Database Schema: Difference between revisions

From Edge Threat Management Wiki - Arista
Jump to navigationJump to search
m (Dmorris moved page Global DB Schema to Database Schema without leaving a redirect)
No edit summary
Line 1: Line 1:
[[Category:Reports]]
= Database Tables =


All [[Reports]] data is stored in the database. All [[Events]] will add or modify data in the database.
== admin_logins ==  
 
<section begin='admin_logins' />
Data is stored in indexed fully-denormalized tables. For example, there is a ''http_events'' table that has one row per HTTP request and all the metadata associated with that HTTP request.
 
Below is the schema definition of all tables in the database.
 
== ipsec_tunnel_stats ==  
<section begin='ipsec_tunnel_stats' />


{| border="1" cellpadding="2" width="90%%" align="center"
{| border="1" cellpadding="2" width="90%%" align="center"
Line 21: Line 15:
|The time of the event
|The time of the event
|-
|-
|tunnel_name
|login
|Tunnel Name
|Login
|text
|text
|The name of the IPsec tunnel
|The login name
|-
|-
|in_bytes
|local
|In Bytes
|Local
|bigint
|boolean
|The number of bytes received during this time frame
|True if it is a login attempt through a local process
|-
|-
|out_bytes
|client_addr
|Out Bytes
|Client Address
|bigint
|inet
|The number of bytes transmitted during this time frame
|The client IP address
|-
|-
|event_id
|succeeded
|Event ID
|Succeeded
|bigint
|boolean
|The unique event ID
|True if the login succeeded, false otherwise
|-
|reason
|Reason
|character(1)
|The reason for the login (if applicable)
|-
|-
|}
|}
<section end='ipsec_tunnel_stats' />
<section end='admin_logins' />




== ipsec_user_events ==  
== sessions ==  
<section begin='ipsec_user_events' />
<section begin='sessions' />


{| border="1" cellpadding="2" width="90%%" align="center"
{| border="1" cellpadding="2" width="90%%" align="center"
Line 54: Line 53:
!Description
!Description
|-
|-
|event_id
|session_id
|Event ID
|Session ID
|bigint
|bigint
|The unique event ID
|The session
|-
|-
|time_stamp
|time_stamp
Line 64: Line 63:
|The time of the event
|The time of the event
|-
|-
|connect_stamp
|end_time
|Connect Time
|timestamp without time zone
|The time the connection started
|-
|goodbye_stamp
|End Time
|End Time
|timestamp without time zone
|timestamp without time zone
|The time the connection ended
|The time the session ended
|-
|-
|client_address
|bypassed
|Client Address
|Bypassed
|text
|boolean
|The remote IP address of the client
|True if the session was bypassed, false otherwise
|-
|entitled
|Entitled
|boolean
|True if the session is entitled to premium functionality
|-
|protocol
|Protocol
|smallint
|The IP protocol of session
|-
|-
|client_protocol
|icmp_type
|Client Protocol
|ICMP Type
|text
|smallint
|The protocol the client used to connect
|The ICMP type of session if ICMP
|-
|-
|client_username
|hostname
|Client Username
|Hostname
|text
|text
|The username of the client
|The hostname of the local address
|-
|-
|net_process
|username
|Net Process
|Username
|text
|text
|The PID of the PPP process for L2TP connections or the connection ID for Xauth connections
|The username associated with this session
|-
|-
|net_interface
|policy_id
|Net Interface
|Policy ID
|text
|smallint
|The PPP interface for L2TP connections or the client interface for Xauth connections
|The policy
|-
|-
|elapsed_time
|policy_rule_id
|Elapsed Time
|Policy Rule ID
|text
|smallint
|The total time the client was connected
|The ID of the matching policy rule (0 means none)
|-
|-
|rx_bytes
|c_client_addr
|Bytes Received
|Client-side Client Address
|bigint
|inet
|The number of bytes received from the client in this connection
|The client-side client IP address
|-
|-
|tx_bytes
|c_server_addr
|Bytes Sent
|Client-side Server Address
|bigint
|inet
|The number of bytes sent to the client in this connection
|The client-side server IP address
|-
|-
|}
|c_server_port
<section end='ipsec_user_events' />
|Client-side Server Port
 
