Fortinet fields
fortinet Module
Fields from fortinet FortiOS
fortinet.file.hash.crc32- CRC32 Hash of file
type: keyword
Module for parsing Fortinet syslog.
fortinet.firewall.acct_stat- Accounting state (RADIUS)
type: keyword
fortinet.firewall.acktime- Alarm Acknowledge Time
type: keyword
fortinet.firewall.act- Action
type: keyword
fortinet.firewall.action- Status of the session
type: keyword
fortinet.firewall.activity- HA activity message
type: keyword
fortinet.firewall.addr- IP Address
type: ip
fortinet.firewall.addr_type- Address Type
type: keyword
fortinet.firewall.addrgrp- Address Group
type: keyword
fortinet.firewall.adgroup- AD Group Name
type: keyword
fortinet.firewall.admin- Admin User
type: keyword
fortinet.firewall.age- Time in seconds - time passed since last seen
type: integer
fortinet.firewall.agent- User agent - eg. agent="Mozilla/5.0"
type: keyword
fortinet.firewall.alarmid- Alarm ID
type: integer
fortinet.firewall.alert- Alert
type: keyword
fortinet.firewall.analyticscksum- The checksum of the file submitted for analytics
type: keyword
fortinet.firewall.analyticssubmit- The flag for analytics submission
type: keyword
fortinet.firewall.ap- Access Point
type: keyword
fortinet.firewall.app-type- Address Type
type: keyword
fortinet.firewall.appact- The security action from app control
type: keyword
fortinet.firewall.appid- Application ID
type: integer
fortinet.firewall.applist- Application Control profile
type: keyword
fortinet.firewall.apprisk- Application Risk Level
type: keyword
fortinet.firewall.apscan- The name of the AP, which scanned and detected the rogue AP
type: keyword
fortinet.firewall.apsn- Access Point
type: keyword
fortinet.firewall.apstatus- Access Point status
type: keyword
fortinet.firewall.aptype- Access Point type
type: keyword
fortinet.firewall.assigned- Assigned IP Address
type: ip
fortinet.firewall.assignip- Assigned IP Address
type: ip
fortinet.firewall.attachment- The flag for email attachement
type: keyword
fortinet.firewall.attack- Attack Name
type: keyword
fortinet.firewall.attackcontext- The trigger patterns and the packetdata with base64 encoding
type: keyword
fortinet.firewall.attackcontextid- Attack context id / total
type: keyword
fortinet.firewall.attackid- Attack ID
type: integer
fortinet.firewall.auditid- Audit ID
type: long
fortinet.firewall.auditscore- The Audit Score
type: keyword
fortinet.firewall.audittime- The time of the audit
type: long
fortinet.firewall.authgrp- Authorization Group
type: keyword
fortinet.firewall.authid- Authentication ID
type: keyword
fortinet.firewall.authproto- The protocol that initiated the authentication
type: keyword
fortinet.firewall.authserver- Authentication server
type: keyword
fortinet.firewall.bandwidth- Bandwidth
type: keyword
fortinet.firewall.banned_rule- NAC quarantine Banned Rule Name
type: keyword
fortinet.firewall.banned_src- NAC quarantine Banned Source IP
type: keyword
fortinet.firewall.banword- Banned word
type: keyword
fortinet.firewall.botnetdomain- Botnet Domain Name
type: keyword
fortinet.firewall.botnetip- Botnet IP Address
type: ip
fortinet.firewall.bssid- Service Set ID
type: keyword
fortinet.firewall.call_id- Caller ID
type: keyword
fortinet.firewall.carrier_ep- The FortiOS Carrier end-point identification
type: keyword
fortinet.firewall.cat- DNS category ID
type: integer
fortinet.firewall.category- Authentication category
type: keyword
fortinet.firewall.cc- CC Email Address
type: keyword
fortinet.firewall.cdrcontent- Cdrcontent
type: keyword
fortinet.firewall.centralnatid- Central NAT ID
type: integer
fortinet.firewall.cert- Certificate
type: keyword
fortinet.firewall.cert-type- Certificate type
type: keyword
fortinet.firewall.certhash- Certificate hash
type: keyword
fortinet.firewall.cfgattr- Configuration attribute
type: keyword
fortinet.firewall.cfgobj- Configuration object
type: keyword
fortinet.firewall.cfgpath- Configuration path
type: keyword
fortinet.firewall.cfgtid- Configuration transaction ID
type: keyword
fortinet.firewall.cfgtxpower- Configuration TX power
