Technical Tip: FortiOS to CEF log field mapping guidelines

[krajaa]

Description
This article shows the  FortiOS to CEF log field mapping guidelines.

Scope
For version 6.4.2.

Solution
Following are the CEF priority levels.
Thereare opposite of FortiOS priority levels.

The following CEF format:

Date/Time host CEF:Version|Device Vendor|Device Product|Device
Version|Signature ID|Name|Severity|[Extension]

Displays as following in FortiOS logs with CEF enabled:

"MMM dd HH:mm:ss" "hostname of the fortigate" CEF:0|Fortinet|Fortigate|version|logid|type:subtype +[eventtype] +[action] +[status]|reversed level|...

The SignatureId field in FortiOS logs maps to the logid field in CEF and have to be last 5 digits of logid.

The Name field in CEF uses the following formula:

type:subtype + [eventtype] + [action] + [status]

Following is an example of the header and one key-value pair for extension from  the Event VPN log in CEF:

#Feb 12 10:31:04 syslog-800c CEF:0|Fortinet|Fortigate|v5.6.0|37127|event:vpn negotiate
success|3|FTNTFGTlogid=0101037127

The type:subtype field in FortiOS logs maps to the cat field in CEF.
Any fields in FortiOS logs that are unmatched to fields in CEF include the FTNTFGT prefix.
Quotes ("") are removed from FortiOS logs to support CEF.
Forward slashes (//) in string values as well as the equal sign (=) and backward slashes (\) are escaped in FortiOS logs to support CEF.