Appendix C: Security event severity level mappings

Each vendor defines its own severity levels for syslog messages. These severity levels are normalized within FortiNAC to provide additional filtering options for incoming security events. The following table provides severity level mappings between the vendor and FortiNAC.

You must have ATR enabled in your licensing package in order to use ATR features.

Vendor	Vendor Severity Level	FortiNAC Severity Level
CheckPoint	1	1
	2	2
	3	3
	4	4
	5	5
	6	6
	7	7
	8	8
	9	9
	10	10
Stonegate	0	1
	1	2
	2	3
	3	4
	4	5
	5	6
	6	7
	7	8
	8	9
	9	10
TippingPointSMS	0	1
	1	3
	2	5
	3	7
	4	9
FireEye	0	1
	1	2
	2	3
	3	4
	4	5
	5	6
	6	7
	7	8
	8	9
	9	10
FortiOS4	INFORMATION	1
	NOTICE	3
	WARNING	5
	ALERT	7
	CRITICAL	8
	ERROR	9
	EMERGENCY	10
FortiOS5	INFORMATION	1
	NOTICE	3
	WARNING	5
	ALERT	7
	CRITICAL	8
	ERROR	9
	EMERGENCY	10
PaloAlto	INFORMATIONAL	1
	LOW	3
	MEDIUM	5
	HIGH	7
	CRITICAL	9
RSA	0	1
	1	2
	2	3
	3	4
	4	5
	5	6
	6	7
	7	8
	8	9
	9	10