Category Archives: FortiSIEM

FortiSIEM Network Flow Monitoring Events

Leave a reply
Network Flow Monitoring Events

Network Flow Events

These events are generated from Cisco Netflow and SFlow.

Event Type: IOS-NETFLOW-BI (BI standing for bidirecational: two unidirectional netflow messages are combined into one), SFLOW-BI

Description: Event containing netflow data Source: Cisco IOS (Netflow) Key Attributes:

Name Id Type Description
Event Type eventType string Event type set to IOS-NETFLOW-BI, SFLOW-BI
Event Severity eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event Severity

Category

 eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event Receive

Time

 phRecvTime Date Time at which AccelOps generated this event (after receiving netflow)
Reporting IP reptDevIpAddr Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Source IP srcIpAddr IP Source IP address of the flow
Dest IP destIpAddr IP Destination IP address of the flow
IP Protocol ipProto uint16 IP protocol e.g. TCP/UDP/GRE/ICMP etc
Source TCP/UDP

Port

 srcIpPort uint16 Source TCP/UDP port
Dest TCP/UDP

Port

 destIpPort uint16 Destination TCP/UDP port
ICMP Type icmpType uint16 ICMP type
ICMP Code icmpCode uint16 ICMP code
IP Type of Service tos uchar IP Type of Service
Sent TCP flags srcDestTCPFlags uchar OR-ed TCP Flags from Source to Destination
Received TCP

flags

 destSrcTCPFlags uchar OR-ed TCP Flags from Destination to Source
Source Intf SNMP

Index

 srcSnmpIntfIndex uint16 Source SNMP interface index
Source Interface

Name

 srcIntfName string Source Interface name
Dest Intf SNMP

Index

 destSnmpIntfIndex uint16 Destination SNMP interface index
Destination

Interface Name

 destIntfName string Destination Interface name
Source

Autonomous

System Number

 srcASNum uint16 Source Autonomous number
Dest Autonomous

System Number

 destASNum uint16 Destination Autonomous number
Sent Bytes sentBytes uint32 Sent Bytes in this flow
Sent Packets sentPkts uint32 Sent Packets in this flow
Received Bytes recvBytes uint32 Received Bytes in this flow
Received Packets recvPkts uint32 received Packets in this flow

FortiSIEM Application Monitoring Events

Leave a reply
Application Monitoring Events

Application Monitoring Events

AccelOps generates the following events related to application monitoring

Process Resource Utilization

Apache Performance Metrics

Microsoft ASP.NET Metrics

Exchange RPC Metrics

Exchange RPC Error Metrics

Exchange Mailbox Metrics

Exchange SMTP Metrics

Microsoft DNS Performance Metrics

Microsoft DHCP Performance Metrics

Microsoft Active Directory Performance Metrics

IP SLA VoIP Metrics

IP SLA HTTP metrics

IP SLA ICMP metrics

Generic IPSLA metrics

Tomcat Application Server Monitoring Metrics

Glassfish Application Server Monitoring Metrics

Weblogic Application Server Monitoring Metrics

Websphere Application Server Monitoring Metrics

JBOSS Application Server Monitoring Metrics

Process Resource Utilization

Pages: 1 2 3 4 5 6 7 8 9 10

FortiSIEM VM Network IO Monitoring

Leave a reply

VM Network IO Monitoring

Event Type: PH_DEV_MON_VM_STATE

Description: Event containing VM CPU metrics Source: All

Key Attributes:

Name Id Type Description
Event Type eventType string Event type set to PH_DEV_MON_SYS_PING_STAT
Event

Severity

 eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event

Severity

Category

 eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event

Receive

Time

 phRecvTime Date Time at which AccelOps generated this event
Reporting IP reptDevIpAddr Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as

Host name attribute)
Relaying IP relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event

Log

 rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
vmName
Host name hostName string Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP

