Document toolboxDocument toolbox

av.checkpoint

Introduction

The tags beginning with av.checkpoint identify events generated by antivirus services belonging to Check Point.

Valid tags and data tables 

The full tag must have 4 levels. The first two are fixed as av.checkpoint. The third level identifies the type of events sent. The fourth level indicates the event subtype.

These are the valid tags and corresponding data tables that will receive the parsers' data:

Product / Service

Tags

Data tables

Product / Service

Tags

Data tables

Mobile Threat Prevention

av.checkpoint.mtp.audit

av.checkpoint.mtp.audit

av.checkpoint.mtp.event

av.checkpoint.mtp.event

For more information, read more About Devo tags.

Table structure

These are the fields displayed in these tables:

av.checkpoint.mtp.audit

Field

Type

Source field name

Extra fields

Field

Type

Source field name

Extra fields

eventdate

timestamp

 

 

machine

str

vmachine

 

url

str

 

 

auditAlertSeverity

str

 

 

user

str

 

 

module

str

 

 

category

str

 

 

event

str

 

 

eventData

str

 

 

hostchain

str

 

✓

tag

str

 

✓

rawMessage

str

message

✓

av.checkpoint.mtp.event

Field

Type

Source field name

Extra fields

Field

Type

Source field name

Extra fields

eventdate

timestamp

 

 

machine

str

vmachine

 

url

str

 

 

devideAlertEvent

str

 

 

eventType

str

 

 

signature

str

 

 

riskLevel

str

 

 

deviceID

str

 

 

deviceOwner

str

 

 

deviceEmail

str

 

 

deviceNumber

str

 

 

deviceType

str

 

 

deviceOSLevel

str

 

 

deviceModel

str

 

 

deviceRiskLevel

str

 

 

hostchain

str

 

✓

tag

str

 

✓

rawMessage

str

message

✓

Â