Conversion Functions
These functions convert formats before setting to the event attributes.
The following are deprecated
calculateMSec
Description: This function converts a time duration in HH:MM:SS format to milliseconds.
Syntax:
<setEventAttribute attr="durationMSec">
calculateMSec($_duration)
</setEventAttribute>
Arg1: Variable storing the time duration (HH:MM:SS format) to be converted to milliseconds.
Arg2: Variable storing the time duration in milliseconds (integer).
Note: Variable can be a local variable or a FortiSIEM event attribute.
Example:
<setEventAttribute attr="durationMSec">
calculateMSec($_duration)
</setEventAttribute>
Suppose _duration is parsed as 00:01:05
After execution:
durationMSec: 65000
calculateSec
Description: This function converts a time duration in HH:MM:SS format to seconds.
Syntax:
<setEventAttribute attr="Arg2">
calculateMSec(Arg1)
</setEventAttribute>
Arg1: Variable storing the time duration (HH:MM:SS format) to be converted to seconds.
Arg2: Variable storing the time duration in seconds (integer).
Note: Variable can be a local variable or a FortiSIEM event attribute.
Example:
<setEventAttribute attr="vulnScanDuration">
calculateSec($_duration)
</setEventAttribute>
Suppose _duration is parsed as 00:01:05.
After execution:
vulnScanDuration: 65
convertHexStrToInt
Description: This function converts a hex number to integer.
Syntax:
<setEventAttribute attr="Arg2">
convertHexStrToInt(Arg1)
</setEventAttribute>
Arg1: Variable storing the value in hex format to be converted to integer.
Arg2: Variable storing the converted integer value.
Note: Variable can be a local variable or a FortiSIEM event attribute.
Example:
<setEventAttribute attr="ipConnId">
convertHexStrToInt($_ipConnId)
</setEventAttribute>
Input:
_ipConnId: 0xA
Output:
ipConnId =10
convertIpDecimalToStr
Description: This function converts decimal IP address to string.
Syntax:
<setEventAttribute attr="Arg2">
convertIpDecimalToStr(Arg1)
</setEventAttribute>
Arg1: Variable storing the IPV4 value as integer.
Arg2: Variable storing the converted IPV4 value in string format.
Note: Variable can be a local variable or a FortiSIEM event attribute.
Example:
<setEventAttribute attr="srcIpAddr">
convertIpDecimalToStr($_srcIpAddr)
</setEventAttribute>
Input:
_srcIpAddr = 16843009
Output:
srcIpAddr = 1.1.1.1
convertStrToIntIpPort
Description:This function converts TCP/UDP Port name to port number, e.g. HTTP -> 80.
Syntax:
<setEventAttribute attr="Arg2">
convertStrToIntIpPort($Arg1)
</setEventAttribute>
Arg1: Variable storing the TCP/UDP Port name in string format.
Arg2: Variable storing the converted TCP/UDP Port name in integer format.
Note: Variable can be a local variable or a FortiSIEM event attribute.
Example:
<setEventAttribute attr="destIpPort">
convertStrToIntIpPort($appTransportProto)
</setEventAttribute>
Input:
appTransportProto = "http"
Output:
destIpPort = 80
convertStrToIntIpProto
Description:This function converts an IP protocol name (e.g. TCP, UDP, ICMP, etc.) to integer form.
Syntax:
<setEventAttribute attr="Arg2">
convertStrToIntIpProto (Arg1)
</setEventAttribute>
Arg1: Variable storing the IP protocol name in string format.
Arg2: Variable storing the converted IP protocol name in integer format.
Note: Variable can be a local variable or a FortiSIEM event attribute.
Example:
<setEventAttribute attr="ipProto">
convertStrToIntIpProto($_proto)
</setEventAttribute>
Input:
_proto = "TCP"
Output:
ipProto = 6
toLower
Description: This function converts string to lower case.
Syntax:
<setEventAttribute attr="Arg2">
toLower ($Arg1)
</setEventAttribute>
Arg1: Variable storing the string to be converted to lower case.
Arg2: Variable storing the converted string in lower case.