type: integer
fortinet.firewall.channel- Wireless Channel
type: integer
fortinet.firewall.channeltype- SSH channel type
type: keyword
fortinet.firewall.chassisid- Chassis ID
type: integer
fortinet.firewall.checksum- The checksum of the scanned file
type: keyword
fortinet.firewall.chgheaders- HTTP Headers
type: keyword
fortinet.firewall.cldobjid- Connector object ID
type: keyword
fortinet.firewall.client_addr- Wifi client address
type: keyword
fortinet.firewall.cloudaction- Cloud Action
type: keyword
fortinet.firewall.clouduser- Cloud User
type: keyword
fortinet.firewall.column- VOIP Column
type: integer
fortinet.firewall.command- CLI Command
type: keyword
fortinet.firewall.community- SNMP Community
type: keyword
fortinet.firewall.configcountry- Configuration country
type: keyword
fortinet.firewall.connection_type- FortiClient Connection Type
type: keyword
fortinet.firewall.conserve- Flag for conserve mode
type: keyword
fortinet.firewall.constraint- WAF http protocol restrictions
type: keyword
fortinet.firewall.contentdisarmed- Email scanned content
type: keyword
fortinet.firewall.contenttype- Content Type from HTTP header
type: keyword
fortinet.firewall.cookies- VPN Cookie
type: keyword
fortinet.firewall.count- Counts of action type
type: integer
fortinet.firewall.countapp- Number of App Ctrl logs associated with the session
type: integer
fortinet.firewall.countav- Number of AV logs associated with the session
type: integer
fortinet.firewall.countcifs- Number of CIFS logs associated with the session
type: integer
fortinet.firewall.countdlp- Number of DLP logs associated with the session
type: integer
fortinet.firewall.countdns- Number of DNS logs associated with the session
type: integer
fortinet.firewall.countemail- Number of email logs associated with the session
type: integer
fortinet.firewall.countff- Number of ff logs associated with the session
type: integer
fortinet.firewall.countips- Number of IPS logs associated with the session
type: integer
fortinet.firewall.countssh- Number of SSH logs associated with the session
type: integer
fortinet.firewall.countssl- Number of SSL logs associated with the session
type: integer
fortinet.firewall.countwaf- Number of WAF logs associated with the session
type: integer
fortinet.firewall.countweb- Number of Web filter logs associated with the session
type: integer
fortinet.firewall.cpu- CPU Usage
type: integer
fortinet.firewall.craction- Client Reputation Action
type: integer
fortinet.firewall.criticalcount- Number of critical ratings
type: integer
fortinet.firewall.crl- Client Reputation Level
type: keyword
fortinet.firewall.crlevel- Client Reputation Level
type: keyword
fortinet.firewall.crscore- Some description
type: integer
fortinet.firewall.cveid- CVE ID
type: keyword
fortinet.firewall.daemon- Daemon name
type: keyword
fortinet.firewall.datarange- Data range for reports
type: keyword
fortinet.firewall.date- Date
type: keyword
fortinet.firewall.ddnsserver- DDNS server
type: ip
fortinet.firewall.desc- Description
type: keyword
fortinet.firewall.detectionmethod- Detection method
type: keyword
fortinet.firewall.devcategory- Device category
type: keyword
fortinet.firewall.devintfname- HA device Interface Name
type: keyword
fortinet.firewall.devtype- Device type
type: keyword
fortinet.firewall.dhcp_msg- DHCP Message
type: keyword
fortinet.firewall.dintf- Destination interface
type: keyword
fortinet.firewall.disk- Assosciated disk
type: keyword
fortinet.firewall.disklograte- Disk logging rate
type: long
fortinet.firewall.dlpextra- DLP extra information
type: keyword
fortinet.firewall.docsource- DLP fingerprint document source
type: keyword
fortinet.firewall.domainctrlauthstate- CIFS domain auth state
type: integer
fortinet.firewall.domainctrlauthtype- CIFS domain auth type
type: integer
fortinet.firewall.domainctrldomain- CIFS domain auth domain
type: keyword
fortinet.firewall.domainctrlip- CIFS Domain IP
type: ip
fortinet.firewall.domainctrlname- CIFS Domain name
type: keyword
