Elastic
Start free trial Contact Sales
Loading

Checkpoint fields

Some checkpoint module

checkpoint

Module for parsing Checkpoint syslog.

checkpoint.confidence_level
Confidence level determined by ThreatCloud.

type: integer

checkpoint.calc_desc
Log description.

type: keyword

checkpoint.dst_country
Destination country.

type: keyword

checkpoint.dst_user_name
Connected user name on the destination IP.

type: keyword

checkpoint.email_id
Email number in smtp connection.

type: keyword

checkpoint.email_subject
Original email subject.

type: keyword

checkpoint.email_session_id
Connection uuid.

type: keyword

checkpoint.event_count
Number of events associated with the log.

type: long

checkpoint.sys_message
System messages

type: keyword

checkpoint.logid
System messages

type: keyword

checkpoint.failure_impact
The impact of update service failure.

type: keyword

checkpoint.id
Override application ID.

type: integer

checkpoint.identity_src
The source for authentication identity information.

type: keyword

checkpoint.information
Policy installation status for a specific blade.

type: keyword

checkpoint.layer_name
Layer name.

type: keyword

checkpoint.layer_uuid
Layer UUID.

type: keyword

checkpoint.log_id
Unique identity for logs.

type: integer

checkpoint.malware_family
Additional information on protection.

type: keyword

checkpoint.origin_sic_name
Machine SIC.

type: keyword

checkpoint.policy_mgmt
Name of the Management Server that manages this Security Gateway.

type: keyword

checkpoint.policy_name
Name of the last policy that this Security Gateway fetched.

type: keyword

checkpoint.protection_id
Protection malware id.

type: keyword

checkpoint.protection_name
Specific signature name of the attack.

type: keyword

checkpoint.protection_type
Type of protection used to detect the attack.

type: keyword

checkpoint.protocol
Protocol detected on the connection.

type: keyword

checkpoint.proxy_src_ip
Sender source IP (even when using proxy).

type: ip

checkpoint.rule
Matched rule number.

type: integer

checkpoint.rule_action
Action of the matched rule in the access policy.

type: keyword

checkpoint.scan_direction
Scan direction.

type: keyword

checkpoint.session_id
Log uuid.

type: keyword

checkpoint.source_os
OS which generated the attack.

type: keyword

checkpoint.src_country
Country name, derived from connection source IP address.

type: keyword

checkpoint.src_user_name
User name connected to source IP

type: keyword

checkpoint.ticket_id
Unique ID per file.

type: keyword

checkpoint.tls_server_host_name
SNI/CN from encrypted TLS connection used by URLF for categorization.

type: keyword

checkpoint.verdict
TE engine verdict Possible values: Malicious/Benign/Error.

type: keyword

checkpoint.user
Source user name.

type: keyword

checkpoint.vendor_list
The vendor name that provided the verdict for a malicious URL.

type: keyword

checkpoint.web_server_type
Web server detected in the HTTP response.

type: keyword

checkpoint.client_name
Client Application or Software Blade that detected the event.

type: keyword

checkpoint.client_version
Build version of SandBlast Agent client installed on the computer.

type: keyword

checkpoint.extension_version
Build version of the SandBlast Agent browser extension.

type: keyword

checkpoint.host_time
Local time on the endpoint computer.

type: keyword

checkpoint.installed_products
List of installed Endpoint Software Blades.

type: keyword

checkpoint.cc
The Carbon Copy address of the email.

type: keyword

checkpoint.parent_process_username
Owner username of the parent process of the process that triggered the attack.

type: keyword

checkpoint.process_username
Owner username of the process that triggered the attack.

type: keyword

checkpoint.audit_status
Audit Status. Can be Success or Failure.

type: keyword

checkpoint.objecttable
Table of affected objects.

type: keyword

checkpoint.objecttype
The type of the affected object.

type: keyword

checkpoint.operation_number
The operation nuber.

type: keyword

checkpoint.email_recipients_num
Amount of recipients whom the mail was sent to.

type: integer

checkpoint.suppressed_logs
Aggregated connections for five minutes on the same source, destination and port.

type: integer

checkpoint.blade_name
Blade name.

