fix(Fortigate): enhancement the extraction of the user group

SEKOIA-IO · Jan 2, 2025 · 9235a59 · 9235a59
1 parent 36ceb70
commit 9235a59
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/Fortinet/fortigate/ingest/parser.yml b/Fortinet/fortigate/ingest/parser.yml
@@ -241,7 +241,7 @@ stages:
           fortinet.fortigate.policyid: "{{parsed_event.message.policyid}}"
           fortinet.fortigate.poluuid: "{{parsed_event.message.poluuid}}"
           network.forwarded_ip: "{{parsed_event.message.forwardedfor}}"
-          group.name: "{{parsed_event.message.group}}"
+          group.name: "{{parsed_event.message.group or parsed_event.message.FTNTFGTgroup}}"
 
       - set:
           fortinet.fortigate.poluuid: "{{parsed_event.message.uuid}}"