V 2.0 : SmartDashboard Events

V 2.0 : SmartDashboard Events

Base Rule

General Information

Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Product

<vmid>

Text/String

Product name

Originip

<sip>

IP Address

IP of the log origin 

origin

N/A

N/A

Name of the first Security Gateway that reported this event

operation

N/A

N/A

N/A

subject

<subject>

Text/String

N/A

status

<status>

Text/String

N/A

administrator

<login>

Text/String

N/A

client

N/A

N/A

N/A

performedon

<object>

Text/String

N/A

objecttable

N/A

N/A

N/A

objecttype

<objecttype>

Text/String

N/A

time

N/A

N/A

N/A

generalinformation

N/A

N/A

N/A

Action

<action>

Text/String

Description of detected malware activity

ifdirection

N/A

N/A

Connection direction

ifname

<sinterface>

Text/String

The name of the Security Gateway interface, through which a connection traverses

session_id

N/A

N/A

N/A

client_ip_host

N/A

N/A

N/A

alert

N/A

N/A

Alert level of matched rule (for connection logs)

flags

N/A

N/A

Checkpoint internal field

loguid

N/A

N/A

UUID  of unified logs  

sequencenum

N/A

N/A

Number added to order logs with the same linux timestamp and origin

originsicname

N/A

N/A

N/A

calc_desc

N/A

N/A

N/A

sendtotrackerasadvancedauditlog

N/A

N/A

N/A

admin_level

N/A

N/A

N/A

cma_name

N/A

N/A

N/A

customer_name

N/A

N/A

N/A

fieldschanges

N/A

N/A

N/A

mds_name

N/A

N/A

N/A

operation_number

N/A

N/A

N/A

uid

N/A

N/A

N/A

version

<version>

Number

N/A