Vendors / Fortinet / FortiGate / FortiGate historical HTTPS close

Event type

FortiGate historical HTTPS close

Historical FortiOS HTTPS close sample profile, 48 raw key=value fields, registry endpoint/MAC/NAT/policy and fresh seconds clock/session/source port.

PLAIN TEXT 48 fields Generator

fortigate traffic https

Preview Sample View Schema

CLI Install

meltr templates install fortinet

Overview

What this event covers

Historical raw sample from the 7.6.3 reference, not current default exporter schema. Requires source-specific entities: entities/fortinet/fortigate/forward-traffic.yaml; example configuration: configs/fortinet/fortigate/forward-traffic.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

›An HTTPS TCP session closes.

Security relevance

Informational

Frequency notes

One event/second test rate; independent session summaries, fixed sample counters.

Resources

Docs and tools

Official reference: samples, field definitions and ID 13 official

Generation

Configuration

Base frequency: 3600 events/hour
Business hours: 1.0x
Night hours: 1.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

date

String Required

Position 1 in the native text record. Single clock through strftime(%Y-%m-%d), UTC.

Source: Single clock through strftime(%Y-%m-%d), UTC.

Format unquoted

Example date=2026-10-01

time

String Required

Position 2 in the native text record. Same clock through strftime(%H:%M:%S), UTC.

Source: Same clock through strftime(%H:%M:%S), UTC.

Format unquoted

Example time=22:48:08

logid

String Required

Position 3 in the native text record. Fixed "0000000013".

Source: Fixed "0000000013".

Format quoted

Example logid="0000000013"

type

String Required

Position 4 in the native text record. Fixed "traffic".

Source: Fixed "traffic".

Format quoted

Example type="traffic"

subtype

String Required

Position 5 in the native text record. Fixed "forward".

Source: Fixed "forward".

Format quoted

Example subtype="forward"

level

String Required

Position 6 in the native text record. Fixed "notice".

Source: Fixed "notice".

Format quoted

Example level="notice"

vd

String Required

Position 7 in the native text record. Fixed "vdom1".

Source: Fixed "vdom1".

Format quoted

Example vd="vdom1"

eventtime

String Required

Position 8 in the native text record. Same clock through unix_timestamp then int; historical seconds profile.

Source: Same clock through unix_timestamp then int; historical seconds profile.

Format unquoted

Example eventtime=1790894888

srcip

String Required

Position 9 in the native text record. Selected client.ip_address.

Source: Selected client.ip_address.

Format unquoted

Example srcip=10.20.0.11

srcname

String Required

Position 10 in the native text record. Same client.hostname; restricted ASCII hostname.

Source: Same client.hostname; restricted ASCII hostname.

Format quoted

Example srcname="workstation-02"

srcport

String Required

Position 11 in the native text record. Faker pyint(min_value=49152, max_value=65535), selected once.

Source: Faker pyint(min_value=49152, max_value=65535), selected once.

Format unquoted

Example srcport=65271

srcintf

String Required

Position 12 in the native text record. Fixed "port12".

Source: Fixed "port12".

Format quoted

Example srcintf="port12"

srcintfrole

String Required

Position 13 in the native text record. Fixed "undefined".

Source: Fixed "undefined".

Format quoted

Example srcintfrole="undefined"

dstip

String Required

Position 14 in the native text record. Mapped server.destination_ipv4.

Source: Mapped server.destination_ipv4.

Format unquoted

Example dstip=198.51.100.71

dstname

String Required

Position 15 in the native text record. Same server.destination_name.

Source: Same server.destination_name.

Format quoted

Example dstname="service.example.com"

dstport

String Required

Position 16 in the native text record. Fixed 443.

Source: Fixed 443.

Format unquoted

Example dstport=443

dstintf

String Required

Position 17 in the native text record. Fixed "port11".

Source: Fixed "port11".

Format quoted

Example dstintf="port11"

dstintfrole

String Required

Position 18 in the native text record. Fixed "undefined".

Source: Fixed "undefined".

Format quoted

Example dstintfrole="undefined"

poluuid

String Required

Position 19 in the native text record. Same server.policy_uuid, stable policy identity.

Source: Same server.policy_uuid, stable policy identity.

Format quoted

Example poluuid="c3c0ff0e-0e32-5d85-8a13-571898f50409"

sessionid

String Required

Position 20 in the native text record. Faker pyint(min_value=1, max_value=4294967295).

