Anti-Malware

Vendor Documentation

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122323

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk144192

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Product	<version>	<vmid>
Origin	<sender>	N/A
Action	<action>	<action>
Action	<tag1>	<tag1>
SIP	<sip>	<sip>
SPort	<sport>	<sport>
DIP	<dip>	<dip>
DPort	<dport>	<dport>
src_machine_name	<sname>	<sname>
protocol	<protname>	<protnum>
ifname	<sinterface>	<sinterface>
ifdirection	<tag2>	N/A
User	<login>	N/A
src_user_name	<login>	<login>
Url	<url>	<url>
web_client_type	<useragent>	<useragent>
sent_bytes	<bytesout>	<bytesin>
received_bytes	<bytesin>	<bytesout>
session_id	<session>	N/A
malware_family	<objecttype>	N/A
Confidence_Level	<amount>	N/A
severity	<severity>	<severity>
malware_action	<vendorinfo>	<vendorinfo>
rule_name	<command>	N/A
Protection_Name	<threatname>	<threatname>
Protection_Name	<object>	N/A
status	<status>	<status>
Dst_DNS_Host	<dname>	<domainimpacted>
description	<subject>	N/A
Reason	<reason>	<reason>
Attack	<threatname>	N/A
Virus_Name	<threatname>	N/A
short_desc	<vmid>	N/A
N/A	N/A	<snatip>
N/A	N/A	<policy>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Rule ID	Rule Name	Rule Type	Common Event	Classification
1010506	Anti-Malware	Base Rule	General Threat Protection Event	Activity
	Anti-Malware : Activity Detected	Sub Rule	Possible Malware Activity	Malware
	Anti-Malware : Control Traffic	Sub Rule	General Threat Message	Activity
	Anti-Malware : Traffic Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
	Anti-Malware : Traffic Blocked	Sub Rule	Threat Blocked	Failed Activity
	Anti-Malware : Traffic Dropped	Sub Rule	Threat Blocked	Failed Activity
	Anti-Malware : Traffic Rejected	Sub Rule	Threat Blocked	Failed Activity

LogRhythm Default v2.0

Rule ID	Rule Name	Rule Type	Common Event	Classification
1011997	V 2.0 : Anti-Malware Events	Base Rule	Detected Malware Activity	Malware
	V 2.0 : Anti-Malware Events : Malware Detected	Sub Rule	Detected Malware Activity	Malware
	V 2.0 : Anti-Malware Events : Malware Prevented	Sub Rule	Failed Malware Activity	Failed Malware