Sophos XG Firewall | Appendix A - Logs | 523
• Application Filter Logs
• Malware Logs
• Email Logs
• Firewall Logs
• IPS Logs
• Authentication Logs
• Admin Logs
• Sandstorm Logs
• WAF Logs
• Advanced Threat Protection Logs
• Security Heartbeat Logs
To view logs for all modules, go to
Log Viewer
page.
Log Viewer
Use Log Viewer to view the logs for modules like System, Web filter, Application Filter, Malware, Email, Firewall,
IPS, Authentication, Admin, Sandstorm, Web Application Protection, Advanced Threat Protection, and Security
Heartbeat. This page gives consolidated information about all the events logged by your device.
You can also open multiple live packet capture windows with different filers from this page. To view them, you need to enable Packet Capture from Monitor & Analyze > Diagnostics > Packet Capture. It is recommended to enable
Wrap Capture Buffer Once Full on
Configure Capture Filter
page to continue capturing packets after the buffer is full.
Click Open PCAP link under Live PCAP column to view packet capture in a new window. It will display the packet captures that are automatically filtered based on the values of the currently selected packet. Click Display Filter in the packet capture window to modify the filters. You cannot open packet capture window for the following modules:
System and Admin.
Using this page, you can:
• Set Refresh Interval – Select refresh interval for refreshing the logs automatically. Select time from Set Refresh
Interval drop down list or click Refresh to refresh the logs.
• De-anonymize - To view actual (de-anonymized) user identities in all logs which are in encrypted from
(anonymized), if Data Anonymization is enabled.
Note: To enable Data Anonymization go to Configure > System Services > Data Anonymization page.
• View logs for all modules:
•
System
– System logs provide information about all the system related logs, including the logs for VPN events.
•
Web Filter
– Web filter logs provide web surfing details like accessed/blocked sites, users trying to access the blocked websites etc. and the action taken by the device (Allowed or Blocked).
•
Application Filter
– Application filter logs provide details about applications to which access was denied by
the device.
•
Malware
– Malware logs provide information about the viruses identified by the device.
•
Email
– Email logs provide information about the mail traffic processed by the device.
•
Firewall
– Firewall logs provide information about how much traffic passes through a particular firewall rule and through which interfaces.
•
IPS
– IPS logs provide information about the intrusion attempts detected/blocked by the device.
•
Authentication
– Authentication logs provide information about all the authentication logs including firewall,
VPN and User Portal authentication.
•
Admin
– Admin logs provide information about administrator event and tasks.
•
WAF
– WAF logs provide information about HTTP/S requests and action taken on the same.
Sophos XG Firewall | Appendix A - Logs | 524
•
Advanced Threat Protection
- ATP logs provide information related to threats detected/blocked by the device.
•
Security Heartbeat
- Security Heartbeat logs provide information on Heartbeat connection and status.
View List of System Events
Time
Time when the event occurred.
Log Comp
Displays the log components of the system event.
Log component types – HTTP, HA, central management, IPSec, L2TP, PPTP, SSL VPN, Device,
DHCP Server, Interface, Gateway, DDNS, WebCat, IPS, anti-virus, quarantine, WLAN, HTTPS, guest user, protected application server, CTA, PPPoE, wireless protection, RED, ATP, SSL VPN
Client, IPSec client, authentication clients, RED firmware, AP firmware and Up2Date.
Status
Successful: Displays event is successful.
Failed: Displays event is failed.
Username
Username of the user.
Message
Message for the type of system event.
Message ID
Message ID of the message.
Figure 484: System Log
View List of Web Filter Events
Logs are displayed only if the Web Protection module is subscribed.
Time
Time when the event occurred.
Action
Allowed: Displays websites allowed by the device.
Denied: Displays websites blocked by the device.
Username
Username of the user that accessed the URL.
Sophos XG Firewall | Appendix A - Logs | 525
Source IP
Source IP address (IPv4 / IPv6).
Destination IP
Destination IP address (IPv4 / IPv6).
Category
Web Category under which the URL is categorized by the device.