|integer
 
|The client-side server port
== http_events ==
<section begin='http_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|request_id
|c_client_port
|Request ID
|Client-side Client Port
|bigint
|integer
|The HTTP request ID
|The client-side client port
|-
|-
|time_stamp
|s_client_addr
|Timestamp
|Server-side Client Address
|timestamp without time zone
|inet
|The time of the event
|The server-side client IP address
|-
|s_server_addr
|Server-side Server Address
|inet
|The server-side server IP address
|-
|s_server_port
|Server-side Server Port
|integer
|The server-side server port
|-
|-
|session_id
|s_client_port
|Session ID
|Server-side Client Port
|bigint
|integer
|The session
|The server-side client port
|-
|-
|client_intf
|client_intf
Line 152: Line 158:
|The server interface
|The server interface
|-
|-
|c_client_addr
|client_country
|Client-side Client Address
|Client Country
|inet
|text
|The client-side client IP address
|The client Country
|-
|-
|s_client_addr
|client_latitude
|Server-side Client Address
|Client Latitude
|inet
|real
|The server-side client IP address
|The client Latitude
|-
|-
|c_server_addr
|client_longitude
|Client-side Server Address
|Client Longitude
|inet
|real
|The client-side server IP address
|The client Longitude
|-
|-
|s_server_addr
|server_country
|Server-side Server Address
|Server Country
|inet
|text
|The server-side server IP address
|The server Country
|-
|-
|c_client_port
|server_latitude
|Client-side Client Port
|Server Latitude
|integer
|real
|The client-side client port
|The server Latitude
|-
|-
|s_client_port
|server_longitude
|Server-side Client Port
|Server Longitude
|integer
|real
|The server-side client port
|The server Longitude
|-
|-
|c_server_port
|c2p_bytes
|Client-side Server Port
|From-Client Bytes
|integer
|bigint
|The client-side server port
|The number of bytes the client sent to Untangle (client-to-pipeline)
|-
|-
|s_server_port
|p2c_bytes
|Server-side Server Port
|To-Client Bytes
|integer
|bigint
|The server-side server port
|The number of bytes Untangle sent to client (pipeline-to-client)
|-
|-
|policy_id
|s2p_bytes
|Policy ID
|From-Server Bytes
|smallint
|bigint
|The policy
|The number of bytes the server sent to Untangle (client-to-pipeline)
|-
|-
|username
|p2s_bytes
|Username
|To-Server Bytes
|text
|bigint
|The username associated with this session
|The number of bytes Untangle sent to server (pipeline-to-client)
|-
|-
|hostname
|filter_prefix
|Hostname
|Filter Block
|text
|text
|The hostname of the local address
|The network filter that blocked the connection (filter,shield,invalid)
|-
|-
|method
|firewall_blocked
|Method
|Firewall Blocked
|character(1)
|boolean
|The HTTP method
|True if Firewall blocked the session, false otherwise
|-
|-
|uri
|firewall_flagged
|URI
|Firewall Flagged
|text
|boolean
|The HTTP URI
|True if Firewall flagged the session, false otherwise
|-
|-
|host
|firewall_rule_index
|Host
|Firewall Rule ID
|integer
|The matching rule in Firewall (if any)
|-
|application_control_lite_protocol
|Application Control Lite Protocol
|text
|text
|The HTTP host
|The application protocol according to Application Control Lite
|-
|-
|domain
|application_control_lite_blocked
|Domain
|Application Control Lite Blocked
|text
|boolean
|The HTTP domain (shortened host)
|True if Application Control Lite blocked the session
|-
|-
|referer
|captive_portal_blocked
|Referer
|Captive Portal Blocked
|text
|boolean
|The Referer URL
|True if Captive Portal blocked the session
|-
|-
|c2s_content_length
|captive_portal_rule_index
|Client-to-server Content Length
|Captive Portal Rule ID
|bigint
|integer
|The client-to-server content length
|The matching rule in Captive Portal (if any)
|-
|-
|s2c_content_length
|application_control_application
|Server-to-client Content Length
|Application Control Application
|bigint
|The server-to-client content length
|-
|s2c_content_type
|Server-to-client Content Type
|text
|text
|The server-to-client content type
|The application according to Application Control
|-
|-
|ad_blocker_cookie_ident
|application_control_protochain
|Ad Blocker Cookie
|Application Control Protochain
|text
|text
|This name of cookie blocked by Ad Blocker
|The protochain according to Application Control
|-
|-
|ad_blocker_action
|application_control_category
|Ad Blocker Action
|Application Control Category
|character(1)
|This action of Ad Blocker on this request
|-
|web_filter_lite_reason
|Web Filter Lite Reason
|character(1)
|This reason Web Filter Lite blocked/flagged this request
|-
|web_filter_lite_category
|Web Filter Lite Category
|text
|text
|This category according to Web Filter Lite
|The category according to Application Control
|-
|-
|web_filter_lite_blocked
|application_control_blocked
|Web Filter Lite Blocked
|Application Control Blocked
|boolean
|boolean
|If Web Filter Lite blocked this request
|True if Application Control blocked the session
|-
|-
|web_filter_lite_flagged
|application_control_flagged
|Web Filter Lite Flagged
|Application Control Flagged
|boolean
|boolean
|If Web Filter Lite flagged this request
|True if Application Control flagged the session
|-
|-
|web_filter_reason
|application_control_confidence
|Web Filter Reason
|Application Control Confidence
|character(1)
|integer
|This reason Web Filter blocked/flagged this request
|True if Application Control confidence of this session's identification
|-
|application_control_ruleid
|Application Control Rule ID
|integer
|The matching rule in Application Control (if any)
|-
|-
|web_filter_category
|application_control_detail
|Web Filter Category
|Application Control Detail
|text
|text
|This category according to Web Filter
|The text detail from the Application Control engine
|-
|-
|web_filter_blocked
|bandwidth_control_priority
|Web Filter Blocked
|Bandwidth Control Priority
|boolean
|integer
|If Web Filter blocked this request
|The priority given to this session
|-
|-
|web_filter_flagged
|bandwidth_control_rule
|Web Filter Flagged
|Bandwidth Control Rule ID
|boolean
|integer
|If Web Filter flagged this request
|The matching rule in Bandwidth Control rule (if any)
|-
|-
|virus_blocker_lite_clean
|ssl_inspector_ruleid
|Virus Blocker Lite Clean
|SSL Inspector Rule ID
|boolean
|integer
|The cleanliness of the file according to Virus Blocker Lite
|The matching rule in SSL Inspector rule (if any)
|-
|-
|virus_blocker_lite_name
|ssl_inspector_status
|Virus Blocker Lite Name
|SSL Inspector Status
|text
|text
|The name of the malware according to Virus Blocker Lite
|The status/action of the SSL session (INSPECTED,IGNORED,BLOCKED,UNTRUSTED,ABANDONED)
|-
|-
|virus_blocker_clean
|ssl_inspector_detail
|Virus Blocker Clean
|SSL Inspector Detail
|boolean
|The cleanliness of the file according to Virus Blocker
|-
|virus_blocker_name
|Virus Blocker Name
|text
|text
|The name of the malware according to Virus Blocker
|Additional text detail about the SSL connection (SNI, IP Address)
|-
|-
|}
|local_addr
<section end='http_events' />
|Local Address
|inet
|The IP address of the local participant
|-
|remote_addr
|Remote Address
|inet
|The IP address of the remote participant
|-
|tags
|Tags
|text
|The tags on this session
|-
|}
<section end='sessions' />




== captive_portal_user_events ==  
== session_minutes ==  
<section begin='captive_portal_user_events' />
<section begin='session_minutes' />


