sophos Module
Module for parsing sophosxg syslog.
-
sophos.xg.action
-
Event Action
type: keyword
-
sophos.xg.activityname
-
Web policy activity that matched and caused the policy result.
type: keyword
-
sophos.xg.ap
-
Access Point Serial ID or LocalWifi0 or LocalWifi1.
type: keyword
-
sophos.xg.app_category
-
Name of the category under which application falls
type: keyword
-
sophos.xg.app_filter_policy_id
-
Application filter policy ID applied on the traffic
type: keyword
-
sophos.xg.app_is_cloud
-
Application is Cloud
type: keyword
-
sophos.xg.app_name
-
Application name
type: keyword
-
sophos.xg.app_resolved_by
-
Application is resolved by signature or synchronized application
type: keyword
-
sophos.xg.app_risk
-
Risk level assigned to the application
type: keyword
-
sophos.xg.app_technology
-
Technology of the application
type: keyword
-
sophos.xg.appfilter_policy_id
-
Application Filter policy applied on the traffic
type: integer
-
sophos.xg.application
-
Application name
type: keyword
-
sophos.xg.application_category
-
Application is resolved by signature or synchronized application
type: keyword
-
sophos.xg.application_filter_policy
-
Application Filter policy applied on the traffic
type: integer
-
sophos.xg.application_name
-
Application name
type: keyword
-
sophos.xg.application_risk
-
Risk level assigned to the application
type: keyword
-
sophos.xg.application_technology
-
Technology of the application
type: keyword
-
sophos.xg.appresolvedby
-
Technology of the application
type: keyword
-
sophos.xg.auth_client
-
Auth Client
type: keyword
-
sophos.xg.auth_mechanism
-
Auth mechanism
type: keyword
-
sophos.xg.av_policy_name
-
Malware scanning policy name which is applied on the traffic
type: keyword
-
sophos.xg.backup_mode
-
Backup mode
type: keyword
-
sophos.xg.branch_name
-
Branch Name
type: keyword
-
sophos.xg.category
-
IPS signature category.
type: keyword
-
sophos.xg.category_type
-
Type of category under which website falls
type: keyword
-
sophos.xg.classification
-
Signature classification
type: keyword
-
sophos.xg.client_host_name
-
Client host name
type: keyword
-
sophos.xg.client_physical_address
-
Client physical address
type: keyword
-
sophos.xg.clients_conn_ssid
-
Number of client connected to the SSID.
type: long
-
sophos.xg.collisions
-
collisions
type: long
-
sophos.xg.con_event
-
Event Start/Stop
type: keyword
-
sophos.xg.con_id
-
Unique identifier of connection
type: integer
-
sophos.xg.configuration
-
Configuration
type: float
-
sophos.xg.conn_id
-
Unique identifier of connection
type: integer
-
sophos.xg.connectionname
-
Connectionname
type: keyword
-
sophos.xg.connectiontype
-
Connectiontype
type: keyword
-
sophos.xg.connevent
-
Event on which this log is generated
type: keyword
-
sophos.xg.connid
-
Connection ID
type: keyword
-
sophos.xg.content_type
-
Type of the content
type: keyword
-
sophos.xg.contenttype
-
Type of the content
type: keyword
-
sophos.xg.context_match
-
Context Match
type: keyword
-
sophos.xg.context_prefix
-
Content Prefix
type: keyword
-
sophos.xg.context_suffix
-
Context Suffix
type: keyword
-
sophos.xg.cookie
-
cookie
type: keyword
-
sophos.xg.date
-
Date (yyyy-mm-dd) when the event occurred
type: date
-
sophos.xg.destinationip
-
Original destination IP address of traffic
type: ip
-
sophos.xg.device
-
device
type: keyword
-
sophos.xg.device_id
-
Serial number of the device
type: keyword
-
sophos.xg.device_model
-
Model number of the device
type: keyword
-
sophos.xg.device_name
-
Model number of the device
