Fortinet black logo

Administration Guide

Predefined event handlers

Predefined event handlers

FortiAnalyzer includes many predefined event handlers that you can use to generate events. You can easily create a custom event handler by cloning a predefined event handler and customizing its settings. See Cloning event handlers.

Note

In 6.2.0 and up, predefined event handlers have been consolidated and have multiple filters that can be enabled or disabled individually.

The following are a small sample of FortiAnalyzer predefined event handlers. To see all predefined event handlers, go to Incidents & Events/FortiSoC > Event Monitor > Event Handler List and select Show Predefined.

Event Handler

Description

Default-Compromised Host-Detection-by IOC-By-Threat

Disabled by default

Filter 1:

  • Event Severity: Critical
  • Log Type: Traffic Log
  • Group by: dstip
  • Log messages that match all of the following conditions:
    • tdtype~infected
  • Tags: By_Endpoint, IP, C&C

Filter 2:

  • Event Severity: Critical
  • Log Type: Web Filter
  • Group by: Hostname URL
  • Log messages that match all of the following conditions:
    • tdtype~infected
  • Tags: By_Endpoint, C&C, URL

Filter 3:

  • Event Severity: Critical
  • Log Type: DNS Log
  • Group by: QNAME
  • Log messages that match all of the following conditions:
    • tdtype~infected
  • Tags: By_Endpoint, C&C, Domain

Default-Data-Leak-Detection-By-Threat

Disabled by deafult

Filter 1:

  • Event Severity: Medium
  • Log Type: DLP
  • Group by: Filter Category, Source Endpoint
  • Tags: Signature, Leak

Filter 2:

  • Event Severity: Low
  • Log Type: DLP
  • Group by: Filter Category
  • Event Status: Mitigated
  • Tags: Signature, Leak

Default-Sandbox-Detections-By-Endpoint

Disabled by default

Filter 1:

  • Event Severity: Critical
  • Log Type: AntiVirus
  • Group by: Source Endpoint, Virus Name
  • Log messages that match all of the following conditions:
    • logid==0211009235 or logid==0211009237
  • Tags: By_Endpoint, Sandbox, Signature, Malware

Filter 2:

  • Event Severity: Critical
  • Log Type: AntiVirus
  • Group by: Source Endpoint, Virus Name
  • Log messages that match all of the following conditions:
    • logid==0211009234 or logid==0211009236
  • Tags: By_Endpoint, Sandbox, Signature, Malware

Filter 3:

  • Event Severity: Critical
  • Log Type: AntiVirus
  • Group by: Source Endpoint
  • Log messages that match all of the following conditions:
    • logid==0201009238 and fsaverdict==malicious
  • Tags: By_Endpoint, Sandbox, Malware

Local Device Event

Available only in the Root ADOM.

Enabled by default

  • Devices: Local Device
  • Event Severity: Medium
  • Log Type: Event Log
  • Event Type: Any
  • Group By: Device ID
  • Log messages that match the following conditions:
    • Level Equal To Emergency
  • Tags: System, Local

Below are examples of raw logs that would trigger the associated default event handler.

Default Event Handler

Example Log

Local Device Event

id=6872390755323740160 itime=2020-09-14 10:06:03 euid=1 epid=1 dsteuid=1 dstepid=1 log_id=0034043006 subtype=logdb type=event level=warning time=10:06:03 date=2020-09-14 user=system action=delete msg=Requested to trim database tables older than 60 days to enforce the retention policy of Adom root. userfrom=system desc=Trim local db devid=FAZ-VMTM20001572 devname=FAZ-VMTM20001572 dtime=2020-09-14 10:06:03 itime_t=1600103163

