Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-custom-parsers-schema-netflow

Netflow schema

Use this reference to identify the fields available in the netflow schema and the parser fields used to populate them.

For a field to be populated in Sophos XDR, the corresponding parser field must be present in the source data.

Schema summary

Property Value
Schema name Netflow
Parser field prefix Netflow
Supports custom parsers Yes
Schema components Direction, fw_action

Schema components

Netflow.Direction

Name Number Description
UNKNOWN 0 Unused but required for Proto3.
INBOUND 1 The flow is inbound to the source.
OUTBOUND 2 The flow is outbound to the source.
CLIENT_TO_SERVER 3 When reported by a firewall, the control will only know who is the initiator (client) of the connection and who is the receiver (server).
SERVER_TO_CLIENT 4 When reported by a firewall, the control will only know who is the initiator (client) of the connection and who is the receiver (server).

Netflow.fw_action

Did the firewall appliance allow or deny the traffic, and if deny, then how?

Name Number Description
FW_UNKNOWN 0 Unused but required for Proto3.
FW_BLOCKED 1 Flow dropped: firewall blocked the TCP handshake or the UDP packet.
FW_ALLOWED 2 Flow was not denied by the firewall.
FW_RESET_CLIENT_TO_SERVER 3 Firewall sent a RST packet to the server (TCP probe).
FW_RESET_SERVER_TO_CLIENT 4 Firewall sent a RST packet to the client (TCP probe).
FW_RESET_BOTH 5 Firewall sent a RST packet to both client and server (TCP probe).
FW_ICMP_CLIENT 6 ICMP destination host unreachable sent to client (UDP probe).

Schema fields

Normalized Field Type Parser Field Description
resource_id string resourceId$ Full resource string identifying the record.
tenant_id string tenantId$ ID of the tenant.
sensor_type string sensorType$ Type of device that generated this event.
sensor_event_id string sensorEventId$ Event ID of original_data assigned by the sensor.
sensor_tenant string sensorTenant$ A customer ID supplied by the application that originated the data.
sensor_id string sensorId$ An ID for the data supplied by the application that originated it.
sensor_cpe string sensorCpe$ CPE of the platform producing the alert.
original_data string originalData$ Original, unadulterated data prior to any transformation.
event_time_usec uint64 eventTimeUsec$ Event time in microseconds (µs).
ingest_time_usec uint64 ingestTimeUsec$ Ingest time in microseconds (µs).
event_time_fidelity TimeFidelity eventTimeFidelity$ Specifies the original precision of the time used to populate event_time_usec.
host_id string hostId$ The host ID that uniquely identifies the host where the event originated, such as IPv(4/6) address or device MAC address.
sensor_version string sensorVersion$ The agent version as string.
source_mac string sourceMac$ Source MAC address in text canonical format.
destination_mac string destinationMac$ Destination MAC address in text canonical format.
source_address string sourceAddress$ IP address of the source.
destination_address string destinationAddress$ IP address of the destination.
source_port uint32 sourcePort$ Port of the source.
destination_port uint32 destinationPort$ Port of the destination.
protocol uint32 protocol$ Transfer protocol.
tx_packet_count uint64 txPacketCount$ Number of packets transferred.
tx_byte_count uint64 txByteCount$ Number of bytes transferred.
rx_packet_count uint64 rxPacketCount$ Number of packets received.
rx_byte_count uint64 rxByteCount$ Number of bytes received.
direction Netflow.Direction direction$ Direction of the network traffic between the source and destination from the perspective of the sensor, such as INBOUND or OUTBOUND.
start_timestamp_usec uint64 startTimestampUsec$ Microseconds of the flow start.
end_timestamp_usec uint64 endTimestampUsec$ Microseconds of the flow end.
src_ipblacklists repeated string srcIpblacklists$ Provides the names of blacklists matched by the source.
dest_ipblacklists repeated string destIpblacklists$ Provides the names of blacklists matched by the destination.
src_ipgeo_summary GeoSummary The geographic location of the source IP. Not writable from a custom parser. Populated automatically by Sophos enrichment from source_address. See note at the end of this page.
dest_ipgeo_summary GeoSummary The geographic location of the destination IP. Not writable from a custom parser. Populated automatically by Sophos enrichment from target_address. See note at the end of this page.
source_nat_address string sourceNatAddress$ If Network Address Translation is done, the source IP used.
destination_nat_address string destinationNatAddress$ If Network Address Translation is done, the destination IP used.
source_nat_port uint32 sourceNatPort$ If Network Address Translation is done, the source port used.
destination_nat_port uint32 destinationNatPort$ If Network Address Translation is done, the destination port used.
application_name string applicationName$ Application detected by Deep Packet Inspection engine, such as PaloAlto's APP-ID.
flow_action Netflow.fw_action flowAction$ Provides an enum to define what the firewall might have done to the flow. If free form text is needed, see connection_end_reason. 0: FW_UNKNOWN. Not used. 1: FW_BLOCKED. Flow dropped. Firewall blocked the TCP handshake or the UDP packet. 2: FW_ALLOWED. Flow was not denied by the firewall. 3: FW_RESET_CLIENT_TO_SERVER. Firewall sent a RST packet to the server (TCP probe). 4: FW_RESET_SERVER_TO_CLIENT. Firewall sent a RST packet to the client (TCP probe). 5: FW_RESET_BOTH. Firewall sent a RST packet to both client and server (TCP probe). 6: FW_ICMP_CLIENT. ICMP destination host unreachable sent to client (UDP probe).
connection_end_reason string connectionEndReason$ Provides details on why the session ended if flow_action was not enough. Examples: tcp-rst-from-client (Paloalto), TCP Reset - I (ASA).
community_id_hash string communityIdHash$ Allows us to relate netflow record to other records like IDS alerts. See Community ID Flow Hashing.
event_metadata KeyValuePairsIndexed eventMetadata$ Event metadata can be provided by the data source to add context, such firewall rule name or source interface.
processCorrelationID ProcessCorrelationID processCorrelationId$ Process correlation ID of the process creating this netflow session.
process_image_path string processImagePath$ Image path of the process initiating this netflow.

Geographic IP fields are not writable from custom parsers.

The src_ipgeo_summary and dest_ipgeo_summary fields are populated by an automatic Sophos enrichment step that runs after custom parser normalization. Any value a custom parser writes to these fields will be replaced before the event reaches queryable storage.

To get geographic data populated, ensure your parser writes the relevant IP addresses to source_address$ and target_address$. Enrichment uses those fields to look up the geographic data and fill in src_ipgeo_summary (from source_address) and dest_ipgeo_summary (from target_address) automatically.

Enrichment only applies to publicly routable IP addresses; private and loopback addresses are skipped.