Normalized Event Schema

Review normalized JSON fields for source, destination, user, action, and observer context.

IP, user, device, and license values on this page are anonymized.

{
  "@timestamp": "2026-07-15T10:18:22Z",
  "event.category": "network",
  "event.action": "deny",
  "observer.product": "FortiGate",
  "source.ip": "198.51.100.24",
  "destination.ip": "10.10.4.20",
  "user.name": "anon.user",
  "bivoxy.normalized": true
}