Skip to main content

Traffic-Blocked Log Event JSON Format

Abstract

This document describes the JSON log event fields of the Log Streaming Traffic Blocked log event and provides an example.

The traffic-blocked log event is generated when Cyber Shield Traffic Filtering blocks a traffic flow.

The log event JSON contains the Header fields and a log JSON object. The fields in the log JSON object for when the eventName in the Header is set to traffic-blocked are described in the table below. For more information on the Header, refer to Log Event Header Fields.

Table 9. JSON fields present in the log object for the traffic-blocked log event

Field Name

Type

Description

signatureId

String

The ID of the traffic signature, which matched the traffic flow to cause it to be blocked.

eventName

String

Informative text describing the traffic signature with which the blocked traffic flow was matched.

classification

String

Informative text describing the threat classification of the blocked traffic flow.

priority

Integer

The Cyber Shield Traffic Filtering priority level. Traffic matching specific patterns of interest are classified into three threat priority levels, where 1 is the highest severity, and 3 is the lowest.

category

String

The Cyber Shield traffic filter category of the blocked traffic flow.

protocol

String

The protocol of the blocked traffic flow.

sourceIp

String

The IP address of the traffic source.

sourcePort

Integer

The port number of the traffic source.

destinationIp

String

The IP address of the intended traffic destination.

destinationPort

Integer

The port number of the intended traffic destination.



Example of a Traffic-Blocked Log Event
{
  "CloudConnexaLogVersion": 1,
  "timestamp": "2023-11-10T15:50:04.000000Z",
  "cloudId": "test",
  "service": "CloudConnexa",
  "traceId": "33249eb9-836e-4f9c-b9da-3688166bfa2b",
  "initiator": "521572bc-fcc2-4c05-a78c-d2a9654cc676",
  "initiatorType": "Device",
  "initiatorName": "My Main Device",
  "parentEntity": "43efdaaa-d8a1-4af1-acc1-d96b77313f42",
  "parentEntityType": "User",
  "parentEntityName": "My User",
  "category": "Security.CyberShieldBlockedTraffic",
  "eventName": "traffic-blocked",
  "log": {
    "signatureId": "1:99999907:1",
    "eventName": "ET WORM OpenVPN generate event for category Malware prio 1",
    "classification": "Attempted Information Leak",
    "priority": 1,
    "category": "Malware and Ransomware",
    "protocol": "TCP",
    "sourceIp": "100.96.1.130",
    "sourcePort": 55544,
    "destinationIp": "104.18.21.80",
    "destinationPort": 80
  }
}
In this section: