---
title: "firewall.fortinet"
canonical: "https://docs.devo.com/space/latest/94663604/firewall.fortinet"
format: markdown
---
> Macro (toc)

## Purpose

Use tags in this category to identify events generated by Fortinet [FortiGate](https://www.fortinet.com/products/next-generation-firewall) Next-Generation Firewall, [Unified Threat Management](https://www.fortinet.com/resources/cyberglossary/unified-threat-management) (UTM), [FortiAnalyzer](https://www.fortinet.com/products/management/fortianalyzer), Fortinet [Secure Access Service Edge](https://www.fortinet.com/products/sase) (SASE), and [FortiEDR](https://www.fortinet.com/products/endpoint-security/fortiedr).

For Fortinet logs in CEF format, use [cef0.fortinet](https://devodocs.atlassian.net/wiki/spaces/latest/pages/413630529).  For Fortinet [email security](https://www.fortinet.com/products/email-security), use [mail.fortinet](https://devodocs.atlassian.net/wiki/spaces/latest/pages/356679723).  For Fortinet [identity management](https://www.fortinet.com/solutions/enterprise-midsize-business/identity-access-management), use [iam.fortinet](https://devodocs.atlassian.net/wiki/spaces/latest/pages/370475009).

## Send it

Data should be sent using the [Devo Relay](https://devodocs.atlassian.net/wiki/spaces/latest/pages/96468993).

### Log formats

[Fortinet logs](https://docs.fortinet.com/document/fortigate/7.6.3/fortios-log-message-reference/670197/log-types-and-subtypes) may be in *comma separated value* format or *space separated value* format.  Both formats are widely used.  Generally, Devo uses *comma separated value* by default.  To parse your logs with the *space separated value* option, add `.noncsv` to the *target tag* using the relay rule.

### Example [relay rules](https://devodocs.atlassian.net/wiki/spaces/latest/pages/96469377)

For

- FortiAnalyzer, create a [syslog server](https://docs.fortinet.com/document/fortianalyzer/7.6.2/administration-guide/374190) using the relay IP and a free port.
- FortiSASE
- Fortinet versions > 5.6 with legacy-reliable mode.

```
         Source message: 
            Source data: type=\"{0,1}([^\s^\"]+)\"{0,1}\ssubtype=\"{0,1}([^\s^\"]+)\"{0,1}
             Source tag: 
             Target tag: firewall.fortinet.\\D1.\\D2.noncsv
Sent without syslog tag: true
        Stop processing: true
```

This example is for *space separated value* format.


Using the **FortiGate** GUI, go to Log & Report →[ Log Settings](https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/250999/log-settings-and-targets) and select Remote Logging and Archiving to configure the Devo relay as a remote syslog server.  Then run these FortiGate CLI commands.

```
config log syslogd setting
set status enable
set csv enable
set legacy-reliable
set facility local7
set server <relay_ip>
set port <relay_port>
end
```

If the FortiGate version is lower or equal to 5.6, enable mode *udp* instead of *legacy-reliable*.

For [FortiGate logs](https://docs.fortinet.com/document/fortigate/7.6.3/fortios-log-message-reference/670197/log-types-and-subtypes) containing quotes, an example rule is

```
         Source message: 
            Source data: ,type=\"([^,]+)\",subtype=\"([^,]+)\"(,|$)
             Source tag: 
             Target tag: firewall.fortinet.\\D1.\\D2
Sent without syslog tag: true
        Stop processing: true
```

For FortiGate logs not containing quotes

```
         Source message: 
            Source data: ,type=([^,]+),subtype=([^,]+)(,|$)
             Source tag: 
             Target tag: firewall.fortinet.\\D1.\\D2
Sent without syslog tag: true
        Stop processing: true
```


For **FortiEDR**

```
         Source message: 
            Source data: 
             Source tag: 
             Target tag: firewall.fortinet.fortiedr.endpoint
Sent without syslog tag: true
        Stop processing: true
```

## Secure it

Use the security resources for [firewall.all.traffic](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126157/firewall.all.traffic#Secure-it) with Fortinet.

Secure firewall.fortinet.event.dns using resources for [domains.all](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126139).

Secure authentication into Fortinet devices using resources for [auth.all](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126107/auth.all#Secure-it).