fortinet.firewall.domainctrlprotocoltype- CIFS Domain connection protocol
type: integer
fortinet.firewall.domainctrlusername- CIFS Domain username
type: keyword
fortinet.firewall.domainfilteridx- Domain filter ID
type: integer
fortinet.firewall.domainfilterlist- Domain filter name
type: keyword
fortinet.firewall.ds- Direction with distribution system
type: keyword
fortinet.firewall.dst_int- Destination interface
type: keyword
fortinet.firewall.dstintfrole- Destination interface role
type: keyword
fortinet.firewall.dstcountry- Destination country
type: keyword
fortinet.firewall.dstdevcategory- Destination device category
type: keyword
fortinet.firewall.dstdevtype- Destination device type
type: keyword
fortinet.firewall.dstfamily- Destination OS family
type: keyword
fortinet.firewall.dsthwvendor- Destination HW vendor
type: keyword
fortinet.firewall.dsthwversion- Destination HW version
type: keyword
fortinet.firewall.dstinetsvc- Destination interface service
type: keyword
fortinet.firewall.dstosname- Destination OS name
type: keyword
fortinet.firewall.dstosversion- Destination OS version
type: keyword
fortinet.firewall.dstserver- Destination server
type: integer
fortinet.firewall.dstssid- Destination SSID
type: keyword
fortinet.firewall.dstswversion- Destination software version
type: keyword
fortinet.firewall.dstunauthusersource- Destination unauthenticated source
type: keyword
fortinet.firewall.dstuuid- UUID of the Destination IP address
type: keyword
fortinet.firewall.duid- DHCP UID
type: keyword
fortinet.firewall.eapolcnt- EAPOL packet count
type: integer
fortinet.firewall.eapoltype- EAPOL packet type
type: keyword
fortinet.firewall.encrypt- Whether the packet is encrypted or not
type: integer
fortinet.firewall.encryption- Encryption method
type: keyword
fortinet.firewall.epoch- Epoch used for locating file
type: integer
fortinet.firewall.espauth- ESP Authentication
type: keyword
fortinet.firewall.esptransform- ESP Transform
type: keyword
fortinet.firewall.eventtype- UTM Event Type
type: keyword
fortinet.firewall.exch- Mail Exchanges from DNS response answer section
type: keyword
fortinet.firewall.exchange- Mail Exchanges from DNS response answer section
type: keyword
fortinet.firewall.expectedsignature- Expected SSL signature
type: keyword
fortinet.firewall.expiry- FortiGuard override expiry timestamp
type: keyword
fortinet.firewall.fams_pause- Fortinet Analysis and Management Service Pause
type: integer
fortinet.firewall.fazlograte- FortiAnalyzer Logging Rate
type: long
fortinet.firewall.fctemssn- FortiClient Endpoint SSN
type: keyword
fortinet.firewall.fctuid- FortiClient UID
type: keyword
fortinet.firewall.field- NTP status field
type: keyword
fortinet.firewall.filefilter- The filter used to identify the affected file
type: keyword
fortinet.firewall.filehashsrc- Filehash source
type: keyword
fortinet.firewall.filtercat- DLP filter category
type: keyword
fortinet.firewall.filteridx- DLP filter ID
type: integer
fortinet.firewall.filtername- DLP rule name
type: keyword
fortinet.firewall.filtertype- DLP filter type
type: keyword
fortinet.firewall.fortiguardresp- Antispam ESP value
type: keyword
fortinet.firewall.forwardedfor- Email address forwarded
type: keyword
fortinet.firewall.fqdn- FQDN
type: keyword
fortinet.firewall.frametype- Wireless frametype
type: keyword
fortinet.firewall.freediskstorage- Free disk integer
type: integer
fortinet.firewall.from- From email address
type: keyword
fortinet.firewall.from_vcluster- Source virtual cluster number
type: integer
fortinet.firewall.fsaverdict- FSA verdict
type: keyword
fortinet.firewall.fwserver_name- Web proxy server name
type: keyword
fortinet.firewall.gateway- Gateway ip address for PPPoE status report
type: ip
fortinet.firewall.green- Memory status
type: keyword
fortinet.firewall.groupid- User Group ID
type: integer
fortinet.firewall.ha-prio- HA Priority
type: integer
fortinet.firewall.ha_group- HA Group
type: keyword
fortinet.firewall.ha_role- HA Role
type: keyword
fortinet.firewall.handshake- SSL Handshake
