Event

date

Date

If the log server type is Syslog or CEF, the date is in UTC format.

If type is FortiAnalyzer or a local log, then it is the local date.

In both cases, the tz and tzone fields indicate the timezone of FortiSandbox.

string

time

Time

If the log server type is Syslog or CEF, the time is in UTC format.

If type is FortiAnalyzer or a local log, then it is the local time.

In both cases, the tz and tzone fields indicate the timezone of FortiSandbox.

string

tz

time zone abbreviation. e.g. PST, PDT

string

user

User Name

string

ui

User Interface

string

action

Action

string

status

Status

string

error

Error Message

string

reason

Reason

string

letype

sub of subcategory

uint8

admin

Admin User Name

string

blacklist

Blacklist Name

string

emailsndr

Email Sender

string

emailrcvr

Email Receiver

string

cloneidx

Virtual Machine Clone Index

uint32

jobcount

Job Count

uint32

device

FortiGate or other device name

string

dbid

DB Identifier

uint32

email

Email

string

etime

Finish Timestamp

uint32

rptfmt

Report Format

string

harole

HA Cluster Role Name

string

hostname

Hostname

string

index

Index

uint32

ip

IPv4 or IPv6 Address

string

jobtype

Job Type

string

snmpoid

SNMP Object ID

string

officekt

Office key type

string

os

OS Name

string

filepath

File Path

string

pid

Process ID

uint32

pidstatus

Process Status

uint32

port

Interface Port

string

quarantine

Network Share Quarantine

string

rpttype

Report Type

string

retcode

Report return code

uint32

serial

Serial Number

string

from

Access From

string

sha1

SHA1 Checksum

string

subject

Email Subject

string

sharename

Network Share Name

string

sid

Job Submission ID

string

sizebin

Size of Binary

uint32

sizeconf

Size of Configuration

uint32

snmpaction

SNMP Action

string

stime

Start Timestamp

uint64

susr

Source User Name

string

urlcat

URL Category

string

version

Version

string

vmname

Virtual Machine Name

string

vmkey

Virtual Machine Key

string

whitelist

Whitelist Name

string

cip

Source IP

string

cport

Source Port

string

sip

Destination IP

string

sport

Destination Port

string

service

Service

string

ftype

File Type

string

rsrc

Submit Source

string

fcuid

FortiClient UID

string

unauthuser

Unauthorized User

string

unauthusersource

Unauthorized User Source

string

xforwarded

X-FORWARDED-FOR

string

trueclient

True Client IP

string

session_id

Email Session ID

string

mcate

Malware category

string

pfdur

Performance Data Collecting Duration

pfendtm

Performance Data Collecting End Time

pftjob

Total Scanned Jobs

pftexe

Total EXE Jobs

pftpdf

Total PDF Jobs

pftoffice

Total Office Jobs

pftflash

Total Flash Jobs

pftweb

Total Web Jobs

pftarch

Total Compressed Jobs

pftandroid

Total Android Jobs

pftmac

Total Mac Jobs

pftlinux

Total Linux Jobs

pfturl

Total URL Jobs

pftuser

Total User defined Jobs

pfvjob

Total VM Scanned Jobs

pfvexe

VM EXE Jobs

pfvpdf

VM PDF Jobs

pfvoffice

VM Office Jobs

pfvflash

VM Flash Jobs

pfvweb

VM Web Jobs

pfvarch

VM Compressed Jobs

pfvandroid

VM Android Jobs

pfvmac

VM Mac Jobs

pfvlinux

VM Linux Jobs

pfvurl

VM URL Jobs

pfvuser

VM User defined Jobs

pfavgscantm

Average Scan Time

pfmedianscantm

Median Scan Time

pfmaxscantm

Max Scan Time

pfavgvmscantm

VM Scan Time

Pfmedianvmscantm

Median VM Scan Time

pfmaxvmscantm

Max VM Scan Time

pfavgwait

Average Wait Time

pfmedianwait

Median Wait Time

pfmaxwait

Max Wait Time

pfavgvmwait

Average VM Wait Time

pfmedianvmwait

Median VM Wait Time

pfmaxvmwait

Max VM Wait Time

pf0dayfile

0Day File

pf0dayurl

0Day URL File

pfmalfile

Malicious File

pfmalurl

Malicious URL File

pfai

AI Detected File

cpu

CPU Usage

mem

Memory Usage

disk

HDD Disk Usage

ramdisk

Ram Disk Usage

vmdisk

VM Disk Usage

snifferbw

Sniffer Port Speed

rpttype

report type

enum

rptfmt

report format

enum

etime

finish timestamp

uint32

stime

start timestamp

uint32

fname

file name

string