Document toolboxDocument toolbox

proxy.bluecoat

Introduction

The tags beginning with proxy.bluecoat identify events generated by Symantec ProxySG (formerly Proxy Blue Coat) belonging to Symantec.

Valid tags and data tables 

The full tag must have at least 4 levels. The first two are fixed as proxy.bluecoat. The third level identifies the type of events sent and the rest of them indicate the event subtypes.

These are the valid tags and corresponding data tables that will receive the parsers' data:

Product / Service

Tags

Data tables

Product / Service

Tags

Data tables

Symantec ProxySG (formerly Proxy Blue Coat)

proxy.bluecoat.proxysg.bcreportermain_v1

proxy.bluecoat.proxysg.bcreportermain_v1

proxy.bluecoat.proxysg.leef

proxy.bluecoat.proxysg.leef

proxy.bluecoat.proxysg.main.kv

proxy.bluecoat.proxysg.main

proxy.bluecoat.proxysg.main.app

proxy.bluecoat.proxysg.main

For more information, read more about Devo tags.

Table structure

These are the fields displayed in these tables:

proxy.bluecoat.proxysg.bcreportermain_v1

Field

Type

Source field name

Extra fields

Field

Type

Source field name

Extra fields

eventdate

timestamp

 

 

proxyHost

str

 

 

serverdate

timestamp

 

 

time_taken

str

 

 

c_ip

str

 

 

cs_username

str

 

 

cs_auth_group

str

 

 

x_exception_id

str

 

 

sc_filter_result

str

 

 

cs_categories

str

 

 

cs_referer

str

 

 

sc_status

str

 

 

s_action

str

 

 

cs_method

str

 

 

rs_content_type

str

 

 

cs_uri_scheme

str

 

 

cs_host

str

 

 

cs_uri_port

str

 

 

cs_uri_path

str

 

 

cs_uri_query

str

 

 

cs_uri_extension

str

 

 

cs_user_agent

str

 

 

s_ip

str

 

 

sc_bytes

str

 

 

cs_bytes

str

 

 

x_virus_id

str

 

 

x_bluecoat_application_name

str

 

 

x_bluecoat_application_operation

str

 

 

x_bluecoat_transaction_uuid

str

 

 

x_icap_reqmod_header_X_ICAP_Metadata

str

 

 

x_icap_respmod_header_X_ICAP_Metadata

str

 

 

hostchain

str

 

✓

tag

str

 

✓

rawMessage

str

rawSource

✓

proxy.bluecoat.proxysg.leef

Field

Type

Source field name

Extra fields

Field

Type

Source field name

Extra fields

eventdate

timestamp

 

 

proxyHost

str

 

 

srcIp

ip4

 

 

srcPort

int4

 

 

dstIp

ip4

 

 

dstPort

int4

 

 

username

str

 

 

deviceTime

timestamp

 

 

sAction

str

 

 

scStatus

int4

 

 

csMethod

str

 

 

timeTaken

int4

 

 

scBytes

int8

 

 

csBytes

int8

 

 

csUriScheme

str

 

 

csHost

str

 

 

csUriQuery

str

 

 

csUriExtension

str

 

 

csAuthGroup

str

 

 

rsContentType

str

 

 

csUserAgent

str

 

 

csReferer

str

 

 

scFilterResult

str

 

 

filterCategory

str

 

 

sslBlueCoat

int4

 

 

csXForwardedFor

str

 

 

sSupplierName

ip4

 

 

xExceptionId

str

 

 

csCategories

str

 

 

serverIp

ip4

 

 

xVirusId

str

 

 

xBluecoatAppName

str

 

 

xBluecoatAppOp

str

 

 

xCsCertCN

str

 

 

xVirusDetails

str

 

 

xIcapErrorCode

str

 

 

xIcapErrorDetails

str

 

 

xBluecoatRefId

str

 

 

csCategorizationTime

int4

 

 

csUri

str

 

 

csUriPath

str

 

 

hostchain

str

 

✓

tag

str

 

✓

rawMessage

str

rawSource

✓

proxy.bluecoat.proxysg.main

Field

Type

Field Transformation

Source field name

Extra fields

Field

Type

Field Transformation

Source field name

Extra fields

eventdate

timestamp

 

 

 

proxyHost

str

 

 

 

serverdate

timestamp

ifthenelse(isnotnull(serverdatecomp), serverdatecomp, parsedate(serverdatedate, +' ' + serverdatetime, dateformat("DD/MM/YYYY HH:mm:ss")))

serverdatedate

serverdatecomp

serverdatetime

 

username

str

 

 

 

srcIp

ip4

 

 

 

srcPort

str

 

 

 

host

str

 

 

 

dstPort

int4

 

 

 

protocol

str

 

 

 

method

str

 

 

 

url

str

 

 

 

urlQuery

str

 

 

 

statusCode

int4

 

 

 

action

str

 

 

 

filterResult

str

 

 

 

categories

str

 

 

 

contentType

str

 

 

 

referer

str

 

 

 

userAgent

str

 

 

 

authGroup

str

 

 

 

supplier

str

 

 

 

serverIp

ip4

 

 

 

responseTime

int4

 

 

 

responseLength

int4

 

 

 

requestLength

int4

 

 

 

virusID

str

 

 

 

hostchain

str

 

 

✓

tag

str

 

 

✓

date

str

 

 

 

eventCode

str

 

 

 

event

str

 

 

 

failureCode

str

 

 

 

symbol

str

 

 

 

domain

str

 

 

 

reason

str

 

 

 

code

str

 

 

 

severity

str

 

 

 

app

str

 

 

 

messageCode

str

 

 

 

rawMessage

str

 

rawSource

 

How is the data sent to Devo?

Since there is no facility for applying the Devo tag in the source system, the events should be forwarded to a Devo Relay. 

Devo Relay rules

You need to define two relay rules as described below. It is important the rules run in the specified order on the relay - Rule 1 must come before Rule 2.

Rule 1:  Drop all events received on the port that start with #

  • Source Port → 13005

  • Source Data → ^#.*

  • Check the Stop Processing and Drop Event checkboxes

Rule 2:  Tag all other events received on the port as proxy.bluecoat.proxysg.main.

  • Source Port → 13005

  • Target Tag → proxy.bluecoat.proxysg.main

  • Check the Sent without syslog tag checkbox

Â