type: keyword

checkpoint.status
Ok/Warning/Error.

type: keyword

checkpoint.short_desc
Short description of the process that was executed.

type: keyword

checkpoint.long_desc
More information on the process (usually describing error reason in failure).

type: keyword

checkpoint.scan_hosts_hour
Number of unique hosts during the last hour.

type: integer

checkpoint.scan_hosts_day
Number of unique hosts during the last day.

type: integer

checkpoint.scan_hosts_week
Number of unique hosts during the last week.

type: integer

checkpoint.unique_detected_hour
Detected virus for a specific host during the last hour.

type: integer

checkpoint.unique_detected_day
Detected virus for a specific host during the last day.

type: integer

checkpoint.unique_detected_week
Detected virus for a specific host during the last week.

type: integer

checkpoint.scan_mail
Number of emails that were scanned by "AB malicious activity" engine.

type: integer

checkpoint.additional_ip
DNS host name.

type: keyword

checkpoint.description
Additional explanation how the security gateway enforced the connection.

type: keyword

checkpoint.email_spam_category
Email categories. Possible values: spam/not spam/phishing.

type: keyword

checkpoint.email_control_analysis
Message classification, received from spam vendor engine.

type: keyword

checkpoint.scan_results
"Infected"/description of a failure.

type: keyword

checkpoint.original_queue_id
Original postfix email queue id.

type: keyword

checkpoint.risk
Risk level we got from the engine.

type: keyword

checkpoint.roles
The role of identity.

type: keyword

checkpoint.observable_name
IOC observable signature name.

type: keyword

checkpoint.observable_id
IOC observable signature id.

type: keyword

checkpoint.observable_comment
IOC observable signature description.

type: keyword

checkpoint.indicator_name
IOC indicator name.

type: keyword

checkpoint.indicator_description
IOC indicator description.

type: keyword

checkpoint.indicator_reference
IOC indicator reference.

type: keyword

checkpoint.indicator_uuid
IOC indicator uuid.

type: keyword

checkpoint.app_desc
Application description.

type: keyword

checkpoint.app_id
Application ID.

type: integer

checkpoint.app_sig_id
IOC indicator description.

type: keyword

checkpoint.certificate_resource
HTTPS resource Possible values: SNI or domain name (DN).

type: keyword

checkpoint.certificate_validation
Precise error, describing HTTPS certificate failure under "HTTPS categorize websites" feature.

type: keyword

checkpoint.browse_time
Application session browse time.

type: keyword

checkpoint.limit_requested
Indicates whether data limit was requested for the session.

type: integer

checkpoint.limit_applied
Indicates whether the session was actually date limited.

type: integer

checkpoint.dropped_total
Amount of dropped packets (both incoming and outgoing).

type: integer

checkpoint.client_type_os
Client OS detected in the HTTP request.

type: keyword

checkpoint.name
Application name.

type: keyword

checkpoint.properties
Application categories.

type: keyword

checkpoint.sig_id
Application’s signature ID which how it was detected by.

type: keyword

checkpoint.desc
Override application description.

type: keyword

checkpoint.referrer_self_uid
UUID of the current log.

type: keyword

checkpoint.referrer_parent_uid
Log UUID of the referring application.

type: keyword

checkpoint.needs_browse_time
Browse time required for the connection.

type: integer

checkpoint.cluster_info
Cluster information. Possible options: Failover reason/cluster state changes/CP cluster or 3rd party.

type: keyword

checkpoint.sync
Sync status and the reason (stable, at risk).

type: keyword

checkpoint.file_direction
File direction. Possible options: upload/download.

type: keyword

checkpoint.invalid_file_size
File_size field is valid only if this field is set to 0.

type: integer

checkpoint.top_archive_file_name
In case of archive file: the file that was sent/received.

type: keyword

checkpoint.data_type_name
Data type in rulebase that was matched.

type: keyword

checkpoint.specific_data_type_name
Compound/Group scenario, data type that was matched.

type: keyword

checkpoint.word_list
Words matched by data type.

type: keyword

checkpoint.info
Special log message.

type: keyword

checkpoint.outgoing_url
URL related to this log (for HTTP).

