Extraction Functions
These functions extract values from parsed values before setting to event attributes.
extractHostFromFQDN
Description: This function extracts host name from Fully Qualified Domain name (FQDN). If FQDN contains dot character, then it returns the string before the first dot; otherwise, returns the whole string.
Syntax:
<setEventAttribute attr="Arg2">
extractHostFromFQDN ($Arg1)
</setEventAttribute>
Arg1: Variable storing Fully Qualified Domain name (FQDN).
Arg2: Variable storing the extracted host name.
Note: Variable can be a local variable or a FortiSIEM event attribute.
Example:
<setEventAttribute attr="hostName">
extractHostFromFQDN($_fqdn)
</setEventAttribute>
Input:
_fqdn = host2.example.com
Output:
hostName: host2
getEventSeverityFromSyslogPriority
Description: This function calculates integer priority from syslog priority. The last 3 bits of the priority indicate the severity: http://en.wikipedia.org/wiki/Syslog
Syntax:
<setEventAttribute attr="Arg2">
getEventSeverityFromSyslogPriority ($Arg1)
</setEventAttribute>
Arg1: Variable storing syslog priority
Arg2: Variable storing the converted integer priority
Note: Variable can be a local variable or a FortiSIEM event attribute.
Example:
<setEventAttribute attr="eventSeverity">
getEventSeverityFromSyslogPriority($_pri)
</setEventAttribute>
Input:
_pri: 52
Output:
eventSeverity: 5
DeviceToCMDBAttr
Description: This function returns the host name for an IP by looking up FortiSIEM CMDB.
Syntax:
<setEventAttribute attr="Arg2">
DeviceToCMDBAttr("cpSelectedIp"|"cpDeviceId", $Arg1, "hostName")
</setEventAttribute>
Arg1: Event Attribute containing Device IP Address or Device Natural ID.
Arg2: The event attribute to which returned CMDB hostName value is set.
Example:
<setEventAttribute attr="reptDevName">
DeviceToCMDBAttr("cpSelectedIp", $reptDevIpAddr, "hostName")
</setEventAttribute>
The function finds a CMDB device matching the IP address in reptDevIpAddr. Then the hostname value is set to reptDevName.
CMDB
|
Host Name |
IP Address |
|---|---|
| Host1 | 10.1.1.1 |
| Host2 | 10.1.1.2 |
| Host3 | 10.1.1.3 |
Input:
reptDevIpAddr = 10.1.1.2
Output
reptDevName = Host2
extractHostFromURL
Description: This function extracts hostname from a URL.
Syntax:
<setEventAttribute attr="Arg2">
extractHostFromURL ($Arg1)
</setEventAttribute>
Arg1: Variable storing the URL.
Arg2: Variable storing the extracted host name.
Note: Variable can be a local variable or a FortiSIEM event attribute.
Example:
<setEventAttribute attr="destName">
extractHostFromURL($infoURL)
</setEventAttribute>
Input:
infoURL: http://www.example.com:80/request
Output:
destName: www.example.com