Splunk Enterprise Security

Splunk TA Fortinet feild alias breaks for signature field (events related to ips or virus).

asalimkumar
New Member

Splunk TA Fortinet field alias breaks for the signature field (events related to ips or virus).

We are using Spunk-TA for Fortinet. We noticed one thing, signature as a field extraction on works for either virus type or intrusion. Which means when it works for intrusion it breaks for viruses or vice versa. I have created a separate field alias in local/props.conf but the status remains the same

These are the entries in props.conf under default

[eventtype::ftnt_fgt_ips]

FIELDALIAS-fgt_ips_signature = attack as signature
FIELDALIAS-fgt_ips_category = attack as category

[eventtype::ftnt_fgt_webfilter]

FIELDALIAS-fgt_webfilter_category = catdesc as category

[eventtype::ftnt_fgt_virus]

FIELDALIAS-fgt_virus_signature = virus as signature
FIELDALIAS-fgt_virus_category = dtype as category

These are the entries in props.conf under local
[fgt_utm]
FIELDALIAS-fields01 = url AS uri_query
FIELDALIAS-ipssignature = attack AS signature
FIELDALIAS-fgt_virus_signature = virus AS signature

I am new to the Splunk overall as a SIEM. is it breaking we are creating the same field alias? How can I make it work for both ip and virus

Appreciate any insight over this

0 Karma