type: keyword

checkpoint.dlp_rule_name
Matched rule name.

type: keyword

checkpoint.dlp_recipients
Mail recipients.

type: keyword

checkpoint.dlp_subject
Mail subject.

type: keyword

checkpoint.dlp_word_list
Phrases matched by data type.

type: keyword

checkpoint.dlp_template_score
Template data type match score.

type: keyword

checkpoint.message_size
Mail/post size.

type: integer

checkpoint.dlp_incident_uid
Unique ID of the matched rule.

type: keyword

checkpoint.dlp_related_incident_uid
Other ID related to this one.

type: keyword

checkpoint.dlp_data_type_name
Matched data type.

type: keyword

checkpoint.dlp_data_type_uid
Unique ID of the matched data type.

type: keyword

checkpoint.dlp_violation_description
Violation descriptions described in the rulebase.

type: keyword

checkpoint.dlp_relevant_data_types
In case of Compound/Group: the inner data types that were matched.

type: keyword

checkpoint.dlp_action_reason
Action chosen reason.

type: keyword

checkpoint.dlp_categories
Data type category.

type: keyword

checkpoint.dlp_transint
HTTP/SMTP/FTP.

type: keyword

checkpoint.duplicate
Log marked as duplicated, when mail is split and the Security Gateway sees it twice.

type: keyword

checkpoint.incident_extension
Matched data type.

type: keyword

checkpoint.matched_file
Unique ID of the matched data type.

type: keyword

checkpoint.matched_file_text_segments
Fingerprint: number of text segments matched by this traffic.

type: integer

checkpoint.matched_file_percentage
Fingerprint: match percentage of the traffic.

type: integer

checkpoint.dlp_additional_action
Watermark/None.

type: keyword

checkpoint.dlp_watermark_profile
Watermark which was applied.

type: keyword

checkpoint.dlp_repository_id
ID of scanned repository.

type: keyword

checkpoint.dlp_repository_root_path
Repository path.

type: keyword

checkpoint.scan_id
Sequential number of scan.

type: keyword

checkpoint.special_properties
If this field is set to 1 the log will not be shown (in use for monitoring scan progress).

type: integer

checkpoint.dlp_repository_total_size
Repository size.

type: integer

checkpoint.dlp_repository_files_number
Number of files in repository.

type: integer

checkpoint.dlp_repository_scanned_files_number
Number of scanned files in repository.

type: integer

checkpoint.duration
Scan duration.

type: keyword

checkpoint.dlp_fingerprint_long_status
Scan status - long format.

type: keyword

checkpoint.dlp_fingerprint_short_status
Scan status - short format.

type: keyword

checkpoint.dlp_repository_directories_number
Number of directories in repository.

type: integer

checkpoint.dlp_repository_unreachable_directories_number
Number of directories the Security Gateway was unable to read.

type: integer

checkpoint.dlp_fingerprint_files_number
Number of successfully scanned files in repository.

type: integer

checkpoint.dlp_repository_skipped_files_number
Skipped number of files because of configuration.

type: integer

checkpoint.dlp_repository_scanned_directories_number
Amount of directories scanned.

type: integer

checkpoint.number_of_errors
Number of files that were not scanned due to an error.

type: integer

checkpoint.next_scheduled_scan_date
Next scan scheduled time according to time object.

type: keyword

checkpoint.dlp_repository_scanned_total_size
Size scanned.

type: integer

checkpoint.dlp_repository_reached_directories_number
Number of scanned directories in repository.

type: integer

checkpoint.dlp_repository_not_scanned_directories_percentage
Percentage of directories the Security Gateway was unable to read.

type: integer

checkpoint.speed
Current scan speed.

type: integer

checkpoint.dlp_repository_scan_progress
Scan percentage.

type: integer

checkpoint.sub_policy_name
Layer name.

type: keyword

checkpoint.sub_policy_uid
Layer uid.

type: keyword

checkpoint.fw_message
Used for various firewall errors.

type: keyword

checkpoint.message
ISP link has failed.

type: keyword

checkpoint.isp_link
Name of ISP link.

type: keyword

checkpoint.fw_subproduct
Can be vpn/non vpn.

type: keyword

checkpoint.sctp_error
Error information, what caused sctp to fail on out_of_state.

type: keyword

checkpoint.chunk_type
Chunck of the sctp stream.

type: keyword

checkpoint.sctp_association_state
The bad state you were trying to update to.

type: keyword

checkpoint.tcp_packet_out_of_state
State violation.

type: keyword

checkpoint.tcp_flags
TCP packet flags (SYN, ACK, etc.,).

type: keyword

checkpoint.connectivity_level
Log for a new connection in wire mode.

type: keyword

checkpoint.ip_option
IP option that was dropped.

type: integer

checkpoint.tcp_state
Log reinting a tcp state change.

type: keyword

checkpoint.expire_time
Connection closing time.

type: keyword

checkpoint.icmp_type
In case a connection is ICMP, type info will be added to the log.

type: integer

checkpoint.icmp_code
In case a connection is ICMP, code info will be added to the log.

type: integer

checkpoint.rpc_prog
Log for new RPC state - prog values.

type: integer

checkpoint.dce-rpc_interface_uuid
Log for new RPC state - UUID values

type: keyword

checkpoint.elapsed
Time passed since start time.

type: keyword

checkpoint.icmp
Number of packets, received by the client.

type: keyword

checkpoint.capture_uuid
UUID generated for the capture. Used when enabling the capture when logging.

type: keyword

checkpoint.diameter_app_ID
The ID of diameter application.

type: integer

checkpoint.diameter_cmd_code
Diameter not allowed application command id.

type: integer

checkpoint.diameter_msg_type
Diameter message type.

type: keyword

checkpoint.cp_message
Used to log a general message.

type: integer

checkpoint.log_delay
Time left before deleting template.

type: integer

checkpoint.attack_status
In case of a malicious event on an endpoint computer, the status of the attack.

type: keyword

checkpoint.impacted_files
In case of an infection on an endpoint computer, the list of files that the malware impacted.

type: keyword

checkpoint.remediated_files
In case of an infection and a successful cleaning of that infection, this is a list of remediated files on the computer.

type: keyword

checkpoint.triggered_by
The name of the mechanism that triggered the Software Blade to enforce a protection.

type: keyword

checkpoint.https_inspection_rule_id
ID of the matched rule.

type: keyword

checkpoint.https_inspection_rule_name
Name of the matched rule.

type: keyword

checkpoint.app_properties
List of all found categories.

type: keyword

checkpoint.https_validation
Precise error, describing HTTPS inspection failure.

type: keyword

checkpoint.https_inspection_action
HTTPS inspection action (Inspect/Bypass/Error).

type: keyword

checkpoint.icap_service_id
Service ID, can work with multiple servers, treated as services.

type: integer

checkpoint.icap_server_name
Server name.

type: keyword

checkpoint.internal_error
Internal error, for troubleshooting

type: keyword

checkpoint.icap_more_info
Free text for verdict.

type: integer

checkpoint.reply_status
ICAP reply status code, e.g. 200 or 204.

type: integer

checkpoint.icap_server_service
Service name, as given in the ICAP URI

type: keyword

checkpoint.mirror_and_decrypt_type
Information about decrypt and forward. Possible values: Mirror only, Decrypt and mirror, Partial mirroring (HTTPS inspection Bypass).

type: keyword

checkpoint.interface_name
Designated interface for mirror And decrypt.

type: keyword

checkpoint.session_uid
HTTP session-id.

type: keyword

checkpoint.broker_publisher
IP address of the broker publisher who shared the session information.

type: ip

checkpoint.src_user_dn
User distinguished name connected to source IP.

type: keyword

checkpoint.proxy_user_name
User name connected to proxy IP.

type: keyword

checkpoint.proxy_machine_name
Machine name connected to proxy IP.

type: integer

checkpoint.proxy_user_dn
User distinguished name connected to proxy IP.

type: keyword

checkpoint.query
DNS query.

type: keyword

checkpoint.dns_query
DNS query.

type: keyword

checkpoint.inspection_item
Blade element performed inspection.

type: keyword

checkpoint.performance_impact
Protection performance impact.

