action

The status of the session: blocked - Blocked infected file by AV engine passthrough - Allowed by AV engine monitored - Log, but do NOT block infected file analytics - Submitted to Sandbox for analysis

string

agent

User agent - eg. agent="Mozilla/5.0"

string

analyticscksum

The checksum of the file submitted for analytics

string

date

Date

string

devid

string

direction

Message/packets direction

string

dlpextra

string

dlpfilteridx

uint32

dlpfiltername

string

dlpfiltertype

string

dlpprofile

string

dlpseverity

string

dstintf

Destination Interface

string

dstintfrole

Destination Interface's assigned role (LAN, WAN, etc.)

string

dstip

Destination IP Address

ip

dstport

Destination Port

uint16

eventtime

Time when detection occured

uint64

eventtype

Event type of AV

string

fctuid

Forticlient user ID

string

filename

File name

string

from

Email address from the Email Headers (IMAP/POP3/SMTP)

string

group

Group name (authentication)

string

imgdimension

string

level

Log level

string

logid

Log ID

string

msg

Log message

string

ocrlog

uint8

pdstport

uint16

policyid

Policy ID

uint32

profile

The name of the profile that was used to detect and take action

string

proto

Protocol number

uint8

psrcport

uint16

scorelist

string

service

Proxy service which scanned this traffic

string

sessionid

Session ID

uint32

srcdomain

string

srcintf

Source Interface

string

srcintfrole

Source Interface's assigned role (LAN, WAN, etc.)

string

srcip

Source IP Address

ip

srcport

Source Port

uint16

subservice

string

subtype

Subtype of the virus log

string

time

Time

string

to

Email address(es) from the Email Headers (IMAP/POP3/SMTP)

string

type

Log type

string

tz

Time Zone

string

unauthuser

string

unauthusersource

string

url

The URL address

string

user

Username (authentication)

string

vd

VDOM name

string

violatecategory

string

violatescore

uint8