action

The status of the session: log-only - DLP event is detected , but NOT blocked (similar to monitor action) block - Blocked exempt - Allowed ban - blocked (Not in used since FortiOS 5.0, replaced by blocked) ban-sender - blocks all data being sent by an ip or user (Not in used since FortiOS 5.0, replaced by quarantine) quarantine-ip - Blocked and band the source ip (Not in used since FortiOS 5.0) quarantine-interface - Blocked and band the source interface (Not in used since FortiOS 5.0)

string

agent

User agent - eg. agent="Mozilla/5.0"

string

attachment

string

authserver

Authentication Server

string

cc

string

date

Date

string

devid

Device ID

string

direction

Direction of packets

string

dlpextra

DLP extra information

string

dstauthserver

string

dstcountry

string

dstintf

Destination Interface

string

dstintfrole

Destination Interface's assigned role (LAN, WAN, etc.)

string

dstip

Destination IP

ip

dstport

Destination Port

uint16

dstuser

string

dstuuid

string

epoch

Epoch used for locating file

uint32

eventid

The serial number of the dlparchive file in the same epoch

uint32

eventtime

Event Time, time when DLP event detected.

uint64

eventtype

DLP event type

string

fctuid

FortiClient User ID

string

filename

File name

string

filesize

File size in bytes

uint64

filetype

File type

string

filtercat

DLP filter category

string

filteridx

DLP filter ID

uint32

filtername

DLP rule name

string

filtertype

DLP filter type

string

forwardedfor

Forwarded For

string

from

Email address from the Email Headers (IMAP/POP3/SMTP)

string

group

User group name

string

hostname

The host name of a URL

string

httpmethod

string

infectedfilelevel

Infected File Level (Critical,Warning etc)

uint32

infectedfilename

Infected File Name

string

infectedfilesize

Infected File Size

uint64

infectedfiletype

Infected File Type

string

level

Log Level

string

logid

Log ID

string

pdstport

uint16

policyid

Policy ID

uint32

policymode

string

policytype

string

poluuid

string

profile

DLP profile name

string

proto

Protocol number

uint8

psrcport

uint16

rawdata

Raw Data

string

recipient

Email addresses from the SMTP envelope

string

referralurl

string

sender

Email address from the SMTP envelope

string

service

Service name

string

sessionid

Session ID

uint32

severity

Severity level of a DLP rule

string

srccountry

string

srcdomain

string

srcintf

Source Interface

string

srcintfrole

Source Interface's assigned role (LAN, WAN, etc.)

string

srcip

Source IP

ip

srcport

Source Port

uint16

srcuuid

string

subject

The subject title of the email message

string

subservice

string

subtype

Log subtype

string

time

Time

string

to

Email address(es) from the Email Headers (IMAP/POP3/SMTP)

string

trueclntip

True client's IP

ip

type

Log type

string

tz

string

unauthuser

Unauthenticated user

string

unauthusersource

Unauthenticated user source

string

url

The URL address

string

user

User name

string

vd

Virtual domain name

string