Fortinet FortiGate Security Gateway Sample Event Messages

Use this sample event message as a way of verifying a successful integration with JSA.

Fortinet FortiGate Security Gateway sample message when you use the Syslog or the Syslog Redirect protocol

Due to formatting, paste the message format into a text editor and then remove any carriage return or line feed characters.

Sample 1: The following sample shows an attempt to use a remote-access vulnerability that affects Microsoft Exchange Server. A remote attacker uses the vulnerability by sending an email with a meeting request that contains specially crafted vCal and iCal calendar data. As a result, the attacker might be able to take control of a vulnerable system.

Table 1: Highlighted fields

JSA field name	Highlighted payload field name
Event ID	attack_id
Source IP	src
Source Port	src_port
Destination IP	dst
Destination Port	dst_port
Protocol	proto
Policy	policyid
Device Time	date + time

Sample 2: The following sample shows that routing information has changed.

Table 2: Highlighted fields

JSA field name	Highlighted payload field name
Event ID	logdesc + level
Device Time	date + time

Sample 3: The following sample shows that a firewall is allowed.

Table 3: Highlighted fields

JSA field name	Highlighted payload field name
Event ID	utmaction
Source IP	srcip
Source Port	srcport
Destination IP	dstip
Destination Port	dstport
Pre NAT Source IP	srcip
Pre NAT Source Port	srcport
Post NAT Source IP	transip
Post NAT Source Port	transport
Protocol	proto
Policy	policyid
Duration Seconds	duration
Device Time	date + time