URL Filter Messages

Vendor Documentation

Rule Name	Rule Type	Common Event	Classification
URL Filter Messages	Base Rule	URL Information	Information
Website Blocked	Sub Rule	Web Site Blocked - Category	Failed Activity
Website Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
logid	<vmid>	Number	The ID (logid) is a 10-digit field. It is a unique identifier for that specific log.
level	<severity>	Text\String	Each log entry contains a Level (level) field that indicates the estimated severity of the event that caused the log entry.
srcip	<sip>	IP Address	IP address of the traffic’s origin.
dstip	<dip>	IP Address	Destination IP address for the web.
hostname	<dname>	Text\String	N/A
srcport	<sport>	Number	Port number of the traffic's origin.
dstport	<dport>	Number	Port number of the traffic's destination.
srcintf	<sinterface>	Text\String	Interface name of the traffic's origin.
dstintf	<dinterface>	Text\String	Interface of the traffic's destination.
proto	<protnum>	Number	The protocol used by web traffic (tcp by default).
service	<protname>	Text\String	Name of the service.
sessionid	<session>	Number	N/A
msg	<subject>	Text\String	N/A
url	<url>	Text\String	N/A
action	<command>	Text\String	N/A
catdesc	<status>	Text\String	N/A
rcvdbyte	<bytesin>	Number	N/A
sentbyte	<bytesout>	Number	N/A