The dsubtype field is in every FortiRecorder log message where type=detection. It indicates the subtype of detection, such as "motion alarm".
dsubtype
type=detection
"motion alarm"