Event Definitions

From Edge Threat Management Wiki - Arista
Revision as of 21:15, 17 May 2017 by Dmorris (talk | contribs) (Dmorris moved page Events to Event Definitions without leaving a redirect)
Jump to navigationJump to search

All event data is stored in the Database Schema in a relational database. As Untangle and applications process traffic they create Event objects that add and modify content in the database. Each event has it's own class/object with certain fields that modify the database in a certain way.

The list below shows the classes used in the event logging and the attributes of each event object. These can be used to add alerts in Reports or for other event handling within Untangle.

HostTableEvent

<section begin='HostTableEvent' />

These events are created by the base system and inserted to the host_table_updates table when the host table is modified.

Attribute Name Type Description
address InetAddress The address
class Class The class name
key String The key
timeStamp Timestamp The timestamp
value String The value

<section end='HostTableEvent' />


DeviceTableEvent

<section begin='DeviceTableEvent' />

These events are created by the base system and inserted to the device_table_updates table when the device list is modified.

Attribute Name Type Description
class Class The class name
device DeviceTableEntry The Device
key String The key
macAddress String The MAC address
timeStamp Timestamp The timestamp
value String The value

<section end='DeviceTableEvent' />


PenaltyBoxEvent

<section begin='PenaltyBoxEvent' />

These events are created by the Bandwidth Control and inserted to the penaltybox table.

Attribute Name Type Description
action int The action
address InetAddress The address
class Class The class name
entryTime Timestamp The entry time
exitTime Timestamp The exit time
timeStamp Timestamp The timestamp

<section end='PenaltyBoxEvent' />


SessionStatsEvent

<section begin='SessionStatsEvent' />

These events are created by the base system and update the sessions table when a session ends with the updated stats.

Attribute Name Type Description
c2pBytes long The number of bytes sent from the client to Untangle
class Class The class name
endTime long The end time/date
p2cBytes long The number of bytes sent to the client from Untangle
p2sBytes long The number of bytes sent to the server from Untangle
s2pBytes long The number of bytes sent from the server to Untangle
sessionId Long The session ID
timeStamp Timestamp The timestamp

<section end='SessionStatsEvent' />


SessionEvent

<section begin='SessionEvent' />

These events are created by the base system and update the sessions table each time a session is created.

Attribute Name Type Description
cClientAddr InetAddress The client-side (pre-NAT) client address
cClientPort Integer The client-side (pre-NAT) client port
cServerAddr InetAddress The client-side (pre-NAT) server address
cServerPort Integer The client-side (pre-NAT) server port
sClientAddr InetAddress The server-side (post-NAT) client address
sClientPort Integer The server-side (post-NAT) client port
sServerAddr InetAddress The server-side (post-NAT) server address
sServerPort Integer The server-side (post-NAT) server port
bypassed boolean True if bypassed, false otherwise
class Class The class name
clientCountry String The client country
clientIntf Integer The client interface ID
clientLatitude Double The client latitude
clientLongitude Double The client longitude
entitled boolean The entitled status
filterPrefix String The filter prefix if blocked by the filter rules
hostname String The hostname
icmpType Short The ICMP type
localAddr InetAddress The local host address
policyId Integer The policy ID
policyRuleId Integer The policy rule ID
protocol Short The protocol
protocolName String The protocol name
remoteAddr InetAddress The remote host address
serverCountry String The server country
serverIntf Integer The server interface ID
serverLatitude Double The server latitude
serverLongitude Double The server longitude
sessionId Long The session ID
timeStamp Timestamp The timestamp
username String The username

<section end='SessionEvent' />


SessionMinuteEvent

<section begin='SessionMinuteEvent' />

These events are created by the base system and update the session_minutes table each minute a session exists.

Attribute Name Type Description
c2sBytes long The number of bytes sent from the client to the server
class Class The class name
s2cBytes long The number of bytes sent from the server to the client
sessionId long The session ID
timeStamp Timestamp The timestamp

<section end='SessionMinuteEvent' />


SessionNatEvent

<section begin='SessionNatEvent' />

These events are created by the base system and update the sessions table each time a session is NATd with the post-NAT information.

Attribute Name Type Description
sClientAddr InetAddress The server-side (post-NAT) client address
sClientPort Integer The server-side (post-NAT) client port
sServerAddr InetAddress The server-side (post-NAT) server address
sServerPort Integer The server-side (post-NAT) server port
class Class The class name
serverIntf Integer The server interface ID
timeStamp Timestamp The timestamp

<section end='SessionNatEvent' />


QuotaEvent

<section begin='QuotaEvent' />

These events are created by the Bandwidth Control and inserted or update the quotas table when quotas are given or exceeded.

