DNS activity ASIM parser for Fortinet FortiGate
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimDnsFortinetFortiGate |
| Built-in Parser | _ASim_Dns_FortinetFortiGate |
| Schema | Dns |
| Schema Version | 0.1.7 |
| Parser Type | 🔌 Source (product-specific) |
| Product | Fortinet FortiGate |
| Parser Version | 0.1.2 (version history) |
| Last Updated | Dec 8, 2025 |
| Unifying Parser | ASimDns |
| Source File | Parsers\ASimDns\Parsers\ASimDnsFortinetFortigate.yaml |
Description
This ASIM parser supports normalizing Fortinet FortiGate logs ingested in 'CommonSecurityLogs' table produced by the Microsoft Sentinel Fortinet connector to the ASIM DNS normalized schema.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
CommonSecurityLog |
DeviceEventClassID endswith "54000"DeviceEventClassID endswith "54200"DeviceEventClassID endswith "54400"DeviceEventClassID endswith "54401"DeviceEventClassID endswith "54600"DeviceEventClassID endswith "54601"DeviceEventClassID endswith "54800"DeviceEventClassID endswith "54801"DeviceEventClassID endswith "54802"DeviceEventClassID endswith "54803"DeviceEventClassID endswith "54804"DeviceEventClassID endswith "54805"DeviceProduct startswith "Fortigate"DeviceVendor == "Fortinet" |
✓ | ✓ | ✓ |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
Solutions: Common Event Format, Fortinet FortiGate Next-Generation Firewall connector for Microsoft Sentinel (legacy connector), VirtualMetric DataStream
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