V 2.0 : Threat Extraction Events

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122323

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk144192

V 2.0: Threat Extraction Events

Base Rule

General Threat Message

Activity

virtuallogsource

N/A

N/A

N/A

Subproduct

N/A

N/A

Can be VPN or non-VPN

Product

<vmid>

Text/String

Product name

Originip

N/A

N/A

IP of the log origin 

origin

N/A

N/A

Name of the first Security Gateway that reported this event

Action

<action>

Text/String

Description of detected malware activity

SIP

<sip>

IP Address

Source IP

SPort

<sport>

Number

Source host port number

DIP

<dip>

IP Address

Destination IP

dport

<dport>

Number

Destination host port number

protocol

<protnum>

Number

Protocol detected on the connection

ifname

<sinterface>

Text/String

The name of the Security Gateway interface through which a connection traverses

ifdirection

N/A

N/A

Connection direction

Reason

<reason>

Text/String

N/A

Rule

N/A

N/A

N/A

Info

N/A

N/A

N/A

XlateSIP

<snatip>

IP Address

N/A

XlateSport

<snatport>

Number

N/A

XlateDIP

<dnatip>

IP Address

N/A

XlateDport

<dnatport>

Number

N/A

User

<login>

Text/String

Source user name 

alert

N/A

N/A

Alert level of matched rule (for connection logs) 

icmp-code

N/A

N/A

N/A

icmp-type

N/A

N/A

N/A

matched_category

N/A

N/A

N/A

rule_name

N/A

N/A

N/A

Url

<url>

Text/String

Matched URL

time

N/A

N/A

The time stamp when the log was created

Severity

<severity>

Number

Threat severity determined by ThreatCloud
Possible values:
0 - Informational
1 - Low
2 - Medium
3 - High
4 - Critical

to

<recipient>

Text/String

Recipient email address 

from

<sender>

Text/String

Sender email address 

Protection_name

<threatname>

Text/String

Specific signature name of the attack 

SmartDefense_Profile

N/A

N/A

N/A

Protection_Type

N/A

N/A

Type of protection used to detect the attack 

scope_ip

N/A

N/A

N/A

Email_Subject

<subject>

Text/String

Original email subject 

file_md5

<hash>

Text/String

File md5  

file_name

<object>

Text/String

Malicious file name / Matched file size 

file_type

<objecttype>

Text/String

Classified file type 

file_size

<size>

Number

Attachment file size / Matched file size 

flags

N/A

N/A

Checkpoint internal field

loguid

N/A

N/A

UUID of unified logs  

originsicname

N/A

N/A

N/A

sequencenum

N/A

N/A

Number added to order logs with the same Linux timestamp and origin

version

N/A

N/A

N/A

__policy_id_tag

<policy>

Text/String

N/A

content_risk

N/A

N/A

N/A

file_id

N/A

N/A

N/A

file_sha1

N/A

N/A

File sha1 

log_id

N/A

N/A

Unique identity for logs includes: Type, Family, Product/Blade, Category 

mail_id

N/A

N/A

N/A

malware_rule_id

N/A

N/A

Threat prevention rule ID  

malware_rule_name

N/A

N/A

Threat prevention rule name 

original_queue_id

N/A

N/A

N/A

policy

N/A

N/A

N/A

policy_time

N/A

N/A

N/A

scrub_activity

N/A

N/A

N/A

scrubbed_content

N/A

N/A

N/A

log_link

N/A

N/A

N/A