Sophos XG Firewall | Appendix A - Logs | 560
Firewall" priority=Information user_name="gaurav" server=
www.iviewtest.com
:8989 sourceip=10.198.235.254
localip=10.198.233.48 ws_protocol="HTTP/1.1" url=/ querystring= cookie="-" referer=- method=GET httpstatus=403 reason="Static URL Hardening" extra="No signature found" contenttype="text/html" useragent="Mozilla/5.0 (Windows NT 6.1; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0" host=10.198.235.254
responsetime=19310 bytessent=726 bytesrcv=510 fw_rule_id=3 device="SFW" date=2017-01-31 time=17:28:48 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=075000617071 log_type="WAF" log_component="Web Application
Firewall" priority=Information user_name="gaurav" server=
www.iviewtest.com
:8989 sourceip=10.198.235.254
localip=10.198.233.48 ws_protocol="HTTP/1.1" url=/ querystring= cookie="-" referer=- method=GET httpstatus=302 reason="-" extra="-" contenttype="text/html" useragent="Mozilla/5.0 (Windows NT 6.1; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0" host=10.198.235.254 responsetime=23113 bytessent=765 bytesrcv=510 fw_rule_id=3 device="SFW" date=2017-01-31 time=18:03:30 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=075000617071 log_type="WAF" log_component="Web
Application Firewall" priority=Information user_name="gaurav" server=
www.iviewtest.com
:8990 sourceip=10.198.235.254 localip=10.198.233.48 ws_protocol="HTTP/1.1" url=/download/ eicarcom2.zip querystring= cookie="; PHPSESSID=jetkd9iadd969hsr77jpj4q974;
_pk_id.1.fc3a=3a6250e215194a92.1485866024.1.1485866069.1485866024.; _pk_ses.1.fc3a=*" referer=
http:// www.iviewtest.com:8990/85-0-Download.html
method=GET httpstatus=403 reason="Antivirus" extra="EICAR-
AV-Test" contenttype="text/html" useragent="Mozilla/5.0 (Windows NT 6.1; WOW64; rv:50.0) Gecko/20100101
Firefox/50.0" host=10.198.235.254 responsetime=403214 bytessent=739 bytesrcv=715 fw_rule_id=6
Malware Logs
HTTP, HTTPS, FTP Logs are displayed only if Web Protection Module is subscribed.
POP, POPS, IMAP, IMAPS, SMTP and SMTPS Logs are displayed only if Web Protection Module is subscribed.
Message ID
08001
08002
09001
09002
10001
10002
11001
11002
12001
12002
Message
The URL has been blocked as it contained a virus
Access to URL is allowed as it does not contain any virus
FTP data transfer was blocked as it contained a virus
FTP data transfer didn’t have any virus and completed successfully
The mail is infected with a virus detected by the Device
Mail doesn’t contain any virus
The mail is infected with a virus detected by the Device
Mail doesn’t contain any virus
The mail is infected with a virus detected by the Device
Mail doesn’t contain any virus
Log Component
HTTP
HTTP
FTP
FTP
SMTP
SMTP
POP3
POP3
IMAP4
IMAP4
Sophos XG Firewall | Appendix A - Logs | 561
Sample Logs:
device="SFW" date=2017-01-31 time=15:35:15 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=030906208001 log_type="Anti-Virus" log_component="HTTP" log_subtype="Virus" status="" priority=Critical fw_rule_id=2 user_name="gaurav" iap=1 av_policy_name="" virus="EICAR-AV-Test" url="
http://www.eicar.org/download/eicar.com
" domainname="
www.eicar.org
" src_ip=10.198.47.71 src_country_code=R1 dst_ip=213.211.198.62 dst_country_code=DEU protocol="TCP" src_port=11013 dst_port=80 sent_bytes=0 recv_bytes=353
Module-specific Fields
Data Fields
status
Type
string fw_rule_id user_name iap av_policy_name from_email_address to_email_address subject mailid mailsize virus
FTP_url
FTP_direction filename filesize filepath ftpcommand url domainname quarantine src_domainname dst_domainname src_ip integer string integer string string string string string string string string string string integer string string string string string string string string
Description
Ultimate status of traffic – Allowed or
Denied
Firewall Rule ID which is applied on the traffic
User name
Policy Code of the Internet Access Policy applied
Malware scanning policy name which is applied on the traffic
Sender email address
Receipeint email address
Signature messsage
Signature classification
Priority of IPS policy
Virus name
FTP URL from which virus was downloaded
Direction of FTP transfer: Upload or
Download
Name of the file that contained virus
Size of the file that contained virus
Path of the file containing virus
FTP command used when virus was found
URL from which virus was downloaded
Domain from which virus was downloaded
Path and filename of the file quarantined
Sender domain name
Receiver domain name
Original Source IP address of traffic
