As in this MIB documentation: http://www.circitor.fr/Mibs/Html/F/FORTINET-FORTIGATE-MIB.php#fgIpsAnomalyDetections

Number of intrusions DECed as anomalies since start-up in this virtual domain
  • I read that as detected. The word Detections is right above it. But it is a dumb word to abbreviate, in the context of the sentence. May 11, 2019 at 6:55

1 Answer 1


It most likely means "Decoded" in this context, as "decoder" is the language keyword Fortinet uses to describe their anomaly detection:

The FortiGate IPS uses protocol decoders to identify the abnormal traffic patterns that do not meet the protocol requirements and standards. For example, the HTTP decoder monitors the HTTP traffic to identify any HTTP packets that do not meet the HTTP protocol standards.

I would consider this a vendor-specific term rather than an industry term.

Another option might be "Decrypted", because Fortinet uses "dec" as their keyword for "decryption" (e.g., set dec-offload-antireplay {enable | disable}) but I truly think "Decoded" better matches the log entry you're looking at.

  • Thanks for the quick answer. I was thinking it could mean "DEClassified", but now it seems to be the opposite! May 11, 2019 at 2:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.