Technical Reference
Wazuh Integration
Review Wazuh decoder and rule examples for joining endpoint signals with FortiGate events.
IP, user, device, and license values on this page are anonymized.
<decoder name="bivoxy-fortigate-anon"> <prematch>devname=</prematch> <regex>srcip=(\S+) .* dstip=(\S+) .* action="(\w+)"</regex> <order>srcip,dstip,action</order> </decoder> <rule id="110042" level="8"> <decoded_as>bivoxy-fortigate-anon</decoded_as> <mitre><id>T1110</id></mitre> </rule>