firewall.velocloud

Introduction

Tags beginning with firewall.velocloud identify events generated by VeloCloud.

The full tag must have 3 levels. The first two are fixed as firewall.velocloud. The third level identifies the type of events sent.

Product / Service	Tags	Data tables

Product / Service	Tags	Data tables
VeloCloud Firewall	`firewall.velocloud.traffic`	`firewall.velocloud.traffic`

These are the fields displayed in this table:

Field	Type	Field transformation	Source field name	Extra fields

Field	Type	Field transformation	Source field name	Extra fields
eventdate	`timestamp`
host	`str`		vhost
sid	`str`
sessionID	`int8`		id
segmentObjectId	`int8`
ruleLogicalId	`str`
interface	`str`
protocol	`str`
srcIp	`ip4`		sourceIp
srcPort	`int4`		sourcePort
dstIp	`ip4`		destIp
dstPort	`int4`		destPort
dest_name	`str`		sdwanDestination
action	`str`
application	`str`
durationSecs	`int8`
bytesSent	`int8`
bytesReceived	`int8`
reason	`str`
nat_src	`ip4`
nat_spt	`int4`
svlan	`str`
dvlan	`str`
dstDomain	`str`
fwPolicyName	`str`
eventName	`str`	`(isnull(action) ? "null" : action) + "_" + (isnull(protocol) ? "null" : protocol) + "_" + (isnull(reason) ? "null" : reason)`	reason protocol action
hostchain	`str`			✓
tag	`str`			✓
rawMessage	`str`