type: integer

checkpoint.inspection_category
Inspection category: protocol anomaly, signature etc.

type: keyword

checkpoint.inspection_profile
Profile which the activated protection belongs to.

type: keyword

checkpoint.summary
Summary message of a non-compliant DNS traffic drops or detects.

type: keyword

checkpoint.question_rdata
List of question records domains.

type: keyword

checkpoint.answer_rdata
List of answer resource records to the questioned domains.

type: keyword

checkpoint.authority_rdata
List of authoritative servers.

type: keyword

checkpoint.additional_rdata
List of additional resource records.

type: keyword

checkpoint.files_names
List of files requested by FTP.

type: keyword

checkpoint.ftp_user
FTP username.

type: keyword

checkpoint.mime_from
Sender’s address.

type: keyword

checkpoint.mime_to
List of receiver address.

type: keyword

checkpoint.bcc
List of BCC addresses.

type: keyword

checkpoint.content_type
Mail content type. Possible values: application/msword, text/html, image/gif etc.

type: keyword

checkpoint.user_agent
String identifying requesting software user agent.

type: keyword

checkpoint.referrer
Referrer HTTP request header, previous web page address.

type: keyword

checkpoint.http_location
Response header, indicates the URL to redirect a page to.

type: keyword

checkpoint.content_disposition
Indicates how the content is expected to be displayed inline in the browser.

type: keyword

checkpoint.via
Via header is added by proxies for tracking purposes to avoid sending reqests in loop.

type: keyword

checkpoint.http_server
Server HTTP header value, contains information about the software used by the origin server, which handles the request.

type: keyword

checkpoint.content_length
Indicates the size of the entity-body of the HTTP header.

type: keyword

checkpoint.authorization
Authorization HTTP header value.

type: keyword

checkpoint.http_host
Domain name of the server that the HTTP request is sent to.

type: keyword

checkpoint.inspection_settings_log
Indicats that the log was released by inspection settings.

type: keyword

checkpoint.cvpn_resource
Mobile Access application.

type: keyword

checkpoint.cvpn_category
Mobile Access application type.

type: keyword

checkpoint.url
Translated URL.

type: keyword

checkpoint.reject_id
A reject ID that corresponds to the one presented in the Mobile Access error page.

type: keyword

checkpoint.fs-proto
The file share protocol used in mobile acess file share application.

type: keyword

checkpoint.app_package
Unique identifier of the application on the protected mobile device.

type: keyword

checkpoint.appi_name
Name of application downloaded on the protected mobile device.

type: keyword

checkpoint.app_repackaged
Indicates whether the original application was repackage not by the official developer.

type: keyword

checkpoint.app_sid_id
Unique SHA identifier of a mobile application.

type: keyword

checkpoint.app_version
Version of the application downloaded on the protected mobile device.

type: keyword

checkpoint.developer_certificate_name
Name of the developer’s certificate that was used to sign the mobile application.

type: keyword

checkpoint.email_control
Engine name.

type: keyword

checkpoint.email_message_id
Email session id (uniqe ID of the mail).

type: keyword

checkpoint.email_queue_id
Postfix email queue id.

type: keyword

checkpoint.email_queue_name
Postfix email queue name.

type: keyword

checkpoint.file_name
Malicious file name.

type: keyword

checkpoint.failure_reason
MTA failure description.

type: keyword

checkpoint.email_headers
String containing all the email headers.

type: keyword

checkpoint.arrival_time
Email arrival timestamp.

type: keyword

checkpoint.email_status
Describes the email’s state. Possible options: delivered, deferred, skipped, bounced, hold, new, scan_started, scan_ended

type: keyword

checkpoint.status_update
Last time log was updated.

type: keyword

checkpoint.delivery_time
Timestamp of when email was delivered (MTA finished handling the email.

type: keyword

checkpoint.links_num
Number of links in the mail.

type: integer

checkpoint.attachments_num
Number of attachments in the mail.

type: integer

checkpoint.email_content
Mail contents. Possible options: attachments/links & attachments/links/text only.

type: keyword

checkpoint.allocated_ports
Amount of allocated ports.

type: integer

checkpoint.capacity
Capacity of the ports.