Devo [Exchange](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95212575) has Fortinet-specific alerts:

- SecOpsFortinetHighRiskAppUse
- SecOpsFortinetCriticalAppUse

### VPN

Many organizations require users to enable VPN when working.  To determine which users need help enabling the VPN, create a list of users who have already successfully connected.

```
from firewall.fortinet.event.endpoint 
where eq(logdesc,"FortiClient VPN connected") group by user
```

### Risk Levels

Use the risk levels computed by Zscaler to identify problematic devices by creating a [gradient alert](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126955).

```
from firewall.fortinet.event.securityRating 
group every 1d by auditreporttype,devName 
select max(criticalcount) as critical
```

### Malicious wireless access points

An analyst wants to be notified of unauthorized wireless access points so they can be removed from the organization’s campus.  Removing rogue access points can prevent users from accidentally connecting to a malicious network.

```
from firewall.fortinet.event.wireless 
where toktains(action,"rogue-ap") or toktains(action,"fake-ap"), not has(action,"-off") 
group by devName, devID, action, 
split(split(rawMessage,"ssid=\"",1),"\"",0) as ssid,
split(split(rawMessage,"manuf=\"",1),"\"",0) as manufacturer
select
max(int(split(split(rawMessage,"signal=",1)," ",0))) as signal
```

### Voice over IP data exfiltration

A user is suspected of placing calls to conduct insider trading.  Identify who is being called from their SIP address.

```
from firewall.fortinet.utm.voip
where eq(kind,"call"), eq(status,"end")
group by `from`, to
```

### Eavesdropping

Security noticed a SIP phone was being used to listen to board meetings.  The attacker had started the call in the morning and left it running during confidential discussions in the afternoon.  Identify other SIP phones in conference rooms that have placed unusually long calls, which might indicate attempts to access private managerial discussions.  Use this information to determine if access to SIP phones needs to be restricted.

```
from firewall.fortinet.utm.voip
where eq(kind,"call"), eq(status,"end"),
int(duration)>(4*60)//calls over four hours
group by `from` select count() as long_calls, max(int(duration)) as longest_call
```

### Robocalling

Compromised SIP phones may be used to illegally place marketing robocalls.  Find SIP phones that are placing calls to a high number of recipients so they can be isolated from the network.

```
from firewall.fortinet.utm.voip
where eq(kind,"call")
group by `from`
select length(collectdistinct(to)) as recipients
where recipients>100
```