{| border="1" cellpadding="2" width="90%%" align="center"
{| border="1" cellpadding="2" width="90%%" align="center"
Line 329: Line 340:
!Type
!Type
!Description
!Description
|-
|session_id
|Session ID
|bigint
|The session
|-
|-
|time_stamp
|time_stamp
Line 335: Line 351:
|The time of the event
|The time of the event
|-
|-
|policy_id
|c2s_bytes
|Policy ID
|From-Client Bytes
|bigint
|bigint
|The policy
|The number of bytes the client sent
|-
|-
|event_id
|s2c_bytes
|Event ID
|From-Server Bytes
|bigint
|bigint
|The unique event ID
|The number of bytes the server sent
|-
|-
|login_name
|start_time
|Login Name
|Start Time
|text
|timestamp without time zone
|The login username
|The start time of the session
|-
|-
|event_info
|end_time
|Event Type
|End Time
|text
|timestamp without time zone
|The type of event (LOGIN, FAILED, TIMEOUT, INACTIVE, USER_LOGOUT, ADMIN_LOGOUT)
|The time the session ended
|-
|-
|auth_type
|bypassed
|Authorization Type
|Bypassed
|text
|boolean
|The authorization type for this event
|True if the session was bypassed, false otherwise
|-
|-
|client_addr
|entitled
|Client Address
|Entitled
|text
|boolean
|The remote IP address of the client
|True if the session is entitled to premium functionality
|-
|-
|}
|protocol
<section end='captive_portal_user_events' />
|Protocol
 
|smallint
 
|The IP protocol of session
== server_events ==
<section begin='server_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|time_stamp
|icmp_type
|Timestamp
|ICMP Type
|timestamp without time zone
|smallint
|The time of the event
|The ICMP type of session if ICMP
|-
|-
|load_1
|hostname
|CPU load (1-min)
|Hostname
|numeric(6,2)
|text
|The 1-minute CPU load
|The hostname of the local address
|-
|-
|load_5
|username
|CPU load (5-min)
|Username
|numeric(6,2)
|text
|The 5-minute CPU load
|The username associated with this session
|-
|-
|load_15
|policy_id
|CPU load (15-min)
|Policy ID
|numeric(6,2)
|smallint
|The 15-minute CPU load
|The policy
|-
|-
|cpu_user
|policy_rule_id
|CPU User Utilization
|Policy Rule ID
|numeric(6,3)
|smallint
|The user CPU percent utilization
|The ID of the matching policy rule (0 means none)
|-
|-
|cpu_system
|c_client_addr
|CPU System Utilization
|Client-side Client Address
|numeric(6,3)
|inet
|The system CPU percent utilization
|The client-side client IP address
|-
|-
|mem_total
|c_server_addr
|Total Memory
|Client-side Server Address
|bigint
|inet
|The total bytes of memory
|The client-side server IP address
|-
|-
|mem_free
|c_server_port
|Memory Free
|Client-side Server Port
|bigint
|integer
|The number of free bytes of memory
|The client-side server port
|-
|-
|disk_total
|c_client_port
|Disk Size
|Client-side Client Port
|bigint
|integer
|The total disk size in bytes
|The client-side client port
|-
|-
|disk_free
|s_client_addr
|Disk Free
|Server-side Client Address
|bigint
|inet
|The free disk space in bytes
|The server-side client IP address
|-
|-
|swap_total
|s_server_addr
|Swap Size
|Server-side Server Address
|bigint
|inet
|The total swap size in bytes
|The server-side server IP address
|-
|-
|swap_free
|s_server_port
|Swap Free
|Server-side Server Port
|bigint
|integer
|The free disk swap in bytes
|The server-side server port
|-
|-
|active_hosts
|s_client_port
|Active Hosts
|Server-side Client Port
|integer
|integer
|The number of active hosts
|The server-side client port
|-
|client_intf
|Client Interface
|smallint
|The client interface
|-
|-
|}
|server_intf
<section end='server_events' />
|Server Interface
 
|smallint
 
|The server interface
== interface_stat_events ==
<section begin='interface_stat_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|time_stamp
|client_country
|Timestamp
|Client Country
|timestamp without time zone
|text
|The time of the event
|The client Country
|-
|-
|interface_id
|client_latitude
|Interface ID
|Client Latitude
|integer
|real
|The interface ID
|The client Latitude
|-
|-
|rx_rate
|client_longitude
|Rx Rate
|Client Longitude
|double precision
|real
|The RX rate (bytes/s)
|The client Longitude
|-
|-
|tx_rate
|server_country
|Tx Rate
|Server Country
|double precision
|text
|The TX rate (bytes/s)
|The server Country
|-
|-
|}
|server_latitude
<section end='interface_stat_events' />
|Server Latitude
 
|real
 
|The server Latitude
== openvpn_stats ==
<section begin='openvpn_stats' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|time_stamp
|server_longitude
|Timestamp
|Server Longitude
|timestamp without time zone
|real
|The time of the event
|The server Longitude
|-
|-
|start_time
|filter_prefix
|Start Time
|Filter Block
|timestamp without time zone
|text
|The time the OpenVPN session started
|The network filter that blocked the connection (filter,shield,invalid)
|-
|-
|end_time
|firewall_blocked
|End Time
|Firewall Blocked
|timestamp without time zone
|boolean
|The time the OpenVPN session ended
|True if Firewall blocked the session, false otherwise
|-
|-
|rx_bytes
|firewall_flagged
|Bytes Received
|Firewall Flagged
|bigint
|boolean
|The total bytes received from the client during this session
|True if Firewall flagged the session, false otherwise
|-
|-
|tx_bytes
|firewall_rule_index
|Bytes Sent
|Firewall Rule ID
|bigint
|integer
|The total bytes sent to the client during this session
|The matching rule in Firewall (if any)
|-
|application_control_lite_protocol
|Application Control Lite Protocol
|text
|The application protocol according to Application Control Lite
|-
|-
|remote_address
|application_control_lite_blocked
|Remote Address
|Application Control Lite Blocked
|inet
|boolean
|The remote IP address of the client
|True if Application Control Lite blocked the session
|-
|-
|pool_address
|captive_portal_blocked
|Pool Address
|Captive Portal Blocked
|inet
|boolean
|The pool IP address of the client
|True if Captive Portal blocked the session
|-
|-
|remote_port
|captive_portal_rule_index
|Remote Port
|Captive Portal Rule ID
|integer
|integer
|The remote port of the client
|The matching rule in Captive Portal (if any)
|-
|-
|client_name
|application_control_application
|Client Name
|Application Control Application
|text
|text
|The name of the client
|The application according to Application Control
|-
|-
|event_id
|application_control_protochain
|Event ID
|Application Control Protochain
|bigint
|text
|The unique event ID
|The protochain according to Application Control
|-
|-
|}
|application_control_category
<section end='openvpn_stats' />
|Application Control Category
 
|text
 
|The category according to Application Control
== openvpn_events ==
<section begin='openvpn_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|time_stamp
|application_control_blocked
|Timestamp
|Application Control Blocked
|timestamp without time zone
|boolean
|The time of the event
|True if Application Control blocked the session
|-
|-
|remote_address
|application_control_flagged
|Remote Address
|Application Control Flagged
|inet
|boolean
|The remote IP address of the client
|True if Application Control flagged the session
|-
|-
|pool_address
|application_control_confidence
|Pool Address
|Application Control Confidence
|inet
|integer
|The pool IP address of the client
|True if Application Control confidence of this session's identification
|-
|-
|client_name
|application_control_ruleid
|Client Name
|Application Control Rule ID
|text
|integer
|The name of the client
|The matching rule in Application Control (if any)
|-
|-
|type
|application_control_detail
|Type
|Application Control Detail
|text
|text
|The type of the event (CONNECT/DISCONNECT)
|The text detail from the Application Control engine
|-
|-
|}
|bandwidth_control_priority
<section end='openvpn_events' />
|Bandwidth Control Priority
 
|integer
 
|The priority given to this session
== mail_msgs ==
<section begin='mail_msgs' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|time_stamp
|bandwidth_control_rule
|Timestamp
|Bandwidth Control Rule ID
|timestamp without time zone
|integer
|The time of the event
|The matching rule in Bandwidth Control rule (if any)
|-
|-
|session_id
|ssl_inspector_ruleid
|Session ID
|SSL Inspector Rule ID
|bigint
|integer
|The session
|The matching rule in SSL Inspector rule (if any)
|-
|-
|client_intf
|ssl_inspector_status
|Client Interface
|SSL Inspector Status
|smallint
|text
|The client interface
|The status/action of the SSL session (INSPECTED,IGNORED,BLOCKED,UNTRUSTED,ABANDONED)
|-
|-
|server_intf
|ssl_inspector_detail
|Server Interface
|SSL Inspector Detail
|smallint
|text
|The server interface
|Additional text detail about the SSL connection (SNI, IP Address)
|-
|-
|c_client_addr
|local_addr
|Client-side Client Address
|Local Address
|inet
|inet
|The client-side client IP address
|The IP address of the local participant
|-
|-
|s_client_addr
|remote_addr
|Server-side Client Address
|Remote Address
|inet
|inet
|The server-side client IP address
|The IP address of the remote participant
|-
|-
|c_server_addr
|tags
|Client-side Server Address
|Tags
|inet
|text
|The client-side server IP address
|The tags on this session
|-
|-
|s_server_addr
|}
|Server-side Server Address
<section end='session_minutes' />
|inet
 
|The server-side server IP address
 
== quotas ==
<section begin='quotas' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|c_client_port
|time_stamp
|Client-side Client Port
|Timestamp
|integer
|timestamp without time zone
|The client-side client port
|The time of the event
|-
|-
|s_client_port
|action
|Server-side Client Port
|Action
|integer
|integer
|The server-side client port
|The action (1=Quota Given, 2=Quota Exceeded)
|-
|-
|c_server_port
|size
|Client-side Server Port
|Size
|integer
|The client-side server port
|-
|s_server_port
|Server-side Server Port
|integer
|The server-side server port
|-
|policy_id
|Policy ID
|bigint
|bigint
|The policy
|The size of the quota
|-
|-
|username
|reason
|Username
|Reason
|text
|text
|The username associated with this session
|The reason for the action
|-
|msg_id
|Message ID
|bigint
|The message ID
|-
|-
|subject
|entity
|Subject
|Entity
|text
|text
|The email subject
|The IP entity given the quota (address/username)
|-
|-
|hostname
|}
|Hostname
<section end='quotas' />
|text
 
|The hostname of the local address
 
== host_table_updates ==
<section begin='host_table_updates' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|event_id
|address
|Event ID
|Address
|bigint
|inet
|The unique event ID
|The IP address of the host
|-
|-
|sender
|key
|Sender
|Key
|text
|text
|The address of the sender
|The key being updated
|-
|-
|receiver
|value
|Receiver
|Value
|text
|text
|The address of the receiver
|The new value for the key
|-
|-
|virus_blocker_lite_clean
|time_stamp
|Virus Blocker Lite Clean
|Timestamp
|boolean
|timestamp without time zone
|The cleanliness of the file according to Virus Blocker Lite
|The time of the event
|-
|-
|virus_blocker_lite_name
|old_value
|Virus Blocker Lite Name
|Old Value
|text
|text
|The name of the malware according to Virus Blocker Lite
|The old value for the key
|-
|-
|virus_blocker_clean
|}
|Virus Blocker Clean
<section end='host_table_updates' />
|boolean
 
|The cleanliness of the file according to Virus Blocker
 
== device_table_updates ==
<section begin='device_table_updates' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|virus_blocker_name
|mac_address
|Virus Blocker Name
|MAC Address
|text
|text
|The name of the malware according to Virus Blocker
|The MAC address of the device
|-
|key
|Key
|text
|The key being updated
|-
|-
|spam_blocker_lite_score
|value
|Spam Blocker Lite Score
|Value
|real
|text
|The score of the email according to Spam Blocker Lite
|The new value for the key
|-
|-
|spam_blocker_lite_is_spam
|time_stamp
|Spam Blocker Lite Spam
|Timestamp
|boolean
|timestamp without time zone
|The spam status of the email according to Spam Blocker Lite
|The time of the event
|-
|-
|spam_blocker_lite_tests_string
|old_value
|Spam Blocker Lite Tests
|Old Value
|text
|text
|The tess results for Spam Blocker Lite
|The old value for the key
|-
|-
|spam_blocker_lite_action
|}
|Spam Blocker Lite Action
<section end='device_table_updates' />
|character(1)
 
|The action taken by Spam Blocker Lite
 
== alerts ==
<section begin='alerts' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|spam_blocker_score
|time_stamp
|Spam Blocker Score
|Timestamp
|real
|timestamp without time zone
|The score of the email according to Spam Blocker
|The time of the event
|-
|-
|spam_blocker_is_spam
|description
|Spam Blocker Spam
|Text detail of the event
|boolean
|text
|The spam status of the email according to Spam Blocker
|The description from the alert rule.
|-
|-
|spam_blocker_tests_string
|summary_text
|Spam Blocker Tests
|Summary Text
|text
|text
|The tess results for Spam Blocker
|The summary text of the alert
|-
|-
|spam_blocker_action
|json
|Spam Blocker Action
|JSON Text
|character(1)
|The action taken by Spam Blocker
|-
|phish_blocker_score
|Phish Blocker Score
|real
|The score of the email according to Phish Blocker
|-
|phish_blocker_is_spam
|Phish Blocker Phish
|boolean
|The phish status of the email according to Phish Blocker
|-
|phish_blocker_tests_string
|Phish Blocker Tests
|text
|text
|The tess results for Phish Blocker
|The summary JSON representation of the event causing the alert
|-
|phish_blocker_action
|Phish Blocker Action
|character(1)
|The action taken by Phish Blocker
|-
|-
|}
|}
<section end='mail_msgs' />
<section end='alerts' />




