vrf

uint16

virusid

Virus ID (unique virus identifier)

uint32

viruscat

string

virus

Virus Name

string

vd

VDOM name

string

user

Username (authentication)

string

url

The URL address

string

unauthusersource

string

unauthuser

string

tz

Time Zone

string

type

Log type

string

trueclntip

ip

transid

uint32

to

Email address(es) from the Email Headers (IMAP/POP3/SMTP)

string

time

Time

string

subtype

Subtype of the virus log

string

subservice

string

subject

string

srcuuid

string

srcport

Source Port

uint16

srcname

string

srcmac

string

srcip

Source IP Address

ip

srcintfrole

Source Interface's assigned role (LAN, WAN, etc.)

string

srcintf

Source Interface

string

srcdomain

string

srccountry

string

sharename

string

sessionid

Session ID

uint32

service

Proxy service which scanned this traffic

string

sender

Email address from the SMTP envelope

string

referralurl

string

ref

The URL of the FortiGuard IPS database entry for the attack

string

recipient

Email addresses from the SMTP envelope

string

rawdata

string

quarskip

Quarantine skip explanation

string

psrcport

uint16

proto

Protocol number

uint8

profile

The name of the profile that was used to detect and take action

string

poluuid

string

policytype

string

policymode

string

policyid

Policy ID

uint32

pdstport

uint16

pathname

string

msg

Log message

string

messageid

string

logid

Log ID

string

level

Log level

string

itype

string

icbverdict

string

icbseverity

string

icbfiletype

string

icbfileid

string

icbconfidence

string

icbaction

string

httpmethod

string

group

Group name (authentication)

string

from

Email address from the Email Headers (IMAP/POP3/SMTP)

string

forwardedfor

string

filetype

File type

string

filename

File name

string

filehashsrc

Used by Outbreak Prevention External Hash: external source that provided the hash signature

string

filehash

Used by Outbreak Prevention External Hash: the hash signature used in the detection

string

fctuid

Forticlient user ID

string

eventtype

Event type of AV

string

eventtime

Time when detection occured

uint64

dtype

Data type for virus category

string

dstuuid

string

dstuser

string

dstport

Destination Port

uint16

dstip

Destination IP Address

ip

dstintfrole

Destination Interface's assigned role (LAN, WAN, etc.)

string

dstintf

Destination Interface

string

dstcountry

string

dstauthserver

string

direction

Message/packets direction

string

devid

string

date

Date

string

crscore

Threat Weight Score

uint32

crlevel

Threat Weight Level

string

craction

Threat Weight action

uint32

contentdisarmed

Content Disarm action- eg. disarmed, detected

string

checksum

The checksum of the scanned file

string

cdrcontent

string

cc

string

authserver

Server used to authenticate the involved user

string

attachment

string

analyticssubmit

The flag for analytics submission

string

analyticscksum

The checksum of the file submitted for analytics

string

agent

User agent - eg. agent="Mozilla/5.0"

string