type: keyword
-
sophos.xg.dictionary_name
-
Dictionary Name
type: keyword
-
sophos.xg.dir_disp
-
TPacket direction. Possible values:“org”, “reply”, “”
type: keyword
-
sophos.xg.direction
-
Direction
type: keyword
-
sophos.xg.domainname
-
Domain from which virus was downloaded
type: keyword
-
sophos.xg.download_file_name
-
Download file name
type: keyword
-
sophos.xg.download_file_type
-
Download file type
type: keyword
-
sophos.xg.dst_country_code
-
Code of the country to which the destination IP belongs
type: keyword
-
sophos.xg.dst_domainname
-
Receiver domain name
type: keyword
-
sophos.xg.dst_ip
-
Original destination IP address of traffic
type: ip
-
sophos.xg.dst_port
-
Original destination port of TCP and UDP traffic
type: integer
-
sophos.xg.dst_zone_type
-
Type of destination zone
type: keyword
-
sophos.xg.dstdomain
-
Destination Domain
type: keyword
-
sophos.xg.duration
-
Durability of traffic (seconds)
type: long
-
sophos.xg.email_subject
-
Email Subject
type: keyword
-
sophos.xg.ep_uuid
-
Endpoint UUID
type: keyword
-
sophos.xg.ether_type
-
ethernet frame type
type: keyword
-
sophos.xg.eventid
-
ATP Evenet ID
type: keyword
-
sophos.xg.eventtime
-
Event time
type: date
-
sophos.xg.eventtype
-
ATP event type
type: keyword
-
sophos.xg.exceptions
-
List of the checks excluded by web exceptions.
type: keyword
-
sophos.xg.execution_path
-
ATP execution path
type: keyword
-
sophos.xg.extra
-
extra
type: keyword
-
sophos.xg.file_name
-
Filename
type: keyword
-
sophos.xg.file_path
-
File path
type: keyword
-
sophos.xg.file_size
-
File Size
type: integer
-
sophos.xg.filename
-
File name associated with the event
type: keyword
-
sophos.xg.filepath
-
Path of the file containing virus
type: keyword
-
sophos.xg.filesize
-
Size of the file that contained virus
type: integer
-
sophos.xg.free
-
free
type: integer
-
sophos.xg.from_email_address
-
Sender email address
type: keyword
-
sophos.xg.ftp_direction
-
Direction of FTP transfer: Upload or Download
type: keyword
-
sophos.xg.ftp_url
-
FTP URL from which virus was downloaded
type: keyword
-
sophos.xg.ftpcommand
-
FTP command used when virus was found
type: keyword
-
sophos.xg.fw_rule_id
-
Firewall Rule ID which is applied on the traffic
type: integer
-
sophos.xg.fw_rule_type
-
Firewall rule type which is applied on the traffic
type: keyword
-
sophos.xg.hb_health
-
Heartbeat status
type: keyword
-
sophos.xg.hb_status
-
Heartbeat status
type: keyword
-
sophos.xg.host
-
Host
type: keyword
-
sophos.xg.http_category
-
HTTP Category
type: keyword
-
sophos.xg.http_category_type
-
HTTP Category Type
type: keyword
-
sophos.xg.httpresponsecode
-
code of HTTP response
type: long
-
sophos.xg.iap
-
Internet Access policy ID applied on the traffic
type: keyword
-
sophos.xg.icmp_code
-
ICMP code of ICMP traffic
type: keyword
-
sophos.xg.icmp_type
-
ICMP type of ICMP traffic
type: keyword
-
sophos.xg.idle_cpu
-
idle ##
type: float
-
sophos.xg.idp_policy_id
-
IPS policy ID which is applied on the traffic
type: integer
-
sophos.xg.idp_policy_name
-
IPS policy name i.e. IPS policy name which is applied on the traffic
type: keyword
-
sophos.xg.in_interface
-
Interface for incoming traffic, e.g., Port A
type: keyword
-
sophos.xg.interface
-
interface
type: keyword
-
sophos.xg.ipaddress
-
Ipaddress
type: keyword
-
sophos.xg.ips_policy_id
-
IPS policy ID applied on the traffic
type: integer
-
sophos.xg.lease_time
-
Lease Time
type: keyword
-
sophos.xg.localgateway
-
Localgateway
type: keyword
-
sophos.xg.localnetwork
-
Localnetwork
type: keyword
