Junos Syslog Event

Junos Syslog Event

Base Rule

Information

General Security Information

N/A

N/A

N/A

The time when the log was generated on the SRX Series device.

N/A

N/A

N/A

The time when the log was received on the log collector.

N/A

N/A

N/A

The name of the SRX Series device.

N/A

<vendorinfo>

Text/String

The event name of the log.

Source-Country

N/A

N/A

The source country name.

source-address

<sip>

IP Address

The source IP address from where the event occurred.

Destination-Country

N/A

N/A

Destination country name from where the event occurred.

destination-address

<dip>

IP Address

The destination IP address of the event.

source-port

<sport>

Number

The source port of the event.

destination-port

<dport>

Number

The destination port of the event.

Description

<subject>

Text/String

The description of the log.

Attack-name

<threatname>

Text/String

Attack name of the log: Trojan, worm, virus, etc.

Threat-Severity

<severity>

Text/String

The severity level of the threat.

Policy Name

<policy>

Text/String

The policy name in the log.

UTM-category or Virus-Name

N/A

N/A

The UTM category of the log.

URL

<url>

Text/String

Accessed URL name that triggered the event.

Event category

N/A

N/A

The event category of the log.

Username

<account>

Text/String

The username of the log.

Action

<action>

Text/String

Action taken for the event: warning, allow, and block.

Log-Source

N/A

N/A

The IP address of the log source.

Application

N/A

N/A

The application name from which the events or logs are generated

Hostname

<sname>

Text/String

The host name in the log.

Service-Name

N/A

N/A

The name of the application service. For example, FTP, HTTP, SSH, etc.

Nested-Application

N/A

N/A

The nested application in the log.

source-zone-name

N/A

N/A

The source zone of the log.

destination-zone-name

N/A

N/A

The destination zone of the log.

Protocol-ID

<protnum>

Number

The protocol ID in the log.

Roles

N/A

N/A

The role name associated with the log.

Reason

<reason>

Text/String

The reason for the log generation. For example, a connection tear down may have an associated reason such as authentication failed.

NAT-Source-Port

<snatport>

Number

The translated source port.

NAT-Destination-Port

<dnatport>

Number

The translated destination port.

NAT-Source-Rule-Name

N/A

N/A

The NAT source rule name.

NAT-Destination-Rule-Name

N/A

N/A

The NAT destination rule name.

NAT-Source-address

<snatip>

IP Address

The translated (or natted) source IP address. It can contain IPv4 or IPv6 addresses.

nat-destination-address

<dnatip>

IP Address

The translated (also called natted) destination IP address.

Traffic-Session-ID

<session>

Number

The traffic session ID of the log.

Path-Name

N/A

N/A

The path name of the log.

Logical-system-Name

N/A

N/A

The name of the logical system.

Rule-Name

N/A

N/A

The name of the rule.

Profile-Name

N/A

N/A

The name of the All events profile that triggered the event.

Client-Hostname

<dname>

Text/String

Hostname of the client.

Malware-Info

N/A

N/A

Information of the malware.

Logical-Subsystem-Name

N/A

N/A

The name of the logical system in JSA logs.