type: keyword
fortinet.firewall.hash- Hash value of downloaded file
type: keyword
fortinet.firewall.hbdn_reason- Heartbeat down reason
type: keyword
fortinet.firewall.highcount- Highcount fabric summary
type: integer
fortinet.firewall.host- Hostname
type: keyword
fortinet.firewall.iaid- DHCPv6 id
type: keyword
fortinet.firewall.icmpcode- Destination Port of the ICMP message
type: keyword
fortinet.firewall.icmpid- Source port of the ICMP message
type: keyword
fortinet.firewall.icmptype- The type of ICMP message
type: keyword
fortinet.firewall.identifier- Network traffic identifier
type: integer
fortinet.firewall.in_spi- IPSEC inbound SPI
type: keyword
fortinet.firewall.incidentserialno- Incident serial number
type: integer
fortinet.firewall.infected- Infected MMS
type: integer
fortinet.firewall.infectedfilelevel- DLP infected file level
type: integer
fortinet.firewall.informationsource- Information source
type: keyword
fortinet.firewall.init- IPSEC init stage
type: keyword
fortinet.firewall.initiator- Original login user name for Fortiguard override
type: keyword
fortinet.firewall.interface- Related interface
type: keyword
fortinet.firewall.intf- Related interface
type: keyword
fortinet.firewall.invalidmac- The MAC address with invalid OUI
type: keyword
fortinet.firewall.ip- Related IP
type: ip
fortinet.firewall.iptype- Related IP type
type: keyword
fortinet.firewall.keyword- Keyword used for search
type: keyword
fortinet.firewall.kind- VOIP kind
type: keyword
fortinet.firewall.lanin- LAN incoming traffic in bytes
type: long
fortinet.firewall.lanout- LAN outbound traffic in bytes
type: long
fortinet.firewall.lease- DHCP lease
type: integer
fortinet.firewall.license_limit- Maximum Number of FortiClients for the License
type: keyword
fortinet.firewall.limit- Virtual Domain Resource Limit
type: integer
fortinet.firewall.line- VOIP line
type: keyword
fortinet.firewall.live- Time in seconds
type: integer
fortinet.firewall.local- Local IP for a PPPD Connection
type: ip
fortinet.firewall.log- Log message
type: keyword
fortinet.firewall.login- SSH login
type: keyword
fortinet.firewall.lowcount- Fabric lowcount
type: integer
fortinet.firewall.mac- DHCP mac address
type: keyword
fortinet.firewall.malform_data- VOIP malformed data
type: integer
fortinet.firewall.malform_desc- VOIP malformed data description
type: keyword
fortinet.firewall.manuf- Manufacturer name
type: keyword
fortinet.firewall.masterdstmac- Master mac address for a host with multiple network interfaces
type: keyword
fortinet.firewall.mastersrcmac- The master MAC address for a host that has multiple network interfaces
type: keyword
fortinet.firewall.mediumcount- Fabric medium count
type: integer
fortinet.firewall.mem- Memory usage system statistics
type: integer
fortinet.firewall.meshmode- Wireless mesh mode
type: keyword
fortinet.firewall.message_type- VOIP message type
type: keyword
fortinet.firewall.method- HTTP method
type: keyword
fortinet.firewall.mgmtcnt- The number of unauthorized client flooding managemet frames
type: integer
fortinet.firewall.mode- IPSEC mode
type: keyword
fortinet.firewall.module- PCI-DSS module
type: keyword
fortinet.firewall.monitor-name- Health Monitor Name
type: keyword
fortinet.firewall.monitor-type- Health Monitor Type
type: keyword
fortinet.firewall.mpsk- Wireless MPSK
type: keyword
fortinet.firewall.msgproto- Message Protocol Number
type: keyword
fortinet.firewall.mtu- Max Transmission Unit Value
type: integer
fortinet.firewall.name- Name
type: keyword
fortinet.firewall.nat- NAT IP Address
type: keyword
fortinet.firewall.netid- Connector NetID
type: keyword
fortinet.firewall.new_status- New status on user change
type: keyword
fortinet.firewall.new_value- New Virtual Domain Name
type: keyword
fortinet.firewall.newchannel- New Channel Number
type: integer
fortinet.firewall.newchassisid- New Chassis ID
type: integer
fortinet.firewall.newslot- New Slot Number
type: integer
fortinet.firewall.nextstat- Time interval in seconds for the next statistics.