URL
URL accessed.
Bytes Transfer
Number of bytes transferred.
Message ID
Message ID of the message.
Policy ID
Policy ID applicable to the message.
Live PCAP
Click Open PCAP link to view packet capture in a new window based on Source IP, Policy ID and
Username.
Figure 485: Web Filter Log Viewer
View List of Application Filter Events
Logs are displayed only if the Web Protection module is subscribed.
Time
Time when event occured.
Action
Denied.
Username
Username of the user that accessed the application.
Source IP
Source IP address (IPv4 / IPv6).
Destination IP
Destination IP address (IPv4 / IPv6).
Application Category
Category under which the application is categorized.
Sophos XG Firewall | Appendix A - Logs | 526
Application
Name of the application denied.
Message ID
Message ID of the message.
Policy ID
Policy ID applicable to the message.
Live PCAP
Click Open PCAP link to view packet capture in a new window based on Source IP, Policy ID and
Username.
Figure 486: Application Filter Log Viewer
View List of Malware Events
HTTP, HTTPS, and FTP logs are displayed only if the Web Protection module is subscribed.
POP, POPS, IMAP, IMAPS, SMTP and SMTPS logs are displayed only if Email Protection module is subscribed.
Time
Time when the event occurred.
Protocol
Displays name of the protocol.
Types of protocol: HTTP, HTTPS, FTP, POP, POPS, IMAP, IMAPS, SMTP and SMTPS.
Username
Username of the user on whose system, virus was detected.
Source IP
Source IP address (IPv4 / IPv6).
Destination IP
Destination IP address (IPv4 / IPv6).
Virus
Name of the virus detected.
Message
Message for the virus detected.
Message ID
Message ID of the message.
Sophos XG Firewall | Appendix A - Logs | 527
Live PCAP
Click Open PCAP link to view packet capture in a new window based on Source IP and Username.
Figure 487: Malware Log Viewer
View List of Email Events
Logs are displayed only if the Email Protection module is subscribed.
Time
Time when the event occurred.
Log Comp
Displays the log components of the email events.
Types of log components: SMTP, SMTPS, POP, POPS, IMAP and IMAPS.
Action
Displays action taken against any email events.
Actions: Reject, Drop, Accept, Change Recipient, Prefix Subject, Tmp Reject and Accept with SPX.
Username
Username of the user on whose system, spam was detected.
Source IP
Source IP address (IPv4 / IPv6).
Destination IP
Destination IP address (IPv4 / IPv6).
Email Sender
Email address of the sender.
Email Receiver
Email address of the recipient.
Email Subject
Subject of the email.
Message
Message related to action taken by the device for the email event.
Message ID
Message ID of the message.
Live PCAP
Click Open PCAP link to view packet capture in a new window based on Source IP and Username.
Figure 488: Email Log Viewer
Sophos XG Firewall | Appendix A - Logs | 528
View List of Firewall Events
Time
Time when the event occurred.
Log Comp
Displays the log components of the firewall events.
Examples: firewall rule, invalid traffic, local ACL, DoS attack, ICMP redirection, source routed, fragmented traffic, MAC filter, IPMAC filter, IP spoof , protected application server heartbeat and
ICMP error message.
Action
Allowed: Permits the traffic.
Denied: Restrict the traffic.
Username
Username of the user on which the firewall rule is applied.
Firewall Rule
Firewall rule ID.
In Interface
Interface through which the traffic is coming in.
Out Interface
Interface through which the traffic is going out.
Source IP
Source IP address (IPv4 / IPv6).
Destination IP
Destination IP address (IPv4 / IPv6).
Rule Type
Type of firewall rule.
Message ID
Message ID of the message.
Live PCAP
Click Open PCAP link to view packet capture in a new window based on Source IP, Firewall Rule
ID and Username.
Figure 489: Firewall Log Viewer
View List of IPS Events
Logs are displayed only if the Network Protection module is subscribed.
Time
Time when the event occurred.
Log Comp
Displays the log components of IPS events.
Types of log components: anomaly and signatures.