-
sophos.xg.log_component
-
Component responsible for logging e.g. Firewall rule
type: keyword
-
sophos.xg.log_id
-
Unique 12 characters code (0101011)
type: keyword
-
sophos.xg.log_subtype
-
Sub type of event
type: keyword
-
sophos.xg.log_type
-
Type of event e.g. firewall event
type: keyword
-
sophos.xg.log_version
-
Log Version
type: keyword
-
sophos.xg.login_user
-
ATP login user
type: keyword
-
sophos.xg.mailid
-
mailid
type: keyword
-
sophos.xg.mailsize
-
mailsize
type: integer
-
sophos.xg.message
-
Message
type: keyword
-
sophos.xg.mode
-
Mode
type: keyword
-
sophos.xg.nat_rule_id
-
NAT Rule ID
type: keyword
-
sophos.xg.newversion
-
Newversion
type: keyword
-
sophos.xg.oldversion
-
Oldversion
type: keyword
-
sophos.xg.out_interface
-
Interface for outgoing traffic, e.g., Port B
type: keyword
-
sophos.xg.override_authorizer
-
Override authorizer
type: keyword
-
sophos.xg.override_name
-
Override name
type: keyword
-
sophos.xg.override_token
-
Override token
type: keyword
-
sophos.xg.phpsessid
-
PHP session ID
type: keyword
-
sophos.xg.platform
-
Platform of the traffic.
type: keyword
-
sophos.xg.policy_type
-
Policy type applied to the traffic
type: keyword
-
sophos.xg.priority
-
Severity level of traffic
type: keyword
-
sophos.xg.protocol
-
Protocol number of traffic
type: keyword
-
sophos.xg.qualifier
-
Qualifier
type: keyword
-
sophos.xg.quarantine
-
Path and filename of the file quarantined
type: keyword
-
sophos.xg.quarantine_reason
-
Quarantine reason
type: keyword
-
sophos.xg.querystring
-
querystring
type: keyword
-
sophos.xg.raw_data
-
Raw data
type: keyword
-
sophos.xg.received_pkts
-
Total number of packets received
type: long
-
sophos.xg.receiveddrops
-
received drops
type: long
-
sophos.xg.receivederrors
-
received errors
type: keyword
-
sophos.xg.receivedkbits
-
received kbits
type: long
-
sophos.xg.recv_bytes
-
Total number of bytes received
type: long
-
sophos.xg.red_id
-
RED ID
type: keyword
-
sophos.xg.referer
-
Referer
type: keyword
-
sophos.xg.remote_ip
-
Remote IP
type: ip
-
sophos.xg.remotenetwork
-
remotenetwork
type: keyword
-
sophos.xg.reported_host
-
Reported Host
type: keyword
-
sophos.xg.reported_ip
-
Reported IP
type: keyword
-
sophos.xg.reports
-
Reports
type: float
-
sophos.xg.rule_priority
-
Priority of IPS policy
type: keyword
-
sophos.xg.sent_bytes
-
Total number of bytes sent
type: long
-
sophos.xg.sent_pkts
-
Total number of packets sent
type: long
-
sophos.xg.server
-
Server
type: keyword
-
sophos.xg.sessionid
-
Sessionid
type: keyword
-
sophos.xg.sha1sum
-
SHA1 checksum of the item being analyzed
type: keyword
-
sophos.xg.signature
-
Signature
type: float
-
sophos.xg.signature_id
-
Signature ID
type: keyword
-
sophos.xg.signature_msg
-
Signature messsage
type: keyword
-
sophos.xg.site_category
-
Site Category
type: keyword
-
sophos.xg.source
-
Source
type: keyword
-
sophos.xg.sourceip
-
Original source IP address of traffic
type: ip
-
sophos.xg.spamaction
-
Spam Action
type: keyword
-
sophos.xg.sqli
-
related SQLI caught by the WAF
type: keyword
-
sophos.xg.src_country_code
-
Code of the country to which the source IP belongs
type: keyword
-
sophos.xg.src_domainname
-
Sender domain name
type: keyword
-
sophos.xg.src_ip
-
Original source IP address of traffic
type: ip
-
sophos.xg.src_mac
-
Original source MAC address of traffic
type: keyword
-
sophos.xg.src_port
-
Original source port of TCP and UDP traffic
type: integer
-
sophos.xg.src_zone_type
-
Type of source zone
type: keyword
-
sophos.xg.ssid
-
Configured SSID name.