Attribute Name Type Description
action int The action (1=Quota Given, 2=Quota Exceeded)
address InetAddress The address
class Class The class name
quotaSize long The quota size
reason String The reason
timeStamp Timestamp The timestamp

<section end='QuotaEvent' />


SettingsChangesEvent

<section begin='SettingsChangesEvent' />

These events are created by the base system and inserted to the settings_changes table when settings are changed.

Attribute Name Type Description
class Class The class name
hostname String The hostname
settingsFile String The settings file
timeStamp Timestamp The timestamp
username String The username

<section end='SettingsChangesEvent' />


LogEvent

<section begin='LogEvent' />

These base class for all events.

Attribute Name Type Description
class Class The class name
timeStamp Timestamp The timestamp

<section end='LogEvent' />


InterfaceStatEvent

<section begin='InterfaceStatEvent' />

These events are created by the base system and inserted to the interface_stat_events table periodically with interface stats.

Attribute Name Type Description
class Class The class name
interfaceId int The interface ID
rxRate double The RX rate in byte/s
timeStamp Timestamp The timestamp
txRate double The TX rate in byte/s

<section end='InterfaceStatEvent' />


SystemStatEvent

<section begin='SystemStatEvent' />

These events are created by the base system and inserted to the server_events table periodically.

Attribute Name Type Description
activeHosts int The active host count
class Class The class name
cpuSystem float The system CPU utilization
cpuUser float The user CPU utilization
diskFree long The amount of disk free
diskFreePercent float The percentage of disk free
diskTotal long The total size of the disk
diskUsed long The amount of disk used
diskUsedPercent float The percentage of disk used
load1 float The 1-minute CPU load
load15 float The 15-minute CPU load
load5 float The 5-minute CPU load
memBuffers long The amount of memory used by buffers
memCache long The amount of memory used by cache
memFree long The amount of free memory
memFreePercent float The percentage of total memory that is free
memTotal long The total amount of memory
memUsed long The amount of used memory
memUsedPercent float The percentage of total memory that is used
swapFree long The amount of free swap
swapFreePercent float The percentage of total swap that is free
swapTotal long The total size of swap
swapUsed long The amount of used swap
swapUsedPercent float The percentage of total swap that is used
timeStamp Timestamp The timestamp

<section end='SystemStatEvent' />


TunnelStatusEvent

<section begin='TunnelStatusEvent' />

These events are created by IPsec VPN and inserted to the ipsec_tunnel_stats table periodically.

Attribute Name Type Description
class Class The class name
inBytes long The number of bytes received from this tunnel
outBytes long The number of bytes sent in this tunnel
timeStamp Timestamp The timestamp
tunnelName String The name of this tunnel

<section end='TunnelStatusEvent' />


VirtualUserEvent

<section begin='VirtualUserEvent' />

These events are created by IPsec VPN and inserted to the ipsec_user_events table when a user event occurs.

Attribute Name Type Description
class Class The class name
clientAddress InetAddress The client address
clientProtocol String The client protocol
clientUsername String The client username
elapsedTime String The elapsed time
eventId Long The event ID
netInterface String The net interface
netProcess String The net process
netRXbytes Long The number of RX (received) bytes
netTXbytes Long The number of TX (transmitted) bytes
timeStamp Timestamp The timestamp

<section end='VirtualUserEvent' />


AlertEvent

<section begin='AlertEvent' />

These events are created by Reports and inserted to the alerts table when an alert fires.

Attribute Name Type Description
cause LogEvent The cause
class Class The class name
description String The description
json JSONObject The JSON string
summaryText String The summary text
timeStamp Timestamp The timestamp

<section end='AlertEvent' />


ConfigurationBackupEvent

<section begin='ConfigurationBackupEvent' />

These events are created by Configuration Backup and inserted to the configuratio_backup_events table when a backup occurs.

Attribute Name Type Description
class Class The class name
destination String The destination
detail String The details
success boolean True if successful, false otherwise
timeStamp Timestamp The timestamp

<section end='ConfigurationBackupEvent' />


WebCacheEvent

<section begin='WebCacheEvent' />

These events are created by Web Cache and inserted to the web_cache_stats table periodically.

Attribute Name Type Description
bypassCount long The number of bypasses
class Class The class name
hitBytes long The number of bytes worth of hits
hitCount long The number of hits
missBytes long The number of bytes worth of misses
missCount long The number of misses
policyId Long The policy ID
systemCount long The number of system bypasses
timeStamp Timestamp The timestamp

<section end='WebCacheEvent' />


PrioritizeEvent

<section begin='PrioritizeEvent' />

These events are created by the Bandwidth Control and update the session table when a session is prioritized.

