Splunk Enterprise Security

Splunk TA Fortinet feild alias breaks for signature field (events related to ips or virus).

asalimkumar
New Member

Splunk TA Fortinet field alias breaks for the signature field (events related to ips or virus).

We are using Spunk-TA for Fortinet. We noticed one thing, signature as a field extraction on works for either virus type or intrusion. Which means when it works for intrusion it breaks for viruses or vice versa. I have created a separate field alias in local/props.conf but the status remains the same

These are the entries in props.conf under default

[eventtype::ftnt_fgt_ips]

FIELDALIAS-fgt_ips_signature = attack as signature
FIELDALIAS-fgt_ips_category = attack as category

[eventtype::ftnt_fgt_webfilter]

FIELDALIAS-fgt_webfilter_category = catdesc as category

[eventtype::ftnt_fgt_virus]

FIELDALIAS-fgt_virus_signature = virus as signature
FIELDALIAS-fgt_virus_category = dtype as category

These are the entries in props.conf under local
[fgt_utm]
FIELDALIAS-fields01 = url AS uri_query
FIELDALIAS-ipssignature = attack AS signature
FIELDALIAS-fgt_virus_signature = virus AS signature

I am new to the Splunk overall as a SIEM. is it breaking we are creating the same field alias? How can I make it work for both ip and virus

Appreciate any insight over this

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...