...
This table collects different firewall IPS-related logs.
Source tables
The information displayed is extracted from the following tables:
firewall.checkpoint.log_exporter
firewall.fortinet.utm.ips
firewall.sonicwall.genv58
...
Note |
---|
Extra fields Fields marked as Extra in the table below are not shown by default in data tables and need to be explicitly requested in the query. You can find them marked as Extra when you perform a query so they can be easily identified. Learn more about this in Selecting unrevealed columns. |
Field | Type | Source field name | Extra fields |
---|---|---|---|
eventdate |
|
| |
source |
|
| |
firewall_name |
| fwname | |
firewall_cluster |
|
fwcluster |
source_ip |
|
| |
source_ipv4 |
| srcIp | |
source_port |
ip4
|
|
destination_ip |
int4
|
|
destination_ipv4 |
|
dstIp |
destination_port |
int4
|
| ||
action |
|
| |
severity |
|
|
attack_name |
bool
|
attack | |
attack_id |
|
attackId |
rawMessage |
|
rawSource | |||
hostchain |
|
| ✓ |
tag |
|
|
✓
str
rawSource
✓ |
Field transformations
Even though all source tables have several features in common, they have some particularities that make it necessary to undergo a set of transformations to harmonize them for the union table. The most common transformations comprise changes in the data type or the application of rules when several columns in the source table feed a single column in the union table. You can find below the detailed list of transformations in each source table.
Anchor | ||||
---|---|---|---|---|
|
Field in union table | Field in source table | Field transformation | Type | Extra fields | ||
---|---|---|---|---|---|---|
eventdate | eventdate |
|
| |||
source | - |
|
| |||
firewall_name | firewall_name |
|
| |||
firewall_cluster | firewall_cluster |
|
| |||
source_ip | srcIp_str |
|
| |||
source_ipv4 | source_ipv4 |
|
| |||
source_port | s_port |
|
| |||
destination_ip | dstIp_str |
|
| |||
destination_ipv4 | destination_ipv4 |
|
| |||
destination_port | p_dport |
|
| |||
action | action |
|
| |||
severity | severity |
|
| |||
attack_name | attack_name |
|
| |||
attack_id | attack_id |
|
| |||
rawSource | rawSource |
|
| ✓ | ||
rawMessage | rawMessage |
|
| |||
hostchain | hostchain |
|
| ✓ | ||
tag | tag |
|
| ✓ |
Anchor | ||||
---|---|---|---|---|
|
fwcluster
virtDomain
Code Block |
---|
virtDomain ?: 'default' |
str
srcIp
Field in union table | Field in source table | Field transformation | Type | Extra fields | |
---|---|---|---|---|---|
eventdate | eventdate |
|
| ||
source | - |
|
|
fwname
devName
Code Block |
---|
devName ?: 'default' |
str
firewall_name | firewall_name |
|
| |||
firewall_cluster | firewall_cluster |
|
| |||
source_ip | srcIp_str |
|
| |||
source_ipv4 | source_ipv4 |
|
| |||
source_port | srcPort |
|
| |||
destination_ip | dstIp_str |
|
int4
dstIp
|
dstIp
destination_ipv4 | destination_ipv4 |
|
|
destination_port | dstPort |
|
|
int4
attack
| ||||
action | action |
|
| |
severity | severity |
|
|
httpService
service
Code Block |
---|
eq(service, "HTTP") |
bool
attack_name | attack_name |
|
| |
attack_id | attack_id |
|
|
rawSource |
rawMessage |
|
|
str
✓ |
rawMessage | rawMessage |
|
| |
hostchain | hostchain |
|
| ✓ |
tag | tag |
str
✓
rawMessage
|
| ✓ |
Anchor | ||||
---|---|---|---|---|
|
Field in union table | Field in source table | Field transformation | Type | Extra fields | |
---|---|---|---|---|---|
eventdate | eventdate |
|
| ||
source | - |
|
|
fwname
sn
Code Block |
---|
sn ?: 'default' |
str
fwcluster
fw
Code Block |
---|
fw ?: 'default' |
str
srcIp
srcIp
ip4
srcPort
srcPort
Code Block |
---|
int4(srcPort) |
int4
dstIp
dstIp
ip4
dstPort
dstPort
Code Block |
---|
int4(dstPort) |
int4
attack
ipscat
Code Block |
---|
replace(ipscat, split(ipscat, " ", 0), "") |
str
attackId
sid
Code Block |
---|
str(sid) |
str
firewall_name | firewall_name |
|
| |||
firewall_cluster | firewall_cluster |
|
| |||
source_ip | srcIp |
|
| |||
source_ipv4 | source_ipv4 |
|
| |||
source_port | srcPort |
|
| |||
destination_ip | dstIp |
|
| |||
destination_ipv4 | destination_ipv4 |
|
| |||
destination_port | dstPort |
|
| |||
action | m |
|
| |||
severity | ipspri |
|
|
httpService
ipscat
Code Block |
---|
(startswith(ipscat, "WEB-") or ipscat = "SOCIAL-NETWORKING") |
bool
attack_name | attack_name |
|
| |
attack_id | attack_id |
|
| |
rawSource | rawMessage |
|
| ✓ |
rawMessage | rawMessage |
|
| |
hostchain | hostchain |
|
| ✓ |
tag | tag |
str
✓
rawMessage
|
| ✓ |