##sourcetype
[force_sourcetype_fortigate]
SOURCE_KEY = _raw
DEST_KEY = MetaData:Sourcetype
REGEX = ^.+?devid=\"?F(?:G|W|\dK).+?(?:\s|\,|\,\s)type=\"?(traffic|utm|event|anomaly)
FORMAT = sourcetype::fortigate_$1

## LOOKUP

[ftnt_protocol_lookup]
filename = ftnt_protocol_info.csv

[ftnt_action_lookup]
filename = ftnt_action_info.csv

[ftnt_event_action_lookup]
filename = ftnt_event_action_info.csv

[ftnt_severity_lookup]
filename = ftnt_severity_info.csv

## REPORT

[field_extract]
DELIMS = "\ ,", "="

[src_ip_from_ui]
SOURCE_KEY = ui
REGEX = ((?:\d+\.){3}\d+)
FORMAT = src_ip_from_ui::$1

[extract_cim_fields_for_user]
SOURCE_KEY = user
REGEX = ^(?:N\/A$|(((.*))))
FORMAT = src_user::$1 src_user_name::$2 user_name::$3

[extract_file_and_file_path]
SOURCE_KEY = url
REGEX = ^((?:[^?]*[\/])([^?]*))
FORMAT = file_path::$1 file_name::$2

[extract_url_domain]
SOURCE_KEY = url
REGEX = ^(?:[^:]+:\/\/)?(?!(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|\S+:\/\/))([^:\/]+)
FORMAT = url_domain::$1
