Fortigate logs to Elastic SIEM App about fortinet-2-elasticsearch HOT 5 CLOSED

Hi @H1L021 , thanks for the suggestion for network_traffic !!! I spent quite some time trying to figure out how to make it work on SIEM. I will add it to even.category as suggested

About geo field names, the pipeline geo_enrichment already handles it so those fields show up on SIEM UI.

    #rename iso code fields to match ECS
    mutate { 
        remove_field => ["src_ip_geo_apply", "dest_ip_geo_apply" ] 
        rename => { "[source][geo][country_code2]" => "[source][geo][country_iso_code]" }
        rename => { "[destination][geo][country_code2]" => "[destination][geo][country_iso_code]" }
        rename => { "[source][geo][region_code]" => "[source][geo][region_iso_code]" }
        rename => { "[destination][geo][region_code]" => "[destination][geo][region_iso_code]" }

from fortinet-2-elasticsearch.

Thank you, my bad didn't see it. Sorry

from fortinet-2-elasticsearch.

3af76bd

from fortinet-2-elasticsearch.

looks like network_traffic is depreciated as of 8.0.0 - see here elastic/beats#19039

perhaps the real issue is the timeline event renderer needs to be updated?

from fortinet-2-elasticsearch.

yeah. That is why I left this line commented

from fortinet-2-elasticsearch.