type: keyword
-
sophos.xg.start_time
-
Start time
type: date
-
sophos.xg.starttime
-
Starttime
type: date
-
sophos.xg.status
-
Ultimate status of traffic – Allowed or Denied
type: keyword
-
sophos.xg.status_code
-
Status code
type: keyword
-
sophos.xg.subject
-
Email subject
type: keyword
-
sophos.xg.syslog_server_name
-
Syslog server name.
type: keyword
-
sophos.xg.system_cpu
-
system
type: float
-
sophos.xg.target
-
Platform of the traffic.
type: keyword
-
sophos.xg.temp
-
Temp
type: float
-
sophos.xg.threatname
-
ATP threatname
type: keyword
-
sophos.xg.timestamp
-
timestamp
type: date
-
sophos.xg.timezone
-
Time (hh:mm:ss) when the event occurred
type: keyword
-
sophos.xg.to_email_address
-
Receipeint email address
type: keyword
-
sophos.xg.total_memory
-
Total Memory
type: integer
-
sophos.xg.trans_dst_ip
-
Translated destination IP address for outgoing traffic
type: ip
-
sophos.xg.trans_dst_port
-
Translated destination port for outgoing traffic
type: integer
-
sophos.xg.trans_src_ip
-
Translated source IP address for outgoing traffic
type: ip
-
sophos.xg.trans_src_port
-
Translated source port for outgoing traffic
type: integer
-
sophos.xg.transaction_id
-
Transaction ID
type: keyword
-
sophos.xg.transactionid
-
Transaction ID of the AV scan.
type: keyword
-
sophos.xg.transmitteddrops
-
transmitted drops
type: long
-
sophos.xg.transmittederrors
-
transmitted errors
type: keyword
-
sophos.xg.transmittedkbits
-
transmitted kbits
type: long
-
sophos.xg.unit
-
unit
type: keyword
-
sophos.xg.updatedip
-
updatedip
type: ip
-
sophos.xg.upload_file_name
-
Upload file name
type: keyword
-
sophos.xg.upload_file_type
-
Upload file type
type: keyword
-
sophos.xg.url
-
URL from which virus was downloaded
type: keyword
-
sophos.xg.used
-
used
type: integer
-
sophos.xg.used_quota
-
Used Quota
type: keyword
-
sophos.xg.user
-
User
type: keyword
-
sophos.xg.user_cpu
-
system
type: float
-
sophos.xg.user_gp
-
Group name to which the user belongs.
type: keyword
-
sophos.xg.user_group
-
Group name to which the user belongs
type: keyword
-
sophos.xg.user_name
-
user_name
type: keyword
-
sophos.xg.users
-
Number of users from System Health / Live User events.
type: long
-
sophos.xg.vconn_id
-
Connection ID of the master connection
type: integer
-
sophos.xg.virus
-
virus name
type: keyword
-
sophos.xg.web_policy_id
-
Web policy ID
type: keyword
-
sophos.xg.website
-
Website
type: keyword
-
sophos.xg.xss
-
related XSS caught by the WAF
type: keyword