Guides
ProductDeveloperPartnerPersonal
Guides
ProductDeveloperPartnerPersonal

Cloud Firewall Log Formats

Suggest Edits

Cloud Firewall logs show traffic that has been handled by network tunnels.

Table of Contents

Examples

"2024-06-14 18:59:57","[211039844]","Passive Monitor", "CDFW Tunnel Device","OUTBOUND","1","84","172.17.3.4","60951","146.112.255.129","443","ams1.edc","12","ALLOW","google.com,apple.com","44,66","1718391597","1718391597","3","3","1108","755","39-42","","","","","","","\[]","","","","2204063"

The example entry is 293 bytes. To estimate the size of your S3 Logs, see Estimate the Size of Your Logs.

Order of Fields in the Cloud Firewall Log

<timestamp><origin IDs><identities><identity type><direction><protocol><packet size><source IP><source port><destination IP><destination port><data center><rule ID><action><fqdns><destination list IDs><first packet timestamp><last packet timestamp><packets sent><packets received><bytes sent><bytes received><fw event ID><destination country><app ID><aws region><private app group ID><private flow><posture ID><casi category IDs><traffic source><content category IDs><content category list IDs><organization ID>

  • Timestamp—The timestamp of the request transaction in UTC.
  • Origin IDs—The unique identity of the network tunnel.
  • Identities—The names of the network tunnel.
  • Identity Type—The type of identity that made the request. Should always be "CDFW Tunnel Device".
  • Direction—The direction of the packet. It is destined either towards the internet or to the customer's network.
  • Protocol—The actual protocol of the traffic. It could be TCP, UDP, ICMP.
  • Packet Size—The size of the packet that Umbrella CDFW received.
  • Source IP—The internal IP address of the user-generated traffic towards the CDFW. If the traffic goes through NAT before it comes to CDFW, it will be the NAT IP address.
  • Source Port—The internal port number of the user-generated traffic towards the CDFW.
  • Destination IP—The destination IP address of the user-generated traffic towards the CDFW.
  • Destination Port—The destination port number of the user-generated traffic towards the CDFW.
  • Data Center—The name of the Umbrella data center that processed the user-generated traffic.
  • Rule ID—The ID of the rule that processed the user traffic.
  • Action—The final verdict whether to allow or block the traffic based on the rule.
  • FQDNs—The fully qualified domain names (FQDNs) that match the request.
  • Destination List IDs—The destination list IDs that Umbrella applied in the rule.
  • First Packet Timestamp—The timestamp when the first packet of the session was received in UTC in seconds. Populated only for traffic handled by Cisco Secure Firewall.
  • Last Packet Timestamp The timestamp when the last packet of the session was received in UTC in seconds. Populated only for traffic handled by Cisco Secure Firewall.
  • Packets Sent—The number of packets sent during the session. Populated only for traffic handled by Cisco Secure Firewall.
  • Packets Received—The number of packets received during the session. Populated only for traffic handled by Cisco Secure Firewall.
  • Bytes Sent—The number of bytes sent during the session. Populated only for traffic handled by Cisco Secure Firewall.
  • Bytes Received—The number of bytes received during the session. Populated only for traffic handled by Cisco Secure Firewall.
  • FW Event ID—The ID of the firewall event. Populated only for traffic handled by Cisco Secure Firewall.
  • Destination Country—The ISO-3166 alpha-2 two-character identifier of the country associated with the destination IP.
  • AWS Region—The AWS region that stores your VPN logs.
  • Private Resource ID—The unique private resource ID identified for the current session.
  • Private App Group ID—The unique ID of the private resource group ID that the private resource belongs to.
  • Private Flow—TRUE if Umbrella applied a private access rule to the user-generated traffic, and FALSE if Umbrella applied an internet access rule.
  • Posture ID—The unique ID of the endpoint posture profile.
  • CASI Category IDs—Name of the Application category to which the App ID belongs.
  • Traffic Source—The source of the user-generated traffic. Valid values are 0 - Unknown, 1 - VPN,2 – ZTNA, 3 - Network Tunnel.
  • Content Category IDs—ID of one or more content categories matched by the rule.
  • Content Category List IDs—ID of one or more content category lists that include categories matched by the rule.
  • Organization ID—The Umbrella organization ID. For more information, see Find Your Organization ID.

Admin Audit Log Formats < Cloud Firewall Log Formats > Data Loss Prevention (DLP) Log Formats

Updated 22 days ago