sourcetype=fortigate_utm OR sourcetype=fgt_utm) subtype=ips

[ftnt_fortigate_anomaly]
search = (sourcetype=fortigate_anomaly OR sourcetype=fortigate_utm OR sourcetype=fgt_anomaly OR sourcetype=fgt_utm) subtype=anomaly

[ftnt_fortigate_virus]
search = (sourcetype=fortigate_utm OR sourcetype=fgt_utm) subtype=virus vendor_action!=analytics

[ftnt_fortigate_netscan]
search = (sourcetype=fortigate_utm OR sourcetype=fgt_utm) subtype=netscan

[ftnt_fortigate_spam]
search = (sourcetype=fortigate_utm OR sourcetype=fgt_utm) subtype=spam

[ftnt_fortigate_webfilter]
search = (sourcetype=fortigate_utm OR sourcetype=fgt_utm) subtype=webfilter

[ftnt_fortigate_appctrl]
search = (sourcetype=fortigate_utm OR sourcetype=fgt_utm) subtype=app-ctrl

[ftnt_fortigate_event]
search = sourcetype=fgt_event OR sourcetype=fortigate_event

[ftnt_fortigate_vpn]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=vpn

[ftnt_fortigate_vpn_cert_change]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=vpn logid IN("0101041984", "0101041987")

[ftnt_fortigate_vpn_auth]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=vpn (vendor_action=negotiate OR vendor_action=ssl-login-fail)

[ftnt_fortigate_vpn_start]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=vpn vendor_action IN("tunnel-up", "install_sa", "ssl-new-con", "ssl-web-pass")

[ftnt_fortigate_vpn_end]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) ((subtype=vpn AND vendor_action IN("tunnel-down", "delete_ipsec_sa", "ssl-web-close")) OR (logid=0107045061 AND connection_type="sslvpn"))

[ftnt_fortigate_wireless]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=wireless

[ftnt_fortigate_wireless_config_change]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=wireless vendor_action IN("oper-channel", "oper-txpower", "config-txpower", "country-config-success", "controller-cfg-loaded", "controller-up", "ap-join", "ap-add")

[ftnt_fortigate_wireless_client_auth]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=wireless (vendor_action=client-ip-detected OR vendor_action=client-deauthentication)

[ftnt_fortigate_wireless_client_authentication]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=wireless vendor_action IN("client-authentication", "user-sign-on-success", "user-sign-on", "user-sign-on-failure")

[ftnt_fortigate_wireless_client_deauthentication]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=wireless vendor_action=client-deauthentication

[ftnt_fortigate_system]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=system

[ftnt_fortigate_dhcp_ack]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=system logid=0100026001

[ftnt_fortigate_auth]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=user vendor_action=authentication (vendor_status=success OR vendor_status=failure)

[ftnt_fortigate_auth_privileged]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=system (vendor_action=login OR vendor_action=logout)

[ftnt_fortigate_auth_privileged_login]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=system vendor_action=login NOT (logid=0100022952 OR logid=0100022949)

[ftnt_fortigate_auth_privileged_logout]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=system vendor_action=logout

[ftnt_fortigate_perf_stats]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=system vendor_action=perf-stats

[ftnt_fortigate_cpu_stats]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=system vendor_action=cpu-usage

[ftnt_fortigate_config_change]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=system (vendor_action IN("Add", "Edit", "delete", "add-vdom", "pba-create", "pba-close") OR logid IN("0100032141", "0100041000", "0100032130", "0100032102"))

[ftnt_fortigate_restart]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) subtype=system (vendor_action=reboot OR vendor_action=shutdown)

[ftnt_fortigate_scanunit_db]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) logid IN("0100022815","0100022813")

[ftnt_fortigate_user_config_change]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) logid IN("0100032132","0102043039")

[ftnt_fortigate_alerts]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) logid IN("0101041990", "0101041992", "0101039946", "0100046600", "0101053103", "0100032006", "0100022918", "0100022952", "0100022949", "0100036883", "0101039944")

[ftnt_fortigate_detected_ip_using_dhcp]
search = (sourcetype=fortigate_event OR sourcetype=fgt_event) logid=0104043579