Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing fortigate decoder options in v6 decoder part #7257

Open
ncuxlv opened this issue Jan 23, 2025 · 0 comments
Open

Missing fortigate decoder options in v6 decoder part #7257

ncuxlv opened this issue Jan 23, 2025 · 0 comments

Comments

@ncuxlv
Copy link

ncuxlv commented Jan 23, 2025

Decoder : /var/ossec/ruleset/decoders/0100-fortigate_decoders.xml
There are missing 2 options which are already exist in v4 and v5 decoder devid and devname which are very usefull.

Fix is very simple need to add this in fortigate decoder:

<decoder name="fortigate-firewall-v6">
  <parent>fortigate-firewall-v6</parent>
  <regex>devid="(\.*)"|devid=(\.*)\s|devid=(\.*)$</regex>
  <order>devid</order>
</decoder>

<decoder name="fortigate-firewall-v6">
  <parent>fortigate-firewall-v6</parent>
  <regex>devname="(\.*)"|devname=(\.*)\s|devname=(\.*)$</regex>
  <order>devname</order>
</decoder>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant