V 2.0 : Content Awareness Events

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122323

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk144192

V 2.0 : Content Awareness Events

Base Rule

General Network Traffic

Network Traffic

V 2.0 : Content Awareness : Traffic Accept

Sub Rule

Traffic Allowed by Network Firewall

Network Allow

V 2.0 : Content Awareness : Traffic Reject

Sub Rule

Traffic Denied by Network Firewall

Network Deny

V 2.0 : Content Awareness : Traffic Allow

Sub Rule

Traffic Allowed by Network Firewall

Network Allow

V 2.0 : Content Awareness : Traffic Block

Sub Rule

Traffic Denied by Network Firewall

Network Deny

subproduct

N/A

N/A

Sub-product

Product

<vmid>

Text/String

Product name

Action

<action>
<tag1>

Text/String

N/A

Originip

N/A

N/A

IP of the log origin 

SIP

<sip>

IP Address

Source IP

Origin

N/A

N/A

Name of the first Security Gateway that reported this event

src_machine_name

N/A

N/A

Machine name connected to source IP

DIP

<dip>

IP Address

Destination IP

dst_machine_name

N/A

N/A

Machine name connected to destination IP

dport

<dport>

Number

Destination host port number

protocol

<protnum>

Number

Protocol detected on the connection

ifname

N/A

N/A

The name of the Security Gateway interface, through which a connection traverses

ifdirection

N/A

N/A

Connection direction

User

N/A

N/A

Source user name

src_user_name

N/A

N/A

User name connected to source IP

dst_user_name

N/A

N/A

Connected user name on the destination IP

file_name

<object>

Number

File name

file_direction

N/A

N/A

File direction
Possible options: upload, download

file_type

<objecttype>

Text/String

Classified file type

file_size

<size>

Number

Attachment file size / Matched file size

data_type_name

N/A

N/A

Data type in rulebase that was matched

file_id

<object>

Number

Unique file identifier

invalid_file_size

N/A

N/A

file_size field is valid only if this field is set to 0

top_archive_file_name

N/A

N/A

In case of archive file: the file that was sent/received

connection_luuid

N/A

N/A

Calculation of md5 of the IP and user name as UID

duration

N/A

N/A

N/A

alert

N/A

N/A

Alert level of matched rule (for connection logs)

conn_direction

N/A

N/A

N/A

flags

N/A

N/A

N/A

logid

N/A

N/A

N/A

loguid

N/A

N/A

UUID of unified logs 

originsicname

N/A

N/A

Machine SIC 

sequencenum

N/A

N/A

Number added to order logs with the same Linux timestamp and origin

version

N/A

N/A

N/A

__policy_id_tag

<policy>

Text/String

N/A

data_type_name

N/A

N/A

Data type in rule base that was matched

data_type_uid

N/A

N/A

N/A

specific_data_type_name

N/A

N/A

Compound/Group scenario, data type that was matched

specific_data_type_uid

N/A

N/A

N/A

word_list

N/A

N/A

Words matched by data type

hll_key

N/A

N/A

N/A