Page Comparison

...

Tags	Data tables
`cef0.fortinet.fortiauthenticator`	`cef0.fortinet.fortiauthenticator`
`cef0.fortinet.fortigate`	`cef0.fortinet.fortigate`
`cef0.fortinet.fortigate100e`	`cef0.fortinet.fortigate100e`
`cef0.fortinet.fortigate200e`	`cef0.fortinet.fortigate200e`
`cef0.fortinet.fortigate300d`	`cef0.fortinet.fortigate300d`
`cef0.fortinet.fortigate400e`	`cef0.fortinet.fortigate400e`
`cef0.fortinet.fortigate600e`	`cef0.fortinet.fortigate600e`
`cef0.fortinet.fortigate60e`	`cef0.fortinet.fortigate60e`
`cef0.fortinet.fortigateAll`	`cef0.fortinet.fortigateAll`
`cef0.fortinet.fortinacVmCa`	`cef0.fortinet.fortinacVmCa`

...

These are the fields displayed in this table:these tables:

Rw ui tabs macro

Rw tab

title	1-5

cef0.fortinet.fortiauthenticator
cef0.fortinet.fortigate
cef0.fortinet.fortigate100e
cef0.fortinet.fortigate200e
cef0.fortinet.fortigate300d

Anchor
tag1
tag1
cef0.fortinet.fortiauthenticator

Field	Type

...

Source field name

...

Extra field

...


eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
destinationServiceName	`str`
msg	`str`
deviceFacility	`str`
suser	`str`
dvc	`ip4`
act	`str`
deviceProcessName	`str`
in	`int8`
rt	`timestamp`
out	`int8`
dtz	`str`
deviceZoneID	`str`
eventAnnotationAuditTrail	`str`
eventAnnotationVersion	`str`
eventAnnotationModificationTime	`str`
art	`str`
originalAgentAddress	`str`
eventId	`str`
at	`str`
mrt	`str`
customerURI	`str`
originalAgentZoneURI	`str`
assetCriticality	`str`
eventAnnotationFlags	`str`
agt	`str`
modelConfidence	`str`
aid	`str`
amac	`str`
deviceZoneExternalID	`str`
Severity	`str`
relevance	`str`
av	`str`
eventAnnotationStageUpdateTime	`str`
locality	`str`
ahost	`str`
originalAgentVersion	`str`
customerID	`str`
atz	`str`
originalAgentMacAddress	`str`
originalAgentType	`str`
deviceSeverity	`str`
originalAgentId	`str`
eventAnnotationManagerReceiptTime	`str`
originalAgentHostName	`str`
priority	`str`
deviceZoneURI	`str`
eventAnnotationEndTime	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓

...

cefTag

rawMessage

str

Anchor
tag2
tag2
cef0.fortinet.fortigate

Field	Type

...

Source field name

...

Extra field

...


