| Appendix A - Logs | 561

Application Firewall" priority=Information user_name="jsmith" server=www.iviewtest.com:8990 sourceip=10.198.235.254 localip=10.198.233.48 ws_protocol="HTTP/1.1" url=/download/ eicarcom2.zip querystring= cookie="; PHPSESSID=jetkd9iadd969hsr77jpj4q974;

_pk_id.1.fc3a=3a6250e215194a92.1485866024.1.1485866069.1485866024.; _pk_ses.1.fc3a=*" referer=http:// www.iviewtest.com:8990/85-0-Download.html method=GET httpstatus=403 reason="Antivirus" extra="EICAR-

AV-Test" contenttype="text/html" useragent="Mozilla/5.0 (Windows NT 6.1; WOW64; rv:50.0) Gecko/20100101

Firefox/50.0" host=10.198.235.254 responsetime=403214 bytessent=739 bytesrcv=715 fw_rule_id=6

Advanced Threat Protection (ATP) Logs

Logs are displayed only if Network Protection Module is subscribed.

Message ID

18009

18010

Message

Alert by ATP

Drop by ATP

Sample Logs:

device="SFW" date=2017-01-31 time=18:44:31 timezone="IST" device_name="CR750iNG-XP" device_id=C44310050024-P29PUA log_id=086304418010 log_type="ATP" log_component="Firewall" log_subtype="Drop" priority=Warning user_name="jsmith" protocol="TCP" src_port=22623 dst_port=80 sourceip=10.198.47.71 destinationip=46.161.30.47 url=46.161.30.47 threatname=C2/Generic-A eventid=C366ACFB-7A6F-4870-B359-A6CFDA8C85F7 eventtype="Standard" login_user="" process_user="" ep_uuid= execution_path=""

Heartbeat Logs

Logs are displayed only if Network Protection Module is subscribed.

Message ID

18012

18013

Message

Heartbeat status

Endpoint status

Sample Logs

device="SFW" date=2017-02-01 time=17:01:55 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=116725518013 log_type="Heartbeat" log_component="Endpoint" log_subtype="Information" priority=Notice ep_name=Heartbeat206-PC ep_uuid=54d320ef-7c6c-4cc7b900-8aabcc9ca04b ep_ip=10.198.47.206 ep_health=Green ep_event_time=1485948715 device="SFW" date=2017-02-01 time=17:01:47 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=116725518013 log_type="Heartbeat" log_component="Endpoint" log_subtype="Information" priority=Notice ep_name=Heartbeat206-PC ep_uuid=54d320ef-7c6c-4cc7b900-8aabcc9ca04b ep_ip=10.198.47.206 ep_health=Red ep_event_time=1485948707 device="SFW" date=2017-02-01 time=17:24:38 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=116725518013 log_type="Heartbeat" log_component="Endpoint" log_subtype="Information" priority=Notice ep_name=Heartbeat206-PC ep_uuid=54d320ef-7c6c-4cc7b900-8aabcc9ca04b ep_ip=10.198.47.206 ep_health=Missing ep_event_time=1485950078