Splunk Enterprise Security

Fortigate logs are not in CIM format

map000
New Member

I installed Fortinet Fortigate Add-on for Splunk 1.6.0 and Fortinet Fortigate App for Splunk 1.4.
Sourcetypes are identified correctly: fgt_traffic, fgt_utm and fgt_event but the logs are not in the CIM format: srcip, srcport, dstip, dstport.
Any recommendation?

0 Karma

cmeo
Contributor

In that case it looks like a permissions issue. If you want to use these aliases inside search, change the permissions for the aliases in local.meta so that they're exported system wide for read. And also any other objects inside the app that you might want to use from another app.

I haven't loaded this app since I don't have a fortigate, but typically an installation will set the knowledge objects to be only visible within the originating app.

Make sure, of course, that any objects you do this to, don't conflict with things exported from other apps (unlikely, as they should be tied to sourcetypes only applicable to fortigate, but worth checking nonetheless), or you won't get the results you expect. You can use btool to check the work.

0 Karma

cmeo
Contributor

Pretty sure you'll need to do this yourself then.

It boils down to studying the applicable CIM topic area, working out what tags, eventtypes and field aliases are needed for your sourcetypes, and creating them. Sounds like you won't need to do any extractions or lookups, but I'm not familiar with Fortigate devices so you'd need to check this as well.

Not terribly helpful help, but this is simply what happens sometimes.
Cheers,
Charles

0 Karma

map000
New Member

I checked field aliases and for the Fortinet Fortigate Add-on for Splunk, the aliases seems to be defined ok, e.g. fgt_event : FIELDALIAS-fgt_vpn_src_user user as src_user.

However, when using the Splunk Search app, the logs are using srcip, srcport, dstip, dstport, etc format.

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...