Sophos XG Firewall | Appendix A - Logs | 514
Endpoint IP
IP address of the endpoint.
Endpoint Health
Status of endpoint health (red, yellow, green).
Message ID
Message ID of the message.
Live PCAP
Click Open PCAP link to view packet capture in a new window based on Endpoint IP.
Figure 472: Security Heartbeat Log Viewer
Log ID Structure
Log is identified by Log ID. Log ID is a unique 12 characters code c1c2c3c4c5c6c7c8c9c10c11c12
Where: c1c2 - Log Type ID c3c4 - Log Component ID c5c6 - Log Sub Type ID c7 - Priority c8c9c10c11c12 - Message ID
For example, if the Log ID is 010101600001.
c1c2 – 01 c3c4 – 01 c5c6 – 01 c7 - 6 c8c9c10c11c12 - 00001
Hence, from the Log ID, we derive:
Log Type
(01) = Firewall
Log Component
(01) = Firewall Rule
Log Sub-type
(01) = Allowed
Message (00001) = Firewall Traffic Allowed (to be seen under appropriate type of logs. Here, since Log Type is
Firewall, Message is found under Firewall Logs)
Log Type
Log Type identifies the type of log.
log_type
Security Policy
IPS
Anti-Virus
Anti Spam
Content Filtering
Event
WAF
ATP
EATP
Wireless Protection
Heartbeat
System Health
Sandstorm
Log Component
Log Component identifies the component of the log.
log_component
Firewall Rule
Invalid Traffic
Appliance Access
DoS Attacks
ICMP Redirection
Source Routed
Anomaly
Signatures
HTTP
FTP
SMTP
POP3
IMAP4
Fragmented Traffic
Invalid Fragmented Traffic
HA
Foreign Host
IPMAC Filter
Sophos XG Firewall | Appendix A - Logs | 515
log_component
IP Spoof
GUI
CLI
LCD
CCC
IM
IPsec
L2TP
PPTP
SSL VPN
Firewall Authentication
VPN Authentication
SSL VPN Authentication
My Account Authentication
Appliance
DHCP Server
Interface
Gateway
DDNS
WebCat
IPS
AV
Dial-In Authentication
Dial-In
Quarantine
Application Filter
Landing Page
WLAN
ARP Flood
HTTPS
Guest User
WAF
Virtual Host
CTA
Sophos XG Firewall | Appendix A - Logs | 516
log_component
NTLM
Appliances Deactivated
PPPoE
External Authentication
API
ICAP
SMTPS
Wireless Controller
POPS
IMAPS
Firewall
DNS
Web Proxy
Heartbeat
End Point
RED
ATP
SSL VPN Client
IPsec Client
Authentication Client
RED Firmware
AP Firmware up2date
CPU
Memory
Disk
Live User
Missing Heartbeat
Enhanced app control
ICMP related packets
Mail proxy
Log Subtype and Module Icons
Sophos XG Firewall | Appendix A - Logs | 517
OB Probable Spam
No Modification
Modified Headers
Modified Body
4xx Error
5xx Error
Alert
DLP
SPX
DOS
Override
Information
Usage
Warned
Pending
log_subtype
Allowed
Denied
Detect
Drop
Clean
Virus
Spam
Probable Spam
Admin
Authentication
System
OB Clean
OB Spam
Table 7: Module Icons
Module Name
Web Filter
Blue
Blue
Blue
Green
Blue
Orange
Blue
Blue
Blue
Blue
Blue
Red
Red
Orange
Blue
Blue
Blue
Blue
Blue
Red
Red
Blue
Blue
Color
Green
Red
Orange
Red
Green
Icon and Color
(Green/Red/Orange)
Sophos XG Firewall | Appendix A - Logs | 518
