Export logs in JSON format

timestamp

Time when the event was received. Format: yyyy-mm-ddThh:mm:ssZ.

2022-05-12T08:11:46.15869Z

node

The unique name of the device that generated the event.

utmcore@ntoorereaeda

proto

Level 4 protocol used.

UDP

data

Indicates the data being transmitted.

{"question":[{"domain":"google.com","type":"A","class":"IN"}],

"answer":[{"domain":"google.com","type":"TXT","class":"IN","ttl":5,"data":"Blocked"},{"domain":"google.com","type":"A","class":"IN","ttl":5,"data":"10.10.0.1"}]}

reasons

The reason why the event was created, e.g. the URL category on which the rule was triggered.

{"url_cats":[{"id":37,"name":"Search Engines & Portals","threat_level":1}]}

url_categories

id

ID of the triggered URL category.

37

threat_level

Threat level of the triggered category.

Available values:

• 1: very low

• 2: low

• 3: medium

• 4: high

• 5: very high

name

Name of the triggered category.

Search Engines & Portals

source

zone

guid

Unique ID of the traffic source zone.

d0038912-0d8a-4583-a525-e63950b1da47

name

Traffic source zone name.

Trusted

country

Source country name.

AE (a two-letter country code is displayed)

ip

IPv4 address of the traffic source.

10.10.10.10

port

Source port

Values: 0-65535.

destination

zone

guid

Unique ID of the traffic destination zone.

3c0b1253-f069-4060-903b-5fec4f465db0

name

Traffic destination zone name.

Untrusted

country

Destination country name.

AE (a two-letter country code is displayed)

ip

IPv4 address of the traffic destination.

104.19.197.151

port

Destination port

Values: 0-65535. Port 53 is normally used for DNS.

rule

guid

Unique ID of the rule triggered to cause the event.

59e38e06-533a-4771-9664-031c3e8b2e1f

name

Name of the rule triggered to cause the event.

Rule1

user

guid

Unique ID of the user. If the user type is Unknown then the ID: 00000000-0000-0000-0000-000000000000.

a7a3cd49-8232-4f1a-962a-3659af89e96f

name

The username.

user1

groups

guid

Unique ID of the group the user is a member of.

919878b2-e882-49ed-3331-8ec72c3c79cb

name

Name of the group the user is a member of.

Default Group

timestamp

Time when the event was received. Format: yyyy-mm-ddThh:mm:ssZ.

2022-05-12T08:11:46.15869Z

node

The unique name of the device that generated the event.

utmcore@ersthetatica

from

Sender email.

sender@example.com

to

Recipient email.

receiver@example.com

app_protocol

Application layer network protocol.

SMTP

source

zone

guid

Unique ID of the traffic source zone.

d0038912-0d8a-4583-a525-e63950b1da47

name

Traffic source zone name.

Trusted

country

Source country name.

AE (a two-letter country code is displayed)

ip

IPv4 address of the traffic source.

10.10.10.10

port

Source port

Values: 0-65535.

destination

zone

guid

Unique ID of the traffic destination zone.

3c0b1253-f069-4060-903b-5fec4f465db0

name

Traffic destination zone name.

Untrusted

country

Destination country name.

AE (a two-letter country code is displayed)

ip

IPv4 address of the traffic destination.

10.10.10.10

port

Destination port

Values: 0-65535.

rule

guid

Unique ID of the rule triggered to cause the event.

59e38e06-533a-4771-9664-031c3e8b2e1f

name

Name of the rule triggered to cause the event.

Mail security rule

user

guid

Unique ID of the user.

a7a3cd49-8232-4f1a-962a-3659af89e96f

name

The username.

user_name

groups

guid

Unique ID of the group the user is a member of.

919878b2-e882-49ed-3331-8ec72c3c79cb

name

Name of the group the user is a member of.

Default Group

The username.

DESKTOP-0731NFQ\\Username

The result of executing a WMI or SNMP query.

