FortiGate UTM security events

Source and collection

Device logging subsystem / configured remote syslog or vendor export.

Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 1

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: d2181011da9ff4180364b529c7c6ba27122f80697368640e6c9effd8ae595e25

<190>date=2024-08-28 time=10:33:52 devname="MYFWNAME" devid="FG3000000" eventtime=1724834031664506909 tz="+0200" logid="1700062307" type="utm" subtype="ssl" eventtype="ssl-anomaly" level="information" vd="MYVDOM" action="info" policyid=15 poluuid="9f03da94-18e1-51ed-3097-84c637b243d4" policytype="policy" sessionid=2181010122 service="SSL" user="usr.1@mydom.tld" group="Some_group" profile="ssh_inspect" srcip=10.2.3.4 srcport=59968 srccountry="Reserved" dstip=10.3.2.1 dstport=8443 dstcountry="Some_land" srcintf="ssl.MYVDOM" srcintfrole="undefined" dstintf="OUT_111" dstintfrole="lan" srcuuid="59eb7b0a-278d-51ed-eda0-acf3cdfa314d" dstuuid="e032441e-278d-51ed-cd25-0c124f2c9428" proto=6 tlsver="tls1.2" eventsubtype="certificate-anomaly" msg="SNI and certificate info is mismatched"

Structure and field interpretation

Envelope

Priority, timestamp and hostname depend on the transport format.

Message payload

Use the exact vendor message type and version, not a generic whitespace split.

Investigation uses

• Review subtype, action, policy and connection context alongside traffic logs.
• Compare device event time and collector time; monitor drops and preserve the original message.

Validation boundaries

This fixture represents the upstream 7.2 test layout; different UTM subtypes have different fields.

This text sample passed byte-integrity and record-framing checks. Its field interpretation follows the cited format; a vendor-specific semantic parser has not been certified.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Related sources

• Windows Security 5156 — Filtering Platform connection permitted
• Palo Alto PAN-OS traffic
• Palo Alto PAN-OS threat
• Palo Alto PAN-OS configuration
• Cisco ASA TCP connection creation
• Cisco ASA TCP teardown

Ecosystem connections

• Telemetry Library — ATT&CK data components
• Detection Rules — candidate detection content
• Threat hunting — from intelligence to validated defense
• Practical security learning paths
• AdversaryGraph — evidence-led investigation

References

• Log message fields | FortiGate / FortiOS 7.0.5 | Fortinet Document Library

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.