Splunk Enterprise Security

Splunk TA Fortinet feild alias breaks for signature field (events related to ips or virus).

asalimkumar
New Member

Splunk TA Fortinet field alias breaks for the signature field (events related to ips or virus).

We are using Spunk-TA for Fortinet. We noticed one thing, signature as a field extraction on works for either virus type or intrusion. Which means when it works for intrusion it breaks for viruses or vice versa. I have created a separate field alias in local/props.conf but the status remains the same

These are the entries in props.conf under default

[eventtype::ftnt_fgt_ips]

FIELDALIAS-fgt_ips_signature = attack as signature
FIELDALIAS-fgt_ips_category = attack as category

[eventtype::ftnt_fgt_webfilter]

FIELDALIAS-fgt_webfilter_category = catdesc as category

[eventtype::ftnt_fgt_virus]

FIELDALIAS-fgt_virus_signature = virus as signature
FIELDALIAS-fgt_virus_category = dtype as category

These are the entries in props.conf under local
[fgt_utm]
FIELDALIAS-fields01 = url AS uri_query
FIELDALIAS-ipssignature = attack AS signature
FIELDALIAS-fgt_virus_signature = virus AS signature

I am new to the Splunk overall as a SIEM. is it breaking we are creating the same field alias? How can I make it work for both ip and virus

Appreciate any insight over this

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...