Using the Generic Text Filter in an event handler

The Generic Text Filter uses the glibc regex library for values with operators (~,!~), using the POSIX standard. Filter string syntax is parsed by FortiAnalyzer, and both upper and lower case characters are supported (for example "and" is the same as "AND"). You must use an escape character when needed. For example, cfgpath=firewall.policy is the wrong syntax because it's missing an escape character. The correct syntax is cfgpath=firewall\.policy.

To create an event handler using the Generic Text Filter to match raw log data:

1. Go to Log View, and select a log type.
2. In the toolbar, click Tools > Display Raw.

   The easiest method is to copy the text string you want from the raw log and paste it into the Generic Text Filter field. Ensure you insert an escape character when necessary, for example, cfgpath=firewall\.policy.

3. Locate and copy the text in the raw log.
4. Go to FortiSoC/Incidents & Events > Handlers > Event Handler List and click Create New.
5. In the Generic Text Filter box, paste the text you copied or type the text you want. Ensure you use the raw log field names, for example, mem (not memory) and setuprate (not setup-rate).

   For information on text format and operators, hover the cursor over the help icon. The operator ~ means contains and !~ means does not contain.

6. If you want to be notified of events, configure the Notifications section.
7. Configure other settings as required and click OK. For a description of the fields, see Creating a custom event handler.