Attribute Name Type Description
class Class The class name
priority int The priority
ruleId int The rule ID
sessionEvent SessionEvent The session event
timeStamp Timestamp The timestamp

<section end='PrioritizeEvent' />


HttpResponseEvent

<section begin='HttpResponseEvent' />

These events are created by HTTP subsystem and update the http_events table when a web response happens.

Attribute Name Type Description
class Class The class name
contentLength long The content length
contentType String The content type
httpRequestEvent HttpRequestEvent The corresponding HTTP request event
requestLine RequestLine The request line
timeStamp Timestamp The timestamp

<section end='HttpResponseEvent' />


HttpRequestEvent

<section begin='HttpRequestEvent' />

These events are created by HTTP subsystem and inserted to the http_events table when a web request happens.

Attribute Name Type Description
class Class The class name
contentLength long The content length
domain String The domain
host String The host
method HttpMethod The HTTP method
referer String The referer
requestId Long The request ID
requestUri URI The request URI
sessionEvent SessionEvent The session event
timeStamp Timestamp The timestamp

<section end='HttpRequestEvent' />


ApplicationControlLiteEvent

<section begin='ApplicationControlLiteEvent' />

These events are created by Application Control Lite and update the sessions table when application control lite identifies a session.

Attribute Name Type Description
blocked boolean True if blocked, false otherwise
class Class The class name
protocol String The protocol
sessionId Long The session ID
timeStamp Timestamp The timestamp

<section end='ApplicationControlLiteEvent' />


FirewallEvent

<section begin='FirewallEvent' />

These events are created by Firewall and update the sessions table when a firewall rule matches a session.

Attribute Name Type Description
blocked boolean True if blocked, false otherwise
class Class The class name
flagged boolean True if flagged, false otherwise
ruleId long The rule ID
sessionId Long The session ID
timeStamp Timestamp The timestamp

<section end='FirewallEvent' />


WebFilterQueryEvent

<section begin='WebFilterQueryEvent' />

These events are created by Web Filter and inserted to the http_query_events table when web filter processes a search engine search.

Attribute Name Type Description
class Class The class name
contentLength long The content length
host String The host
method HttpMethod The method
nodeName String The name of the application
requestId Long The request ID
requestUri URI The request URI
sessionEvent SessionEvent The session event
term String The search term/phrase
timeStamp Timestamp The timestamp

<section end='WebFilterQueryEvent' />


WebFilterEvent

<section begin='WebFilterEvent' />

These events are created by Web Filter and update the http_events table when web filter processes a web request.

Attribute Name Type Description
blocked Boolean True if blocked, false otherwise
category String The category
class Class The class name
flagged Boolean True if flagged, false otherwise
nodeName String The name of the application
reason Reason The reason
timeStamp Timestamp The timestamp

<section end='WebFilterEvent' />


ApplicationControlLogEvent

<section begin='ApplicationControlLogEvent' />

These events are created by Application Control and update the sessions table when application control identifies a session.

Attribute Name Type Description
application String The application
blocked boolean True if blocked, false otherwise
category String The category
class Class The class name
confidence Integer The confidence (0-100)
detail String The details
flagged boolean True if flagged, false otherwise
protochain String The protochain
ruleId Integer The rule ID
sessionEvent SessionEvent The session event
state Integer The state
timeStamp Timestamp The timestamp

<section end='ApplicationControlLogEvent' />


SslInspectorLogEvent

<section begin='SslInspectorLogEvent' />

These events are created by SSL Inspector and update the sessions table when a session is processed by SSL Inspector.

Attribute Name Type Description
class Class The class name
detail String The details
ruleId Integer The rule ID
sessionEvent SessionEvent The session event
status String The status
timeStamp Timestamp The timestamp

<section end='SslInspectorLogEvent' />


SpamSmtpTarpitEvent

<section begin='SpamSmtpTarpitEvent' />

These events are created by Spam Blocker and inserted to the smtp_tarpit_events table when a session is tarpitted.

Attribute Name Type Description
iPAddr InetAddress The IP address
class Class The class name
hostname String The hostname
sessionEvent SessionEvent The session event
sessionId Long The session ID
timeStamp Timestamp The timestamp
vendorName String The application name

<section end='SpamSmtpTarpitEvent' />


SpamLogEvent

<section begin='SpamLogEvent' />

These events are created by Spam Blocker and update the mail_msgs table when an email is scanned.

