Log fields by type
securityevent
|
Log Field Name |
Description |
Data Type |
Length |
|---|---|---|---|
|
action |
block or monitor |
string |
32 |
|
analyticscksum |
file sha256 checksum |
enumeration string |
64 |
|
checksum |
file crc32 checksum |
int |
20 |
|
date |
date |
string |
260 |
|
destaddr |
destination address |
string |
260 |
|
destport |
destination port number |
int |
20 |
|
detectedby |
the security feature that detected virus |
enumeration string |
64 |
|
detectedin |
where the virus is detected |
enumeration string |
64 |
|
deviceip |
device IP address |
string |
20 |
|
devicemac |
device MAC address |
string |
17 |
|
devid |
device ID |
string |
16 |
|
emsserial |
EMS serial number |
string |
16 |
|
eventtype |
type of event |
enumeration string |
32 |
|
fctver |
FCT version |
string |
16 |
|
fgtserial |
FGT serial number |
string |
16 |
|
file |
file location |
string |
256 |
|
filesize |
file size |
int |
20 |
|
from |
email from |
string |
128 |
|
gatewayaddr |
gateway address |
string |
260 |
|
gatewayport |
gateway port number |
int |
20 |
|
hostname |
host name of local machine |
string |
256 |
|
id |
log id |
int |
20 |
|
level |
log level |
enumeration string |
20 |
|
logver |
log protocol version |
int |
20 |
|
msg |
description of this log |
string |
512 |
|
os |
operating system |
string |
96 |
|
pcdomain |
domain name of local machine |
string |
128 |
|
ref |
FortiGuard virus database reference url |
enumeration string |
512 |
|
service |
network protocol |
string |
64 |
|
sigid |
signature id |
string |
260 |
|
subtype |
AntiVirus, FireWall, WebFilter ... |
enumeration string |
32 |
|
time |
time |
string |
260 |
|
to |
email to |
string |
512 |
|
type |
Traffic, Security Event or System Event |
enumeration string |
16 |
|
uid |
FortiClient unique ID |
string |
32 |
|
user |
current logged on user |
string |
256 |
|
usingpolicy |
current policy name |
string |
64 |
|
vd |
vdom |
string |
512 |
|
virus |
virus name |
string |
512 |
|
viruscat |
virus category |
string |
260 |
|
vpn |
vpn tunnel name |
string |
32 |
|
vulncat |
category |
string |
32 |
|
vulncvss |
cvss score |
string |
64 |
|
vulnengine |
engine version |
string |
64 |
|
vulnid |
id of the vulnerability |
int |
20 |
|
vulnname |
name of the vulnerability |
string |
128 |
|
vulnproducts |
name of the vulnerable product |
string |
2048 |
|
vulnref |
reference of the vulnerability |
string |
256 |
|
vulnseverity |
severity level |
string |
8 |
|
vulnsignature |
signature version |
string |
260 |
|
ztnarule |
ZTNA rule name |
string |
260 |
systemevent
|
Log Field Name |
Description |
Data Type |
Length |
|---|---|---|---|
|
date |
date |
string |
260 |
|
deviceip |
device IP address |
string |
20 |
|
devicemac |
device MAC address |
string |
17 |
|
devid |
device ID |
string |
16 |
|
emshostname |
EMS host name |
string |
64 |
|
emsip |
EMS IP |
string |
20 |
|
emsserial |
EMS serial number |
string |
16 |
|
epenfeatures |
enabled features list |
string |
128 |
|
epfeatures |
installed features list |
string |
128 |
|
ephbemsduration |
EMS heart beat duration |
int |
20 |
|
ephbemslast |
EMS heart beat last time |
string |
64 |
|
epmgmtst |
management status |
enumeration string |
64 |
|
eponlinest |
online status |
enumeration string |
32 |
|
epplace |
EP place |
enumeration string |
32 |
|
epquarmsg |
quarant message |
string |
260 |
|
eventtype |
type of event |
enumeration string |
32 |
|
fctip |
FCT IP |
string |
20 |
|
fctver |
FCT version |
string |
16 |
|
fgtserial |
FGT serial number |
string |
16 |
|
hostname |
host name of local machine |
string |
256 |
|
id |
log id |
int |
20 |
|
level |
log level |
enumeration string |
20 |
|
logver |
log protocol version |
int |
20 |
|
msg |
description of this log |
string |
512 |
|
os |
operating system |
string |
96 |
|
pcdomain |
domain name of local machine |
string |
128 |
|
social_email |
social email |
string |
128 |
|
social_phone |
social phone number |
string |
64 |
|
social_srvc |
social service |
string |
64 |
|
social_user |
social user name |
string |
256 |
|
status |
status description |
string |
16 |
|
subtype |
AntiVirus, FireWall, WebFilter ... |
enumeration string |
32 |
|
time |
time |
string |
260 |
|
type |
Traffic, Security Event or System Event |
enumeration string |
16 |
|
uid |
FortiClient unique ID |
string |
32 |
|
user |
current logged on user |
string |
256 |
|
usingpolicy |
current policy name |
string |
64 |
|
vd |
vdom |
string |
512 |