eventdate	`timestamp`
rawMessage	`str`		✓
hostchain	`str`		✓
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
c6a1Label	`str`
c6a1	`str`
c6a2Label	`str`
c6a2	`str`
c6a3Label	`str`
c6a3	`str`
c6a4Label	`str`
c6a4	`str`
cfp1Label	`str`
cfp1	`float8`
cfp2Label	`str`
cfp2	`float8`
cfp3Label	`str`
cfp3	`float8`
cfp4Label	`str`
cfp4	`float8`
cn1Label	`str`
cn1	`int8`
cn2Label	`str`
cn2	`int8`
cn3Label	`str`
cn3	`int8`
cnt	`int4`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs5Label	`str`
cs5	`str`
cs6Label	`str`
cs6	`str`
destinationDnsDomain	`str`
destinationServiceName	`str`
destinationTranslatedAddress	`ip4`
destinationTranslatedPort	`int4`
deviceCustomDate1Label	`str`
deviceCustomDate1	`timestamp`
deviceCustomDate2Label	`str`
deviceCustomDate2	`timestamp`
deviceDirection	`int4`
deviceDnsDomain	`str`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceMacAddress	`str`
deviceNtDomain	`str`
deviceOutboundInterface	`str`
deviceProcessName	`str`
deviceTranslatedAddress	`ip4`
dhost	`str`
dmac	`str`
dntdom	`str`
dpid	`int4`
dpriv	`str`
dproc	`str`
dst	`ip4`
duid	`str`
duser	`str`
dvchost	`str`
dvc	`ip4`
dvcpid	`int4`
end	`timestamp`
deviceFacility	`str`
externalId	`str`
fileCreateTime	`timestamp`
fileHash	`str`
fileId	`str`
fileModificationTime	`timestamp`
filePath	`str`
filePermission	`str`
fileType	`str`
fname	`str`
fsize	`int8`
in	`int8`
msg	`str`
oldFileCreateTime	`timestamp`
oldFileHash	`str`
oldFileId	`str`
oldFileModificationTime	`timestamp`
oldFileName	`str`
oldFilePath	`str`
oldFilePermission	`str`
oldFileSize	`int8`
oldFileType	`str`
outcome	`str`
out	`int8`
proto	`str`
reason	`str`
requestClientApplication	`str`
requestCookies	`str`
requestMethod	`str`
request	`str`
rt	`timestamp`
shost	`str`
smac	`str`
sntdom	`str`
sourceDnsDomain	`str`
sourceServiceName	`str`
sourceTranslatedAddress	`ip4`
sourceTranslatedPort	`int4`
spid	`int4`
spriv	`str`
sproc	`str`
spt	`int4`
src	`ip4`
start	`timestamp`
suid	`str`
suser	`str`
catdt	`str`
deviceDomain	`str`
deviceSeverity	`str`
dpt	`int4`
dtz	`str`
dvcmac	`str`
endTime	`str`
eventId	`str`
flexNumber1	`str`
flexNumber1Label	`str`
flexNumber2	`str`
flexNumber2Label	`str`
flexString1	`str`
flexString1Label	`str`
flexString2	`str`
flexString2Label	`str`
modelConfidence	`int4`
priority	`int4`
relevance	`int4`
requestContext	`str`
sessionId	`str`
slat	`float8`
slong	`float8`
dlat	`float8`
dlong	`float8`
sourceGeoCountryCode	`str`
sourceGeoLocationInfo	`str`
sourceGeoPostalCode	`str`
sourceGeoRegionCode	`str`
destinationGeoCountryCode	`str`
destinationGeoLocationInfo	`str`
destinationGeoPostalCode	`str`
destinationGeoRegionCode	`str`
agt	`ip4`
ahost	`str`
art	`str`
atz	`str`
mrt	`timestamp`
categoryBehavior	`str`
categoryCustomFormatField	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
categorySignificance	`str`
categoryTechnique	`str`
categoryTupleDescription	`str`
assetCriticality	`str`
customerID	`str`
customerURI	`str`
tag	`str`	cefTag	✓

Anchor
tag3

...

tag3
cef0.fortinet.

...

fortigate100e

Field	Type

...

Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priority_code	`str`
cef_tag	`str`
cef_version	`str`
emb_device_vendor	`str`
emb_device_product	`str`
device_version	`str`
signature_id	`str`
name	`str`
severity	`str`
device_action	`str`
application	`str`
category	`str`
device_external_id	`str`
device_ingress_interface	`str`
device_egress_interface	`str`
destination_ip	`ip4`
destination_port	`int4`
device_hostname	`str`
bytes_in	`int8`
bytes_out	`int8`
protocol	`str`
source_translated_address	`ip4`
source_translated_port	`int4`
source_ip	`ip4`
source_port	`int4`
start	`timestamp`
ad_appcat	`str`
ad_dstcountry	`str`
ad_dstintfrole	`str`
ad_duration	`str`
ad_eventtime	`str`
ad_logid	`str`
ad_policyid	`str`
ad_policyname	`str`
ad_policytype	`str`
ad_poluuid	`str`
ad_rcvdpkt	`str`
ad_sentpkt	`str`
ad_srccountry	`str`
ad_srcintfrole	`str`
ad_subtype	`str`
ad_trandisp	`str`
ad_tz	`str`
ad_vd	`str`
device_severity	`str`
external_id	`str`
logver	`str`
timezone	`str`
hostchain	`str`		✓
tag	`str`	cef_tag	✓
rawMessage	`str`		✓