Address

 hostIpAddr IP Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
phyMachName string
phyMachIpAddr IP
vSwitch string
intfName string
sentPkts uint32 Sent Packets
recvPkts uint32 Received Packets
sentBytes uint32 Sent Bytes
recvBytes uint32 Received Bytes
Poll Interval pollIntv uint32 Polling interval in seconds

Sample event:

<134>Feb 08 18:22:16 10.1.2.11 java:

[PH_DEV_MON_VM_NET_INTF_UTIL]:[eventSeverity]=PHL_INFO,[phyMachName

]=HOST-10.1.2.51,

[phyMachIpAddr]=10.1.2.51, [pollIntv]=180, [vmName]=CO159,

[morId]=vm-194, [hostName]=CO159, [hostIpAddr]=10.1.2.159,

[vSwitch]=vSwitch0, [intfName]=Network adapter 1, [sentPkts]=454,

[recvPkts]=939, [sentBytes]=102400, [recvBytes]=307200

VM Cluster CPU Utilization

VM Cluster Memory Utilization

VM Cluster Datastore I/O Utilization

VM Resource pool CPU Utilization

 

VM Resource pool Memory Utilization

ESX State Monitoring

ESX Datastore Utilization Monitoring

ESX Disk I/O Monitoring

<134>Oct 02 12:00:42 192.168.1.3 java:

[PH_DEV_MON_ESX_DISK_IO]:[eventSeverity]=PHL_INFO,

[hostName]=ESX3i-QA-01.prospecthills.net, [hostIpAddr]=192.168.1.3,

[pollIntv]=180, [morId]=ha-host, [diskName]=mpx.vmhba32:C0:T0:L0,

[diskReadKBytesPerSec]=9.9, [diskWriteKBytesPerSec]=0.3,

[diskReadReqPerSec]=1.215, [diskWriteReqPerSec]=0.045,

[devDiskRdLatency]=0.1, [devDiskWrLatency]=0.4, [kernDiskRdLatency]=0.0,

[totDiskRdLatency]=0.1, [totDiskWrLatency]=0.4, [kernDiskWrLatency]=0.0

ESX Datastore I/O Monitoring

FortiSIEM VM Datastore I/O Monitoring

Leave a reply

VM Datastore I/O Monitoring

Event Type: PH_DEV_MON_VM_STATE

Description: Event containing VM CPU metrics Source: All

Key Attributes:

Name Id Type Description
Event Type eventType string Event type set to PH_DEV_MON_SYS_PING_STAT
Event

Severity

 eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event

Severity

Category

 eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event

Receive

Time

 phRecvTime Date Time at which AccelOps generated this event
Reporting

IP

 reptDevIpAddr Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event

Log

 rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
vmName
Host name hostName string Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP

Address

 hostIpAddr IP Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
phyMachName string
phyMachIpAddr IP
datastore string
diskReadReqPerSec double
diskWriteReqPerSec double
diskReadKBytesPerSec double
diskWriteKBytesPerSec double
Poll Interval pollIntv uint32 Polling interval in seconds

Sample event:

FortiSIEM VM Datastore Utilization Monitoring

Leave a reply

VM Datastore Utilization Monitoring

Event Type: PH_DEV_MON_VM_DISK_UTIL

Description: Event containing VM Datastore utilization metrics Source: All

Key Attributes:

Name Id Type Description
Event Type eventType string Event type set to PH_DEV_MON_SYS_PING_STAT
Event

Severity

 eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event

Severity

Category

 eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event

Receive

Time

 phRecvTime Date Time at which AccelOps generated this event
Reporting IP reptDevIpAddr Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as

Host name attribute)
Relaying IP relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event

Log

 rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
vmName
Host name hostName string Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP

Address

 hostIpAddr IP Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
phyMachName
phyMachIpAddr
datastore
datastoreType
diskUtil
totalDiskMB
freeDiskMB
usedDiskMB
Poll Interval pollIntv uint32 Polling interval in seconds