type: integer

checkpoint.ports_usage
Percentage of allocated ports.

type: integer

checkpoint.nat_exhausted_pool
4-tuple of an exhausted pool.

type: keyword

checkpoint.nat_rulenum
NAT rulebase first matched rule.

type: integer

checkpoint.nat_addtnl_rulenum
When matching 2 automatic rules , second rule match will be shown otherwise field will be 0.

type: integer

checkpoint.message_info
Used for information messages, for example:NAT connection has ended.

type: keyword

checkpoint.nat46
NAT 46 status, in most cases "enabled".

type: keyword

checkpoint.end_time
TCP connection end time.

type: keyword

checkpoint.tcp_end_reason
Reason for TCP connection closure.

type: keyword

checkpoint.cgnet
Describes NAT allocation for specific subscriber.

type: keyword

checkpoint.subscriber
Source IP before CGNAT.

type: ip

checkpoint.hide_ip
Source IP which will be used after CGNAT.

type: ip

checkpoint.int_start
Subscriber start int which will be used for NAT.

type: integer

checkpoint.int_end
Subscriber end int which will be used for NAT.

type: integer

checkpoint.packet_amount
Amount of packets dropped.

type: integer

checkpoint.monitor_reason
Aggregated logs of monitored packets.

type: keyword

checkpoint.drops_amount
Amount of multicast packets dropped.

type: integer

checkpoint.securexl_message
Two options for a SecureXL message: 1. Missed accounting records after heavy load on logging system. 2. FW log message regarding a packet drop.

type: keyword

checkpoint.conns_amount
Connections amount of aggregated log info.

type: integer

checkpoint.scope
IP related to the attack.

type: keyword

checkpoint.analyzed_on
Check Point ThreatCloud / emulator name.

type: keyword

checkpoint.detected_on
System and applications version the file was emulated on.

type: keyword

checkpoint.dropped_file_name
List of names dropped from the original file.

type: keyword

checkpoint.dropped_file_type
List of file types dropped from the original file.

type: keyword

checkpoint.dropped_file_hash
List of file hashes dropped from the original file.

type: keyword

checkpoint.dropped_file_verdict
List of file verdics dropped from the original file.

type: keyword

checkpoint.emulated_on
Images the files were emulated on.

type: keyword

checkpoint.extracted_file_type
Types of extracted files in case of an archive.

type: keyword

checkpoint.extracted_file_names
Names of extracted files in case of an archive.

type: keyword

checkpoint.extracted_file_hash
Archive hash in case of extracted files.

type: keyword

checkpoint.extracted_file_verdict
Verdict of extracted files in case of an archive.

type: keyword

checkpoint.extracted_file_uid
UID of extracted files in case of an archive.

type: keyword

checkpoint.mitre_initial_access
The adversary is trying to break into your network.

type: keyword

checkpoint.mitre_execution
The adversary is trying to run malicious code.

type: keyword

checkpoint.mitre_persistence
The adversary is trying to maintain his foothold.

type: keyword

checkpoint.mitre_privilege_escalation
The adversary is trying to gain higher-level permissions.

type: keyword

checkpoint.mitre_defense_evasion
The adversary is trying to avoid being detected.

type: keyword

checkpoint.mitre_credential_access
The adversary is trying to steal account names and passwords.

type: keyword

checkpoint.mitre_discovery
The adversary is trying to expose information about your environment.

type: keyword

checkpoint.mitre_lateral_movement
The adversary is trying to explore your environment.

type: keyword

checkpoint.mitre_collection
The adversary is trying to collect data of interest to achieve his goal.

type: keyword

checkpoint.mitre_command_and_control
The adversary is trying to communicate with compromised systems in order to control them.

type: keyword

checkpoint.mitre_exfiltration
The adversary is trying to steal data.

type: keyword

checkpoint.mitre_impact
The adversary is trying to manipulate, interrupt, or destroy your systems and data.

type: keyword

checkpoint.parent_file_hash
Archive’s hash in case of extracted files.

type: keyword

checkpoint.parent_file_name
Archive’s name in case of extracted files.

type: keyword

checkpoint.parent_file_uid
Archive’s UID in case of extracted files.