Anchor
tag4
tag4
cef0.fortinet.fortigate200e

Field	Type	Source field name	Extra field
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
c6a4Label	`str`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceOutboundInterface	`str`
dst	`ip4`
dpt	`int4`
dvchost	`str`
in	`int8`
out	`int8`
proto	`str`
rt	`timestamp`
shost	`str`
sourceTranslatedAddress	`ip4`
sourceTranslatedPort	`int4`
src	`ip4`
spt	`int4`
agentZoneURI	`str`
agt	`str`
ahost	`str`
aid	`str`
amac	`str`
art	`str`
at	`str`
atz	`str`
av	`str`
categoryBehavior	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
categorySignificance	`str`
customerURI	`str`
destinationZoneURI	`str`
deviceSeverity	`str`
dtz	`str`
eventId	`str`
geid	`str`
sourceTranslatedZoneURI	`str`
sourceZoneURI	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓

...

cefTag

rawMessage

str

✓

Anchor
tag5
tag5
cef0.fortinet.fortigate300d

Field	Type

...

Source field name

...

Extra field

...


eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
c6a4Label	`str`
cnt	`int4`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceOutboundInterface	`str`
dhost	`str`
dst	`ip4`
dpt	`int4`
dvchost	`str`
in	`int8`
msg	`str`
out	`int8`
proto	`str`
request	`str`
rt	`timestamp`
shost	`str`
sourceTranslatedAddress	`ip4`
src	`ip4`
start	`timestamp`
agentZoneURI	`str`
agt	`str`
ahost	`str`
aid	`str`
amac	`str`
art	`str`
at	`str`
atz	`str`
av	`str`
categoryBehavior	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
categorySignificance	`str`
customerURI	`str`
destinationZoneURI	`str`
deviceSeverity	`str`
dtz	`str`
eventId	`str`
geid	`str`
sourceTranslatedZoneURI	`str`
sourceZoneURI	`str`
type	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓

...

cefTag

rawMessage

str

✓

Rw tab

title	6-10

cef0.fortinet.fortigate400e
cef0.fortinet.fortigate600e
cef0.fortinet.fortigate60e
cef0.fortinet.fortigateAll
cef0.fortinet.fortinacVmCa

Anchor
tag6
tag6
cef0.fortinet.fortigate400e

Field	Type

...

Source field name

...

Extra field

...


eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
c6a4Label	`str`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceOutboundInterface	`str`
dhost	`str`
dst	`ip4`
dpt	`int4`
dvchost	`str`
in	`int8`
out	`int8`
proto	`str`
rt	`timestamp`
shost	`str`
sourceTranslatedAddress	`ip4`
sourceTranslatedPort	`int4`
src	`ip4`
spt	`int4`
agentZoneURI	`str`
agt	`str`
ahost	`str`
aid	`str`
amac	`str`
art	`str`
at	`str`
atz	`str`
av	`str`
categoryBehavior	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
categorySignificance	`str`
destinationZoneURI	`str`
deviceSeverity	`str`
dtz	`str`
eventId	`str`
geid	`str`
sourceTranslatedZoneURI	`str`
sourceZoneURI	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓

...

cefTag

rawMessage

str

✓

Anchor
tag7
tag7
cef0.fortinet.fortigate600e

Field	Type

...

Source field name

...

Extra field

...


eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
rt	`timestamp`
eventId	`str`
msg	`str`
app	`str`
proto	`str`
in	`int8`
out	`int8`
categorySignificance	`str`
categoryBehavior	`str`
categoryDeviceGroup	`str`
categoryOutcome	`str`
categoryObject	`str`
art	`str`
cat	`str`
deviceSeverity	`str`
act	`str`
src	`ip4`
sourceZoneURI	`str`
spt	`int4`
dhost	`str`
dst	`ip4`
destinationZoneURI	`str`
dpt	`int4`
request	`str`
requestContext	`str`
c6a4Label	`str`
ahost	`str`
agt	`str`
agentZoneURI	`str`
amac	`str`
av	`str`
atz	`str`
at	`str`
dvchost	`str`
dtz	`str`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceOutboundInterface	`str`
aid	`str`
geid	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓

...

cefTag

rawMessage

str

✓

Anchor
tag8
tag8
cef0.fortinet.fortigate60e

Field	Type

...

Source field name

...

