Data Fields
status user_name iap av_policy_name src_ip, src_port dst_ip, dst_port virus url domain_name dst_country_code log_id sent_bytes recv_bytes
Type
string integer string integer integer string string string string integer integer integer
Description
End-user associated with the item being scanned.
Numerical ID of the web policy applied to this transaction.
IP address and port from which the connection originated (client-side).
IP address and port to which the connection is directed (server-side).
Name of the malware identified by the scan engine.
Protocol-specific information about the event.
FQDN part of the URL.
GeoIP country code associated with the destination IP address.
Numerical ID indicating the type of the message.
Data, in bytes, sent by the firewall to the destination.
Data, in bytes, received.
Email Logs
Logs are displayed only if Email Protection Module is subscribed.
13006
13007
13008
13009
13010
13011
13012
Message ID
13001
13002
13003
13004
13005
Message
A mail considered to be a SPAM
A mail considered to be a PROBABLE SPAM
A mail was not considered SPAM or PROBABLE SPAM
Sender IP address is blacklisted.
A mail considered to be an Outbound SPAM
A mail considered to be an Outbound Probable SPAM
Flagged clean by both IBS/OBS
Message is marked clean by outbound
DLP detected in mail
SPX successfully applied
SPX failed
SMTP DOS
Sophos XG Firewall | Appendix A - Logs | 533
Protocol
SMTP
Sophos XG Firewall | Appendix A - Logs | 534
Message ID
13013
13014
14001
14002
14003
15001
15002
15003
Module-specific Fields
Data Fields
status firewall_rule_id user policy_name sender recipient subject message_id email_size action
Type
string integer string string string string string string string string reason host domain src_ip src_country dst_ip dst_country
Message
Email is marked Clean by Sophos Sandstorm
Email is marked Malicious by Sophos Sandstorm
A mail considered to be a SPAM
A mail considered to be a PROBABLE SPAM
A mail was not considered SPAM or PROBABLE SPAM
A mail considered to be a SPAM
A mail considered to be a PROBABLE SPAM
A mail was not considered SPAM or PROBABLE SPAM string string integer string string string string
Protocol
Description
Ultimate status of traffic – Allowed or Denied
Firewall Rule ID which is applied on the traffic
User name
Spam policy name which is applied on the traffic
Sender email address
Recipient email address
Email subject
Email ID
Email size
Action performed on the message
Possible values:
Reject
Drop
Accept
Change Recipient
Prefix subject
Sandstorm Allow
Sandstorm Deny
Reason why email was detected as spam/malicious
Sender domain name
Receiver domain name
Original Source IP address of traffic
Code of the country to which the source IP belongs
Original Destination IP address of traffic
Code of the country to which the destination IP belongs
POP
IMAP
