Splunk Enterprise Security

Splunk TA Fortinet feild alias breaks for signature field (events related to ips or virus).

asalimkumar
New Member

Splunk TA Fortinet field alias breaks for the signature field (events related to ips or virus).

We are using Spunk-TA for Fortinet. We noticed one thing, signature as a field extraction on works for either virus type or intrusion. Which means when it works for intrusion it breaks for viruses or vice versa. I have created a separate field alias in local/props.conf but the status remains the same

These are the entries in props.conf under default

[eventtype::ftnt_fgt_ips]

FIELDALIAS-fgt_ips_signature = attack as signature
FIELDALIAS-fgt_ips_category = attack as category

[eventtype::ftnt_fgt_webfilter]

FIELDALIAS-fgt_webfilter_category = catdesc as category

[eventtype::ftnt_fgt_virus]

FIELDALIAS-fgt_virus_signature = virus as signature
FIELDALIAS-fgt_virus_category = dtype as category

These are the entries in props.conf under local
[fgt_utm]
FIELDALIAS-fields01 = url AS uri_query
FIELDALIAS-ipssignature = attack AS signature
FIELDALIAS-fgt_virus_signature = virus AS signature

I am new to the Splunk overall as a SIEM. is it breaking we are creating the same field alias? How can I make it work for both ip and virus

Appreciate any insight over this

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...