VPN & Firewall 1

Vendor Documentation

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122323

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk144192

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
virtuallogsource	N/A	N/A
Subproduct	N/A	N/A
Product	<version>	<vmid>
Originip	N/A	N/A
origin	<sender>	N/A
Action	<action> <tag1>	<action> <tag1>
SIP	<sip>	<sip>
SPort	<sport>	<sport>
DIP	<dip>	<dip>
dport	<dport>	<dport>
protocol	<protnum>/<protname>	<protnum>
ifname	<sinterface>	<sinterface>
ifdirection	<tag2>	N/A
Reason	<reason>	<reason>
Rule	<command>	N/A
Info	<vendorinfo>	N/A
XlateSIP	<snatip>	<snatip>
XlateSport	<snatport>	<snatport>
XlateDIP	<dnatip>	<dnatip>
XlateDPort	<dnatport>	<dnatport>
User	<login>	<login>
alert	N/A	N/A
sys_msgs	N/A	N/A
sys_message	N/A	N/A
rule_uid	N/A	N/A
icmp_code	N/A	N/A
icmp_type	N/A	N/A
matched_category	<subject>	N/A
rule_name	<command>	N/A
OriginZone	N/A	N/A
ImpactedZone	N/A	N/A
PolicyManagement	N/A	N/A
PolicyName	<policy>	N/A
Service	<process>	N/A
State	<status>	N/A
TCP_Flags	N/A	N/A
src_machine_name	<sname>	N/A
time	N/A	N/A
flags	N/A	N/A
loguid	N/A	N/A
originsicname	N/A	N/A
sequencenum	N/A	N/A
version	N/A	N/A
__policy_id_tag	<policy>	<policy>
bytes	N/A	N/A
client_inbound_bytes	N/A	<bytesin>
client_inbound_interface	N/A	N/A
client_inbound_packets	N/A	<packetsin>
client_outbound_bytes	N/A	<bytesout>
client_outbound_interface	N/A	N/A
client_outbound_packets	N/A	<packetsout>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Rule ID	Rule Name	Rule Type	Common Event	Classification
1010505	VPN & Firewall	Base Rule	General Firewall Log	Network Traffic
	VPN & Firewall : Traffic Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
	VPN & Firewall : Traffic Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
	VPN & Firewall : Traffic Accepted	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
	VPN & Firewall : Traffic Dropped	Sub Rule	Traffic Denied by Host Firewall	Network Deny
	VPN & Firewall : Traffic Rejected	Sub Rule	Traffic Denied by Network Firewall	Network Deny
	VPN & Firewall : Traffic Decrypted	Sub Rule	Decrypted Packet	Network Traffic
	VPN & Firewall : Traffic Encrypted	Sub Rule	Encrypt Packet	Network Traffic
	VPN & Firewall : Traffic Redirected	Sub Rule	Traffic Redirected	Network Traffic

LogRhythm Default v2.0

Rule ID	Rule Name	Rule Type	Common Event	Classification
1012015	V 2.0 : VPN-1 & FireWall-1 Events	Base Rule	General Network Traffic	Network Traffic
	V 2.0 : FireWall Message Dropped	Sub Rule	Traffic Denied by Network Firewall	Network Deny
	V 2.0 : FireWall Message Rejected	Sub Rule	Traffic Denied by Network Firewall	Network Deny
	V 2.0 : FireWall Message Accepted	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
	V 2.0 : FireWall Message Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
	V 2.0 : FireWall Message Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow