2 digits

2 digits

2 digits

1 digit

5 digits

log_type

N/A

log_type

String

Anti-Virus

log_component

N/A

log_component

String

HTTP/HTTPS

log_subtype

Log Subtype

log_subtype

String

Virus

PUA

Clean

severity

N/A

N/A

String

Critical

fw_rule_id

N/A

fw_rule_id

Number

int32

user_name

Username

user

String

384

web_policy_id

N/A

web_policy_id

Number

int16

The web policy that applies to this HTTP transaction

malware

Detection

virus

String

256

The name of the malware identified by the scan engine.

0If the malware was detected by Sandstorm, this will say Sandstorm.

url

N/A

url

String

1024

URL from which the malware was downloaded

domain

N/A

domain

String

512

The FQDN part of the URL

src_ip

Source IP

src_ip

The IP address from which the connection originated (client-side)

src_country

N/A

src_country

String

64

Source country code of the source IP address based on GeoIP.

eg. "IND"

dst_ip

Destination IP

dst_ip

The IP address to which the connection is directed (server-side)

dst_country

N/A

dst_country

String

64

Destination country code of the destination IP address based on GeoIP.

eg. "USA"

src_port

N/A

src_port

The port from which the connection originated (client-side)

dst_port

N/A

dst_port

The port to which the connection is directed (server-side)

bytes_sent

N/A

bytes_sent

Number

int32

The amount of data in bytes sent by the firewall to the destination

bytes_received

N/A

bytes_received

Number

int32

The amount of data in bytes received

http_user_agent

N/A

user_agent

String

256

log_id

N/A

String

eg. "010101600001" 

device_name

N/A

String

eg "SFW"

device_model

N/A

String

eg "SF01V"

device_serial_id

N/A

String

eg "SFDemo-ff94e90"

message

message

String

eg "Malware 'EICAR-AV-Test' was detected and blocked in a download from www.eicar.org"

protocol

protocol

String

eg. "TCP"

src_zone_type

N/A

String

eg "LAN"

src_zone

N/A

String

eg. "LAN"

dst_zone_type

N/A

String

eg.  "WAN"

dst_zone

N/A

String

eg.  "WAN"

user_group

N/A

String

eg.  "student"

log_type

N/A

log_type

String

Anti-Virus

log_component

N/A

log_component

String

HTTP/HTTPS

log_subtype

Log Subtype

log_subtype

String

Virus

PUA

Clean

priority

N/A

N/A

String

Critical

fw_rule_id

N/A

fw_rule_id

Number

int32

user_name

Username

user

String

384

iap

N/A

web_policy_id

Number

int16

The web policy that applies to this HTTP transaction

virus

Detection

virus

String

256

The name of the malware identified by the scan engine.

0If the malware was detected by Sandstorm, this will say Sandstorm.

url

N/A

url

String

1024

URL from which the malware was downloaded

domainname

N/A

domain

String

512

The FQDN part of the URL

src_ip

Source IP

src_ip

The IP address from which the connection originated (client-side)

src_country_code

N/A

src_country

String

64

Source country code of the source IP address based on GeoIP.

eg. "IND"

dst_ip

Destination IP

dst_ip

The IP address to which the connection is directed (server-side)

dst_country_code

N/A

dst_country

String

64

Destination country code of the destination IP address based on GeoIP.

eg. "USA"

src_port

N/A

src_port

The port from which the connection originated (client-side)

dst_port

N/A

dst_port

The port to which the connection is directed (server-side)

sent_bytes

N/A

bytes_sent

Number

int32

The amount of data in bytes sent by the firewall to the destination

recv_bytes

N/A

bytes_received

Number

int32

The amount of data in bytes received

user_agent

N/A

user_agent

String

256

log_id

N/A

String

eg. "010101600001" 

device

N/A

String

eg "SFW"

device_name

N/A

String

eg "SF01V"

device_id

N/A

String

eg "SFDemo-ff94e90"

message

message

String

eg "Malware 'EICAR-AV-Test' was detected and blocked in a download from www.eicar.org"

protocol

protocol

String

eg. "TCP"

8001

device="SFW" date=2016-12-02 time=18:48:18 timezone="GMT" device_name="SFVUNL" device_id=C01001K234RXPA1 log_id=034806208001 log_type="Anti-Virus" log_component="HTTPS" log_subtype="Virus" priority=Critical fw_rule_id=2 user_name="rich" iap=13 virus="EICAR-AV-Test" url="https://secure.eicar.org/eicar.com" domainname="secure.eicar.org" src_ip=192.168.73.220 src_country_code=R1 dst_ip=213.211.198.58 dst_country_code=DEU protocol="TCP" src_port=51499 dst_port=443 sent_bytes=0 recv_bytes=353

device="SFW" date=2016-12-02 time=18:57:57 timezone="GMT" device_name="SFVUNL" device_id=C01001K234RXPA1 log_id=030906208001 log_type="Anti-Virus" log_component="HTTP" log_subtype="Virus" priority=Critical fw_rule_id=0 user_name="rich" iap=13 virus="Sandstorm" url="http://floater.baldrys.ca/badb.exe" domainname="floater.baldrys.ca" src_ip=192.168.73.220 src_country_code=R1 dst_ip=192.168.73.220 dst_country_code=R1 protocol="TCP" src_port=54110 dst_port=80 sent_bytes=0 recv_bytes=1594715

8003

Not currently logged in syslog

log_type

N/A

log_type

String

Anti-Virus

log_component

N/A

log_component

String

FTP

log_subtype

Log Subtype

log_subtype

String

Virus

Clean

priority

N/A

N/A

String

fw_rule_id

N/A

fw_rule_id

Number

int32

user_name

Username

user

String

384

virus

Detection

virus

String

256

Name of detected virus

FTP_url

N/A

url

String

1024

URL of download/upload

FTP_direction

N/A

direction

Download/Upload

Download

Upload

filename

N/A

file_name

String

64

Downloaded/uploaded filename

file_size

N/A

file_size

Number

32

Size of the downloaded/uploaded file

file_path

N/A

file_path

String

1024

Path the file was uploaded/downloaded to/from

ftpcommand

N/A

cmd

String

64

FTP command

RETR

STOR

src_ip

Source IP

src_ip

Source IP address

src_country_code

N/A

src_country

String

64

Source country code of the source IP address

eg. "IND"

"USA"

dst_ip

Destination IP

dst_ip

The destination IP address.

dst_country_code

N/A

dst_country

String

64

Destination country code of the destination IP address

eg. "IND"

"USA"

src_port

N/A

src_port

dst_port

N/A

dst_port

dstdomain

N/A

domain

String

512

sent_bytes

N/A

bytes_sent

Number

int32

recv_bytes

N/A

bytes_received

Number

int32

log_id

N/A

String

eg. "010101600001" 

device

N/A

String

eg "SFW"

device_name

N/A

String

eg "SF01V"

device_id

N/A

String

eg "SFDemo-ff94e90"

message

message

String

eg "Malware 'EICAR-AV-Test' was detected and blocked in a download from www.eicar.org"

protocol

protocol

String

eg. "TCP"

9001

device="SFW" date=2018-06-21 time=19:50:23 timezone="CEST" device_name="SF01V" device_id=SFDemo-2df0960 log_id=031006209001 log_type="Anti-Virus" log_component="FTP" log_subtype="Virus" priority=Critical fw_rule_id=0 user_name="" virus="EICAR-AV-Test" FTP_url="/var/www//home/ftp-user/ta_test_file_1ta-cl1-46" FTP_direction="Upload" filename="/home/ftp-user/ta_test_file_1ta-cl1-46" file_size=0 file_path="/var/www//home/ftp-user/ta_test_file_1ta-cl1-46" ftpcommand="STOR" src_ip=10.146.13.49 src_country_code=R1 dst_ip=10.8.142.181 dst_country_code=R1 protocol="TCP" src_port=39910 dst_port=21 dstdomain="" sent_bytes=0 recv_bytes=0

9002

device="SFW" date=2018-06-21 time=19:50:48 timezone="CEST" device_name="SF01V" device_id=SFDemo-2df0960 log_id=031001609002 log_type="Anti-Virus" log_component="FTP" log_subtype="Allowed" priority=Information fw_rule_id=0 user_name="" virus="" FTP_url="/var/www//home/ftp-user/ta_test_file_1ta-cl1-46" FTP_direction="Download" filename="/home/ftp-user/ta_test_file_1ta-cl1-46" file_size=19926248 file_path="/var/www//home/ftp-user/ta_test_file_1ta-cl1-46" ftpcommand="RETR" src_ip=10.146.13.49 src_country_code= dst_ip=10.8.142.181 dst_country_code= protocol="TCP" src_port=39936 dst_port=21 dstdomain="" sent_bytes=0 recv_bytes=19926248

log_type

N/A

log_type

String

Anti-Virus

log_component

N/A

log_component

String

FTP

log_subtype

Log Subtype

log_subtype

String

Virus

Clean

severity

N/A

String

fw_rule_id

N/A

fw_rule_id

Number

int32

user_name

Username

user

String

384

malware

Detection

virus

String

256

Name of detected virus

url

N/A

url

String

1024

URL of download/upload

con_direction

N/A

direction

Download/Upload

Download

Upload

file_name

N/A

file_name

String

64

Downloaded/uploaded filename

file_size

N/A

file_size

Number

32

Size of the downloaded/uploaded file

file_path

N/A

file_path

String

1024

Path the file was uploaded/downloaded to/from

ftpcommand

N/A

cmd

String

64

FTP command

RETR

STOR

src_ip

Source IP

src_ip

Source IP address

src_country

N/A

src_country

String

64

Source country code of the source IP address

eg. "IND"

"USA"

dst_ip

Destination IP

dst_ip

The destination IP address.

dst_country

N/A

dst_country

String

64

Destination country code of the destination IP address

eg. "IND"

"USA"

src_port

N/A

src_port

dst_port

N/A

dst_port

dstdomain

N/A

domain

String

512

sent_bytes

N/A

bytes_sent

Number

int32

recv_bytes

N/A

bytes_received

Number

int32

log_id

String

eg. "010101600001" 

device_name

String

eg "SFW"

device_model

String

eg "SF01V"

device_serial_id

String

eg "SFDemo-ff94e90"

message

String

eg "Malware 'EICAR-AV-Test' was detected and blocked in a download from www.eicar.org"

protocol

String

eg. "TCP"

log_version

Number

1

eg. log_version=1

src_zone_type

String

eg. src_zone_type="LAN"

src_zone

String

eg. src_zone="LAN"

dst_zone_type

String

eg. dst_zone_type="WAN"

dst_zone

String

eg. dst_zone="WAN"

user_group

String

eg. user_group="student"

timestamp

Timestamp

ISO 8601

2018-12-07T10:03:48+0000

device_name

String

device_model

String

device_serial_id

String

log_id

String

log_type

String

Event

log_component

String

Appliance

Guest User

Appliance Access

log_subtype

String

System

log_version

severity

String

Warning

Information

Notification

message

String

1024

17807

17808

17809

17810

17811

17812

17816

17923

17924

17925

17926

17927

17928

17929

17930

17931

17932

17933

17934

17913

17941

log_type

log_type

String

Event

log_component

log_component

String

Appliance

Guest User

Appliance Access

log_subtype

log_subtype

String

System

priority

String

Warning

Information

Notification

message

message

String

1024

17807

17808

17809

17810

17811

17812

17816

17923

17924

17925

17926

17927

17928

17929

17930

17931

17932

17933

17934

17913

17941

timestamp

Timestamp

ISO 8601

eg. 2018-12-07T10:03:48+0000

device_model

String

eg. XG135

device_name

String

SFW

device_serial_id

String

eg. C44313350024-P29PUA

log_id

String

eg. 010101600001

log_type

String

Content Filtering

log_subtype

String

Denied

log_version

Number

eg. log_version=1

severity

String

Information

fw_rule_id

Number

int32

Firewall rule id

e.g. fw_rule_id=1

user_name

String

384

"" or "<username>"

user_group

String

1024

"" or "<groupname>"

app_filter_policy_id

Number

int16

Id of application filter policy

category

String

64

Category in which application is categorized

Categories present in IPS signature set

app_name

String

64

Application Name

Applications present in IPS signature set

app_risk

Number

8

Risk in which application is categorized

Risks present in IPS signature set

app_technology

String

32

Technology in which application is categorized

Technologies present in IPS signature set

app_category

String

64

Category in which application is categorized

Categories present in IPS signature set

src_ip

<Src IP address>

src_country

String

64

ISO 3166 (A 3) Code

dst_ip

<Dst IP address>

dst_country

String

64

ISO 3166 (A 3) Code

src_port

dst_port

bytes_sent

Number

int32

bytes_received

Number

int32

message

String

1024

app_is_cloud

Boolean

true

false

parent_app

String

eg. parent_app="Skype"

parent_app_category

String

eg. parent_app_category="Instant Messaging"

parent_app_risk

Number

eg. parent_app_risk=1

classification

String

""

Sanctioned

Unsanctioned

New

Tolerated

eg. classification="Sanctioned"

app_resolved_by

String

The module that identified the application (IPS, Micro app or SAC)

Signature

Proxy

EAC

qualifier

String

eg. qualifier="Mapped"

status

String

Deny

17051

log_type

log_type

String

Content Filtering

log_component

log_component

String

Application

log_subtype

log_subtype

String

Denied

priority

String

Information

fw_rule_id

fw_rule_id

Number

int32

Firewall rule id

e.g. fw_rule_id=1

user_name

user

String

384

"" or "<username>"

user_gp

user_group

String

1024

"" or "<groupname>"

application_filter_policy

appfilter_policy_id

Number

int16

Id of application filter policy

category

category

String

64

Category in which application is categorized

Categories present in IPS signature set

application_name

app_name

String

64

Application Name

Applications present in IPS signature set

application_risk

app_risk

Number

8

Risk in which application is categorized

Risks present in IPS signature set

application_technology

app_technology

String

32

Technology in which application is categorized

Technologies present in IPS signature set

application_category

app_category

String

64

Category in which application is categorized

Categories present in IPS signature set

src_ip

src_ip

<Src IP address>

src_country_code

src_country

String

64

dst_ip

dst_ip

<Dst IP address>

dst_country_code

dst_country

String

64

src_port

src_port

dst_port

dst_port

sent_bytes

bytes_sent

Number

int32

recv_bytes

bytes_received

Number

int32

status

status

String

Deny

message

message

String

1024

appresolvedby

appresolvedby

String

Module that identified the application (IPS, Microapp or SAC)

Signature

Proxy

EAC

17051

device="SFW" date=2018-02-27 time=18:13:29 timezone="IST" device_name="XG125w" device_id=S1601E1F9FCB7EE log_id=054402617051 log_type="Content Filtering" log_component="Application" log_subtype="Denied" priority=Information fw_rule_id=1 user_name="" user_gp="" application_filter_policy=8 category="Mobile Applications" application_name="Gtalk Android" application_risk=4 application_technology="Client Server" application_category="Mobile Applications" src_ip=5.5.5.15 src_country_code=DEU dst_ip=74.125.130.188 dst_country_code=USA protocol="TCP" src_port=49128 dst_port=5228 sent_bytes=0 recv_bytes=0 status="Deny" message="" appresolvedby="Signature"

timestamp

Timestamp

ISO 8601

eg. timestamp="2018-12-07T10:03:48+0000"

device_name

String

eg. device_name="SFW"

device_model

String

eg. device_model="XG135"

device_serial_id

String

eg. device_serial_id="C44313350024-P29PUA"

log_id

String

eg. log_id="086320518009" 

log_type

String

8

Log Type

ATP

log_component

String

8

Log Component

Firewall

DNS

IPS

Web

log_subtype

String

8

Status of log

Alert

Drop

log_version

Number

eg. log_version=1

severity

String

8

severity of log

Warning

Notification

Information

user_name

String

384

Appliance User Name

e.g. user_name="gaurav"

user_group

String

src_port

Number

Source port number

dst_port

Number

Destination port number

src_ip

INET

Client source ip address

dst_ip

INET

Destination IP address

protocol

String

eg. protocol="TCP"

src_country

String

dst_country

String

src_zone_type

String

eg. src_zone_type="LAN"

src_zone

String

eg. src_zone="LAN"

dst_zone_type

String

eg. dst_zone_type="WAN"

dst_zone

String

url

String

2048

Destination IP Address in string format Or Domain Or URL

malware

String

128

Threat Name

eg. malware=C2/Generic-A

event_id

String

64

Event id

eg. event_id=C7E26E6F-0097-4EA2-89DE-C31C40636CB2

event_type

String

Event Type

Standard

Extended

reported_user

String

256

Logged user of Host

proc_user

String

256

Host process user

reported_id

String

40

Endpoint ID

file_path

String

16384

Execution path

Threatfeed   

String 

64

Threat feed name

“MDR threat feeds”

"SophosLabs ML threat feeds“

eg. threatfeed="MDR threat feeds"

18009

Oct 18 04:46:59 172.16.131.1 device_name="SFW" timestamp="2023-10-18T04:46:59-0400" device_model="SF01V" device_serial_id="SFDemo-c07-gl-vm-01" log_id=086320518009 log_type="ATP" log_component="Firewall" log_subtype="Alert" log_version=1 severity="Notice" protocol="ICMP" src_ip="172.16.131.3" dst_ip="100.0.80.3" url="100.0.80.3" malware="C2/MDR-A" threatfeed="MDR threat feeds" event_id="09B9517E-AE79-48C1-89CE-ABA7D799113B" event_type="Standard" src_country="R1" dst_country="USA"

18010

Oct 18 04:49:30 172.16.131.1 device_name="SFW" timestamp="2023-10-18T04:49:30-0400" device_model="SF01V" device_serial_id="SFDemo-c07-gl-vm-01" log_id=086304418010 log_type="ATP" log_component="Firewall" log_subtype="Drop" log_version=1 severity="Warning" protocol="ICMP" src_ip="172.16.131.3" dst_ip="100.0.80.3" url="100.0.80.3" malware="C2/MDR-A" threatfeed="MDR threat feeds" event_id="FF2E604F-D94C-4713-A7C6-8ACB65CEE293" event_type="Standard" src_country="R1" dst_country="USA"

log_type

log_type

String

8

Log Type

ATP

log_component

log_component

String

8

Log Component

Firewall

DNS

IPS

Web

log_subtype

log_subtype

String

8

Status of log

Alert

Drop

priority

String

8

Priority of log

Warning

Notification

Information

user_name

user

String

384

Appliance User Name

e.g. user_name="gaurav"

src_port

Source Port

src_port

Number

Source port number

dst_port

Destination Port

dst_port

Number

Destination port number

sourceip

Source IP

src_ip

ipaddr_t

Client source ip address

destinationip

Destination IP

dst_ip

ipaddr_t

Destination IP address

url

url

String

2048

Destination IP Address in string format Or Domain Or URL

threatname

threat

String

128

Threat Name

eg. threatname=C2/Generic-A

eventid

event_id

String

64

Event id

eg. eventid=C7E26E6F-0097-4EA2-89DE-C31C40636CB2

eventtype

type

String

Event Type

Standard

Extended

login_user

host_login_user

String

256

Logged user of Host

process_user

host_process_user

String

256

Host process user

ep_uuid

endpoint_id

String

40

Endpoint ID

execution_path

execution_path

String

16384

Execution path

Threatfeed

threatfeed 

threatfeed

String

64

Threatfeed Name

 "MDR threat feeds"/ "SophosLabs ML threat feeds"

eg. threatfeed="MDR threat feeds"

18009

device="SFW" date=2018-06-05 time=08:49:00 timezone="BST" device_name="XG310" device_id=C30006T22TGR89B log_id=086320518009 log_type="ATP" log_component="Firewall" log_subtype="Alert" priority=Notice user_name="" protocol="ICMP" src_port=0 dst_port=0 sourceip=10.198.32.89 destinationip=82.211.30.202 url=82.211.30.202 threatname=C2/Generic-A threatfeed="MDR threat feeds" eventid=C7E26E6F-0097-4EA2-89DE-C31C40636CB2 eventtype="Standard" login_user="" process_user="" ep_uuid= execution_path=""

18010

device="SFW" date=2017-01-31 time=18:44:31 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=086304418010 log_type="ATP" log_component="Firewall" log_subtype="Drop" priority=Warning user_name="gaurav" protocol="TCP" src_port=22623 dst_port=80 sourceip=10.198.47.71 destinationip=46.161.30.47 url=46.161.30.47 threatname=C2/Generic-A threatfeed="MDR threat feeds"  eventid=C366ACFB-7A6F-4870-B359-A6CFDA8C85F7 eventtype="Standard" login_user="" process_user="" ep_uuid= execution_path=""

timestamp

Timestamp

ISO 8601

eg. timestamp="2018-12-07T10:03:48+0000"

device_name

String

eg. device_name="SFW"

device_model

String

eg. device_model="XG135"

device_serial_id

String

eg. device_serial_id="C44313350024-P29PUA"

log_id

String

eg. log_id="010101600001" 

log_type

String

Event

log_component

String

Firewall Authentication

log_subtype

String

Authentication

log_version

Number

eg. log_version=1

severity

String

Information

status

String

eg. status="Successful"

user_name

String

384

"JohnDoe"

user_group

String

1024

"Sales"

client_used

String

32

refer to  Authentication (Events)

auth_mechanism

String

128

"N/A"

reason

String

128

""

src_ip

"2.2.2.2"

src_mac

String

32

"44:85:00:81:8a:8f"

src_country

String

ISO 3166 (A 3) Code

eg. src_country="IND"

src_port

Number

eg. src_port=59859

protocol

String

eg. protocol="TCP"

dst_ip

INET

IPv4,IPv6

eg. dst_ip="20.20.20.20"

dst_country

String

ISO 3166 (A 3) Code

eg. dst_country="USA"

dst_port

Number

eg. dst_port=53

start

Timestamp

ISO 8601

eg. start="2018-12-07T10:03:48+0000"

end

Timestamp

ISO 8601

eg. end="2018-12-07T10:03:50+0000"

bytes_sent

Number

64

see below

bytes_received

Number

64

see below

message

String

1024

"User JohnDoe was logged out of firewall"

user_full_name

String

384

"Butter vom Brot"

17703

log_type

log_type

String

Event

log_component

log_component

String

Firewall Authentication

log_subtype

log_subtype

String

Authentication

priority

String

Information

user_name

user

String

384

"JohnDoe"

usergroupname

user_group

String

1024

"Sales"

auth_client

client_used

String

32

refer to  Authentication (Events)

auth_mechanism

auth_mechanism

String

128

"N/A"

reason

reason

String

128

""

src_ip

src_ip

"2.2.2.2"

src_mac

src_mac

String

32

"44:85:00:81:8a:8f"

start_time

start_time

see below

sent_bytes

bytes_sent

Number

64

see below

recv_bytes

bytes_received

Number

64

see below

message

message

String

1024

"User JohnDoe was logged out of firewall"

name

name

String

384

"Butter vom Brot"

timestamp

event_timestamp

see below

17703

device="SFW" date=2017-01-31 time=18:13:40 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=062910617703 log_type="Event" log_component="Firewall Authentication" log_subtype="Authentication" status="Successful" priority=Information user_name="gaurav" usergroupname="Open Group" auth_client="Web Client" auth_mechanism="N/A" reason="" src_ip=10.198.47.71 src_mac= start_time=1485866617 sent_bytes=1233 recv_bytes=1265 message="User gaurav was logged out of firewall" name="gaurav" timestamp=1485866620

timestamp

Timestamp

ISO 8601

eg. timestamp="2018-12-07T10:03:48+0000"

device_name

String

eg. device_name="SFW"

device_model

String

eg. device_model="XG135"

device_serial_id

String

eg. device_serial_id="C44313350024-P29PUA"

log_id

String

eg. log_id="010101600001" 

log_type

String

Event

Event

log_component

String

Firewall Authentication

My Account Authentication

Dial-In Authentication

VPN Authentication

SSL VPN Authentication

GUI

Web Application Firewall

CTA

Appliance

External Authentication

VPN Portal Authentication

Firewall Authentication

log_subtype

String

Authentication

Admin

System

Authentication

log_version

Number

eg. log_version=1

severity

String

Information

Notice

Information

status

String

eg. status="Successful"

user_name

String

384

"JohnDoe"

user_group

String

1024

"Sales"

client_used

String

32

""

Authentication Agent

Web Client

SSO

Clientless

L2TP

IPSec

PPTP

CTA

MyAccount

Thin Client

Admin Client

SSLVPN

NTLM Client

24online

Android Client

iOS Client

iOS Web Client

SSLVPN Portal

Android Web Client

Radius SSO

API Client

WiFi SSO

API iOS Client

API Android Client

WAF

eDirectory SSO

Heartbeat

auth_mechanism

String

128

Local

""

LDAP

AD

RADIUS

TACACS+

EDIR

Azure AD SSO

reason

String

128

Login failed

wrong credentials

access not allowed

IP restriction

MAC restriction

max login limit reached

multiple login not allowed

Already login as clientless user

Maximum allowed users limit reached

LDAP account expired

Clientless user is not required to login

user validity expired

ip lease failed

no remote access VPN policy

no access rights

src_ip

1.1.1.1

src_country

String

ISO 3166 (A 3) Code

eg. src_country="IND"

message

String

1024

"Clientless user Nyarlathotep from 1.1.1.1 failed to log in to Firewall"

user_full_name

String

384

"Nyarlathotep S. exited"

src_mac

String

32

"44:85:00:81:8a:8f

17701

messageid="17701" log_type="Event" log_component="Firewall Authentication" log_subtype="Authentication" status="Successful" user="test1" user_group="Open Group" client_used="Web Client" auth_mechanism="Local" reason="" src_ip="55.55.55.56" message="User test1 of group Open Group logged in successfully to Firewall through Local authentication mechanism from 55.55.55.56" name="test1" src_mac=""

17702

messageid="17702" log_type="Event" log_component="Firewall Authentication" log_subtype="Authentication" status="Failed" user="test1" user_group="" client_used="Web Client" auth_mechanism="Local,LDAP,LDAP" reason="wrong credentials" src_ip="55.55.55.56" message="User test1 failed to login to Firewall through Local,LDAP,LDAP authentication mechanism from 55.55.55.56 because of wrong credentials" name="" src_mac=""

17703

messageid="17703" log_type="Event" log_component="Firewall Authentication" log_subtype="Authentication" status="Successful" user="test1" user_group="Open Group" client_used="Web Client" auth_mechanism="N/A" reason="" src_ip="55.55.55.56" src_mac="" start_time="1715012699" bytes_sent="7093" bytes_received="5829" message="User test1 was logged out of firewall" name="test1" event_timestamp="1715012800"

17704

messageid="17704" log_type="Event" log_component="My Account Authentication" log_subtype="Authentication" status="Successful" user="test1" user_group="" client_used="N/A" auth_mechanism="Local" reason="" src_ip="10.166.71.2" message="User test1 logged in successfully to MyAccount through Local authentication mechanism" name="" src_mac=""

17705

messageid="17705" log_type="Event" log_component="My Account Authentication" log_subtype="Authentication" status="Failed" user="chai" user_group="" client_used="N/A" auth_mechanism="Local,LDAP,LDAP" reason="wrong credentials" src_ip="10.166.71.2" message="User chai failed to login to MyAccount through Local,LDAP,LDAP authentication mechanism because of wrong credentials" name="" src_mac=""

17706

messageid="17706" log_type="Event" log_component="My Account Authentication" log_subtype="Authentication" status="Successful" user="test1" user_group="" client_used="" auth_mechanism="" reason="" src_ip="10.166.71.2" message="User test1 logged out from MyAccount" name="" src_mac=""

17707

messageid="17707" log_type="Event" log_component="VPN Authentication" log_subtype="Authentication" status="Successful" user="u1" user_group="" client_used="L2TP" auth_mechanism="Local" reason="" src_ip="10.171.81.64" message="User u1 logged in successfully to L2TP through Local authentication mechanism" name="" src_mac=""

17708

messageid="17708" log_type="Event" log_component="VPN Authentication" log_subtype="Authentication" status="Failed" user="u1" user_group="" client_used="L2TP" auth_mechanism="Local" reason="wrong credentials" src_ip="10.171.81.64" message="User u1 failed to login to L2TP through Local authentication mechanism because of wrong credentials" name="" src_mac=""

17709

17710

messageid="17710" log_type="Event" log_component="SSL VPN Authentication" log_subtype="Authentication" status="Successful" user="test1" user_group="" client_used="SSLVPN" auth_mechanism="Local" reason="" src_ip="55.55.55.56" message="User test1 authenticated successfully to login to SSLVPN through Local authentication mechanism" name="" src_mac=""

17711

messageid="17711" log_type="Event" log_component="SSL VPN Authentication" log_subtype="Authentication" status="Failed" user="test1" user_group="" client_used="SSLVPN" auth_mechanism="Local,LDAP,LDAP" reason="wrong credentials" src_ip="55.55.55.56" message="User test1 failed to login to SSLVPN through Local,LDAP,LDAP authentication mechanism because of wrong credentials" name="" src_mac=""

17712

17713

17714

17715

17718

messageid="17718" log_type="Event" log_component="VPN Portal Authentication" log_subtype="Authentication" status="Successful" user="test1" user_group="" client_used="N/A" auth_mechanism="Local" reason="" src_ip="55.55.55.56" message="User test1 logged in successfully to VPN portal through Local authentication mechanism" name="" src_mac=""

17720

messageid="17720" log_type="Event" log_component="VPN Portal Authentication" log_subtype="Authentication" status="Successful" user="test1" user_group="" client_used="" auth_mechanism="" reason="" src_ip="55.55.55.56" message="User test1 logged out of VPN portal" name="" src_mac=""

17824

messageid="17824" log_type="Event" log_component="SSL VPN" log_subtype="System" access_type="Remote Access" session_id="" additional_information="" start_time="0" user="test1" src_ip="10.81.0.1" bytes_sent="0" bytes_received="0" status="Established" message="SSL VPN User 'test1' connected " event_timestamp="1715013334" con_name="" dst_ip="10.81.0.2"

17825

messageid="17825" log_type="Event" log_component="SSL VPN" log_subtype="System" access_type="Remote Access" session_id="" additional_information="Reason="Logout"" start_time="1715013332" user="test1" src_ip="10.81.0.1" bytes_sent="246793" bytes_received="102177" status="Terminated" message="SSL VPN User 'test1' disconnected" event_timestamp="1715014257" con_name="" dst_ip="10.81.0.2"

17936

messageid="17936" log_type="Event" log_component="SSL VPN" log_subtype="System" session_id="ICATE_NAME='test1_6AA0CA35AA2D'" additional_information="" start_time="1414677827" user="" src_ip="" bytes_sent="0" bytes_received="0" status="Successful" message="User Certificate 'test1_6AA0CA35AA2D' was created for user 'test1'" event_timestamp="1715013162" con_name="" dst_ip=""

17945

17946

17947

17968

17718

client_used="N/A" auth_mechanism="Local" status="Successful" user_name="priya" log_type="Event" log_id="069010617718" log_subtype="Authentication" src_country="Reserved" src_ip="10.166.71.1" severity="Information" log_component="VPN Portal Authentication" message="User priya logged in successfully to VPN portal through Local authentication mechanism" bytes="0"

17719

reason="wrong credentials" client_used="N/A" auth_mechanism="Local" status="Failed" user_name="priya" log_type="Event" log_id="069010517719" log_subtype="Authentication" src_country="Reserved" src_ip="10.166.71.1" severity="Notice" log_component="VPN Portal Authentication" message="User priya failed to login to VPN portal through Local authentication mechanism because of wrong credentials" bytes="0"

17720

client_used="N/A" auth_mechanism="N/A" status="Successful" user_name="priya" log_type="Event" log_id="069010617720" log_subtype="Authentication" src_country="Reserved" src_ip="10.166.71.1" severity="Information" log_component="VPN Portal Authentication" message="User priya logged out of VPN portal" bytes="0"

log_type

log_type

String

Event

Event

log_component

log_component

String

Firewall Authentication

My Account Authentication

Dial-In Authentication

VPN Authentication

SSL VPN Authentication

GUI

Web Application Firewall

CTA

Appliance

External Authentication

VPN Portal Authentication

Firewall Authentication

log_subtype

log_subtype

String

Authentication

Admin

System

Authentication

priority

String

Information

Notice

Information

user_name

user

String

384

"JohnDoe"

usergroupname

user_group

String

1024

"Sales"

auth_client

client_used

String

32

""

Authentication Agent

Web Client

SSO

Clientless

L2TP

IPSec

PPTP

CTA

MyAccount

Thin Client

Admin Client

SSLVPN

NTLM Client

24online

Android Client

iOS Client

iOS Web Client

SSLVPN Portal

Android Web Client

Radius SSO

API Client

WiFi SSO

API iOS Client

API Android Client

WAF

eDirectory SSO

Heartbeat

auth_mechanism

auth_mechanism

String

128

Local

""

LDAP

AD

RADIUS

TACACS+

EDIR

reason

reason

String

128

Login failed

wrong credentials

access not allowed

IP restriction

MAC restriction

max login limit reached

multiple login not allowed

Already login as clientless user

Maximum allowed users limit reached

LDAP account expired

Clientless user is not required to login

user validity expired

ip lease failed

no remote access VPN policy

no access rights

src_ip

src_ip

1.1.1.1

message

message

String

1024

"Clientless user Nyarlathotep from 1.1.1.1 failed to log in to Firewall"

name

name

String

384

"Nyarlathotep S. exited"

src_mac

src_mac

String

32

"44:85:00:81:8a:8f

17701

device="SFW" date=2017-01-31 time=18:13:38 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=062910617701 log_type="Event" log_component="Firewall Authentication" log_subtype="Authentication" status="Successful" priority=Information user_name="gaurav" usergroupname="Open Group" auth_client="Web Client" auth_mechanism="Local" reason="" src_ip=10.198.47.71 message="User gaurav of group Open Group logged in successfully to Firewall through Local authentication mechanism from 10.198.47.71" name="gaurav" src_mac=

