Table columns

The name of the security event parser.

A green check mark indicates that the security event parser is enabled. A red circle indicates that the security event parser is disabled. When enabled, the security event parser is available in Topology. When disabled, the security event parser is not available.

The name of the vendor of the device that generated the event.

Message format for the security event parser. Supported formats include:

CSV: Message is a series of data fields typically separated by commas. Comma separated value. Other characters can be used to separate data fields.

TAG/VALUE: Message is a series of fields each with a tag and a value. For example, the message could contain the following : cip=192.168.10.182. cip is the tag indicating that this is the IP address of the user causing the problem. 192.168.10.182 is the value associated with that tag.

CEF: Message is a series of fields, some in a standard position, others with a tag and a value. For example the message could contain the following:

src=192.168.10.182. src is the tag indicating that this is the IP address of the user causing the problem. 192.168.10.182 is the value associated with that tag.

Character used to separate the fields in the security event parser. Most common options include: space, comma (,) and pipe (|).

This field is not available for the TAG/VALUE format.

Character used to separate field name and value in the security event parser. This field is not available for the CSV format. A space is used as the delimiter.

The name of the field or number of the column containing the source IP address.

The IP address of the host or device the source host was communicating with.

The type of security event received.

The subtype of the security event.

A unique identifying code supplied by the vendor for the specific type of threat or event that occurred.

A description supplied by the security appliance of the event.

Name of the field or number of the column containing the severity.

Right click options

Modify the selected parser.

Deletes the selected parser.

Click to copy information from the selected parser to create a new security parser.

Shows which devices in Topology are currently using the parser.

Allows you to test the security event parser by entering a syslog message received from a device.

Enables the parser.

Disables the parser.

Buttons

Allows you to select a current syslog message to build the security event parser.

You must select the format of the selected syslog file from the Format drop-down list.

Enables the security parser to be available as an option when configuring a pingable device to parse incoming security events

Enter the name of the security event parser.

Enter the name of the vendor of the device that will generated the event.

Select the message format for the security event parser. Supported formats include:

CSV: Message is a series of data fields typically separated by commas. Comma separated value. Other characters can be used to separate data fields.

TAG/VALUE: Message is a series of fields each with a tag and a value. For example, the message could contain the following : cip=192.168.10.182. cip is the tag indicating that this is the IP address of the user causing the problem. 192.168.10.182 is the value associated with that tag.

CEF: Message is a series of fields, some in a standard position, others with a tag and a value. For example the message could contain the following:

src=192.168.10.182. src is the tag indicating that this is the IP address of the user causing the problem. 192.168.10.182 is the value associated with that tag.

Data fields

When you select Entire Column/Tag in the Data Fields drop-down list, enter the name of the field or number of the column containing the value. The entire value will be used to create the security event.

When you select Partial Column/Tag in the Data Fields drop-down list, you can build a regular expression that lets you to define which parts of the column to use when creating the security event.

Refer to websites such as http://www.regular-expressions.info/ and https://www.debuggex.com/ for additional information about building regular expressions.

Enter the name of the field or number of the column containing the source IP address. The entire value will be used to create the security event.

Enter the IP address of the host or device the source host was communicating with.

Enter the type of security event received.

Enter the subtype of the security event.

Enter the unique identifying code supplied by the vendor for the specific type of threat or event that occurred.

Enter the description supplied by the security appliance of the event.

Enter the name of the field or number of the column containing the severity.

Severity mappings

The severity value provided by the vendor.

The severity value in FortiNAC to be mapped to the source value.

Click to add a severity level mapping.

Click to map a single severity value in FortiNAC to a range of values provided by the source.

Click to modify a severity mapping.