Sophos XG Firewall | Appendix A - Logs | 562
Data Fields
src_country_code dst_ip dst_country_code protocol src_port dst_port sent_bytes recv_bytes
Type
string string string integer integer integer integer integer
Description
Code of the country to which the source
IP belongs
Original Destination IP address of traffic
Code of the country to which the destination IP belongs
Protocol number of traffic
Original Source Port of TCP and UDP traffic
Original Destination Port of TCP and
UDP traffic
Total number of bytes sent
Total number of bytes received
Email Logs
Logs are displayed only if Email Protection Module is subscribed.
Message ID
13009
13010
13011
13012
13013
13014
14001
14002
13001
13002
13003
13004
13005
13006
13007
13008
14003
15001
15002
15003
Message
A mail considered to be a SPAM.
A mail considered to be a PROBABLE SPAM.
A mail was not considered SPAM or PROBABLE SPAM.
Sender IP address is blacklisted.
A mail considered to be an Outbound SPAM
A mail considered to be an Outbound Probable SPAM
Flagged clean by both IBS/OBS
Message is marked clean by outbound
DLP detected in mail
SPX successfully applied
SPX failed
SMTP DOS
Email is marked Clean by Sophos Sandstorm.
Email is marked Malicious by Sophos Sandstorm.
A mail considered to be a SPAM.
A mail considered to be a PROBABLE SPAM.
A mail was not considered SPAM or PROBABLE SPAM.
A mail considered to be a SPAM.
A mail considered to be a PROBABLE SPAM.
A mail was not considered SPAM or PROBABLE SPAM.
Sophos XG Firewall | Appendix A - Logs | 563
Sample Logs
device="SFW" date=2017-01-31 time=15:46:45 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=041101613013 log_type="Anti-Spam" log_component="SMTP" log_subtype="Allowed" status="" priority=Information fw_rule_id=0 user_name="gaurav" av_policy_name="Gaurav235" from_email_address="[email protected]" to_email_address="[email protected]" email_subject="GP235" mailid="c000000a-1485857789" mailsize=391 spamaction="SANDSTORM ALLOW" reason="Mail is marked Clean by Sophos Sandstorm." src_domainname="iview.com" dst_domainname="" src_ip=10.198.47.71 src_country_code=R1 dst_ip=10.198.233.61 dst_country_code=R1 protocol="TCP" src_port=11255 dst_port=25 sent_bytes=0 recv_bytes=0 quarantine_reason="Other" device="SFW" date=2017-01-31 time=15:47:01 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=041205614003 log_type="Anti-Spam" log_component="POP3" log_subtype="Clean" status="" priority=Information fw_rule_id=0 user_name="gaurav" av_policy_name="None" from_email_address="gaurav2@
iview.com
" to_email_address="gaurav1@
iview.com
" email_subject="GP235" mailid="<b884459b-279a-7ba6-3991-fc26ad659488@
iview.com
>" mailsize=877 spamaction="Accept" reason="" src_domainname="
iview.com
" dst_domainname="
iview.com
" src_ip=10.198.47.71 src_country_code=R1 dst_ip=10.198.233.61 dst_country_code=R1 protocol="TCP" src_port=11434 dst_port=110 sent_bytes=0 recv_bytes=0 quarantine_reason="Other" device="SFW" date=2017-01-31 time=18:28:25 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=041107413001 log_type="Anti-Spam" log_component="SMTP" log_subtype="Spam" status="" priority=Warning fw_rule_id=0 user_name="gaurav" av_policy_name="Gaurav235" from_email_address="gaurav1@
iview.com
" to_email_address="gaurav2@
iview.com
" email_subject="RPD
Spam Test: Spam" mailid="c000000b-1485867502" mailsize=400 spamaction="DROP" reason="" src_domainname="
iview.com
" dst_domainname="" src_ip=10.198.47.71 src_country_code=R1 dst_ip=10.198.233.61
dst_country_code=R1 protocol="TCP" src_port=22258 dst_port=25 sent_bytes=0 recv_bytes=0 quarantine_reason="Spam" device="SFW" date=2017-01-31 time=18:31:11 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=041207414001 log_type="Anti-Spam" log_component="POP3" log_subtype="Spam" status="" priority=Warning fw_rule_id=0 user_name="gaurav" av_policy_name="GauravPatel" from_email_address="gaurav1@
