Skip to main content
Skip table of contents

V 2.0 : Security Gateway/Management Events

Vendor Documentation

Classification

Rule NameRule TypeCommon EventClassification
V 2.0 : Security Gateway/Management EventsBase RuleGeneral InformationInformation
V 2.0 : Gateway Mgmt : Action FailedSub RuleAction FailureError
V 2.0 : Gateway Mgmt : Action StartedSub RuleStart ActionInformation

Mapping with LogRhythm Schema

Device Key in Log MessageLogRhythm SchemaData TypeSchema Description
virtuallogsourceN/AN/AN/A
subproductN/AN/ACan be VPN or non-VPN
Product<vmid>Text/StringProduct name
Originip<dip>IP AddressIP of the log origin 
originN/AN/AName of the first Security Gateway that reported this event
Action<action>Text/StringDescription of detected malware activity
SIP<sip>IP AddressSource IP
SPort<sport>NumberSource host port number
DIPN/AN/ADestination IP
dport<dport>NumberDestination host port number
protocol<protnum>NumberProtocol detected on the connection
ifname<sinterface>Text/StringThe name of the Security Gateway interface through which a connection traverses
ifdirectionN/AN/AConnection direction
Reason<reason>Text/StringInformation on the error occurred
RuleN/AN/AMatched rule number
InfoN/AN/ASpecial log message
XlateSIP<snatip>IP AddressSource ipv4 after applying NAT
XlateSport<snatport>NumberSource port after applying hide NAT on source IP
XlateDIP<dnatip>IP AddressDestination ipv4 after applying NAT
XlateDPort<dnatport>NumberDestination port after applying NAT
UserN/AN/ASource user name
alertN/AN/AAlert level of matched rule (for connection logs)
icmp-codeN/AN/AN/A
icmp-typeN/AN/AN/A
matched_categoryN/AN/AName of matched category
rule_nameN/AN/AAccess rule name
UrlN/AN/AMatched URL
timeN/AN/AThe time stamp when the log was created
Severity<severity>NumberThreat severity determined by ThreatCloud
Possible values:
0 - Informational
1 - Low
2 - Medium
3 - High
4 - Critical
description<vendorinfo>Text/StringN/A
status

<status>

Text/StringN/A
status<tag1>Text/StringN/A
flagsN/AN/ACheckpoint internal field
loguidN/AN/AUUID of unified logs  
originsicnameN/AN/AMachine SIC 
sequencenumN/AN/ANumber added to order logs with the same Linux timestamp and origin
versionN/AN/AN/A
failure_impact<result>Text/StringThe impact of update service failure 
update_serviceN/AN/AN/A
versionN/AN/AN/A
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.