## Tags and tables

| **[Tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204)** | **[Tables](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94764298)** |
| --- | --- |
|  | firewall.fortinet |
| <span style="color: #0747a6">firewall.fortinet.anomaly.anomaly</span> | <span style="color: #0747a6">firewall.fortinet.anomaly.anomaly</span> |
| <span style="color: #0747a6">firewall.fortinet.anomaly.anomaly.noncsv</span> |  |
|  | firewall.fortinet.event |
| firewall.fortinet.event.admin | firewall.fortinet.event.admin |
| firewall.fortinet.event.admin.noncsv |  |
| firewall.fortinet.event.config | firewall.fortinet.event.config |
| firewall.fortinet.event.config.noncsv |  |
| firewall.fortinet.event.connector | firewall.fortinet.event.connector |
| firewall.fortinet.event.connector.noncsv |  |
| firewall.fortinet.event.wireless | firewall.fortinet.event.wireless |
| firewall.fortinet.event.wireless.noncsv |  |
| firewall.fortinet.event.dhcp | firewall.fortinet.event.dhcp |
| firewall.fortinet.event.dhcp.noncsv |  |
| firewall.fortinet.event.dns | firewall.fortinet.event.dns |
| firewall.fortinet.event.dns.noncsv |  |
| firewall.fortinet.event.endpoint | firewall.fortinet.event.endpoint |
| firewall.fortinet.event.endpoint.noncsv |  |
| firewall.fortinet.event.fgd | firewall.fortinet.event.fgd |
| firewall.fortinet.event.fgd.noncsv |  |
| firewall.fortinet.event.ha | firewall.fortinet.event.ha |
| firewall.fortinet.event.ha.noncsv |  |
| firewall.fortinet.event.his-performance | firewall.fortinet.event.hisPerformance |
| firewall.fortinet.event.his-performance.noncsv |  |
| firewall.fortinet.event.ipsec | firewall.fortinet.event.ipsec |
| firewall.fortinet.event.ipsec.noncsv |  |
| firewall.fortinet.event.pattern | firewall.fortinet.event.pattern |
| firewall.fortinet.event.pattern.noncsv |  |
| firewall.fortinet.event.perf-historical | firewall.fortinet.event.perfHistorical |
| firewall.fortinet.event.perf-historical.noncsv |  |
| firewall.fortinet.event.router | firewall.fortinet.event.router |
| firewall.fortinet.event.router.noncsv |  |
| firewall.fortinet.event.sdwan | firewall.fortinet.event.sdwan |
| firewall.fortinet.event.sdwan.noncsv |  |
| firewall.fortinet.event.security-rating | firewall.fortinet.event.securityRating |
| firewall.fortinet.event.security-rating.noncsv |  |
| firewall.fortinet.event.sslvpn-session | firewall.fortinet.event.sslvpnSession |
| firewall.fortinet.event.sslvpn-session.noncsv |  |
| firewall.fortinet.event.sslvpn-user | firewall.fortinet.event.sslvpnUser |
| firewall.fortinet.event.sslvpn-user.noncsv |  |
| firewall.fortinet.event.switch-controller | firewall.fortinet.event.switchController |
| firewall.fortinet.event.switch-controller.noncsv |  |
| firewall.fortinet.event.system | firewall.fortinet.event.system |
| firewall.fortinet.event.system.noncsv |  |
| firewall.fortinet.event.user | firewall.fortinet.event.user |
| firewall.fortinet.event.user.noncsv |  |
| firewall.fortinet.event.system | firewall.fortinet.event.system |
| firewall.fortinet.event.system.noncsv |  |
| firewall.fortinet.event.vpn | firewall.fortinet.event.vpn |
| firewall.fortinet.event.vpn.noncsv |  |
| firewall.fortinet.event.wad | firewall.fortinet.event.wad |
| firewall.fortinet.event.wad.noncsv |  |
| <span style="color: #0747a6">firewall.fortinet.fortianalyzer.analyzer</span> | <span style="color: #0747a6">firewall.fortinet.fortianalyzer.analyzer</span> |
| firewall.fortinet.fortiedr.endpoint | firewall.fortinet.fortiedr.endpoint |
| <span style="color: #0747a6">firewall.fortinet.ips.anomaly</span> | <span style="color: #0747a6">firewall.fortinet.ips.anomaly</span> |
| <span style="color: #0747a6">firewall.fortinet.ips.anomaly.noncsv</span> |  |
|  | firewall.fortinet.securityevent |
| firewall.fortinet.securityevent.antiexploit | firewall.fortinet.securityevent.antiexploit |
| firewall.fortinet.securityevent.antiexploit.noncsv |  |
| firewall.fortinet.securityevent.av | firewall.fortinet.securityevent.av |
| firewall.fortinet.securityevent.av.noncsv |  |
| firewall.fortinet.securityevent.removablemediaaccess | firewall.fortinet.securityevent.removablemediaaccess |
| firewall.fortinet.securityevent.removablemediaaccess.noncsv |  |
| firewall.fortinet.securityevent.sandboxing | firewall.fortinet.securityevent.sandboxing |