OK, Error

Log event source.

Microsoft-Windows-Security-Auditing

Endpoint device or sensor name.

DESKTOP-0731NFQ

Endpoint device or sensor ID.

35fb5820-74db-4eac-b05b-d01bc284c4e8

The event's category.

Special Logon

The insertion string is the EventData block of the Windows event data.

Windows DefenderSECURITY_PRODUCT_STATE_ON

The WMI or SNMP error that occurred as a result of the query.

0

Detailed information about the event.

The startup type of the "Windows Module Installer" service has been changed from "Automatic" to "Manual".

The ID of the counter added to the WMI and SNMP sensor.

35fb5820-74db-4eac-b05b-d01bc284c4e8

Computer name

DESKTOP-0731NFQ

The endpoint device ID.

35fb5820-74db-4eac-b05b-d01bc284c4e8

The type of the content.

application/json

Number of the network protocol used.

4

Hostname.

www.google.com

Application to which the firewall rule was applied.

C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe

Action taken by the device according to the configured policies.

drop, accept, nat

Name of the user whose account is logged in on the endpoint device.

DESKTOP-0731NFQ\\User

Endpoint device or sensor name.

DESKTOP-0731NFQ

Endpoint device or sensor ID.

35fb5820-74db-4eac-b05b-d01bc284c4e8

The issuer of the application's certificate.

Microsoft Windows Production PCA 2011

Command line prompt.

C:\\Windows\\system32\\svchost.exe -k wsappx -p -s AppXSvc

Session ID.

1656038456

Endpoint device or sensor name.

DESKTOP-0731NFQ

Endpoint device or sensor ID.

35fb5820-74db-4eac-b05b-d01bc284c4e8

A Windows driver that allows the computer to communicate with hardware/device.

USBHUB3

timestamp

Time when the event was received. Format: yyyy-mm-ddThh:mm:ssZ.

2022-05-12T08:11:46.15869Z

node_name

A name that uniquely identifies the UserGate device generating this event.

utmcore@ntoorereaeda

endpoint_id

ID of the endpoint that is the source of the event.

16535060-5a1a-4e92-8331-239406ec34da

endpoint_name

Name of the endpoint that is the source of the event (UserGate client, WMI sensor, etc.).

dep.local

user_name

The "User" field from AD log.

user1.dep.local

log_level

The "Keywords" field from AD log.

Audit Success

log_category_string

Event category code in the AD log.

Group Membership

log_file

Windows log file.

Security

source_name

The "Source" field from AD log.

Microsoft-Windows-Security-Auditing

data

Event description in the AD log.

Group membership information. Subject: \tSecurity ID:\t\tS-1-0-0 \tAccount Name:\t\t- \tAccount Domain:\t\t- \tLogon ID:\t\t0x0 Logon Type:\t\t\t3 New Logon: \tSecurity ID:\t\tS-1-5-21-3795870133-5220325-2125745684-1103 \tAccount Name:\t\tuser1 \tAccount Domain:\t\tDEP \tLogon ID:\t\t0x7A25A21 Event in sequence:\t\t1 of 1 Group Membership:\t\t\t \t\t%{S-1-5-21-3795870133-5220325-2125745684-513} \t\t%{S-1-1-0} \t\t%{S-1-5-32-544} \t\t%{S-1-5-32-555} \t\t%{S-1-5-32-545} \t\t%{S-1-5-32-554} \t\t%{S-1-5-2} \t\t%{S-1-5-11} \t\t%{S-1-5-15} \t\t%{S-1-5-21-3795870133-5220325-2125745684-512} \t\t%{S-1-5-21-3795870133-5220325-2125745684-572} \t\t%{S-1-5-64-10} \t\t%{S-1-16-12288} The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. This event is generated when the Audit Group Membership subcategory is configured. The Logon ID field can be used to correlate this event with the corresponding user logon event as well as to any other security audit events generated during this logon session.

computer_name

Windows node from the AD log where the event took place.