Sample event:

FortiSIEM VM Disk I/O Monitoring

Leave a reply

VM Disk I/O Monitoring

Event Type: PH_DEV_MON_VM_DISK_IO

Description: Event containing VM Disk I/O performance metrics Source: All

Key Attributes:

Name Id Type Description
Event Type eventType string Event type set to PH_DEV_MON_SYS_PING_STAT
Event

Severity

 eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event

Severity

Category

 eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to

Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event

Receive

Time

 phRecvTime Date Time at which AccelOps generated this event
Reporting

IP

 reptDevIpAddr Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event

Log

 rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
vmName
Host name hostName string Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP

Address

 hostIpAddr IP Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
phyMachName
phyMachIpAddr
diskName
datastore
diskReadKBytesPerSec
diskWriteKBytesPerSec
diskReadReqPerSec
diskWriteReqPerSec
Poll Interval pollIntv uint32 Polling interval in seconds

Sample event:

 

FortiSIEM VM Memory Monitoring

Leave a reply

VM Memory Monitoring

cpuReadyPct double
phyCpuUtil double
cpuRunPct double
Poll Interval pollIntv uint32 Polling interval in seconds

Event Type: PH_DEV_MON_VM_MEM_UTIL

Description: Event containing VM Memory utilization metrics Source: All Key Attributes:

Name Id Type Description
Event Type eventType string Event type set to PH_DEV_MON_SYS_PING_STAT
Event

Severity

 eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event

Severity

Category

 eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event

Receive

Time

 phRecvTime Date Time at which AccelOps generated this event
Reporting

IP

 reptDevIpAddr Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as Host name attribute)
Relaying IP relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event

Log

 rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
vmName
Host name hostName string Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP

Address

 hostIpAddr IP Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
phyMachName
phyMachIpAddr
phyMemUtil
actvMemPct
swapReadKBytesPerSec
swapWriteKBytesPerSec
Poll Interval pollIntv uint32 Polling interval in seconds

FortiSIEM VM Per CPU Monitoring Event

Leave a reply

VM Per CPU Monitoring Event

cpuReadyPct
phyCpuUtil
cpuSysPct
Packet Loss

Pct

 pktLossPct double Packet loss percentage from the ping tests done during this interval
Poll Interval pollIntv uint32 Polling interval in seconds

Event Type: PH_DEV_MON_VM_PER_CPU_UTIL

Description: Event containing VM per CPU metrics Source: All Key Attributes:

Name Id Type Description
Event Type eventType string Event type set to PH_DEV_MON_SYS_PING_STAT
Event

Severity

 eventSeverity uint16 Set to 1. In general, a number between 0 (lowest severity) and 10 (highest severity)
Event

Severity

Category

 eventSeverityCat string Set to Low. IN general, takes the values Low, Medium and High. Event Severities 0-4 are mapped to Low, 5-8 are mapped to Medium and 9-10 are mapped to High
Event

Receive

Time

 phRecvTime Date Time at which AccelOps generated this event
Reporting IP reptDevIpAddr Date IP address of device reporting this event. In this case set to the device reporting the utilization (same as

Host name attribute)
Relaying IP relayDevIpAddr Date IP address of device relaying this event from the source to AccelOps. In general it could be a syslog-ng IP address but in this, since AccelOps talks to the device directly, Relaying IP is set to AccelOps IP Address.
Raw Event

Log

 rawEventMsg string Raw event containing all attributes in comma separated “[Attribute] = value” format.
vmName
Host name hostName string Host name (as in AccelOps CMDB) of the device whose CPU utilization is being reported
Host IP

Address

 hostIpAddr IP Access IP (as in AccelOps CMDB) of the device whose CPU utilization is being reported
phyMachName
phyMachIpAddr
cpuName uint32 Average Round trip time from the ping tests done during this interval
cpuSysPct uint32
cpuUtil uint32