== mail_addrs ==  
== settings_changes ==  
<section begin='mail_addrs' />
<section begin='settings_changes' />


{| border="1" cellpadding="2" width="90%%" align="center"
{| border="1" cellpadding="2" width="90%%" align="center"
Line 788: Line 776:
|The time of the event
|The time of the event
|-
|-
|session_id
|settings_file
|Session ID
|Settings File
|bigint
|text
|The session
|The name of the file changed
|-
|-
|client_intf
|username
|Client Interface
|Username
|smallint
|text
|The client interface
|The username logged in at the time of the change
|-
|-
|server_intf
|hostname
|Server Interface
|Hostname
|smallint
|text
|The server interface
|The remote hostname
|-
|-
|c_client_addr
|}
|Client-side Client Address
<section end='settings_changes' />
|inet
 
|The client-side client IP address
 
== wan_failover_test_events ==
<section begin='wan_failover_test_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|s_client_addr
|time_stamp
|Server-side Client Address
|Timestamp
|inet
|timestamp without time zone
|The server-side client IP address
|The time of the event
|-
|-
|c_server_addr
|interface_id
|Client-side Server Address
|Interface ID
|inet
|integer
|The client-side server IP address
|This interface ID
|-
|-
|s_server_addr
|name
|Server-side Server Address
|Interface Name
|inet
|text
|The server-side server IP address
|This name of the interface
|-
|-
|c_client_port
|description
|Client-side Client Port
|Text detail of the event
|integer
|text
|The client-side client port
|The description from the test rule
|-
|-
|s_client_port
|success
|Server-side Client Port
|Success
|integer
|boolean
|The server-side client port
|The result of the test (true if the test succeeded, false otherwise)
|-
|-
|c_server_port
|event_id
|Client-side Server Port
|Event ID
|integer
|The client-side server port
|-
|s_server_port
|Server-side Server Port
|integer
|The server-side server port
|-
|policy_id
|Policy ID
|bigint
|bigint
|The policy
|The unique event ID
|-
|-
|username
|}
|Username
<section end='wan_failover_test_events' />
|text
 
|The username associated with this session
 
== wan_failover_action_events ==
<section begin='wan_failover_action_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|msg_id
|time_stamp
|Message ID
|Timestamp
|bigint
|timestamp without time zone
|The message ID
|The time of the event
|-
|-
|subject
|interface_id
|Subject
|Interface ID
|text
|integer
|The email subject
|This interface ID
|-
|-
|addr
|action
|Address
|Action
|text
|text
|The address of this event
|This action (CONNECTED,DISCONNECTED)
|-
|-
|addr_name
|os_name
|Address Name
|Interface O/S Name
|text
|text
|The name for this address
|This O/S name of the interface
|-
|-
|addr_kind
|name
|Address Kind
|Interface Name
|character(1)
|The type for this address (F=From, T=To, C=CC, G=Envelope From, B=Envelope To, X=Unknown)
|-
|hostname
|Hostname
|text
|text
|The hostname of the local address
|This name of the interface
|-
|-
|event_id
|event_id
Line 888: Line 877:
|The unique event ID
|The unique event ID
|-
|-
|sender
|}
|Sender
<section end='wan_failover_action_events' />
|text
 
|The address of the sender
 
|-
== mail_msgs ==
|virus_blocker_lite_clean
<section begin='mail_msgs' />
|Virus Blocker Lite Clean
 
|boolean
{| border="1" cellpadding="2" width="90%%" align="center"
|The cleanliness of the file according to Virus Blocker Lite
!Column Name
!Human Name
!Type
!Description
|-
|-
|virus_blocker_lite_name
|time_stamp
|Virus Blocker Lite Name
|Timestamp
|text
|timestamp without time zone
|The name of the malware according to Virus Blocker Lite
|The time of the event
|-
|-
|virus_blocker_clean
|session_id
|Virus Blocker Clean
|Session ID
|boolean
|bigint
|The cleanliness of the file according to Virus Blocker
|The session
|-
|-
|virus_blocker_name
|client_intf
|Virus Blocker Name
|Client Interface
|text
|smallint
|The name of the malware according to Virus Blocker
|The client interface
|-
|-
|spam_blocker_lite_score
|server_intf
|Spam Blocker Lite Score
|Server Interface
|real
|smallint
|The score of the email according to Spam Blocker Lite
|The server interface
|-
|-
|spam_blocker_lite_is_spam
|c_client_addr
|Spam Blocker Lite Spam
|Client-side Client Address
|boolean
|inet
|The spam status of the email according to Spam Blocker Lite
|The client-side client IP address
|-
|-
|spam_blocker_lite_action
|s_client_addr
|Spam Blocker Lite Action
|Server-side Client Address
|character(1)
|inet
|The action taken by Spam Blocker Lite
|The server-side client IP address
|-
|-
|spam_blocker_lite_tests_string
|c_server_addr
|Spam Blocker Lite Tests
|Client-side Server Address
|text
|inet
|The tess results for Spam Blocker Lite
|The client-side server IP address
|-
|-
|spam_blocker_score
|s_server_addr
|Spam Blocker Score
|Server-side Server Address
|real
|inet
|The score of the email according to Spam Blocker
|The server-side server IP address
|-
|-
|spam_blocker_is_spam
|c_client_port
|Spam Blocker Spam
|Client-side Client Port
|boolean
|integer
|The spam status of the email according to Spam Blocker
|The client-side client port
|-
|-
|spam_blocker_action
|s_client_port
|Spam Blocker Action
|Server-side Client Port
|character(1)
|integer
|The action taken by Spam Blocker
|The server-side client port
|-
|-
|spam_blocker_tests_string
|c_server_port
|Spam Blocker Tests
|Client-side Server Port
|text
|integer
|The tess results for Spam Blocker
|The client-side server port
|-
|-
|phish_blocker_score
|s_server_port
|Phish Blocker Score
|Server-side Server Port
|real
|integer
|The score of the email according to Phish Blocker
|The server-side server port
|-
|-
|phish_blocker_is_spam
|policy_id
|Phish Blocker Phish
|Policy ID
|boolean
|bigint
|The phish status of the email according to Phish Blocker
|The policy
|-
|-
|phish_blocker_tests_string
|username
|Phish Blocker Tests
|Username
|text
|text
|The tess results for Phish Blocker
|The username associated with this session
|-
|-
|phish_blocker_action
|msg_id
|Phish Blocker Action
|Message ID
|character(1)
|bigint
|The action taken by Phish Blocker
|The message ID
|-
|-
|}
|subject
<section end='mail_addrs' />
|Subject
 
