Domain-Blocked Log Event JSON Format
The domain-blocked log event is generated when Cyber Shield Domain Filtering blocks a domain name resolution.
The log event JSON contains the Header fields and a log JSON object. The fields in the log JSON object for when the eventName in the Header is set to domain-blocked are described in the table below. For more information on the Header, refer to Log Event Header Fields.
Field Name | Type | Description |
|---|---|---|
domain | String | The name of the domain that was blocked. |
category | String | The content filtering category of the blocked domain. |
queryType | String | The type of DNS query used for domain resolution. |
protocol | String | The DNS protocol used. |
Example of a Domain-Blocked Log Event
{
"CloudConnexaLogVersion": 1,
"timestamp": "2023-11-10T15:52:11.000000Z",
"cloudId": "test",
"service": "CloudConnexa",
"traceId": "e8387be6-7a05-4c73-8dae-34047b414194",
"initiator": "521572bc-fcc2-4c05-a78c-d2a9654cc676",
"initiatorType": "Device",
"initiatorName": "My Main Device",
"parentEntity": "43efdaaa-d8a1-4af1-acc1-d96b77313f42",
"parentEntityType": "User",
"parentEntityName": "My User",
"category": "Security.CyberShieldBlockedDomains",
"eventName": "domain-blocked",
"log": {
"domain": "c2c-test-domain.openvpn.com",
"category": "Command and Control",
"queryType": "A",
"protocol": "UDP"
}
}