Note: Variable can be a local variable or a FortiSIEM event attribute.
Example:
<setEventAttribute attr="filePath">
toLower($filePath)
</setEventAttribute>
Input:
filePath = "C:\WINDOWS"
Output:
filePath = "c:\windows"
toUpper
Description: This function converts string to upper case.
Syntax:
<setEventAttribute attr="Arg2">
toUpper ($Arg1)
</setEventAttribute>
Arg1: Variable storing the string to be converted to upper case.
Arg2: Variable storing the converted string in upper case.
Note: Variable can be a local variable or a FortiSIEM event attribute.
Example:
<setEventAttribute attr="filePath">
toUpper($filePath)
</setEventAttribute>
Input:
filePath = "C:\Windows"
Output:
filePath = "C:\WINDOWS"
toDateTime
Description: This function converts string formatted timestamp to Unix epoch time.
Syntax:
<setEventAttribute attr="Arg6">
toDateTime($Arg1, $Arg2, [$Arg3], $Arg4, [$Arg5])
</setEventAttribute>
Arg1: Variable storing the month: Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec or 1/2/3…/12.
Arg2: Variable storing the day: 01-31.
Arg3: Optional – Variable storing the year in YY or YYYY format.
Arg4: Variable storing the time in HH:MM:SS format.
Arg5: Optional - Variable storing the time zone in Z; UTC; GMT; -0700; +05:30; or AM / PM. Regex pattern is Z|UTC|GMT|[+-]\d{1,2}:?\d{2}|AM|PM. If AM or PM is passed directly, then $ is not required.
Arg6: Variable storing converted Unix epoch time.
Note: Variable can be a local variable or a FortiSIEM event attribute.
Example:
Three argument format – Month, Day, Time
<setEventAttribute attr="deviceTime">
toDateTime($_mon, $_day, $_time)
</setEventAttribute>
Input:
_mon: 06
_day: 20
_time: 06:04:00
Output (server local timezone assumed e.g CST time):
deviceTime: 1750460640
Four argument format – Month, Day, Year, Time
<setEventAttribute attr="deviceTime">
toDateTime($_mon, $_day, $_year, $_time)
</setEventAttribute>
Input:
_mon: 06
_day: 20
_year: 2025
_time: 06:04:00
Output (server local timezone assumed e.g CST time):
deviceTime: 1750460640
Five argument format - Month, Day, Year, Time, Timezone
<setEventAttribute attr="deviceTime">
toDateTime($_mon, $_day, $_year, $_time,$_timezone)
</setEventAttribute>
Input:
_mon: 06
_day: 20
_year: 2025
_time: 06:04:00
_timezone: −06:00
Output:
deviceTime: 1750460640
Five argument format - Month, Day, Year, Time, AM/PM
<setEventAttribute attr="deviceTime">
toDateTime($_mon, $_day, $_year, $_time, "PM")
</setEventAttribute>
Input:
_mon: 06
_day: 20
_year: 2025
_time: 06:04:00
Output:
deviceTime: 1750460640
toUnixTime
Description: This function is designed to convert LDAP / Active Directory (GeneralizedTime) format to Unix epoch.
The time format is YYYYMMDDHHMMSS.ffffff[+-]ZZZ e.g. 20100505222910.822003-000. Human readable representation of this timestamp is: 2010-05-05 22:29:10Z (UTC time)
Syntax:
<setEventAttribute attr="Arg2">
toUnixTime ($Arg1)
</setEventAttribute>
Arg1: Variable storing time in GeneralizedTime format: YYYYMMDDHHMMSS.ffffff[+-]ZZZ
Arg2: Variable storing converted Unix epoch time
Note: Variable can be a local variable or a FortiSIEM event attribute.
Example:
<setEventAttribute attr="deviceTime">
toUnixTime($_deviceTime)
</setEventAttribute>
Input:
deviceTime: 20100505222910.822003-000
Output:
deviceTime: 1273098550
convertHexStrToStr (Deprecated)
Description: This function is deprecated.
convertHostNameToIp (Deprecated)
Description: This function is deprecated. Use this function instead: resolveDNSName.