FortiOS to CEF log field mapping guidelines
The following CEF format:
Date/Time host CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|[Extension]
Displays as following in FortiOS logs with CEF enabled:
"MMM dd HH:mm:ss" "hostname of the fortigate" CEF:0|Fortinet|Fortigate|version|logid|type:subtype +[eventtype] +[action] +[status]|reversed level|...
The SignatureId field in FortiOS logs maps to the logid field in CEF and should be last 5 digits of logid.
The Name field in CEF uses the following formula:
type:subtype + [eventtype] + [action] + [status]
Following is an example of the header and one key-value pair for extension from the Event VPN log in CEF:
#Feb 12 10:31:04 syslog-800c CEF:0|Fortinet|Fortigate|v5.6.0|37127|event:vpn negotiate success|3|FTNTFGTlogid=0101037127
The type:subtype field in FortiOS logs maps to the cat field in CEF.
Any fields in FortiOS logs that are unmatched to fields in CEF include the FTNTFGT prefix.
Quotes ("") are removed from FortiOS logs to support CEF.
Forward slashes (//) in string values as well as the equal sign (=) and backward slashes (\) are escaped in FortiOS logs to support CEF.