type: integer
fortinet.firewall.nf_type- Notification Type
type: keyword
fortinet.firewall.noise- Wifi Noise
type: integer
fortinet.firewall.old_status- Original Status
type: keyword
fortinet.firewall.old_value- Original Virtual Domain name
type: keyword
fortinet.firewall.oldchannel- Original channel
type: integer
fortinet.firewall.oldchassisid- Original Chassis Number
type: integer
fortinet.firewall.oldslot- Original Slot Number
type: integer
fortinet.firewall.oldsn- Old Serial number
type: keyword
fortinet.firewall.oldwprof- Old Web Filter Profile
type: keyword
fortinet.firewall.onwire- A flag to indicate if the AP is onwire or not
type: keyword
fortinet.firewall.opercountry- Operating Country
type: keyword
fortinet.firewall.opertxpower- Operating TX power
type: integer
fortinet.firewall.osname- Operating System name
type: keyword
fortinet.firewall.osversion- Operating System version
type: keyword
fortinet.firewall.out_spi- Out SPI
type: keyword
fortinet.firewall.outintf- Out interface
type: keyword
fortinet.firewall.passedcount- Fabric passed count
type: integer
fortinet.firewall.passwd- Changed user password information
type: keyword
fortinet.firewall.path- Path of looped configuration for security fabric
type: keyword
fortinet.firewall.peer- WAN optimization peer
type: keyword
fortinet.firewall.peer_notif- VPN peer notification
type: keyword
fortinet.firewall.phase2_name- VPN phase2 name
type: keyword
fortinet.firewall.phone- VOIP Phone
type: keyword
fortinet.firewall.pid- Process ID
type: integer
fortinet.firewall.policytype- Policy Type
type: keyword
fortinet.firewall.poolname- IP Pool name
type: keyword
fortinet.firewall.port- Log upload error port
type: integer
fortinet.firewall.portbegin- IP Pool port number to begin
type: integer
fortinet.firewall.portend- IP Pool port number to end
type: integer
fortinet.firewall.probeproto- Link Monitor Probe Protocol
type: keyword
fortinet.firewall.process- URL Filter process
type: keyword
fortinet.firewall.processtime- Process time for reports
type: integer
fortinet.firewall.profile- Profile Name
type: keyword
fortinet.firewall.profile_vd- Virtual Domain Name
type: keyword
fortinet.firewall.profilegroup- Profile Group Name
type: keyword
fortinet.firewall.profiletype- Profile Type
type: keyword
fortinet.firewall.qtypeval- DNS question type value
type: integer
fortinet.firewall.quarskip- Quarantine skip explanation
type: keyword
fortinet.firewall.quotaexceeded- If quota has been exceeded
type: keyword
fortinet.firewall.quotamax- Maximum quota allowed - in seconds if time-based - in bytes if traffic-based
type: long
fortinet.firewall.quotatype- Quota type
type: keyword
fortinet.firewall.quotaused- Quota used - in seconds if time-based - in bytes if trafficbased)
type: long
fortinet.firewall.radioband- Radio band
type: keyword
fortinet.firewall.radioid- Radio ID
type: integer
fortinet.firewall.radioidclosest- Radio ID on the AP closest the rogue AP
type: integer
fortinet.firewall.radioiddetected- Radio ID on the AP which detected the rogue AP
type: integer
fortinet.firewall.rate- Wireless rogue rate value
type: keyword
fortinet.firewall.rawdata- Raw data value
type: keyword
fortinet.firewall.rawdataid- Raw data ID
type: keyword
fortinet.firewall.rcvddelta- Received bytes delta
type: keyword
fortinet.firewall.reason- Alert reason
type: keyword
fortinet.firewall.received- Server key exchange received
type: integer
fortinet.firewall.receivedsignature- Server key exchange received signature
type: keyword
fortinet.firewall.red- Memory information in red
type: keyword
fortinet.firewall.referralurl- Web filter referralurl
type: keyword
fortinet.firewall.remote- Remote PPP IP address
type: ip
fortinet.firewall.remotewtptime- Remote Wifi Radius authentication time
type: keyword
fortinet.firewall.reporttype- Report type
type: keyword
fortinet.firewall.reqtype- Request type
type: keyword
fortinet.firewall.request_name- VOIP request name
type: keyword
