Sophos XG Firewall | Appendix A - Logs | 554
IPS Logs
Logs are displayed only if Network Protection Module is subscribed.
Message ID
06001
06002
07001
07002
Message
IPS Anomaly detected
IPS Anomaly dropped
IPS Signature detected
IPS Signature dropped
Sample Logs:
device="SFW" date=2017-02-01 time=12:51:35 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=020804407002 log_type="IDP" log_component="Signatures" log_subtype="Drop" status="" priority=Warning idp_policy_id=2 fw_rule_id=1 user_name="" signature_id=1151209031 signature_msg="Autodesk Design Review GIF GlobalColorTable DataSubBlock
Buffer Overflow" classification="Unknown" rule_priority=3 src_ip=203.190.124.15 src_country_code=HKG dst_ip=10.198.47.71 dst_country_code=R1 protocol="TCP" src_port=80 dst_port=40575 platform="Windows" category="Application and Software" target="Client"
Module-specific Fields
Data Fields
status
Type
string idp_policy_id idp_policy_name fw_rule_id user_name signature_id signature_msg classification rule_priority src_ip src_country_code dst_ip dst_country_code protocol src_port integer integer integer string string string string string string string string string integer integer
Description
Ultimate status of traffic – Allowed or
Denied
IPS policy ID which is applied on the traffic
IPS policy name i.e. IPS policy name which is applied on the traffic
Firewall Rule ID which is applied on the traffic
User name
Signature ID
Signature messsage
Signature classification
Priority of IPS policy
Original Source IP address of traffic
Country Code of country from where traffic has originated.
Original Destination IP address of traffic
Country Code of country to where traffic is destined.
Protocol number of traffic
Original Source Port of TCP and UDP traffic
Data Fields
dst_port icmp_type icmp_code platform category
Type
integer integer integer string string
Description
Original Destination Port of TCP and
UDP traffic
ICMP type of ICMP traffic
ICMP code of ICMP traffic
Platform of the traffic.
Possible values:
Windows
Linux
Unix
MAC
Solaris
BSD
Other
IPS signature category.
Possible values:
Apache HTTP Server
Application and Software
Browsers
Database Management Systems
DNS
ERP Systems
Exchange Mail Server
FTP
Industrial Control Systems
Malware Communication
Microsoft IIS Web Server
Misc
Multimedia
Office Tools
Operating System and Services
Other Mail Server
Other Web Server
Reconnaissance
Sendmail
VoIP and Instant Messaging
Web Services and Applications
Sophos XG Firewall | Appendix A - Logs | 555
