Enhanced FortiGate Wazuh Rule Levels Based on Fortinet Log Severity

[Adicodin]

Summary of Changes:

This pull request updates the 0391-fortigate_rules.xml file by assigning more accurate Wazuh rule levels based on the original Fortinet log severity for each logid.
Previously, all rules had the same alert level i.e., level="4", which did not reflect the true risk profile of Fortinet logs.

---

Fortinet → Wazuh Severity Mapping:

I reviewed Fortinet's official log reference documentation and mapped their log severities to appropriate Wazuh levels using the following general logic:

Fortinet Severity	Mapped Wazuh Level	Notes
(0) Emergency	15	Highest severity — critical system failure
(1) Alert	14	Security alerts requiring immediate action
(2) Critical	10	Very high priority — immediate remediation
(3) Error	8	Significant errors needing attention
(4) Warning	6	Suspicious or risky behavior
(5) Notification	3	Minor but notable system events
(6) Information	2	Informational logs, general activity
(7) Debug / Unknown	4	Default level when severity is not mapped

I applied this mapping across all rules by looking up each logid in Fortinet’s reference and adjusting the <level> tag accordingly with the help of a python script. I’ve mapped the Fortinet severities to Wazuh alert levels using a stricter scale to better reflect the risk profile of each log entry. The mapping favors the maximum in each Wazuh range for clear visibility. Where Fortinet severity is not explicitly defined (like debug or unknown types), I defaulted to level 4 for moderate visibility.

---

Why This Improves the Ruleset:

• Provides more accurate alerting in Wazuh based on real-world severity.

• Helps prioritize responses to critical Fortinet events.

• Reduces alert fatigue by lowering levels for low-risk logs.

---

References Used:

• Fortinet Log Reference Documentation ( https://docs.fortinet.com/document/fortigate/7.6.3/fortios-log-message-reference)

---

Notes:

• All changes were made to a single XML file: 0391-fortigate_rules.xml.

• XML formatting and syntax has been preserved.

• No decoders were modified.