17702

17704

17705

17706

17707

device="SFW" date=2017-03-15 time=14:33:37 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=063010617707 log_type="Event" log_component="VPN Authentication" log_subtype="Authentication" status="Successful" priority=Information user_name="gaurav" usergroupname="" auth_client="N/A" auth_mechanism="Local" reason="" src_ip=10.198.233.49 message="User gaurav logged in successfully to L2TP through Local authentication mechanism" name="" src_mac=

17708

17709

17710

device="SFW" date=2017-03-15 time=17:23:00 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=063110617710 log_type="Event" log_component="SSL VPN Authentication" log_subtype="Authentication" status="Successful" priority=Information user_name="gaurav" usergroupname="" auth_client="N/A" auth_mechanism="Local" reason="" src_ip=10.198.233.49 message="User gaurav authenticated successfully to login to SSLVPN through Local authentication mechanism" name="" src_mac=

17711

17712

17713

17714

17715

17945

17946

17947

17968

17718

messageid="17718" log_type="Event" log_component="VPN Portal Authentication" log_subtype="Authentication" status="Successful" user="priyanka" user_group="" client_used="N/A" auth_mechanism="Local" reason="" src_ip="10.171.4.169" message="User priyanka logged in successfully to VPN portal through Local authentication mechanism" name="" src_mac=""

17719

messageid="17719" log_type="Event" log_component="VPN Portal Authentication" log_subtype="Authentication" status="Failed" user="priyanka" user_group="" client_used="N/A" auth_mechanism="Local" reason="wrong credentials" src_ip="1.1.1.1" message="User priyanka failed to login to VPN portal through Local authentication mechanism because of wrong credentials" name="" src_mac=""

17720

messageid="17720" log_type="Event" log_component="VPN Portal Authentication" log_subtype="Authentication" status="Successful" user="priyanka" user_group="" client_used="N/A" auth_mechanism="N/A" reason="" src_ip="10.166.71.2" message="User priyanka logged out of VPN portal" name="" src_mac=""

Timestamp

Timestamp

ISO 8601

eg. Timestamp="2018-12-07T10:03:48+0000"

device_name

String

SFW

eg. device_name="SFW"

device_model

String

eg. device_model="XG135"

device_serial_id

String

eg. device_serial_id="C44313350024-P29PUA"

log_id

String

eg. log_id="063711517815" 

log_component

String

component of log

DDNS

e.g. log_component=DDNS

log_type

String

Event

eg. log_type="Event"

log_subtype

String

subtype of log

System

e.g. log_subtype=System

log_version

Number

1

eg. log_version=1

severity

String

severity of event

Notification

e.g. severity="Notification"

status

String

eg. status="Successful"

src_host

String

256

hostname for ddns

e.g. src_host="xyz.firewall.co"

reported_ip

reason

String

128

reason of event failure

Invalid Response

Invalid IP

Invalid Configuration or bad authorization

Unknown Error

DNS Error

Reported Abuse

Invalid Response

Connect Failed

message

String

1024

e.g.

message="DDNS update for host test1.customtest.dyndns.org was Successful. Updated with IP 10.198.232.86."

message="DDNS update for host test1.customtest.dyndns.org was  Failed. Last Updated with IP:10.198.232.86

17815

log_type

log_type

log_type

u_int8_t

8

log type

Event

e.g. log_type=Event

log_component

log_component

log_component

u_int8_t

8

component of log

DDNS

e.g. log_component=DDNS

log_subtype

log_subtype

log_subtype

u_int8_t

8

subtype of log

System

e.g. log_subtype=System

priority

severity

u_int8_t

8

severity of event

Notification

e.g. severity="Notification"

host

hostname

host

String

256

hostname for ddns

e.g. hostname="xyz.firewall.co"

updatedip

updated_ip

reason

failure_reason

reason

String

128

reason of event failure

Invalid Response

Invalid IP

Invalid Configuration or bad authorization

Unknown Error

DNS Error

Reported Abuse

Invalid Response

Connect Failed

message

message

String

1024

e.g.

message="DDNS update for host test1.customtest.dyndns.org was Successful. Updated with IP 10.198.232.86."

message="DDNS update for host test1.customtest.dyndns.org was  Failed. Last Updated with IP:10.198.232.86

17815

device="SFW" date=2018-06-06 time=11:12:10 timezone="IST" device_name="SG430" device_id=S4000806149EE49 log_id=063711517815 log_type="Event" log_component="DDNS" log_subtype="System" status="Success" priority=Notice host=test1.customtest.dyndns.org updatedip=10.198.232.86 reason="" message="DDNS update for host test1.customtest.dyndns.org was Successful. Updated with IP 10.198.232.86."

timestamp

Timestamp

ISO 8601

eg. timestamp="2018-12-07T10:03:48+0000"

device_name

String

SFW

eg. device_name="SFW"

device_model

String

eg. device_model="XG135"

device_serial_id

String

eg. device_serial_id="C44313350024-P29PUA"

log_id

String

eg. log_id="010101600001" 

log_type

String

Log Type

Event

log_component

String

Log Component

DHCP Server

e.g.

log_component="DHCP Server"

log_subtype

String

Log subtype

System

e.g.

log_subtype="System"

status

String

DHCP lease status

Renew

Release

Expire

e.g.

status="Renew"

log_version

Number

1

eg. log_version=1

Severity

String

Severity of log

Information

reported_ip

IPv4 or IPv6 address leased to DHCP client

e.g.

reported_ip="55.1.1.2"

src_mac

String

32

MAC address of the DHCP client

e.g.

src_mac="1a:74:ed:3c:74:ce"

reported_host

String

384

Hostname of the DHCP client

e.g.

