V 2.0 : Forensics Events

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122323

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk144192

V 2.0 : Forensics Events

Base Rule

General Threat Message

Activity

V 2.0 : Forensics : Detect Action

Sub Rule

General Threat Message

Activity

V 2.0 : Forensics : Prevent Action

Sub Rule

Threat Blocked

Failed Activity

virtuallogsource

N/A

N/A

N/A

Subproduct

N/A

N/A

Can be VPN or non-VPN

Product

<vmid>

Text/String

Product name

Originip

N/A

N/A

IP of the log origin 

origin

N/A

N/A

Name of the first Security Gateway that reported this event

Action

<action>
<tag1>

Text/String

N/A

SIP

<sip>

IP Address

Source IP

SPort

<sport>

Number

Source host port number

DIP

<dip>

IP Address

Destination IP

dport

<dport>

Number

Destination port

protocol

<protnum>

Number

Protocol detected on the connection

ifname

<sinterface>

Text/String

The name of the Security Gateway interface through which a connection traverses

ifdirection

N/A

N/A

Connection direction

Reason

<reason>

Text/String

Information on the error occurred

Rule

N/A

N/A

Matched rule number

Info

N/A

N/A

Rule information on the blocked diameter CMD

XlateSIP

<snatip>

IP Address

Source ipv4 after applying NAT

XlateSport

<snatport>

Number

Source port after applying hide NAT on source IP

XlateDIP

<dnatip>

IP Address

Destination ipv4 after applying NAT

XlateDPort

<dnatport>

Number

Destination port after applying NAT

User

N/A

N/A

Source user name

alert

N/A

N/A

Alert level of matched rule (for connection logs)

icmp_code

N/A

N/A

If a connection is ICMP, the ICMP code info will be added to the log

icmp_type

N/A

N/A

If a connection is ICMP, the type info will be added to the log

matched_category

N/A

N/A

Name of matched category

rule_name

N/A

N/A

Access rule name

Url

<url>

Text/String

N/A

time

N/A

N/A

The time stamp when the log was created

src_machine_name

<sname>

Text/String

Machine name connected to source IP

src_user_name

<login>

Text/String

User name connected to source IP

Confidence_Level

N/A

N/A

Confidence level determined by ThreatCloud
Possible values:
0 - N/A
1 - Low
2 - Medium-Low
3 - Medium
4 - Medium-High
5 - High

Severity

<severity>

Number

Threat severity determined by ThreatCloud
Possible values:
0 - Informational
1 - Low
2 - Medium
3 - High
4 - Critical

malware_action

<vendorinfo>

Text/String

Description of detected malware activity

Protection_name

<threatname>

Text/String

Specific signature name of the attack

description

<subject>

Text/String

N/A

PolicyName

N/A

N/A

Name of the last policy that this Security Gateway fetched

Protection_Type

N/A

N/A

Type of protection used to detect the attack

file_md5

<hash>

Text/String

File md5 

file_name

<object>

Text/String

Malicious file name / Matched file size

file_type

<objecttype>

Text/String

Classified file type

file_size

<size>

Number

Attachment file size / Matched file size

client_name

N/A

N/A

Client Application or Software Blade that detected the event

generalinformation

N/A

N/A

ID of original file/mail sent by admin

flags

N/A

N/A

Checkpoint internal field

loguid

N/A

N/A

UUID of unified logs 

sequencenum

N/A

N/A

Number added to order logs with the same Linux timestamp and origin

version

N/A

N/A

N/A

attack_status

<status>

Text/String

In case of a malicious event on an endpoint computer, the status of the attack

client_version

N/A

N/A

Build version of SandBlast Agent client installed on the computer

detected_by

N/A

N/A

N/A

event_type

N/A

N/A

N/A

file_sha1

N/A

Text/String

File sha1

file_sha256

N/A

Text/String

File sha256

host_type

N/A

N/A

N/A

impacted_files

N/A

N/A

In case of an infection on an endpoint computer, the list of files that the malware impacted

incident_details

N/A

N/A

N/A

installed_products

N/A

N/A

List of installed Endpoint Software Blades

local_time

N/A

N/A

Local time on the endpoint computer

machine_guid

N/A

N/A

N/A

os_name

N/A

N/A

Name of the OS installed on the source endpoint computer

os_version

N/A

N/A

Build version of the OS installed on the source endpoint computer

packet_capture_unique_id

N/A

N/A

Identifier of the packet capture files

policy_date

N/A

N/A

N/A

policy_number

N/A

N/A

N/A

product_family

N/A

N/A

The product family the blade/product belongs to 
Possible values:
0 - Network
1 - Endpoint
2 - Access
3 - Threat
4 - Mobile

remediated_files

N/A

N/A

In case of an infection and a successful cleaning of that infection, this is a list of remediated files on the computer

service_domain

N/A

N/A

N/A

suspicious_events

N/A

N/A

N/A

user_name

N/A

N/A

N/A

user_sid

N/A

N/A

N/A