DC1.dep.local

insertion_string

Parameters of the AD log event after message parsing.

['S-1-0-0', '-', '-', '0x0', 'S-1-5-21-3795870133-5220325-2125745684-1103', 'user1', 'DEP', '0x7a25a21', '3', '1', '1', '\ \ \\t\\t%

{S-1-5-21-3795870133-5220325-2125745684-513}\ \ \\t\\t%{S-1-1-0}\ \ \\t\\t%{S-1-5-32-544}\ \ \\t\\t%{S-1-5-32-555}\ \ \\t\\t%{S-1-5-32-545}\ \ \\t\\t%{S-1-5-32-554}\ \ \\t\\t%{S-1-5-2}\ \ \\t\\t%{S-1-5-11}

\ \ \\t\\t%{S-1-5-15}\ \ \\t\\t%{S-1-5-21-3795870133-5220325-2125745684-512}\ \ \\t\\t%{S-1-5-21-3795870133-5220325-2125745684-572}\ \ \\t\\t%{S-1-5-64-10}\ \ \\t\\t%{S-1-16-12288}']

error

Error code from the AD log that occurred while receiving data.

0

status

Error description from the AD log that occurred while receiving data.

counter_id

Counter ID of the WMI sensor.

login_logout

log_event_code

The "Event code" field from AD log.

4627

log_event_id

The "Event ID" field from AD log.

4627

log_event_type

Windows log even type (System/Security/Application etc.)

4

timestamp

Time when the event was received. Format: yyyy-mm-ddThh:mm:ssZ.

2022-05-12T08:11:46.15869Z

node

The unique name of the device that generated the event.

utmcore@ntoorereaeda

syslog_facility

Syslog event source type. Example: user-level messages.

For more information about Syslog facility values, see RFC 5424.

1

syslog_severity

Syslog event severity level. Example: warning.

For more information about Syslog severity values, see RFC 5424.

4

computer_name

The name of the device where the event occurred.

node1

app_name

Application triggering the event.

org.gnome.Shell.desktop

process_id

PID of the process triggering the event.

3036

data

The event description.

[3603:3603:1130/125201.838651:ERROR:CONSOLE(6)] \"console.assert\", source: devtools://devtools/bundled/devtools-frontend/front_end/panels/console/console.js (6)

rule

guid

Unique ID of the rule triggered to cause the event.

16535060-5a1a-4e92-8331-239406ec34da

name

Name of the rule triggered to cause the event.

Example - Allow user-level messages

timestamp

Time when the event was received. Format: yyyy-mm-ddThh:mm:ssZ.

2022-05-12T08:11:46.15869Z

node

The unique name of the device that generated the event.

utmcore@ntoorereaeda

reasons

The reason why the event was created.

{\"user_groups_sids\":[\"S-1-5-21-3795870133-5220325-2125745684-513\",\"S-1-5-21-3795870133-5220325-2125745684-512\",\"S-1-5-21-3795870133-5220325-2125745684-572\"],

\"user_sid\":\"S-1-5-21-3795870133-5220325-2125745684-1103\",\"login\":\"user1\",\"domain\":\"DEV\",\"event_id\":4624}

action

Action taken by the device according to the configured policies.

login

src_ip

IPv4 address of the event source.

10.10.0.11

rule

guid

Unique ID of the rule triggered to cause the event.

16535060-5a1a-4e92-8331-239406ec34da

name

Name of the rule triggered to cause the event.

dev.local

user

guid

Unique ID of the user. If the user type is Unknown then the ID: 00000000-0000-0000-0000-000000000000.

745591c3-9d21-092d-8db4-5b9b0000044f

name

The username.

user1

groups

guid

Unique ID of the group the user is a member of.

aa218609-8716-9252-df20-88c43a0d0bf6

name

Name of the group the user is a member of.

CN=Domain Users,CN=Users,DC=dev,DC=local