|text
 
|The email subject
== smtp_tarpit_events ==
<section begin='smtp_tarpit_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|time_stamp
|Timestamp
|timestamp without time zone
|The time of the event
|-
|ipaddr
|Client Address
|inet
|The client IP address
|-
|-
|hostname
|hostname
Line 1,001: Line 975:
|The hostname of the local address
|The hostname of the local address
|-
|-
|policy_id
|event_id
|Policy ID
|Event ID
|bigint
|bigint
|The policy
|The unique event ID
|-
|-
|vendor_name
|sender
|Vendor Name
|Sender
|character varying(255)
|text
|The "vendor name" of the app that logged the event
|The address of the sender
|-
|-
|event_id
|receiver
|Event ID
|Receiver
|bigint
|text
|The unique event ID
|The address of the receiver
|-
|-
|}
|virus_blocker_lite_clean
<section end='smtp_tarpit_events' />
|Virus Blocker Lite Clean
 
|boolean
 
|The cleanliness of the file according to Virus Blocker Lite
== ftp_events ==
<section begin='ftp_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|event_id
|virus_blocker_lite_name
|Event ID
|Virus Blocker Lite Name
|bigint
|text
|The unique event ID
|The name of the malware according to Virus Blocker Lite
|-
|-
|time_stamp
|virus_blocker_clean
|Timestamp
|Virus Blocker Clean
|timestamp without time zone
|boolean
|The time of the event
|The cleanliness of the file according to Virus Blocker
|-
|-
|session_id
|virus_blocker_name
|Session ID
|Virus Blocker Name
|bigint
|text
|The session
|The name of the malware according to Virus Blocker
|-
|-
|client_intf
|spam_blocker_lite_score
|Client Interface
|Spam Blocker Lite Score
|smallint
|real
|The client interface
|The score of the email according to Spam Blocker Lite
|-
|-
|server_intf
|spam_blocker_lite_is_spam
|Server Interface
|Spam Blocker Lite Spam
|smallint
|boolean
|The server interface
|The spam status of the email according to Spam Blocker Lite
|-
|-
|c_client_addr
|spam_blocker_lite_tests_string
|Client-side Client Address
|Spam Blocker Lite Tests
|inet
|text
|The client-side client IP address
|The tess results for Spam Blocker Lite
|-
|-
|s_client_addr
|spam_blocker_lite_action
|Server-side Client Address
|Spam Blocker Lite Action
|inet
|character(1)
|The server-side client IP address
|The action taken by Spam Blocker Lite
|-
|-
|c_server_addr
|spam_blocker_score
|Client-side Server Address
|Spam Blocker Score
|inet
|real
|The client-side server IP address
|The score of the email according to Spam Blocker
|-
|-
|s_server_addr
|spam_blocker_is_spam
|Server-side Server Address
|Spam Blocker Spam
|inet
|boolean
|The server-side server IP address
|The spam status of the email according to Spam Blocker
|-
|-
|policy_id
|spam_blocker_tests_string
|Policy ID
|Spam Blocker Tests
|bigint
|The policy
|-
|username
|Username
|text
|text
|The username associated with this session
|The tess results for Spam Blocker
|-
|-
|hostname
|spam_blocker_action
|Hostname
|Spam Blocker Action
|text
|character(1)
|The hostname of the local address
|The action taken by Spam Blocker
|-
|-
|request_id
|phish_blocker_score
|Request ID
|Phish Blocker Score
|bigint
|real
|The FTP request ID
|The score of the email according to Phish Blocker
|-
|-
|method
|phish_blocker_is_spam
|Method
|Phish Blocker Phish
|character(1)
|boolean
|The FTP method
|The phish status of the email according to Phish Blocker
|-
|-
|uri
|phish_blocker_tests_string
|URI
|Phish Blocker Tests
|text
|text
|The FTP URI
|The tess results for Phish Blocker
|-
|-
|virus_blocker_lite_clean
|phish_blocker_action
|Virus Blocker Lite Clean
|Phish Blocker Action
|boolean
|character(1)
|The cleanliness of the file according to Virus Blocker Lite
|The action taken by Phish Blocker
|-
|-
|virus_blocker_lite_name
|}
|Virus Blocker Lite Name
<section end='mail_msgs' />
|text
|The name of the malware according to Virus Blocker Lite
|-
|virus_blocker_clean
|Virus Blocker Clean
|boolean
|The cleanliness of the file according to Virus Blocker
|-
|virus_blocker_name
|Virus Blocker Name
|text
|The name of the malware according to Virus Blocker
|-
|}
<section end='ftp_events' />




== wan_failover_test_events ==  
== mail_addrs ==  
<section begin='wan_failover_test_events' />
<section begin='mail_addrs' />