reported_host="AH-MM-33445.green.sophos"

message

String

1024

Message about DHCP lease

e.g.

message="Lease IP 55.1.1.2 renewed for MAC 1a:74:ed:3c:74:ce"

lease_time

Number

eg. lease_time=86400

60020

60021

60022

log_type

log_type

String

Log Type

Event

log_component

log_component

String

Log Component

DHCP Server

e.g.

log_component="DHCP Server"

log_subtype

log_subtype

String

Log subtype

System

e.g.

log_subtype="System"

status

status

String

DHCP lease status

Renew

Release

Expire

e.g.

status="Renew"

priority

String

Priority of log

INFORMATION

ipaddress

leased_ip

IPv4 or IPv6 address leased to DHCP client

e.g.

leased_ip="55.1.1.2"

client_physical_address

src_mac

String

32

MAC address of the DHCP client

e.g.

src_mac="1a:74:ed:3c:74:ce"

client_host_name

client_host_name

String

384

Hostname of the DHCP client

e.g.

client_host_name="AH-MM-33445.green.sophos"

message

message

String

1024

Message about DHCP lease

e.g.

message="Lease IP 55.1.1.2 renewed for MAC 1a:74:ed:3c:74:ce"

raw_data

raw_data

8192

DHCP lease details

e.g.

raw_data="55.1.1.2 Tue 05 Jun 00:51:06 2018 Wed 06 Jun 00:51:06 2018 1a:74:ed:3c:74:ce -

60020

device="SFW" date=2018-06-04 time=21:25:36 timezone="-03" device_name="XG330" device_id=C310073YJRGBF7F log_id=063411660020 log_type="Event" log_component="DHCP Server" log_subtype="System" status="Renew" priority=Information ipaddress="5.5.5.5" client_physical_address="00:1a:8c:5f:b4:f6" client_host_name="" message="Lease IP 5.5.5.5 renewed for MAC 00:1a:8c:5f:b4:f6" raw_data="5.5.5.5#011Mon 04 Jun 21:25:36 2018#011Mon 04 Jun 21:27:36 2018#01100:1a:8c:5f:b4:f6#011-"

60021

device="SFW" date=2018-06-04 time=21:34:22 timezone="-03" device_name="XG330" device_id=C310073YJRGBF7F log_id=063411660021 log_type="Event" log_component="DHCP Server" log_subtype="System" status="Release" priority=Information ipaddress="5.5.5.15" client_physical_address="00:1a:8c:5f:b4:f6" client_host_name="" message="Lease IP 5.5.5.15 released from MAC 00:1a:8c:5f:b4:f6" raw_data="5.5.5.15#01100:1a:8c:5f:b4:f6#011-"

60022

device="SFW" date=2018-06-04 time=21:34:22 timezone="-03" device_name="XG330" device_id=C310073YJRGBF7F log_id=063411660022 log_type="Event" log_component="DHCP Server" log_subtype="System" status="Expire" priority=Information leased_ip="172.16.16.17" src_mac="-" client_host_name="" message="Lease 172.16.16.17 expired" raw_data="172.16.16.17"

timestamp

Timestamp

ISO 8601

eg. timestamp="2018-12-07T10:03:48+0000"

device_name

String

eg. device_name="SFW"

device_model

String

eg. device_model="XG135"

device_serial_id

String

eg. device_serial_id="C44313350024-P29PUA"

log_id

String

eg. log_id="041107413001" 

log_type

Log type

Anti-Spam

log_component

Component of log

SMTP

SMTPS

log_subtype

Type of spam

Spam

Probable Spam

Clean

Outbound Spam

Outbound Probable Spam

Outbound Clean

DLP

SPX

Dos

Allowed

Denied

log_version

Number

1

eg. log_version=1

severity

Severity of mail spam

Information

Warning

Notification

Error

fw_rule_id

Number

int32

user_name

String

384

user_group

String

eg. user_group="student"

policy_name

String

32

Policy name

sender

String

1024

Email address of sender

e.g. sender="test@test.local"

recipient

String

1024

Email address of recipient

eg. recipient="test1@test.local"

subject

String

1024

Subject of mail

eg. subject="test"

message_id

String

64

Message id

eg. message_id="10001"

email_size

u_int32_t

int32

Message size

eg. email_size="1111"

action

String

32

Drop

Quarantine

Reject

Tmpreject

Accept

reason

String

256

Mail detected as SPAM

Mail detected as PROBABLE SPAM

Mail is Clean

Sender IP address is blacklisted

Mail detected as OUTBOUND SPAM

Mail detected as OUTBOUND PROBABLE SPAM

Email containing confidential data detected. Relevant Data Protection Policy applied.

SMTP DoS

src_host

String

64

dst_host

String

64

src_ip

ipaddr_t

32

Source IP address

eg. src_ip="1.1.1.1"

src_ip="345::12"

src_country

String

64

ISO 3166 (A 3) Code

eg. "IND"

"USA"

dst_ip

ipaddr_t

32

Destination IP address

eg. dst_ip="1.1.1.2"

dst_ip="345::11"

dst_country

String

64

ISO 3166 (A 3) Code

eg. "IND"

"USA"

src_port

u_int16_t

16

Source port

eg. src_port="1234"

dst_port

u_int16_t

16

Destination port

eg. dst_port="12345"

protocol

String

eg. protocol="POP"

src_zone_type

String

eg. src_zone_type="LAN"

src_zone

String

eg. src_zone="LAN"

dst_zone_type

String

eg. dst_zone_type="WAN"

dst_zone

String

eg. dst_zone="WAN"

bytes_sent

Number

int32

bytes_received

Number

int32

quarantine_reason

u_int32_t

32

Reason for mail quarantine

eg. quarantine_reason="Infected"

app_name

String

13001

13002

13003