Default-Compromised Host-Detection-by IOC-By-Threat

date=2020-09-20 time=07:41:20 id=6874471739997290516 itime=2020-09-20 00:41:20 euid=3 epid=1161 dsteuid=3 dstepid=101 type=utm subtype=ips level=warning sessionid=917509475 policyid=2 srcip=172.16.93.164 dstip=5.79.68.109 srcport=51392 dstport=80 proto=6 logid=0421016399 service=HTTP eventtime=1537181449 crscore=30 crlevel=high srcintfrole=lan dstintfrole=wan direction=outgoing url=/ hostname=survey-smiles.com profile=default eventtype=malicious-url srcintf=95-FortiCloud dstintf=OSPF msg=URL blocked by malicious-url-list devid=FG100D3G02000011 vd=root dtime=2020-09-20 07:41:20 itime_t=1600587680 devname=FG100D3G02000011
Default-Risky-App-Detection-By-Threat
date=2020-09-20 time=07:41:23 id=6874471752882192399 itime=2020-09-20 00:41:23 euid=3 epid=1201 dsteuid=3 dstepid=101 type=utm subtype=app-ctrl level=information action=pass sessionid=3003333495 policyid=79 srcip=172.16.80.218 dstip=122.195.166.40 srcport=38625 dstport=26881 proto=6 logid=1059028704 service=tcp/26881 eventtime=1537399002 incidentserialno=603516169 crscore=5 crlevel=low direction=outgoing apprisk=high appid=6 srcintfrole=lan dstintfrole=wan applist=scan appcat=P2P app=BitTorrent eventtype=app-ctrl-all srcintf=80-software-r dstintf=port7 msg=P2P: BitTorrent_HTTP.Track, devid=FG100D3G02000011 vd=root dtime=2020-09-20 07:41:23 itime_t=1600587683 devname=FG100D3G02000011

FortiOS system events

FortiOS predefined system event handlers are consolidated into a single event handler with multiple filters called Default FOS System Events.

Events are organized by device in the Incidents & Events dashboards, which can be expanded to view all related events.

Default FOS System Event filters apply tags to each event, allowing you to identify which Deafult FOS System Event filter triggered the event.

Tooltip

If you are upgrading from a version before FortiAnalyzer 6.2.0, the existing legacy predefined handlers which are enabled or have been modified will be available as custom handlers. In the Event Handler List, select the More dropdown and choose Show Custom.

Predefined event handlers

FortiAnalyzer includes many predefined event handlers that you can use to generate events. You can easily create a custom event handler by cloning a predefined event handler and customizing its settings. See Cloning event handlers.

Note

In 6.2.0 and up, predefined event handlers have been consolidated and have multiple filters that can be enabled or disabled individually.

The following are a small sample of FortiAnalyzer predefined event handlers. To see all predefined event handlers, go to Incidents & Events/FortiSoC > Event Monitor > Event Handler List and select Show Predefined.

Event Handler

Description

Default-Compromised Host-Detection-by IOC-By-Threat

Disabled by default

Filter 1:

  • Event Severity: Critical
  • Log Type: Traffic Log
  • Group by: dstip
  • Log messages that match all of the following conditions:
    • tdtype~infected
  • Tags: By_Endpoint, IP, C&C

Filter 2:

  • Event Severity: Critical
  • Log Type: Web Filter
  • Group by: Hostname URL
  • Log messages that match all of the following conditions:
    • tdtype~infected
  • Tags: By_Endpoint, C&C, URL

Filter 3:

  • Event Severity: Critical
  • Log Type: DNS Log
  • Group by: QNAME
  • Log messages that match all of the following conditions:
    • tdtype~infected
  • Tags: By_Endpoint, C&C, Domain

Default-Data-Leak-Detection-By-Threat

Disabled by deafult

Filter 1:

  • Event Severity: Medium
  • Log Type: DLP
  • Group by: Filter Category, Source Endpoint
  • Tags: Signature, Leak

Filter 2:

  • Event Severity: Low
  • Log Type: DLP
  • Group by: Filter Category
  • Event Status: Mitigated
  • Tags: Signature, Leak

Default-Sandbox-Detections-By-Endpoint

Disabled by default

Filter 1:

  • Event Severity: Critical
  • Log Type: AntiVirus
  • Group by: Source Endpoint, Virus Name
  • Log messages that match all of the following conditions:
    • logid==0211009235 or logid==0211009237
  • Tags: By_Endpoint, Sandbox, Signature, Malware