{| border="1" cellpadding="2" width="90%%" align="center"
{| border="1" cellpadding="2" width="90%%" align="center"
Line 1,142: Line 1,088:
|The time of the event
|The time of the event
|-
|-
|interface_id
|session_id
|Interface ID
|Session ID
|integer
|bigint
|This interface ID
|The session
|-
|-
|name
|client_intf
|Interface Name
|Client Interface
|text
|smallint
|This name of the interface
|The client interface
|-
|-
|description
|server_intf
|Text detail of the event
|Server Interface
|text
|smallint
|The description from the test rule
|The server interface
|-
|-
|success
|c_client_addr
|Success
|Client-side Client Address
|boolean
|inet
|The result of the test (true if the test succeeded, false otherwise)
|The client-side client IP address
|-
|-
|event_id
|s_client_addr
|Event ID
|Server-side Client Address
|bigint
|inet
|The unique event ID
|The server-side client IP address
|-
|-
|}
|c_server_addr
<section end='wan_failover_test_events' />
|Client-side Server Address
 
|inet
 
|The client-side server IP address
== wan_failover_action_events ==
<section begin='wan_failover_action_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|time_stamp
|s_server_addr
|Timestamp
|Server-side Server Address
|timestamp without time zone
|inet
|The time of the event
|The server-side server IP address
|-
|-
|interface_id
|c_client_port
|Interface ID
|Client-side Client Port
|integer
|integer
|This interface ID
|The client-side client port
|-
|-
|action
|s_client_port
|Action
|Server-side Client Port
|text
|integer
|This action (CONNECTED/DISCONNECTED)
|The server-side client port
|-
|-
|os_name
|c_server_port
|Interface O/S Name
|Client-side Server Port
|text
|integer
|This O/S name of the interface
|The client-side server port
|-
|s_server_port
|Server-side Server Port
|integer
|The server-side server port
|-
|policy_id
|Policy ID
|bigint
|The policy
|-
|-
|name
|username
|Interface Name
|Username
|text
|text
|This name of the interface
|The username associated with this session
|-
|-
|event_id
|msg_id
|Event ID
|Message ID
|bigint
|bigint
|The unique event ID
|The message ID
|-
|-
|}
|subject
<section end='wan_failover_action_events' />
|Subject
 
|text
 
|The email subject
== intrusion_prevention_events ==
<section begin='intrusion_prevention_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|time_stamp
|addr
|Timestamp
|Address
|timestamp without time zone
|text
|The time of the event
|The address of this event
|-
|-
|sig_id
|addr_name
|Signature ID
|Address Name
|bigint
|text
|This ID of the rule
|The name for this address
|-
|-
|gen_id
|addr_kind
|Grouping ID
|Address Kind
|bigint
|character(1)
|The grouping ID for the rule, The gen_id + sig_id specify the rule's unique identifier
|The type for this address (F=From, T=To, C=CC, G=Envelope From, B=Envelope To, X=Unknown)
|-
|hostname
|Hostname
|text
|The hostname of the local address
|-
|-
|class_id
|event_id
|Classtype ID
|Event ID
|bigint
|bigint
|The numeric ID for the classtype
|The unique event ID
|-
|-
|source_addr
|sender
|Source Address
|Sender
|inet
|text
|The source IP address of the packet
|The address of the sender
|-
|-
|source_port
|virus_blocker_lite_clean
|Source Port
|Virus Blocker Lite Clean
|integer
|boolean
|The source port of the packet (if applicable)
|The cleanliness of the file according to Virus Blocker Lite
|-
|-
|dest_addr
|virus_blocker_lite_name
|Destination Address
|Virus Blocker Lite Name
|inet
|text
|The destination IP address of the packet
|The name of the malware according to Virus Blocker Lite
|-
|-
|dest_port
|virus_blocker_clean
|Destination Port
|Virus Blocker Clean
|integer
|The destination port of the packet (if applicable)
|-
|protocol
|Protocol
|integer
|The protocol of the packet
|-
|blocked
|Blocked
|boolean
|boolean
|If the packet was blocked/dropped
|The cleanliness of the file according to Virus Blocker
|-
|-
|category
|virus_blocker_name
|Category
|Virus Blocker Name
|text
|text
|The application specific grouping
|The name of the malware according to Virus Blocker
|-
|-
|classtype
|spam_blocker_lite_score
|Classtype
|Spam Blocker Lite Score
|text
|real
|The generalized threat rule grouping (unrelated to gen_id)
|The score of the email according to Spam Blocker Lite
|-
|spam_blocker_lite_is_spam
|Spam Blocker Lite Spam
|boolean
|The spam status of the email according to Spam Blocker Lite
|-
|spam_blocker_lite_action
|Spam Blocker Lite Action
|character(1)
|The action taken by Spam Blocker Lite
|-
|-
|msg
|spam_blocker_lite_tests_string
|Message
|Spam Blocker Lite Tests
|text
|text
|The "title" or "description" of the rule
|The tess results for Spam Blocker Lite
|-
|-
|}
|spam_blocker_score
<section end='intrusion_prevention_events' />
|Spam Blocker Score
 
|real
 
|The score of the email according to Spam Blocker
== web_cache_stats ==
<section begin='web_cache_stats' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|time_stamp
|spam_blocker_is_spam
|Timestamp
|Spam Blocker Spam
|timestamp without time zone
|boolean
|The time of the event
|The spam status of the email according to Spam Blocker
|-
|-
|hits
|spam_blocker_action
|Hits
|Spam Blocker Action
|bigint
|character(1)
|The number of cache hits during this time frame
|The action taken by Spam Blocker
|-
|-
|misses
|spam_blocker_tests_string
|Misses
|Spam Blocker Tests
|bigint
|text
|The number of cache misses during this time frame
|The tess results for Spam Blocker
|-
|-
|bypasses
|phish_blocker_score
|Bypasses
|Phish Blocker Score
|bigint
|real
|The number of cache user bypasses during this time frame
|The score of the email according to Phish Blocker
|-
|-
|systems
|phish_blocker_is_spam
|System bypasses
|Phish Blocker Phish
|bigint
|boolean
|The number of cache system bypasses during this time frame
|The phish status of the email according to Phish Blocker
|-
|-
|hit_bytes
|phish_blocker_tests_string
|Hit Bytes
|Phish Blocker Tests
|bigint
|text
|The number of bytes saved from cache hits
|The tess results for Phish Blocker
|-
|-
|miss_bytes
|phish_blocker_action
|Miss Bytes
|Phish Blocker Action
|bigint
|character(1)
|The number of bytes not saved from cache misses
|The action taken by Phish Blocker
|-
|-
|event_id
|}
|Event ID
<section end='mail_addrs' />
|bigint
|The unique event ID
|-
|}
<section end='web_cache_stats' />




