EVID 35002 : EPO - Firewall Event

https://kcm.trellix.com/corporate/index?page=content&id=KB54677

Evid 35002 : EPO - Firewall Event

Base Rule

Information

General Firewall Event

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

MachineName

<dname>

Text/String

Name of the system hosting the detecting product.

AgentGuid

N/A

N/A

Unique identifier of the agent that forwarded the event.

IPAddress

N/A

N/A

IP address of the system hosting the detecting product (if given in the event).

OSName

N/A

N/A

N/A

UserName

<domainimpacted>
<account>

Text/String

N/A

TimeZoneBias

N/A

N/A

N/A

RawMACAddress

<dmac>

Text/String/Number

MAC address of the system hosting the detecting product.

ProductName

<vendorinfo>

Text/String

Name of the detecting managed product.

ProductVersion

<version>

Text/String/Number

Version number of the detecting product.

ProductFamily

N/A

N/A

N/A

Analyzer

N/A

N/A

N/A

AnalyzerName

N/A

N/A

Name of the detecting managed product.

AnalyzerVersion

N/A

N/A

Version number of the detecting product.

AnalyzerHostName

N/A

N/A

N/A

AnalyzerDetectionMethod

<object>

Text/String

N/A

EventID

<vmid>

Number

Unique identifier of the event class.

Severity

<severity>

Text/String/Number

N/A

GMTTime

N/A

N/A

N/A

ThreatActionTaken

<action>

Text/String

The action taken by the product in response to the threat.

ThreatCategory

<subject>

Text/String

Category of the event. Possible categories depend on the product.

ThreatEventID

N/A

N/A

N/A

ThreatName

<threatname>

Text/String

Name of the threat.

ThreatSeverity

<severity>

Text/String/Number

N/A

ThreatType

N/A

N/A

Class of the threat.

DetectedUTC

N/A

N/A

N/A

ThreatHandled

<result>

Text/String/Number

N/A

SourceIPV4

<sip>

IP Address

N/A

TargetIPV4

<dip>

IP Address

N/A

TargetPort

<dport>

Number

N/A

TargetProtocol

<protname>

Text/String

N/A

target

N/A

N/A

N/A

BladeName

N/A

N/A

N/A

AnalyzerTechnologyVersion

N/A

N/A

N/A

AnalyzerRuleID

N/A

N/A

N/A

AnalyzerRuleName

<policy>

Text/String

N/A

AnalyzerGTIQuery

N/A

N/A

N/A

SourcePort

<sport>

Number

N/A

SourceParentProcessSigned

N/A

N/A

N/A

SourceFileSize

N/A

N/A

N/A

SourceSigned

N/A

N/A

N/A

TargetSigned

N/A

N/A

N/A

TargetParentProcessSigned

N/A

N/A

N/A

TargetFileSize

<size>

Number

N/A

AttackVectorType

N/A

N/A

N/A

DurationBeforeDetection

N/A

N/A

N/A

NaturalLangDescription

N/A

N/A

N/A

Direction

N/A

N/A

N/A

ICMPType

N/A

N/A

N/A

ThrottledEventCount

N/A

N/A

N/A

AccessRequested

N/A

N/A

N/A