Repository navigation
Expand file tree
/
Copy pathtest-packet-filter.json
More file actions
115 lines (115 loc) · 3.8 KB
/
Copy pathtest-packet-filter.json
File metadata and controls
115 lines (115 loc) · 3.8 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
{
"events": [
{
"@timestamp": "2019-04-08T11:21:55.000Z",
"agent": {
"ephemeral_id": "e311f248-bcfe-40fa-a92c-75047bac1b66",
"id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2",
"name": "docker-fleet-agent",
"type": "filebeat",
"version": "8.1.3"
},
"data_stream": {
"dataset": "sophos.utm",
"namespace": "ep",
"type": "logs"
},
"destination": {
"ip": "172.30.30.1",
"mac": "00:0c:29:93:cc:85",
"port": 51130
},
"ecs": {
"version": "8.0.0"
},
"elastic_agent": {
"id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2",
"snapshot": false,
"version": "8.1.3"
},
"event": {
"code": "ulogd",
"dataset": "sophos.utm",
"original": "2019:04:08-11:21:55 galaxy ulogd[5009]: id=\"2002\" severity=\"info\" sys=\"SecureNet\" sub=\"packetfilter\" name=\"Packet accepted\" action=\"accept\" fwrule=\"3000000014\" initf=\"eth0\" outitf=\"eth3\" srcmac=\"00:50:56:c0:00:01\" dstmac=\"00:0c:29:93:cc:85\" srcip=\"192.168.168.1\" dstip=\"172.30.30.1\" proto=\"6\" length=\"52\" tos=\"0x00\" prec=\"0x00\" ttl=\"127\" srcport=\"57051\" dstport=\"51130\" tcpflags=\"SYN\"",
"timezone": "+00:00"
},
"host": {
"name": "galaxy"
},
"input": {
"type": "log"
},
"log": {
"file": {
"path": "/tmp/service_logs/sophos-utm-generated.log"
},
"level": "info",
"offset": 24605
},
"message": "\"Packet",
"observer": {
"egress": {
"interface": {
"name": "eth3"
}
},
"ingress": {
"interface": {
"name": "eth0"
}
},
"product": "UTM",
"type": "Firewall",
"vendor": "Sophos"
},
"process": {
"pid": 5009
},
"related": {
"ip": [
"172.30.30.1",
"192.168.168.1"
]
},
"rsa": {
"internal": {
"event_desc": "\"Packet",
"messageid": "ulogd"
},
"investigations": {
"ec_activity": "Scan",
"ec_subject": "NetworkComm",
"ec_theme": "TEV",
"event_cat": 1901000000,
"event_cat_name": "Other.Default"
},
"misc": {
"policy_id": "3000000014",
"rule": "2002",
"severity": "info",
"vsys": "SecureNet"
},
"network": {
"alias_host": [
"galaxy"
],
"dinterface": "eth3",
"network_service": "packetfilter",
"sinterface": "eth0"
},
"time": {
"event_time": "2019-04-08T11:21:55.000Z"
}
},
"source": {
"ip": "192.168.168.1",
"mac": "00:50:56:c0:00:01",
"port": 57051
},
"tags": [
"sophos-utm",
"forwarded"
]
}
]
}