Filter 2:

  • Event Severity: Critical
  • Log Type: AntiVirus
  • Group by: Source Endpoint, Virus Name
  • Log messages that match all of the following conditions:
    • logid==0211009234 or logid==0211009236
  • Tags: By_Endpoint, Sandbox, Signature, Malware

Filter 3:

  • Event Severity: Critical
  • Log Type: AntiVirus
  • Group by: Source Endpoint
  • Log messages that match all of the following conditions:
    • logid==0201009238 and fsaverdict==malicious
  • Tags: By_Endpoint, Sandbox, Malware

Local Device Event

Available only in the Root ADOM.

Enabled by default

  • Devices: Local Device
  • Event Severity: Medium
  • Log Type: Event Log
  • Event Type: Any
  • Group By: Device ID
  • Log messages that match the following conditions:
    • Level Equal To Emergency
  • Tags: System, Local

Below are examples of raw logs that would trigger the associated default event handler.

Default Event Handler

Example Log

Local Device Event

id=6872390755323740160 itime=2020-09-14 10:06:03 euid=1 epid=1 dsteuid=1 dstepid=1 log_id=0034043006 subtype=logdb type=event level=warning time=10:06:03 date=2020-09-14 user=system action=delete msg=Requested to trim database tables older than 60 days to enforce the retention policy of Adom root. userfrom=system desc=Trim local db devid=FAZ-VMTM20001572 devname=FAZ-VMTM20001572 dtime=2020-09-14 10:06:03 itime_t=1600103163

Default-Compromised Host-Detection-by IOC-By-Threat

date=2020-09-20 time=07:41:20 id=6874471739997290516 itime=2020-09-20 00:41:20 euid=3 epid=1161 dsteuid=3 dstepid=101 type=utm subtype=ips level=warning sessionid=917509475 policyid=2 srcip=172.16.93.164 dstip=5.79.68.109 srcport=51392 dstport=80 proto=6 logid=0421016399 service=HTTP eventtime=1537181449 crscore=30 crlevel=high srcintfrole=lan dstintfrole=wan direction=outgoing url=/ hostname=survey-smiles.com profile=default eventtype=malicious-url srcintf=95-FortiCloud dstintf=OSPF msg=URL blocked by malicious-url-list devid=FG100D3G02000011 vd=root dtime=2020-09-20 07:41:20 itime_t=1600587680 devname=FG100D3G02000011
Default-Risky-App-Detection-By-Threat
date=2020-09-20 time=07:41:23 id=6874471752882192399 itime=2020-09-20 00:41:23 euid=3 epid=1201 dsteuid=3 dstepid=101 type=utm subtype=app-ctrl level=information action=pass sessionid=3003333495 policyid=79 srcip=172.16.80.218 dstip=122.195.166.40 srcport=38625 dstport=26881 proto=6 logid=1059028704 service=tcp/26881 eventtime=1537399002 incidentserialno=603516169 crscore=5 crlevel=low direction=outgoing apprisk=high appid=6 srcintfrole=lan dstintfrole=wan applist=scan appcat=P2P app=BitTorrent eventtype=app-ctrl-all srcintf=80-software-r dstintf=port7 msg=P2P: BitTorrent_HTTP.Track, devid=FG100D3G02000011 vd=root dtime=2020-09-20 07:41:23 itime_t=1600587683 devname=FG100D3G02000011

FortiOS system events

FortiOS predefined system event handlers are consolidated into a single event handler with multiple filters called Default FOS System Events.

Events are organized by device in the Incidents & Events dashboards, which can be expanded to view all related events.

Default FOS System Event filters apply tags to each event, allowing you to identify which Deafult FOS System Event filter triggered the event.

Tooltip

If you are upgrading from a version before FortiAnalyzer 6.2.0, the existing legacy predefined handlers which are enabled or have been modified will be available as custom handlers. In the Event Handler List, select the More dropdown and choose Show Custom.