Firewall Messages
Vendor Documentation
Classification
Rule Name | Rule Type | Common Event | Classification |
|---|---|---|---|
| Firewall Messages | Base Rule | General Firewall Log | Network Traffic |
| 1004 : FW_Related-Connection | Sub Rule | Traffic Allowed by Host Firewall | Network Allow |
| 70022 : Connection_Closed-Abnormally | Sub Rule | Connection Terminated | Network Traffic |
| 70026 : Connection_Progress | Sub Rule | Connection Starting | Network Traffic |
| 70019 : Connection_Discarded | Sub Rule | Connection Closed | Network Traffic |
| 70018 : Connection_Allowed | Sub Rule | Traffic Allowed by Host Firewall | Network Allow |
| 71257 : TCP_Segment-SYN-No-Options | Sub Rule | TCP SYN Received | Network Traffic |
| 70021 : Connection_Closed | Sub Rule | Connection Closed | Network Traffic |
Mapping with LogRhythm Schema
| Device Key in Log Message | LogRhythm Schema | Data Type |
| Version | <version> | Number |
| vmid | <vmid> | Number |
| objectname | <objectname> | Text/String |
| severity | <severity> | Text/String/Number |
| spt | <sport> | Number |
| dst | <dip> | IP Address |
| request | <object> | Text/String |
| app | <session> | Text/String/Number |
| act | <command> | Text/String |
| msg | <object> | Text/String |
| deviceoutboundinterface | <sinterface> | Text/String/Number |
| deviceinboundinterface | <dinterface> | Text/String/Number |
| proto | <protnum> | Number |
| dpt | <dport> | Number |
| in | <bytesin> | Number |
| out | <bytesout> | Number |
| src | <sip> | IP Address |