Antivirus log support for CEF

Following is an example of an antivirus log on the FortiGate disk:

date=2016-02-12 time=11:11:25 logid=0211008192 type=utm subtype=virus eventtype=infected level=warning vd="vdom1" msg="File is infected." action=blocked service=HTTP sessionid=56633 srcip=192.168.1.183 dstip=192.168.70.184 srcport=45719 dstport=80 srcintf="port15" dstintf="port19" proto=6 direction=incoming filename="eicar.com" checksum="1dd02bdb" quarskip=No-skip virus="EICAR_TEST_FILE" dtype="Virus" ref="http://www.fortinet.com/ve?vn=EICAR_TEST_FILE" virusid=2172 url="http://192.168.70.184/eicar.com" profile="default" user="" agent="Wget/1.10.2" analyticscksum="131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267" analyticssubmit=false crscore=50 crlevel=critical

Following is an example of an antivirus log sent in CEF format to a syslog server:

blocked|4|FTNTFGTlogid=0211008192 cat=utm:virus FTNTFGTsubtype=virus FTNTFGTeventtype=infected FTNTFGTlevel=warning FTNTFGTvd=vdom1 msg=File is infected act=blocked app=HTTP externalId=56633 src=192.168.1.183 dst=192.168.70.184 spt=45719 dpt=80 deviceInboundInterface=port15 deviceOutboundInterface=port19 proto=6 deviceDirection=0 fname=eicar.com FTNTFGTchecksum=1dd02bdb FTNTFGTquarskip=No-skip cs1=EICAR_TEST_FILE cs1Label=Virus FTNTFGTdtype=Virus cs2=http://www.fortinet.com/ve?vn\=EICAR_TEST_FILE cs2Label=Reference FTNTFGTvirusid=2172 request=http://192.168.70.184/eicar.com FTNTFGTprofile=default duser= requestClientApplication=Wget/1 10 2 FTNTFGTanalyticscksum=131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267 FTNTFGTanalyticssubmit=false FTNTFGTcrscore=50 FTNTFGTcrlevel=critical

The following table maps FortiOS log field names to CEF field names.

FortiOS Log Field Name	CEF Field Name
direction	deviceDirection (inbound/outbound mapping to 0/1)
filename	fname
virus	cs1=xxx cs1Label=Virus
ref	cs2=xxx cs2Label=Reference
url	request
agent	requestClientApplication