V 2.0 : Cloud Firewall Logs
Vendor Documentation
Classification
Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|
V 2.0 : Cloud Firewall Logs | Base Rule | General Network Traffic | Network Traffic |
V 2.0 : Cloud Traffic Allowed | Sub Rule | Traffic Allowed by Network Firewall | Network Allow |
V 2.0 : Cloud Traffic Blocked | Sub Rule | Traffic Denied by Network Firewall | Network Deny |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
---|---|---|---|
Timestamp | N/A | N/A | The timestamp of the request transaction in UTC. |
Origin IDs | N/A | N/A | The unique identity of the network tunnel. |
Identities | <object> | Text/String | The names of the network tunnel. |
Identity Type | <objecttype> | Text/String | The type of identity that made the request. Should always be "CDFW Tunnel Device". |
Direction | N/A | N/A | The direction of the packet. It is destined either towards the internet or to the customer's network. |
Protocol | <protnum> | Number | The actual protocol of the traffic. It could be TCP, UDP, ICMP. |
Packet Size | <size> | Number | The size of the packet that Umbrella CDFW received. |
Source IP | <sip> | IP Address | The internal IP address of the user-generated traffic towards the CDFW. If the traffic goes through NAT before it comes to CDFW, it will be the NAT IP address. |
Source Port | <sport> | Number | The internal port number of the user-generated traffic towards the CDFW. |
Destination IP | <dip> | IP Address | The destination IP address of the user-generated traffic towards the CDFW. |
Destination Port | <dport> | Number | The destination port number of the user-generated traffic towards the CDFW. |
Data Center | N/A | N/A | The name of the Umbrella data center that processed the user-generated traffic. |
Rule ID | N/A | N/A | The ID of the rule that processed the user traffic. |
Action | <action> <tag1> | Text/String | The categories that resulted in the destination being blocked. Available in version 4 and above. |