None Authentication in Default Authentication

[StehS]

Hi,

have you noticed that FortiGate authentication events are tagged with "default" by the Fortinet FortiGate Add-on for Splunk, even when they represent non-default user authentications?

The Authentication data model expects the tags "authentication" and "default". According to the current tagging in the TA, all authentication-related event types receive the "default" tag:

default:

    eventtype=ftnt_fortigate_auth

    eventtype=ftnt_fortigate_vpn_auth

    eventtype=ftnt_fortigate_wireless_client_authentication

My understanding is that the "default" tag should only be applied when the authenticating account is a built-in or default account, such as "admin", "root", or similar.

Is this the behavior you are seeing as well, or am I misunderstanding the intended CIM mapping?

Thanks.

[kiran_panchavat]

@StehS  

Have you been noticing this behavior recently, or was it working fine before? We've seen a few issues lately with FortiAnalyzer deployments after upgrades, so I'm wondering if this started after an upgrade as well.

[StehS]

Yes, we are also seeing issues with the log format introduced by the latest Forti update.

However, the tagging of Forti authentication events with the tags default and authentication is not related to that change and can also be observed in older versions. This behavior appears to have been present for quite some time.