V 2.0 : Eventia Analyzer Events

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122323

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk144192

V 2.0 : Eventia Analyzer Events

Base Rule

General Information 

Information

virtuallogsource

N/A

N/A

N/A

subproduct

N/A

N/A

Can be VPN or non-VPN

Product

<vmid>

Text/String

Product name

Originip

N/A

N/A

IP of the log origin 

origin

N/A

N/A

Name of the first Security Gateway that reported this event

Action

<action>

Text/String

N/A

SIP

<sip>

IP Address

Source IP

SPort

<sport>

Number

Source host port number

DIP

<dip>

IP Address

Destination IP

dport

<dport>

Number

Destination host port number

protocol

<protnum>

Number

Protocol detected on the connection

ifname

<sinterface>

Text/String

The name of the Security Gateway interface through which a connection traverses

ifdirection

N/A

N/A

Connection direction

Reason

<reason>

Text/String

Information on the error occurred

Rule

N/A

N/A

Matched rule number

Info

N/A

N/A

Special log message

XlateSIP

<snatip>

IP Address

Source ipv4 after applying NAT

XlateSport

<snatport>

Number

Source port after applying hide NAT on source IP

XlateDIP

<dnatip>

IP Address

Destination ipv4 after applying NAT

XlateDPort

<dnatport>

Number

Destination port after applying NAT

User

N/A

N/A

Source user name

alert

N/A

N/A

Alert level of matched rule (for connection logs)

icmp-code

N/A

N/A

N/A

icmp-type

N/A

N/A

N/A

matched_category

N/A

N/A

Name of matched category

rule_name

N/A

N/A

Access rule name

Url

<url>

Text/String

Matched URL

time

N/A

N/A

The time stamp when the log was created

Severity

<severity>

Number

Threat severity determined by ThreatCloud
Possible values:
0 - Informational
1 - Low
2 - Medium
3 - High
4 - Critical

administrator

<login>

Text/String

User who performed the operation

performedon

N/A

N/A

N/A

generalinformation

<vendorinfo>

Text/String

N/A

flags

N/A

N/A

Checkpoint internal field

logid

N/A

N/A

N/A

loguid

N/A

N/A

UUID of unified logs  

sequencenum

N/A

N/A

Number added to order logs with the same Linux timestamp and origin

version

N/A

N/A

N/A

cu_detected_by

N/A

N/A

N/A

cu_detection_time

N/A

N/A

N/A

cu_last_update_time

N/A

N/A

N/A

cu_log_count

N/A

N/A

N/A

cu_rule_category

N/A

N/A

N/A

cu_rule_id

N/A

N/A

N/A

domain

<domainimpacted>

Text/String

N/A

event_end_time

N/A

N/A

N/A

event_name

N/A

N/A

N/A

event_start_time

N/A

N/A

N/A

hostname

<dname>

Text/String

N/A

is_correlated

N/A

N/A

N/A

is_last

N/A

N/A

N/A

log_id

N/A

N/A

Unique identity for logs includes: Type, Family, Product/Blade, Category 

max_num_count_detected

N/A

N/A

N/A

num_of_updates

N/A

N/A

N/A

origin_repetitions

N/A

N/A

N/A

source_repetitions

N/A

N/A

N/A

time_interval

N/A

N/A

N/A

users_repetitions

N/A

N/A

N/A