type: keyword

checkpoint.similiar_iocs
Other IoCs similar to the ones found, related to the malicious file.

type: keyword

checkpoint.similar_hashes
Hashes found similar to the malicious file.

type: keyword

checkpoint.similar_strings
Strings found similar to the malicious file.

type: keyword

checkpoint.similar_communication
Network action found similar to the malicious file.

type: keyword

checkpoint.te_verdict_determined_by
Emulators determined file verdict.

type: keyword

checkpoint.packet_capture_unique_id
Identifier of the packet capture files.

type: keyword

checkpoint.total_attachments
The number of attachments in an email.

type: integer

checkpoint.additional_info
ID of original file/mail which are sent by admin.

type: keyword

checkpoint.content_risk
File risk.

type: integer

checkpoint.operation
Operation made by Threat Extraction.

type: keyword

checkpoint.scrubbed_content
Active content that was found.

type: keyword

checkpoint.scrub_time
Extraction process duration.

type: keyword

checkpoint.scrub_download_time
File download time from resource.

type: keyword

checkpoint.scrub_total_time
Threat extraction total file handling time.

type: keyword

checkpoint.scrub_activity
The result of the extraction

type: keyword

checkpoint.watermark
Reports whether watermark is added to the cleaned file.

type: keyword

checkpoint.snid
The Check Point session ID.

type: keyword

checkpoint.source_object
Matched object name on source column.

type: keyword

checkpoint.destination_object
Matched object name on destination column.

type: keyword

checkpoint.drop_reason
Drop reason description.

type: keyword

checkpoint.hit
Number of hits on a rule.

type: integer

checkpoint.rulebase_id
Layer number.

type: integer

checkpoint.first_hit_time
First hit time in current interval.

type: integer

checkpoint.last_hit_time
Last hit time in current interval.

type: integer

checkpoint.rematch_info
Information sent when old connections cannot be matched during policy installation.

type: keyword

checkpoint.last_rematch_time
Connection rematched time.

type: keyword

checkpoint.action_reason
Connection drop reason.

type: integer

checkpoint.action_reason_msg
Connection drop reason message.

type: keyword

checkpoint.c_bytes
Boolean value indicates whether bytes sent from the client side are used.

type: integer

checkpoint.context_num
Serial number of the log for a specific connection.

type: integer

checkpoint.match_id
Private key of the rule

type: integer

checkpoint.alert
Alert level of matched rule (for connection logs).

type: keyword

checkpoint.parent_rule
Parent rule number, in case of inline layer.

type: integer

checkpoint.match_fk
Rule number.

type: integer

checkpoint.dropped_outgoing
Number of outgoing bytes dropped when using UP-limit feature.

type: integer

checkpoint.dropped_incoming
Number of incoming bytes dropped when using UP-limit feature.

type: integer

checkpoint.media_type
Media used (audio, video, etc.)

type: keyword

checkpoint.sip_reason
Explains why source_ip isn’t allowed to redirect (handover).

type: keyword

checkpoint.voip_method
Registration request.

type: keyword

checkpoint.registered_ip-phones
Registered IP-Phones.

type: keyword

checkpoint.voip_reg_user_type
Registered IP-Phone type.

type: keyword

checkpoint.voip_call_id
Call-ID.

type: keyword

checkpoint.voip_reg_int
Registration port.

type: integer

checkpoint.voip_reg_ipp
Registration IP protocol.

type: integer

checkpoint.voip_reg_period
Registration period.

type: integer

checkpoint.voip_log_type
VoIP log types. Possible values: reject, call, registration.

type: keyword

checkpoint.src_phone_number
Source IP-Phone.

type: keyword

checkpoint.voip_from_user_type
Source IP-Phone type.

type: keyword

checkpoint.dst_phone_number
Destination IP-Phone.

type: keyword

checkpoint.voip_to_user_type
Destination IP-Phone type.

type: keyword

checkpoint.voip_call_dir
Call direction: in/out.

type: keyword

checkpoint.voip_call_state
Call state. Possible values: in/out.

type: keyword

checkpoint.voip_call_term_time
Call termination time stamp.