Action
Detect: Intrusion attempts detected by the device.
Drop: Intrusion attempts dropped by the device.
Username
Username of the user that triggered the signature.
Source IP
Source IP address (IPv4 / IPv6).
Destination IP
Destination IP address (IPv4 / IPv6).
Signature ID
Signature ID of the signature.
Signature Name
Name for the detected signature.
Category
Category of the signature.
Platform
Platform of the signature.
Target
Target of the signature.
Policy Rule
Firewall rule applied.
Message ID
Message ID of the message.
Live PCAP
Sophos XG Firewall | Appendix A - Logs | 529
Sophos XG Firewall | Appendix A - Logs | 530
Click Open PCAP link to view packet capture in a new window based on Source IP and Username.
Figure 490: IPS Log Viewer
View List of Authentication Events
Time
Date and time when the event occurred.
Log Comp
Displays the log components of the authentication events.
Type of log components: external authentication, firewall authentication, VPN authentication, SSL
VPN authentication, My Account authentication, Dial-In authentication and NTLM authentication.
Status
Successful: Displays the successful events.
Failed: Displays the failed events.
Username
Username of the user.
IP Address
IP address of the user.
Auth Client
Authentication client that is used for authentication.
Auth Mechanism
Type of authentication mechanism: local or external server (AD, LDAP or RADIUS).
Message
Message for the type of authentication event.
Message ID
Message ID of the message.
Live PCAP
Click Open PCAP link to view packet capture in a new window based on Source IP and Username.
Sophos XG Firewall | Appendix A - Logs | 531
Figure 491: Authentication Log Viewer
View List of Admin Events
Time
Time when the event occurred.
Log Comp
Displays type of log components of admin events. Types of log components: GUI, CLI, API and central management.
Status
Successful: Displays the successful events.
Failed: Displays the failed events.
Username
Username of the admin user.
IP Address
IP address of the admin user.
Message
Message for the type of admin event.
Message ID
Message ID of the message.
Figure 492: Admin Log Viewer
View List of Web Server Protection (WAF) Events
Logs are displayed only if Web Server Protection module is subscribed.
Time
Time when the event occurred.
Web Server Name
Displays the name of the web server.
Sophos XG Firewall | Appendix A - Logs | 532
Source IP/Name
Source IP address or name.
URL
URL accessed.
Reason
Reason for the action taken on any web application.
Message
Message for the WAF event.
Status Code
Status code of the action taken on the web application.
Bytes Received
Displays the information of bytes received by the device.
Bytes Transmitted
Displays the information of bytes transmitted by the device.
Message ID
Message ID of the message.
Policy ID
Policy ID applicable to the WAF event.
Live PCAP
Click Open PCAP link to view packet capture in a new window based on Source IP and Policy ID.
Figure 493: WAF Log Viewer
View List of Advanced Threat Protection Events
Logs are displayed only if the Network Protection module is subscribed.
Time
Time when the event occurred.
Host (Source IP)
IP address of the host from where the threat derives.
User
Username of the user.
Destination IP
Destination IP address (IPv4 / IPv6).
Threat
Name of the threat detected by the device.
Threat URL/IP
Sophos XG Firewall | Appendix A - Logs | 533
URL/IP of the threat detected.
Origin
Displays the type of source from where the threat comes (Firewall, DNS, IPS, web).
Action
Action taken on the detection of the threat (log only, log and drop).
Message ID
Message ID of the message.
Login User
Name of the login user.
Process User
Name of the process user.
Executable
Name of executable files possibly infected with threats.
Live PCAP
Click Open PCAP link to view packet capture in a new window based on Source IP and User.
Figure 494: ATP Log Viewer
View List of Security Heartbeat Events
Time
Time when the event occurred.
Endpoint Name
Name of the endpoint.
Endpoint IP
IP address of the endpoint.
Endpoint Health
Status of endpoint health (red, yellow, green).
Message ID
Message ID of the message.
Live PCAP
Click Open PCAP link to view packet capture in a new window based on Endpoint IP.
