action

The status of the session: blocked - Blocked infected file by AV engine passthrough - Allowed by AV engine monitored - Log, but do NOT block infected file analytics - Submitted to Sandbox for analysis

string

analyticscksum

The checksum of the file submitted for analytics

string

date

Date

string

devid

string

dstip

Destination IP Address

ip

dstport

Destination Port

uint16

dtype

Data type for virus category

string

eventtime

Time when detection occured

uint64

eventtype

Event type of AV

string

fctuid

Forticlient user ID

string

filename

File name

string

fsaverdict

FortiSandbox Verdict returned to FortiProxy after analysis (clean, low risk, med risk, high risk, malicious)

string

level

Log level

string

logid

Log ID

string

service

Proxy service which scanned this traffic

string

srcdomain

string

srcip

Source IP Address

ip

srcport

Source Port

uint16

subtype

Subtype of the virus log

string

time

Time

string

type

Log type

string

tz

Time Zone

string

unauthuser

string

unauthusersource

string