1
00:00:00,969 --> 00:00:10,473
This lab uses official FortiGate Traffic samples, forwarded through a running R S Y S
L O G server and captured from real U D P output.

2
00:00:11,127 --> 00:00:18,687
Enter the manufacturer Fortinet and product FortiGate. No firmware version is
inferred from these published examples.

3
00:00:19,344 --> 00:00:28,728
Paste both complete U D P captured messages, including the outer priority, relay
timestamp, relay host, and original FortiGate fields.

4
00:00:29,381 --> 00:00:35,909
Expand the Syslog forwarder hostname section and enter relay zero one, maximum one
hop.

5
00:00:36,559 --> 00:00:43,039
Both received messages have recognized relay headers. No event is marked unsafe or
mismatched.

6
00:00:43,690 --> 00:00:48,610
Apply the declared relay profile while keeping all bytes from the source messages.

7
00:00:49,261 --> 00:00:55,645
Analyze the two published FortiGate Traffic messages as they were actually received
after relay forwarding.

8
00:00:56,298 --> 00:01:03,474
Both Traffic events parsed completely. This is the actual result returned by the
deployed Parser Studio Web interface.

9
00:01:04,145 --> 00:01:12,425
In Review Fields compare source I P, destination I P, policy action and session
identifier to the official vendor source.

10
00:01:13,075 --> 00:01:20,611
Inspect suggested Stellar Cyber seven point zero field mappings. The relay hostname
is not the originating firewall.

11
00:01:21,264 --> 00:01:25,560
Continue to Create Parser after confirming the real source-event fields.

12
00:01:26,221 --> 00:01:34,165
Run Final Test and Create Files. The tested samples passed this local generation
step, not live Stellar ingestion.

13
00:01:34,817 --> 00:01:41,801
Use the separate, actually relayed official FortiGate Web Filter log to perform an
independent one-event validation.