Sophos XG Firewall Web Interface Reference and Admin Guide v16.5

| Appendix A - Logs | 528

Source IP/Name

Source IP address or name.

URL

URL accessed.

Reason

Reason for the action taken on any web application.

Message

Message for the WAF event.

Status Code

Status code of the action taken on the web application.

Bytes Received

Displays the information of bytes received by the device.

Bytes Transmitted

Displays the information of bytes transmitted by the device.

Message ID

Message ID of the message.

Policy ID

Policy ID applicable to the WAF event.

Live PCAP

Click Open PCAP link to view packet capture in a new window based on Source IP and Policy ID.

Figure 492: WAF Log Viewer

View List of Advanced Threat Protection Events

Logs are displayed only if the Network Protection module is subscribed.

Time

Time when the event occurred.

Host (Source IP)

IP address of the host from where the threat derives.

User

Username of the user.

Destination IP

Destination IP address (IPv4 / IPv6).

Threat

Name of the threat detected by the device.

Threat URL/IP