Extra field

...


eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
c6a4Label	`str`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceOutboundInterface	`str`
dst	`ip4`
dpt	`int4`
dvchost	`str`
in	`int8`
out	`int8`
proto	`str`
rt	`timestamp`
shost	`str`
src	`ip4`
spt	`int4`
agentZoneURI	`str`
agt	`str`
ahost	`str`
aid	`str`
amac	`str`
art	`str`
at	`str`
atz	`str`
av	`str`
categoryBehavior	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
categorySignificance	`str`
customerURI	`str`
destinationZoneURI	`str`
deviceSeverity	`str`
dtz	`str`
eventId	`str`
geid	`str`
sourceZoneURI	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓

...

cefTag

rawMessage

str

✓

Anchor
tag9
tag9
cef0.fortinet.fortigateAll

Field	Type

...

Source field name

...

Extra field

...


eventdate	`timestamp`
source	`str`
_cefVer	`str`
fwname	`str`
act	`str`
app	`str`
cat	`str`
c6a4Label	`str`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceOutboundInterface	`str`
dst	`ip4`
dpt	`int4`
dvchost	`str`
in	`int8`
out	`int8`
proto	`str`
rt	`timestamp`
src	`ip4`
spt	`int4`
agt	`str`
ahost	`str`
art	`str`
atz	`str`
categoryBehavior	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
categorySignificance	`str`
deviceSeverity	`str`
dtz	`str`
eventId	`str`
rawMessage	`str`	rawSource	✓

...


hostchain	`str`	✓
tag	`str`	✓

Anchor
tag10
tag10
cef0.fortinet.fortinacVmCa

Field	Type

...

Source field name

...

Extra field

...


eventdate	`timestamp`
hostname	`str`
priority_code	`str`
cef_tag	`str`
cef_version	`str`
emb_device_vendor	`str`
emb_device_product	`str`
device_version	`str`
signature_id	`str`
name	`str`
severity	`str`
category	`str`
message	`str`
device_receipt_time	`str`
source_hostname	`str`
source_ip	`ip4`
source_mac	`str`
source_user_id	`str`
cs1Label	`str`
cs1	`str`
hostchain	`str`	✓
tag	`str`

...

✓

cef_tag	✓
rawMessage	`str`		✓

Versions Compared

Old Version 2

New Version 3

Key

Anchor
tag1
tag1
cef0.fortinet.fortiauthenticator

Anchor
tag2
tag2
cef0.fortinet.fortigate

Anchor
tag3

tag3
cef0.fortinet.

fortigate100e

Anchor
tag4
tag4
cef0.fortinet.fortigate200e

Anchor
tag5
tag5
cef0.fortinet.fortigate300d

Anchor
tag6
tag6
cef0.fortinet.fortigate400e

Anchor
tag7
tag7
cef0.fortinet.fortigate600e

Anchor
tag8
tag8
cef0.fortinet.fortigate60e

Anchor
tag9
tag9
cef0.fortinet.fortigateAll

Anchor
tag10
tag10
cef0.fortinet.fortinacVmCa

Page Comparison

Versions Compared

Old Version 2

New Version 3

Key

Anchortag1tag1cef0.fortinet.fortiauthenticator

Anchortag2tag2cef0.fortinet.fortigate

Anchortag3

tag3cef0.fortinet.

fortigate100e

Anchortag4tag4cef0.fortinet.fortigate200e

Anchortag5tag5cef0.fortinet.fortigate300d

Anchortag6tag6cef0.fortinet.fortigate400e

Anchortag7tag7cef0.fortinet.fortigate600e

Anchortag8tag8cef0.fortinet.fortigate60e

Anchortag9tag9cef0.fortinet.fortigateAll

Anchortag10tag10cef0.fortinet.fortinacVmCa

Anchor
tag1
tag1
cef0.fortinet.fortiauthenticator

Anchor
tag2
tag2
cef0.fortinet.fortigate

Anchor
tag3

tag3
cef0.fortinet.

Anchor
tag4
tag4
cef0.fortinet.fortigate200e

Anchor
tag5
tag5
cef0.fortinet.fortigate300d

Anchor
tag6
tag6
cef0.fortinet.fortigate400e

Anchor
tag7
tag7
cef0.fortinet.fortigate600e

Anchor
tag8
tag8
cef0.fortinet.fortigate60e

Anchor
tag9
tag9
cef0.fortinet.fortigateAll

Anchor
tag10
tag10
cef0.fortinet.fortinacVmCa