action

block or monitor

string

action

action taken for the infected item

enumeration string

activity

activity

enumeration string

ae_api

API used of the violation

string

ae_reason

reason of the violation

string

app

application

string

appname

application name

string

cat

category id

int

category

category name

string

channelurl

channelurl

string

checksum

file crc32 checksum

int

checksum

file SHA256 checksum

string

date

date

string

default_used

if process is handled by default action

int

description

description

string

detectedby

the security feature that detected virus

enumeration string

detectedin

where the virus is detected

enumeration string

detectedpath

detected path(s)

string

deviceip

device IP address

string

devicemac

device MAC address

string

devid

device ID

string

domain

domain of user

string

emsserial

EMS serial number

string

error_code

reason of the failure

int

eventtype

type of event

enumeration string

failed_reason

reason of the failure

string

fctver

FCT version

string

fgtserial

FGT serial number

string

file

file location

string

filesize

file size

int

from

email from

string

hostname

host name of local machine

string

httpport

http port number

int

id

log id

int

ip

IP address

string

level

log level

enumeration string

locip

local ip

string

locport

local port

int

logver

log protocol version

int

maxduration

max-duration for secret

int

msg

description of this log

string

os

operating system

string

pamsessionid

pam session-id

int

path

path of process

string

payload_process

payload process

string

pcdomain

domain name of local machine

string

PID

ID of the malicious process

int

processname

process name

string

proxymode

proxy mode enabled

int

recording

video recording enabled

int

remip

remote ip

string

remotegw

remote gateway

string

remport

remote port

int

ruleuuid

uuid of violated rule

string

score

file score

int

service

network protocol

string

sigid

signature id

string

site

Multi-tenancy site

string

status

scan status

string

status

status

enumeration string

subtype

AntiVirus, FireWall, WebFilter ...

enumeration string

time

time

string

to

email to

string

type

Traffic, Security Event or System Event

string

uid

FortiClient unique ID

string

url

url

string

user

current logged on user

string

username

username of process

string

usingpolicy

current policy name

string

vid

virus id

int

videourl

videourl

string

virus

virus name

string

viruscat

virus category

string

vpn

vpn tunnel name

string

vpnstate

tunnel status

enumeration string

vpntunnel

tunnel name

string

vpnuser

vpn tunnel user name

string

vulncat

category

string

vulncvss

cvss score

string

vulnengine

engine version

string

vulnid

id of the vulnerability

int

vulnname

name of the vulnerability

string

vulnproducts

name of the vulnerable product

string

vulnref

reference of the vulnerability

string

vulnseverity

severity level

string

appengine

app DB engine

string

apppath

process name

string

appsig

app DB signature

string

avaleng

AV allowlist engine version

string

avalsig

AV allowlist signatures version

string

avengine

AV engine

string

avsig

AV signature

string

avsigetm

AV extreme signature

string

avsigext

AV extended signature

string

avsigheu

AV heuristic signature

string

avsiglastupdate

last update time

string

avsigpallas

AV pallas signature

string

date

date

string

deviceip

device IP address

string

devicemac

device MAC address

string

devid

device ID

string

emshostname

EMS host name

string

emsip

EMS IP

string

emsserial

EMS serial number

string

epenfeatures

enabled features list

string

epfeatures

installed features list

string

ephbemsduration

EMS heart beat duration

int

ephbemslast

EMS heart beat last time

string

epmgmtst

management status

enumeration string

eponlinest

online status

enumeration string

epplace

EP place

enumeration string

epquarmsg

quarant message

string

eventtype

type of event

enumeration string

fctip

FCT IP

string

fctver

FCT version

string

fgtserial

FGT serial number

string

file

file or registry path

string

hostname

host name of local machine

string

id

log id

int

ipseng

firewall engine

string

ipssig

firewall signature

string

irdbsig

irdb signature

string

level

log level

enumeration string

logver

log protocol version

int

msg

description of this log

string

os

operating system

string

pcdomain

domain name of local machine

string

policyname

policy name

string

processname

blocked process

string

site

Multi-tenancy site

string

social_email

social email

string

social_phone

social phone number

string

social_srvc

social service

string

social_user

social user name

string

status

status description

string

subtype

AntiVirus, FireWall, WebFilter ...

enumeration string

time

time

string

type

Traffic, Security Event or System Event

string

uid

FortiClient unique ID

string

user

current logged on user

string

usingpolicy

current policy name

string

vulnengine

vulnerability engine

string

browsetime

user browsing time of web page(in seconds)

int

date

date

string

deviceip

device IP address

string

devicemac

device MAC address

string

devid

device ID

string

direction

traffic direction

string

dstip

destination IP

string

dstport

destination port

int

emsserial

EMS serial number

string

eventtype

type of event

enumeration string

fctver

FCT version

string

fgtserial

FGT serial number

string

hostname

host name of local machine

string

id

log id

int

level

log level

enumeration string

logver

log protocol version

int

msg

description of this log

string

os

operating system

string

pcdomain

domain name of local machine

string

proto

network protocol

int

rcvdbyte

data received (in bytes)

int

regip

regip

string

remotename

remote name

string

sentbyte

data sent (in bytes)

int

service

network protocol

string

sessionid

network session

string

site

Multi-tenancy site

string

srcip

source IP

string

srcname

source name

string

srcport

source port

int

srcproduct

source product

string

subtype

AntiVirus, FireWall, WebFilter ...

enumeration string

threat

threat

string

time

time

string

type

Traffic, Security Event or System Event

string

uid

FortiClient unique ID

string

url

url

string

user

current logged on user

string

userinitiated

if user initiated url request

int

usingpolicy

current policy name

string

utmaction

utm action

string