Incident XML File Format

This topic includes an example of the XML file that is generated for incidents, and descriptions of its contents.

Example Incident XML File

XML Tag and Attribute Definitions

Example Incident XML File

<?xml version=”1.0″ encoding=”UTF-8″ ?> <incident incidentId=”5672″ ruleType=”PH_RULE_AUTO_SRVC_DOWN” severity=”10″ repeatCount=”1″ organization=”Super” status=”Cleared”>   <name>Auto Service Stopped</name>   <description>Detects that an automatically running service stopped.

Currently this works for windows servers and is detected via

WMI.</description>

<displayTime>Fri Jun 29 15:51:10 PDT 2012</displayTime>

<incidentSource>

</incidentSource>

<incidentTarget>

<entry attribute=”hostIpAddr” name=”Host IP”>172.16.10.15</entry>

<entry attribute=”hostName” name=”Host Name”>QA-V-WIN03-ADS</entry>

</incidentTarget>

<incidentDetails>

<entry attribute=”serviceName” name=”OS Service

Name”>Spooler</entry>

<entry attribute=”servicePath” name=”OS Service

Path”>C:\WINDOWS\system32\spoolsv.exe</entry>

</incidentDetails>

<affectedBizSrvc>Auth Service</affectedBizSrvc>

<identityLocation>

</identityLocation>  <rawEvents>

[SrvcDown]

[PH_DEV_MON_AUTO_SVC_START_TO_STOP]:[eventSeverity]=PHL_INFO,[fileName]= phPerfJob.cpp,[lineNumber]=6005,[hostName]=QA-V-WIN03-ADS,[hostIpAddr]=1 72.16.10.15,[serviceName]=Spooler,[servicePath]=C:\WINDOWS\system32\spoo lsv.exe,[serviceDesc]=Manages all local and network print queues and controls all printing jobs. If this service is stopped, printing on the local machine will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.,[phLogDetail]=  </rawEvents>

</incident>

XML Tag and Attribute Definitions

XML Tag	Attributes	Description
<incident>
	incidentID	Unique id of the incident in AccelOps. You can search for the incident by using this ID.

 

	ruleType	Unique id of the rule in AccelOps
	severity	The severity of the incident, HIGH MEDIUM LOW
	repeatCount	How many times this incident has occurred
	organization	In multi-tenant deployments, the organization affected by the incident
	status	The status of the incident
<name>		The name of the rule that triggered the incident
<description>		The description of the rule that triggered the incident
<displayTime>		The time when the incident occurred
<incidentSource>		The source of the incident. It includes the event attributes associated with the source presented as name:value pairs. Common attributes for source and target tributes here are  srcIpAddr, de stIpAddr, hostIpAddr.
<incidentTarget>		Where the incident occurred, or the target of an IPS alert. It includes the event attributes associated with the target presented as name:value pairs. Common attributes for source and target tributes here are  srcIpAddr, destIpAddr, hostIpAddr.
<incidentDetails>		The event attributes associated with the rule definition that triggered the incident
<affectedBizSrvc>		Any business services impacted by the event
<identityLocation>		Information associated with the Identity and Location Report
<rawevents>		The contents of the raw event log for the incident.

 

 

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!