Traffic : Local 1

Vendor Documentation

Rule Name	Rule Type	Common Event	Classification
Traffic : Local	Base Rule	General Traffic Log	Network Traffic
Traffic Local Closed	Sub Rule	General Traffic Other Notice	Information
Local Traffic Timeout	Sub Rule	Session Disconnected	Information
Traffic Local Accepted	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Local Traffic Accepted	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Traffic Local Deny	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Forward Traffic Deny	Sub Rule	Traffic Denied by Network Firewall	Network Deny

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
logid	<vmid> <tag1>	Number	The ID (logid) is a 10-digit field. It is a unique identifier for that specific log.
srcip	<sip>	IP Address	IP address of the traffic’s origin.
dstip	<dip>	IP Address	Destination IP address for the web.
srcport	<sport>	Number	Port number of the traffic's origin.
dstport	<dport>	Number	Port number of the traffic's destination.
srcintf	<sinterface>	Text\String	Interface name of the traffic's origin.
dstintf	<dinterface>	Text\String	Interface of the traffic's destination.
proto	<protnum>	Number	The protocol used by web traffic (tcp by default),
sessionid	<session>	Number	ID for the session.
appcat	<objectname>	Text\String	Category of the application.
devname	<subject>	Text\String	N/A
policyid	<policy>	Number	N/A
action	<action> <tag2>	Text\String	N/A
rcvdbyte	<bytesin>	Number	N/A
sentbyte	<bytesout>	Number	N/A
rcvdpkt	<packetsin>	Number	N/A
sentpkt	<packetsout>	Number	N/A