Attribute Name Type Description
action SpamMessageAction The action
class Class The class name
clientAddr InetAddress The client address
clientPort int The client port
messageId Long The message ID
receiver String The receiver
score float The score
sender String The sender
serverAddr InetAddress The server address
serverPort int The server port
smtpMessageEvent SmtpMessageEvent The parent SMTP message event
isSpam boolean True if spam, false otherwise
subject String The subject
testsString String The tests string from the spam engine
timeStamp Timestamp The timestamp
vendorName String The application name

<section end='SpamLogEvent' />


SpamSmtpTarpitEvent

<section begin='SpamSmtpTarpitEvent' />

These events are created by Spam Blocker and inserted to the smtp_tarpit_events table when a session is tarpitted.

Attribute Name Type Description
iPAddr InetAddress The IP address
class Class The class name
hostname String The hostname
sessionEvent SessionEvent The session event
sessionId Long The session ID
timeStamp Timestamp The timestamp
vendorName String The application name

<section end='SpamSmtpTarpitEvent' />


SpamLogEvent

<section begin='SpamLogEvent' />

These events are created by Spam Blocker and update the mail_msgs table when an email is scanned.

Attribute Name Type Description
action SpamMessageAction The action
class Class The class name
clientAddr InetAddress The client address
clientPort int The client port
messageId Long The message ID
receiver String The receiver
score float The score
sender String The sender
serverAddr InetAddress The server address
serverPort int The server port
smtpMessageEvent SmtpMessageEvent The parent SMTP message event
isSpam boolean True if spam, false otherwise
subject String The subject
testsString String The tests string from the spam engine
timeStamp Timestamp The timestamp
vendorName String The application name

<section end='SpamLogEvent' />


CookieEvent

<section begin='CookieEvent' />

These events are created by Ad Blocker and update the http_events table when a cookie is blocked.

Attribute Name Type Description
class Class The class name
identification String The identification string
requestId Long The request ID
sessionEvent SessionEvent The session event
timeStamp Timestamp The timestamp

<section end='CookieEvent' />


AdBlockerEvent

<section begin='AdBlockerEvent' />

These events are created by Ad Blocker and update the http_events table when an ad is blocked.

Attribute Name Type Description
action Action The action
class Class The class name
reason String The reason
requestId Long The request ID
timeStamp Timestamp The timestamp

<section end='AdBlockerEvent' />


IntrusionPreventionLogEvent

<section begin='IntrusionPreventionLogEvent' />

These events are created by Intrusion Prevention and inserted to the intrusion_prevention_events table when a rule matches.

Attribute Name Type Description
blocked short 1 if blocked, 0 otherwise
category String The category
class Class The class name
classificationId long The classification ID
classtype String The classtype
dportIcode int The dportIcode
eventId long The event ID
eventMicrosecond long The event microsecond
eventSecond long The event second
eventType long The event type
generatorId long The generator ID
impact short The impact
impactFlag short The impact flag
ipDestination InetAddress The IP address destination
ipSource InetAddress The IP address source
mplsLabel long The mplsLabel
msg String The msg
padding int The padding
priorityId long The priority ID
protocol short The protocol
sensorId long The sensor ID
signatureId long The signature ID
signatureRevision long The signature revision
sportItype int The sportItype
timeStamp Timestamp The timestamp
vlanId int The VLAN Id

<section end='IntrusionPreventionLogEvent' />


WanFailoverTestEvent

<section begin='WanFailoverTestEvent' />

These events are created by WAN Failover and inserted to the wan_failover_test_events table when a test is run.

Attribute Name Type Description
class Class The class name
description String The description
interfaceId int The interface ID
name String The test name
osName String The O/S interface name
success Boolean True if successful, false otherwise
timeStamp Timestamp The timestamp

<section end='WanFailoverTestEvent' />


WanFailoverEvent

<section begin='WanFailoverEvent' />

These events are created by WAN Failover and inserted to the wan_failover_action_events table when WAN Failover takes an action.

Attribute Name Type Description
action WanFailoverEvent$Action The action
class Class The class name
interfaceId int The interface ID
name String The name
osName String The O/S interface name
timeStamp Timestamp The timestamp

<section end='WanFailoverEvent' />


CaptivePortalUserEvent

<section begin='CaptivePortalUserEvent' />

These events are created by Captive Portal and inserted to the captive_portal_user_events table when Captive Portal user takes an action.