type: keyword

checkpoint.voip_duration
Call duration (seconds).

type: keyword

checkpoint.voip_media_port
Media int.

type: keyword

checkpoint.voip_media_ipp
Media IP protocol.

type: keyword

checkpoint.voip_est_codec
Estimated codec.

type: keyword

checkpoint.voip_exp
Expiration.

type: integer

checkpoint.voip_attach_sz
Attachment size.

type: integer

checkpoint.voip_attach_action_info
Attachment action Info.

type: keyword

checkpoint.voip_media_codec
Estimated codec.

type: keyword

checkpoint.voip_reject_reason
Reject reason.

type: keyword

checkpoint.voip_reason_info
Information.

type: keyword

checkpoint.voip_config
Configuration.

type: keyword

checkpoint.voip_reg_server
Registrar server IP address.

type: ip

checkpoint.scv_user
Username whose packets are dropped on SCV.

type: keyword

checkpoint.scv_message_info
Drop reason.

type: keyword

checkpoint.ppp
Authentication status.

type: keyword

checkpoint.scheme
Describes the scheme used for the log.

type: keyword

checkpoint.auth_method
Password authentication protocol used (PAP or EAP).

type: keyword

checkpoint.auth_status
The authentication status for an event.

type: keyword

checkpoint.machine
L2TP machine which triggered the log and the log refers to it.

type: keyword

checkpoint.vpn_feature_name
L2TP /IKE / Link Selection.

type: keyword

checkpoint.reject_category
Authentication failure reason.

type: keyword

checkpoint.peer_ip_probing_status_update
IP address response status.

type: keyword

checkpoint.peer_ip
IP address which the client connects to.

type: keyword

checkpoint.peer_gateway
Main IP of the peer Security Gateway.

type: ip

checkpoint.link_probing_status_update
IP address response status.

type: keyword

checkpoint.source_interface
External Interface name for source interface or Null if not found.

type: keyword

checkpoint.next_hop_ip
Next hop IP address.

type: keyword

checkpoint.srckeyid
Initiator Spi ID.

type: keyword

checkpoint.dstkeyid
Responder Spi ID.

type: keyword

checkpoint.encryption_failure
Message indicating why the encryption failed.

type: keyword

checkpoint.ike_ids
All QM ids.

type: keyword

checkpoint.community
Community name for the IPSec key and the use of the IKEv.

type: keyword

checkpoint.ike
IKEMode (PHASE1, PHASE2, etc..).

type: keyword

checkpoint.cookieI
Initiator cookie.

type: keyword

checkpoint.cookieR
Responder cookie.

type: keyword

checkpoint.msgid
Message ID.

type: keyword

checkpoint.methods
IPSEc methods.

type: keyword

checkpoint.connection_uid
Calculation of md5 of the IP and user name as UID.

type: keyword

checkpoint.site_name
Site name.

type: keyword

checkpoint.esod_rule_name
Unknown rule name.

type: keyword

checkpoint.esod_rule_action
Unknown rule action.

type: keyword

checkpoint.esod_rule_type
Unknown rule type.

type: keyword

checkpoint.esod_noncompliance_reason
Non-compliance reason.

type: keyword

checkpoint.esod_associated_policies
Associated policies.

type: keyword

checkpoint.spyware_name
Spyware name.

type: keyword

checkpoint.spyware_type
Spyware type.

type: keyword

checkpoint.anti_virus_type
Anti virus type.

type: keyword

checkpoint.end_user_firewall_type
End user firewall type.

type: keyword

checkpoint.esod_scan_status
Scan failed.

type: keyword

checkpoint.esod_access_status
Access denied.

type: keyword

checkpoint.client_type
Endpoint Connect.

type: keyword

checkpoint.precise_error
HTTP parser error.

type: keyword

checkpoint.method
HTTP method.

type: keyword

checkpoint.trusted_domain
In case of phishing event, the domain, which the attacker was impersonating.

type: keyword

checkpoint.comment
type: keyword
checkpoint.conn_direction
Connection direction

type: keyword

checkpoint.db_ver
Database version

type: keyword

checkpoint.update_status
Status of database update

type: keyword