Fortinet Fortigate NetworkSession ASIM parser bugs on AdditinalExtensions

[bacatta]

Describe the bug
Not getting additional fields value like "SrcGeoCountry" and others, for Fortigate source.

To Reproduce
Run "_Im_NetworkSession_FortinetFortiGateV04" function on some "fortigate traffic" log in CommonSecurityLog.

Expected behavior
Fields of NetworkSession populated when the values are present in CommonSecurityLog/AdditionalExtensions.

Additional context
From the vendor documentation: https://docs.fortinet.com/document/fortigate/7.6.2/fortios-log-message-reference/949981
And after some analysis of this code:

    | parse-kv AdditionalExtensions as (
            FortinetFortiGatestart:datetime,
            FortinetFortiGatesrcintfrole:string,
            FortinetFortiGatedstintfrole:string,
            FortinetFortiGateexternalID:string,
            FortinetFortiGatepolicyid:int,
            FortinetFortiGatedstcountry:string,
            FortinetFortiGatesrccountry:string,
            FortinetFortiGatecrscore:string,
            FortinetFortiGateduration:int,
            FortinetFortiGatesentpkt:long,
            FortinetFortiGatercvdpkt:long
        ) with (pair_delimiter=';', kv_delimiter='=')
    | project-rename
        EventStartTime          = FortinetFortiGatestart,
        SrcZone                 = FortinetFortiGatesrcintfrole,
        DstZone                 = FortinetFortiGatedstintfrole,
        NetworkSessionId        = FortinetFortiGateexternalID,
        NetworkRuleNumber       = FortinetFortiGatepolicyid,
        NetworkDuration         = FortinetFortiGateduration,
        DstGeoCountry           = FortinetFortiGatedstcountry,
        SrcGeoCountry           = FortinetFortiGatesrccountry,
        ThreatOriginalRiskLevel = FortinetFortiGatecrscore,
        SrcPackets              = FortinetFortiGatesentpkt,
        DstPackets              = FortinetFortiGatercvdpkt

I think there is 2 bugs. The delimiter should be ' ' instead of ';'. And the prefixes should be "FTNTFGT" instead of 'FortinetFortiGate'.

[v-visodadasi]

Hi @bacatta , Thanks for flagging this issue, we will investigate this issue and get back to you with some updates. Thanks!