IPS web filtering event
EventID=3001014396436619828 IncidentID=3001014743178499216 Tagkey=10.11.4.27:62677:172.16.69.18:80:3000982640374151870-f4841228-9d39-11ed-bce7-523d411b9405 DecoyGroup=IT_Decoy DecoyType=Windows10 AttackerIP=10.11.4.27 AttackerPort=62677 VictimIP=172.16.69.18 VictimPort=80 Operation=FortiGuard_Web_Filtering Host=172.16.69.18 URL=/sample/eicar.tgz Description="172.16.69.18/sample/eicar.tgz" Category=Unknown
| Log Field Name | Description | Data Type |
|---|---|---|
|
AttackerIP |
Event source ip |
string |
|
AttackerPort |
Event source port |
int |
|
Category |
Category name |
string |
|
DecoyGroup |
Decoy group name |
string |
|
DecoyType |
Decoy OS type |
string |
|
Description |
Extra information about the event. For example, ssh command, file changes, etc. |
string |
|
EventID |
Event id |
int |
|
Host |
Host IP |
string |
|
IncidentID |
Incident id |
int |
|
Operation |
Event operation |
string |
|
Tagkey |
Key used to group events into incident |
string |
|
URL |
The URL used to log in to the decoy and browse the endpoint. |
string |
|
VictimIP |
Event destination ip |
string |
|
VictimPort |
Event destination port |
int |