Source: Faker pyint(min_value=1, max_value=4294967295).

Format unquoted

Example sessionid=1616793783

proto

String Required

Position 21 in the native text record. Fixed 6.

Source: Fixed 6.

Format unquoted

Example proto=6

action

String Required

Position 22 in the native text record. Fixed "close".

Source: Fixed "close".

Format quoted

Example action="close"

policyid

String Required

Position 23 in the native text record. Fixed 1.

Source: Fixed 1.

Format unquoted

Example policyid=1

policytype

String Required

Position 24 in the native text record. Fixed "policy".

Source: Fixed "policy".

Format quoted

Example policytype="policy"

policymode

String Required

Position 25 in the native text record. Fixed "learn".

Source: Fixed "learn".

Format quoted

Example policymode="learn"

service

String Required

Position 26 in the native text record. Fixed "HTTPS".

Source: Fixed "HTTPS".

Format quoted

Example service="HTTPS"

dstcountry

String Required

Position 27 in the native text record. Fixed "United States".

Source: Fixed "United States".

Format quoted

Example dstcountry="United States"

srccountry

String Required

Position 28 in the native text record. Fixed "Reserved".

Source: Fixed "Reserved".

Format quoted

Example srccountry="Reserved"

trandisp

String Required

Position 29 in the native text record. Fixed "snat".

Source: Fixed "snat".

Format quoted

Example trandisp="snat"

transip

String Required

Position 30 in the native text record. Same server.nat_ipv4; differs from client IP.

Source: Same server.nat_ipv4; differs from client IP.

Format unquoted

Example transip=10.30.0.2

transport

String Required

Position 31 in the native text record. Same source port, preserving port during SNAT.

Source: Same source port, preserving port during SNAT.

Format unquoted

Example transport=65271

appid

String Required

Position 32 in the native text record. Fixed 40568.

Source: Fixed 40568.

Format unquoted

Example appid=40568

app

String Required

Position 33 in the native text record. Fixed "HTTPS.BROWSER".

Source: Fixed "HTTPS.BROWSER".

Format quoted

Example app="HTTPS.BROWSER"

appcat

String Required

Position 34 in the native text record. Fixed "Web.Client".

Source: Fixed "Web.Client".

Format quoted

Example appcat="Web.Client"

apprisk

String Required

Position 35 in the native text record. Fixed "medium".

Source: Fixed "medium".

Format quoted

Example apprisk="medium"

duration

String Required

Position 36 in the native text record. Fixed 2.

Source: Fixed 2.

Format unquoted

Example duration=2

sentbyte

String Required

Position 37 in the native text record. Fixed 1850.

Source: Fixed 1850.

Format unquoted

Example sentbyte=1850

rcvdbyte

String Required

Position 38 in the native text record. Fixed 39898.

Source: Fixed 39898.

Format unquoted

Example rcvdbyte=39898

sentpkt

String Required

Position 39 in the native text record. Fixed 25.

Source: Fixed 25.

Format unquoted

Example sentpkt=25

rcvdpkt

String Required

Position 40 in the native text record. Fixed 37.

Source: Fixed 37.

Format unquoted

Example rcvdpkt=37

utmaction

String Required

Position 41 in the native text record. Fixed "allow".

Source: Fixed "allow".

Format quoted

Example utmaction="allow"

countapp

String Required

Position 42 in the native text record. Fixed 1.

Source: Fixed 1.

Format unquoted

Example countapp=1

devtype

String Required

Position 43 in the native text record. Fixed "Linux PC".

Source: Fixed "Linux PC".

Format quoted

Example devtype="Linux PC"

osname

String Required

Position 44 in the native text record. Fixed "Linux".

Source: Fixed "Linux".

Format quoted

Example osname="Linux"

mastersrcmac

String Required

Position 45 in the native text record. Same client.mac_address.

Source: Same client.mac_address.

Format quoted

Example mastersrcmac="02:00:00:00:00:0b"

srcmac

String Required

Position 46 in the native text record. Same client.mac_address.

Source: Same client.mac_address.

Format quoted

Example srcmac="02:00:00:00:00:0b"

srcserver

String Required

Position 47 in the native text record. Fixed 0.

Source: Fixed 0.

Format unquoted

Example srcserver=0

utmref

String Required

Position 48 in the native text record. Fixed 0-220586.

Source: Fixed 0-220586.

Format unquoted

Example utmref=0-220586