FortiSIEM Event Data Model (EDM)

The FortiSIEM Event Data Model describes how FortiSIEM normalizes parsed log data into named event attributes, grouped into data models per event category. EDM is this skill's shorthand for the model; Fortinet itself uses no acronym. Use this skill to choose the right data model, inspect event attributes, explain attribute types and display names, and map events into FortiSIEM event attributes for built-in or custom parsers.

The generated YAML files are the authoritative reference for this skill. If an attribute, type, display name, or data model is not present in the YAML data, say that it is not documented here. Use source.md only as the final provenance anchor for the documented FortiSIEM version and raw page copies.

How the FortiSIEM event data model fits together

FortiSIEM normalizes events into flat records of typed event attributes, documented as 21 data models, one per event category. The base event data model lists attributes present in every FortiSIEM event, split into attributes set automatically by the parsing framework and attributes a parser must set. Every other data model adds the attributes relevant to one event category, on top of the base attributes. Each data model's summary names example event types that follow it; the full event type list lives in the FortiSIEM product under Resources > Event Types.