| firewall.fortinet.securityevent.sandboxing.noncsv |  |
| firewall.fortinet.securityevent.sslvpn | firewall.fortinet.securityevent.sslvpn |
| firewall.fortinet.securityevent.sslvpn.noncsv |  |
| firewall.fortinet.securityevent.vulnerabilityscan | firewall.fortinet.securityevent.vulnerabilityscan |
| firewall.fortinet.securityevent.vulnerabilityscan.noncsv |  |
| firewall.fortinet.securityevent.webfilter | firewall.fortinet.securityevent.webfilter |
| firewall.fortinet.securityevent.webfilter.noncsv |  |
|  | <span style="color: #0747a6">firewall.fortinet.systemevent</span> |
| <span style="color: #0747a6">firewall.fortinet.systemevent.endpoint</span> | <span style="color: #0747a6">firewall.fortinet.systemevent.endpoint</span> |
| <span style="color: #0747a6">firewall.fortinet.systemevent.endpoint.noncsv</span> |  |
| <span style="color: #0747a6">firewall.fortinet.systemevent.system</span> | <span style="color: #0747a6">firewall.fortinet.systemevent.system</span> |
| <span style="color: #0747a6">firewall.fortinet.systemevent.system.noncsv</span> |  |
| <span style="color: #0747a6">firewall.fortinet.systemevent.update</span> | <span style="color: #0747a6">firewall.fortinet.systemevent.update</span> |
| <span style="color: #0747a6">firewall.fortinet.systemevent.update.noncsv</span> |  |
|  | firewall.fortinet.traffic |
| firewall.fortinet.traffic.allowed | firewall.fortinet.traffic |
| firewall.fortinet.traffic.allowed.noncsv |  |
| firewall.fortinet.traffic.forward | firewall.fortinet.traffic |
| firewall.fortinet.traffic.forward.noncsv |  |
| firewall.fortinet.traffic.local | firewall.fortinet.traffic.local |
| firewall.fortinet.traffic.local.noncsv |  |
| firewall.fortinet.traffic.slb_http | firewall.fortinet.traffic.slb_http |
| firewall.fortinet.traffic.slb_http.noncsv |  |
|  | <span style="color: #0747a6">firewall.fortinet.utm</span> |
| <span style="color: #0747a6">firewall.fortinet.utm.anomaly</span> | <span style="color: #0747a6">firewall.fortinet.utm.anomaly</span> |
| <span style="color: #0747a6">firewall.fortinet.utm.anomaly.noncsv</span> |  |
| <span style="color: #0747a6">firewall.fortinet.utm.app-ctrl</span> | <span style="color: #0747a6">firewall.fortinet.utm.appCtrl</span> |
| <span style="color: #0747a6">firewall.fortinet.utm.app-ctrl.noncsv</span> |  |
| <span style="color: #0747a6">firewall.fortinet.utm.dns</span> | <span style="color: #0747a6">firewall.fortinet.utm.dns</span> |
| <span style="color: #0747a6">firewall.fortinet.utm.dns.noncsv</span> |  |
| <span style="color: #0747a6">firewall.fortinet.utm.emailfilter</span> | <span style="color: #0747a6">firewall.fortinet.utm.emailfilter</span> |
| <span style="color: #0747a6">firewall.fortinet.utm.emailfilter.noncsv</span> |  |
| <span style="color: #0747a6">firewall.fortinet.utm.ips</span> | <span style="color: #0747a6">firewall.fortinet.utm.ips</span> |
| <span style="color: #0747a6">firewall.fortinet.utm.ips.noncsv</span> |  |
| <span style="color: #0747a6">firewall.fortinet.utm.ssh</span> | <span style="color: #0747a6">firewall.fortinet.utm.ssh</span> |
| <span style="color: #0747a6">firewall.fortinet.utm.ssh.noncsv</span> |  |
| <span style="color: #0747a6">firewall.fortinet.utm.ssl</span> | <span style="color: #0747a6">firewall.fortinet.utm.ssl</span> |
| <span style="color: #0747a6">firewall.fortinet.utm.ssl.noncsv</span> |  |
| <span style="color: #0747a6">firewall.fortinet.utm.virus</span> | <span style="color: #0747a6">firewall.fortinet.utm.virus</span> |
| <span style="color: #0747a6">firewall.fortinet.utm.virus.noncsv</span> |  |
| <span style="color: #0747a6">firewall.fortinet.utm.voip</span> | <span style="color: #0747a6">firewall.fortinet.utm.voip</span> |
| <span style="color: #0747a6">firewall.fortinet.utm.voip.noncsv</span> |  |
| <span style="color: #0747a6">firewall.fortinet.utm.waf</span> | <span style="color: #0747a6">firewall.fortinet.utm.waf</span> |
| <span style="color: #0747a6">firewall.fortinet.utm.waf.noncsv</span> |  |
| <span style="color: #0747a6">firewall.fortinet.utm.webfilter</span> | <span style="color: #0747a6">firewall.fortinet.utm.webfilter</span> |
| <span style="color: #0747a6">firewall.fortinet.utm.webfilter.noncsv</span> |  |
|  | firewall.fortinet.voip |
| firewall.fortinet.voip.voip | firewall.fortinet.voip.voip |
| firewall.fortinet.voip.voip.noncsv |  |