fortinet.firewall.result- VPN phase result
type: keyword
fortinet.firewall.role- VPN Phase 2 role
type: keyword
fortinet.firewall.rssi- Received signal strength indicator
type: integer
fortinet.firewall.rsso_key- RADIUS SSO attribute value
type: keyword
fortinet.firewall.ruledata- Rule data
type: keyword
fortinet.firewall.ruletype- Rule type
type: keyword
fortinet.firewall.scanned- Number of Scanned MMSs
type: integer
fortinet.firewall.scantime- Scanned time
type: long
fortinet.firewall.scope- FortiGuard Override Scope
type: keyword
fortinet.firewall.security- Wireless rogue security
type: keyword
fortinet.firewall.sensitivity- Sensitivity for document fingerprint
type: keyword
fortinet.firewall.sensor- NAC Sensor Name
type: keyword
fortinet.firewall.sentdelta- Sent bytes delta
type: keyword
fortinet.firewall.seq- Sequence number
type: keyword
fortinet.firewall.serial- WAN optimisation serial
type: keyword
fortinet.firewall.serialno- Serial number
type: keyword
fortinet.firewall.server- AD server FQDN or IP
type: keyword
fortinet.firewall.session_id- Session ID
type: keyword
fortinet.firewall.sessionid- WAD Session ID
type: integer
fortinet.firewall.setuprate- Session Setup Rate
type: long
fortinet.firewall.severity- Severity
type: keyword
fortinet.firewall.shaperdroprcvdbyte- Received bytes dropped by shaper
type: integer
fortinet.firewall.shaperdropsentbyte- Sent bytes dropped by shaper
type: integer
fortinet.firewall.shaperperipdropbyte- Dropped bytes per IP by shaper
type: integer
fortinet.firewall.shaperperipname- Traffic shaper name (per IP)
type: keyword
fortinet.firewall.shaperrcvdname- Traffic shaper name for received traffic
type: keyword
fortinet.firewall.shapersentname- Traffic shaper name for sent traffic
type: keyword
fortinet.firewall.shapingpolicyid- Traffic shaper policy ID
type: integer
fortinet.firewall.signal- Wireless rogue API signal
type: integer
fortinet.firewall.size- Email size in bytes
type: long
fortinet.firewall.slot- Slot number
type: integer
fortinet.firewall.sn- Security fabric serial number
type: keyword
fortinet.firewall.snclosest- SN of the AP closest to the rogue AP
type: keyword
fortinet.firewall.sndetected- SN of the AP which detected the rogue AP
type: keyword
fortinet.firewall.snmeshparent- SN of the mesh parent
type: keyword
fortinet.firewall.spi- IPSEC SPI
type: keyword
fortinet.firewall.src_int- Source interface
type: keyword
fortinet.firewall.srcintfrole- Source interface role
type: keyword
fortinet.firewall.srccountry- Source country
type: keyword
fortinet.firewall.srcfamily- Source family
type: keyword
fortinet.firewall.srchwvendor- Source hardware vendor
type: keyword
fortinet.firewall.srchwversion- Source hardware version
type: keyword
fortinet.firewall.srcinetsvc- Source interface service
type: keyword
fortinet.firewall.srcname- Source name
type: keyword
fortinet.firewall.srcserver- Source server
type: integer
fortinet.firewall.srcssid- Source SSID
type: keyword
fortinet.firewall.srcswversion- Source software version
type: keyword
fortinet.firewall.srcuuid- Source UUID
type: keyword
fortinet.firewall.sscname- SSC name
type: keyword
fortinet.firewall.ssid- Base Service Set ID
type: keyword
fortinet.firewall.sslaction- SSL Action
type: keyword
fortinet.firewall.ssllocal- WAD SSL local
type: keyword
fortinet.firewall.sslremote- WAD SSL remote
type: keyword
fortinet.firewall.stacount- Number of stations/clients
type: integer
fortinet.firewall.stage- IPSEC stage
type: keyword
fortinet.firewall.stamac- 802.1x station mac
type: keyword
fortinet.firewall.state- Admin login state
type: keyword
fortinet.firewall.status- Status
type: keyword
fortinet.firewall.stitch- Automation stitch triggered
type: keyword
fortinet.firewall.subject- Email subject
type: keyword
fortinet.firewall.submodule- Configuration Sub-Module Name
type: keyword
fortinet.firewall.subservice- AV subservice
type: keyword
fortinet.firewall.subtype- Log subtype
type: keyword
