CEF 模块

cp_app_risk

-

event.risk_score

checkpoint.app_risk

cp_severity

-

event.severity

checkpoint.severity

baseEventCount

-

-

checkpoint.event_count

deviceExternalId

-

observer.type

-

deviceFacility

-

observer.type

-

deviceInboundInterface

-

observer.ingress.interface.name

-

deviceOutboundInterface

-

observer.egress.interface.name

-

externalId

-

-

checkpoint.uuid

fileHash

-

file.hash.{md5,sha1}

-

reason

-

-

checkpoint.termination_reason

requestCookies

-

-

checkpoint.cookie

sourceNtDomain

-

dns.question.name

-

Signature

-

vulnerability.id

-

Recipient

-

destination.user.email

-

Sender

-

source.user.email

-

deviceCustomFloatingPoint1

更新版本

observer.version

-

deviceCustomIPv6Address2

源 IPv6 地址

source.ip

-

deviceCustomIPv6Address3

目标 IPv6 地址

destination.ip

-

deviceCustomNumber1

以秒为单位的经过时间

event.duration

-

电子邮件收件人数量

-

checkpoint.email_recipients_num

payload

network.bytes

-

deviceCustomNumber2

icmp 类型

-

checkpoint.icmp_type

以秒为单位的持续时间

event.duration

-

deviceCustomNumber3

icmp 代码

-

checkpoint.icmp_code

deviceCustomString1

连接状态

-

checkpoint.connectivity_state

应用程序规则名称

rule.name

-

威胁防御规则名称

rule.name

-

voip 日志类型

-

checkpoint.voip_log_type

dlp 规则名称

rule.name

-

电子邮件 ID

-

checkpoint.email_id

deviceCustomString2

类别

-

checkpoint.category

电子邮件主题

-

checkpoint.email_subject

传感器模式

-

checkpoint.sensor_mode

保护 ID

-

checkpoint.protection_id

扫描调用类型

-

checkpoint.integrity_av_invoke_type

更新状态

-

checkpoint.update_status

对等网关

-

checkpoint.peer_gateway

类别

rule.category

-

deviceCustomString6

应用程序名称

network.application

-

病毒名称

-

checkpoint.virus_name

恶意软件名称

-

checkpoint.spyware_name

恶意软件家族

-

checkpoint.malware_family

deviceCustomString3

用户组

group.name

-

事件扩展

-

checkpoint.incident_extension

保护类型

-

checkpoint.protection_type

电子邮件临时 ID

-

checkpoint.email_spool_id

标识类型

-

checkpoint.identity_type

deviceCustomString4

恶意软件状态

-

checkpoint.spyware_status

威胁防御规则 ID

rule.id

-

扫描结果

-

checkpoint.scan_result

tcp 标志

-

checkpoint.tcp_flags

目标操作系统

os.name

-

保护名称

-

checkpoint.protection_name

电子邮件控制

-

checkpoint.email_control

频率

-

checkpoint.frequency

用户响应

-

checkpoint.user_status

deviceCustomString5

匹配的类别

rule.category

-

vlan id

network.vlan.id

-

身份验证方法

-

checkpoint.auth_method

电子邮件会话 ID

-

checkpoint.email_session_id

deviceCustomDate2

订阅过期

-

checkpoint.subs_exp

deviceFlexNumber1

置信度

-

checkpoint.confidence_level

deviceFlexNumber2

性能影响

-

checkpoint.performance_impact

目标电话号码

-

checkpoint.dst_phone_number

flexString1

应用程序签名 ID

-

checkpoint.app_sig_id

flexString2

恶意软件操作

rule.description

-

攻击信息

event.action

-

rule_uid

-

rule.uuid

-

ifname

-

observer.ingress.interface.name

-

inzone

-

observer.ingress.zone

-

outzone

-

observer.egress.zone

-

product

-

observer.product

-