Splunk TA Fortinet field alias breaks for the signature field (events related to ips or virus).
We are using Spunk-TA for Fortinet. We noticed one thing, signature as a field extraction on works for either virus type or intrusion. Which means when it works for intrusion it breaks for viruses or vice versa. I have created a separate field alias in local/props.conf but the status remains the same
These are the entries in props.conf under default
[eventtype::ftnt_fgt_ips]
FIELDALIAS-fgt_ips_signature = attack as signature
FIELDALIAS-fgt_ips_category = attack as category
[eventtype::ftnt_fgt_webfilter]
FIELDALIAS-fgt_webfilter_category = catdesc as category
[eventtype::ftnt_fgt_virus]
FIELDALIAS-fgt_virus_signature = virus as signature
FIELDALIAS-fgt_virus_category = dtype as category
These are the entries in props.conf under local
[fgt_utm]
FIELDALIAS-fields01 = url AS uri_query
FIELDALIAS-ipssignature = attack AS signature
FIELDALIAS-fgt_virus_signature = virus AS signature
I am new to the Splunk overall as a SIEM. is it breaking we are creating the same field alias? How can I make it work for both ip and virus
Appreciate any insight over this
