DLP log support for CEF
Following is an example of a DLP log on the FortiGate disk:
date=2016-02-12 time=14:16:32 logid=0954024576 type=utm subtype=dlp eventtype=dlp level=warning vd="vdom1" filteridx=2 filtertype=ssn filtercat=file severity=medium sessionid=65177 epoch=2015044633 eventid=0 user="" srcip=192.168.1.183 srcport=36171 srcintf="port15" dstip=192.168.70.184 dstport=80 dstintf="port19" proto=6 service=HTTP filetype=unknown sentbyte=151 rcvdbyte=90170 direction=incoming action=block hostname="192.168.70.184" url="/dlp/ssn/ssn-docx-pdf-valid.tar" agent="Wget/1.10.2" filename="ssn-docx-pdf-valid.tar" filesize=89831 profile="SSN"
Following is an example of a DLP log sent in CEF format to a syslog server:
Feb 12 14:16:32 syslog-800c CEF:0|Fortinet|Fortigate|v5.6.0|24576|utm:dlp dlp block|4|FTNTFGTlogid=0954024576 cat=utm:dlp FTNTFGTsubtype=dlp FTNTFGTeventtype=dlp FTNTFGTlevel=warning FTNTFGTvd=vdom1 FTNTFGTfilteridx=2 cs1=ssn cs1Label=Filter Type FTNTFGTfiltercat=file FTNTFGTseverity=medium externalId=65177 FTNTFGTepoch=2015044633 FTNTFGTeventid=0 duser= src=192.168.1.183 spt=36171 deviceInboundInterface=port15 dst=192.168.70.184 dpt=80 deviceOutboundInterface=port19 proto=6 app=HTTP FTNTFGTfiletype=unknown out=151 in=90170 deviceDirection=0 act=block dhost=192.168.70.184 request=/dlp/ssn/ssn-docx-pdf-valid.tar requestClientApplication=Wget/1.10.2 fname=ssn-docx-pdf-valid.tar fsize=89831 FTNTFGTprofile=SSN
The following table maps FortiOS log field names to CEF field names.
|
FortiOS Log Field Name |
CEF Field Name |
|---|---|
|
filtertype |
cs1=xxx cs1Label=Filter Type |
|
filesize |
fsize |