fortinet.firewall.suspicious- Number of Suspicious MMSs
type: integer
fortinet.firewall.switchproto- Protocol change information
type: keyword
fortinet.firewall.sync_status- The sync status with the master
type: keyword
fortinet.firewall.sync_type- The sync type with the master
type: keyword
fortinet.firewall.sysuptime- System uptime
type: keyword
fortinet.firewall.tamac- the MAC address of Transmitter, if none, then Receiver
type: keyword
fortinet.firewall.threattype- WIDS threat type
type: keyword
fortinet.firewall.time- Time of the event
type: keyword
fortinet.firewall.to- Email to field
type: keyword
fortinet.firewall.to_vcluster- destination virtual cluster number
type: integer
fortinet.firewall.total- Total memory
type: integer
fortinet.firewall.totalsession- Total Number of Sessions
type: integer
fortinet.firewall.trace_id- Session clash trace ID
type: keyword
fortinet.firewall.trandisp- NAT translation type
type: keyword
fortinet.firewall.transid- HTTP transaction ID
type: integer
fortinet.firewall.translationid- DNS filter transaltion ID
type: keyword
fortinet.firewall.trigger- Automation stitch trigger
type: keyword
fortinet.firewall.trueclntip- File filter true client IP
type: ip
fortinet.firewall.tunnelid- IPSEC tunnel ID
type: integer
fortinet.firewall.tunnelip- IPSEC tunnel IP
type: ip
fortinet.firewall.tunneltype- IPSEC tunnel type
type: keyword
fortinet.firewall.type- Module type
type: keyword
fortinet.firewall.ui- Admin authentication UI type
type: keyword
fortinet.firewall.unauthusersource- Unauthenticated user source
type: keyword
fortinet.firewall.unit- Power supply unit
type: integer
fortinet.firewall.urlfilteridx- URL filter ID
type: integer
fortinet.firewall.urlfilterlist- URL filter list
type: keyword
fortinet.firewall.urlsource- URL filter source
type: keyword
fortinet.firewall.urltype- URL filter type
type: keyword
fortinet.firewall.used- Number of Used IPs
type: integer
fortinet.firewall.used_for_type- Connection for the type
type: integer
fortinet.firewall.utmaction- Security action performed by UTM
type: keyword
fortinet.firewall.utmref- Reference to UTM
type: keyword
fortinet.firewall.vap- Virtual AP
type: keyword
fortinet.firewall.vapmode- Virtual AP mode
type: keyword
fortinet.firewall.vcluster- virtual cluster id
type: integer
fortinet.firewall.vcluster_member- Virtual cluster member
type: integer
fortinet.firewall.vcluster_state- Virtual cluster state
type: keyword
fortinet.firewall.vd- Virtual Domain Name
type: keyword
fortinet.firewall.vdname- Virtual Domain Name
type: keyword
fortinet.firewall.vendorurl- Vulnerability scan vendor name
type: keyword
fortinet.firewall.version- Version
type: keyword
fortinet.firewall.vip- Virtual IP
type: keyword
fortinet.firewall.virus- Virus name
type: keyword
fortinet.firewall.virusid- Virus ID (unique virus identifier)
type: integer
fortinet.firewall.voip_proto- VOIP protocol
type: keyword
fortinet.firewall.vpn- VPN description
type: keyword
fortinet.firewall.vpntunnel- IPsec Vpn Tunnel Name
type: keyword
fortinet.firewall.vpntype- The type of the VPN tunnel
type: keyword
fortinet.firewall.vrf- VRF number
type: integer
fortinet.firewall.vulncat- Vulnerability Category
type: keyword
fortinet.firewall.vulnid- Vulnerability ID
type: integer
fortinet.firewall.vulnname- Vulnerability name
type: keyword
fortinet.firewall.vwlid- VWL ID
type: integer
fortinet.firewall.vwlquality- VWL quality
type: keyword
fortinet.firewall.vwlservice- VWL service
type: keyword
fortinet.firewall.vwpvlanid- VWP VLAN ID
type: integer
fortinet.firewall.wanin- WAN incoming traffic in bytes
type: long
fortinet.firewall.wanoptapptype- WAN Optimization Application type
type: keyword
fortinet.firewall.wanout- WAN outgoing traffic in bytes
type: long
fortinet.firewall.weakwepiv- Weak Wep Initiation Vector
type: keyword
fortinet.firewall.xauthgroup- XAuth Group Name
type: keyword
fortinet.firewall.xauthuser- XAuth User Name
type: keyword
fortinet.firewall.xid- Wireless X ID
type: integer