Attribute Name Type Description
authenticationType CaptivePortalSettings$AuthenticationType The authentication type
authenticationTypeValue String The authentication type as a string
class Class The class name
clientAddr InetAddress The client address
event CaptivePortalUserEvent$EventType The event (LOGIN, FAILED, TIMEOUT, INACTIVE, USER_LOGOUT, ADMIN_LOGOUT)
eventValue String The event value as a string (LOGIN, FAILED, TIMEOUT, INACTIVE, USER_LOGOUT, ADMIN_LOGOUT)
loginName String The login name
policyId Integer The policy ID
timeStamp Timestamp The timestamp

<section end='CaptivePortalUserEvent' />


CaptureRuleEvent

<section begin='CaptureRuleEvent' />

These events are created by Captive Portal and update the sessions table when Captive Portal processes a session.

Attribute Name Type Description
captured boolean True if captured, false otherwise
class Class The class name
ruleId Integer The rule ID
sessionEvent SessionEvent The session event
timeStamp Timestamp The timestamp

<section end='CaptureRuleEvent' />


VirusSmtpEvent

<section begin='VirusSmtpEvent' />

These events are created by Virus Blocker and update the mail_msgs table when Virus Blocker scans an email.

Attribute Name Type Description
action String The action
class Class The class name
clean boolean True if clean, false otherwise
messageId Long The message ID
nodeName String The name of the application
timeStamp Timestamp The timestamp
virusName String The virus name, if not clean

<section end='VirusSmtpEvent' />


VirusFtpEvent

<section begin='VirusFtpEvent' />

These events are created by Virus Blocker and update the ftp_events table when Virus Blocker scans an FTP transfer.

Attribute Name Type Description
class Class The class name
clean boolean True if clean, false otherwise
nodeName String The name of the application
sessionEvent SessionEvent The session event
timeStamp Timestamp The timestamp
uri String The URI
virusName String The virus name, if not clean

<section end='VirusFtpEvent' />


VirusHttpEvent

<section begin='VirusHttpEvent' />

These events are created by Virus Blocker and update the http_events table when Virus Blocker scans an HTTP transfer.

Attribute Name Type Description
class Class The class name
clean boolean True if clean, false otherwise
nodeName String The name of the application
requestId Long The request ID
timeStamp Timestamp The timestamp
virusName String The virus name, if not clean

<section end='VirusHttpEvent' />


OpenVpnEvent

<section begin='OpenVpnEvent' />

These events are created by OpenVPN and update the openvpn_events table when OpenVPN processes a client action.

Attribute Name Type Description
address InetAddress The address
class Class The class name
clientName String The client name
poolAddress InetAddress The pool address
timeStamp Timestamp The timestamp
type OpenVpnEvent$EventType The type

<section end='OpenVpnEvent' />


OpenVpnStatusEvent

<section begin='OpenVpnStatusEvent' />

These events are created by OpenVPN and update the openvpn_stats table periodically.

Attribute Name Type Description
address InetAddress The address
bytesRxDelta long The delta number of RX (received) bytes from the previous event
bytesRxTotal long The total number of RX (received) bytes
bytesTxDelta long The delta number of TX (transmitted) bytes from the previous event
bytesTxTotal long The total number of TX (transmitted) bytes
class Class The class name
clientName String The client name
end Timestamp The end
poolAddress InetAddress The pool address
port int The port
start Timestamp The start
timeStamp Timestamp The timestamp

<section end='OpenVpnStatusEvent' />


SmtpMessageAddressEvent

<section begin='SmtpMessageAddressEvent' />

These events are created by SMTP subsystem and inserted to the mail_addrs table for each address on each email.

Attribute Name Type Description
addr String The address
class Class The class name
kind AddressKind The type for this address (F=From, T=To, C=CC, G=Envelope From, B=Envelope To, X=Unknown)
messageId Long The message ID
personal String personal
timeStamp Timestamp The timestamp

<section end='SmtpMessageAddressEvent' />


SmtpMessageEvent

<section begin='SmtpMessageEvent' />

These events are created by SMTP subsystem and inserted to the mail_msgs table for each email.

Attribute Name Type Description
addresses Set The addresses
class Class The class name
envelopeFromAddress String The envelop FROM address
envelopeToAddress String The envelope TO address
messageId Long The message ID
receiver String The receiver
sender String The sender
sessionEvent SessionEvent The session event
sessionId Long The session ID
subject String The subject
timeStamp Timestamp The timestamp
tmpFile File The /tmp file

<section end='SmtpMessageEvent' />


LoginEvent

<section begin='LoginEvent' />

These events are created by Directory Connector and inserted to the directory_connector_login_events table for each login.

Attribute Name Type Description
class Class The class name
clientAddr InetAddress The client address
domain String The domain
event String The event
loginName String The login name
timeStamp Timestamp The timestamp

<section end='LoginEvent' />

Retrieved from "https://wiki.edge.arista.com/index.php?title=Event_Definitions&oldid=4576"