iview.com
" to_email_address="gaurav2@
iview.com
" email_subject="RPD Spam
Test: Spam" mailid="<2a2dd5d4-1a30-617b-27b1-7961ad07cf07@
iview.com
>" mailsize=574 spamaction="Accept" reason="" src_domainname="
iview.com
" dst_domainname="
iview.com
" src_ip=10.198.47.71 src_country_code=R1 dst_ip=10.198.233.61 dst_country_code=R1 protocol="TCP" src_port=22333 dst_port=110 sent_bytes=0 recv_bytes=0 quarantine_reason="Other" device="SFW" date=2017-01-31 time=18:34:41 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=041113413005 log_type="Anti-Spam" log_component="SMTP" log_subtype="Outbound Spam" status="" priority=Warning fw_rule_id=0 user_name="gaurav" av_policy_name="Gaurav123" from_email_address="gaurav1@
iview.com
" to_email_address="gaurav2@
iview.com
" email_subject="RPD Spam Test: Spam" mailid="<a22c9da6-19e5-4764-2836-3f48d7dcc329@
iview.com
>" mailsize=405 spamaction="Accept" reason="" src_domainname="
iview.com
" dst_domainname="" src_ip=10.198.47.71 src_country_code=R1 dst_ip=10.198.233.61 dst_country_code=R1 protocol="TCP" src_port=22420 dst_port=25 sent_bytes=0 recv_bytes=0 quarantine_reason="Spam" device="SFW" date=2017-01-31 time=18:36:22 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=041105613003 log_type="Anti-Spam" log_component="SMTP" log_subtype="Clean" status="" priority=Information fw_rule_id=0 user_name="gaurav" av_policy_name="None" from_email_address="gaurav2@
iview.com
" to_email_address="gaurav1@
iview.com
" email_subject="EMAIL" mailid="<5ab27db7-7bac-82e2-ba40-83ce90577c7f@
iview.com
>" mailsize=398 spamaction="Accept" reason="" src_domainname="
iview.com
" dst_domainname="" src_ip=10.198.47.71 src_country_code=R1 dst_ip=10.198.233.61 dst_country_code=R1 protocol="TCP" src_port=22477 dst_port=25 sent_bytes=0 recv_bytes=0 quarantine_reason="Other"
Sophos XG Firewall | Appendix A - Logs | 564 device="SFW" date=2017-01-31 time=18:36:29 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=041205614003 log_type="Anti-Spam" log_component="POP3" log_subtype="Clean" status="" priority=Information fw_rule_id=0 user_name="gaurav" av_policy_name="None" from_email_address="gaurav2@
iview.com
" to_email_address="gaurav1@
iview.com
" email_subject="EMAIL" mailid="<5ab27db7-7bac-82e2-ba40-83ce90577c7f@
iview.com
>" mailsize=1208 spamaction="Accept" reason="" src_domainname="
iview.com
" dst_domainname="
iview.com
" src_ip=10.198.47.71 src_country_code=R1 dst_ip=10.198.233.61 dst_country_code=R1 protocol="TCP" src_port=22479 dst_port=110 sent_bytes=0 recv_bytes=0 quarantine_reason="Other"
Module-specific Fields
Data Fields Type
status firewall_rule_id user_name av_policy_name string integer string string from_email_address string to_email_address string email_subject mailid string string mailsize spam_action string string
Reason src_domainname dst_domainname src_ip src_country_code dst_ip dst_country_code protocol src_port dst_port sent_bytes string string integer string string string string integer integer integer integer
Description
Ultimate status of traffic – Allowed or Denied
Firewall Rule ID which is applied on the traffic
User name
Spam policy name which is applied on the traffic
Sender email address
Recipient email address
Email subject
Email ID
Email size
Action performed on the message
Possible values:
Reject
Drop
Accept
Change Recipient
Prefix subject
Sandstorm Allow
Sandstorm Deny
Reason why email was detected as spam/malicious
Sender domain name
Receiver domain name
Original Source IP address of traffic
Code of the country to which the source IP belongs
Original Destination IP address of traffic
Code of the country to which the destination IP belongs
Protocol number of traffic
Original Source Port of TCP and UDP traffic
Original Destination Port of TCP and UDP traffic
Total number of bytes sent
