topic Re: None Authentication in Default Authentication in Splunk Enterprise

None Authentication in Default Authentication

StehS — Tue, 07 Jul 2026 13:15:48 GMT

Hi,

have you noticed that FortiGate authentication events are tagged with "default" by the Fortinet FortiGate Add-on for Splunk, even when they represent non-default user authentications?

The Authentication data model expects the tags "authentication" and "default". According to the current tagging in the TA, all authentication-related event types receive the "default" tag:

default:

eventtype=ftnt_fortigate_auth

eventtype=ftnt_fortigate_vpn_auth

eventtype=ftnt_fortigate_wireless_client_authentication

My understanding is that the "default" tag should only be applied when the authenticating account is a built-in or default account, such as "admin", "root", or similar.

Is this the behavior you are seeing as well, or am I misunderstanding the intended CIM mapping?

Thanks.

Re: None Authentication in Default Authentication

kiran_panchavat — Thu, 09 Jul 2026 06:05:30 GMT

@StehS

Have you been noticing this behavior recently, or was it working fine before? We've seen a few issues lately with FortiAnalyzer deployments after upgrades, so I'm wondering if this started after an upgrade as well.

Re: None Authentication in Default Authentication

StehS — Fri, 10 Jul 2026 12:19:50 GMT

Yes, we are also seeing issues with the log format introduced by the latest Forti update.

However, the tagging of Forti authentication events with the tags default and authentication is not related to that change and can also be observed in older versions. This behavior appears to have been present for quite some time.