== http_query_events ==  
== smtp_tarpit_events ==  
<section begin='http_query_events' />
<section begin='smtp_tarpit_events' />


{| border="1" cellpadding="2" width="90%%" align="center"
{| border="1" cellpadding="2" width="90%%" align="center"
Line 1,353: Line 1,285:
!Type
!Type
!Description
!Description
|-
|event_id
|Event ID
|bigint
|The unique event ID
|-
|-
|time_stamp
|time_stamp
Line 1,364: Line 1,291:
|The time of the event
|The time of the event
|-
|-
|session_id
|ipaddr
|Session ID
|Client Address
|inet
|The client IP address
|-
|hostname
|Hostname
|text
|The hostname of the local address
|-
|policy_id
|Policy ID
|bigint
|bigint
|The session
|The policy
|-
|-
|client_intf
|vendor_name
|Client Interface
|Vendor Name
|smallint
|character varying(255)
|The client interface
|The "vendor name" of the app that logged the event
|-
|-
|server_intf
|event_id
|Server Interface
|Event ID
|smallint
|bigint
|The server interface
|The unique event ID
|-
|-
|c_client_addr
|}
|Client-side Client Address
<section end='smtp_tarpit_events' />
|inet
 
|The client-side client IP address
 
== http_events ==
<section begin='http_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|s_client_addr
|request_id
|Request ID
|bigint
|The HTTP request ID
|-
|time_stamp
|Timestamp
|timestamp without time zone
|The time of the event
|-
|session_id
|Session ID
|bigint
|The session
|-
|client_intf
|Client Interface
|smallint
|The client interface
|-
|server_intf
|Server Interface
|smallint
|The server interface
|-
|c_client_addr
|Client-side Client Address
|inet
|The client-side client IP address
|-
|s_client_addr
|Server-side Client Address
|Server-side Client Address
|inet
|inet
Line 1,421: Line 1,396:
|policy_id
|policy_id
|Policy ID
|Policy ID
|bigint
|smallint
|The policy
|The policy
|-
|-
Line 1,433: Line 1,408:
|text
|text
|The hostname of the local address
|The hostname of the local address
|-
|request_id
|Request ID
|bigint
|The HTTP request ID
|-
|-
|method
|method
Line 1,448: Line 1,418:
|text
|text
|The HTTP URI
|The HTTP URI
|-
|term
|Search Term
|text
|The search term
|-
|-
|host
|host
Line 1,458: Line 1,423:
|text
|text
|The HTTP host
|The HTTP host
|-
|domain
|Domain
|text
|The HTTP domain (shortened host)
|-
|referer
|Referer
|text
|The Referer URL
|-
|-
|c2s_content_length
|c2s_content_length
Line 1,474: Line 1,449:
|The server-to-client content type
|The server-to-client content type
|-
|-
|}
|ad_blocker_cookie_ident
<section end='http_query_events' />
|Ad Blocker Cookie
 
|text
 
|This name of cookie blocked by Ad Blocker
== directory_connector_login_events ==
|-
<section begin='directory_connector_login_events' />
|ad_blocker_action
 
|Ad Blocker Action
{| border="1" cellpadding="2" width="90%%" align="center"
|character(1)
!Column Name
|This action of Ad Blocker on this request
!Human Name
!Type
!Description
|-
|-
|time_stamp
|web_filter_reason
|Timestamp
|Web Filter Reason
|timestamp without time zone
|character(1)
|The time of the event
|This reason Web Filter blocked/flagged this request
|-
|-
|login_name
|web_filter_category
|Login Name
|Web Filter Category
|text
|text
|The login name
|This category according to Web Filter
|-
|-
|domain
|web_filter_blocked
|Domain
|Web Filter Blocked
|text
|boolean
|The AD domain
|If Web Filter blocked this request
|-
|-
|type
|web_filter_flagged
|Type
|Web Filter Flagged
|boolean
|If Web Filter flagged this request
|-
|virus_blocker_lite_clean
|Virus Blocker Lite Clean
|boolean
|The cleanliness of the file according to Virus Blocker Lite
|-
|virus_blocker_lite_name
|Virus Blocker Lite Name
|text
|text
|The type of event (I=Login,U=Update,O=Logout)
|The name of the malware according to Virus Blocker Lite
|-
|virus_blocker_clean
|Virus Blocker Clean
|boolean
|The cleanliness of the file according to Virus Blocker
|-
|-
|client_addr
|virus_blocker_name
|Client Address
|Virus Blocker Name
|inet
|text
|The client IP address
|The name of the malware according to Virus Blocker
|-
|-
|}
|}
<section end='directory_connector_login_events' />
<section end='http_events' />




== admin_logins ==  
== ftp_events ==  
<section begin='admin_logins' />
<section begin='ftp_events' />


{| border="1" cellpadding="2" width="90%%" align="center"
{| border="1" cellpadding="2" width="90%%" align="center"
Line 1,524: Line 1,511:
!Type
!Type
!Description
!Description
|-
|event_id
|Event ID
|bigint
|The unique event ID
|-
|-
|time_stamp
|time_stamp
Line 1,530: Line 1,522:
|The time of the event
|The time of the event
|-
|-
|login
|session_id
|Login
|Session ID
|text
|bigint
|The login name
|The session
|-
|-
|local
|client_intf
|Local
|Client Interface
|boolean
|smallint
|True if it is a login attempt through a local process
|The client interface
|-
|-
|client_addr
|server_intf
|Client Address
|Server Interface
|inet
|smallint
|The client IP address
|The server interface
|-
|-
|succeeded
|c_client_addr
|Succeeded
|Client-side Client Address
|boolean
|inet
|True if the login succeeded, false otherwise
|The client-side client IP address
|-
|-
|reason
|s_client_addr
|Reason
|Server-side Client Address
|character(1)
|inet
|The reason for the login (if applicable)
|The server-side client IP address
|-
|-
|}
|c_server_addr
<section end='admin_logins' />
|Client-side Server Address
 
|inet
 
|The client-side server IP address
== sessions ==
<section begin='sessions' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|session_id
|s_server_addr
|Session ID
|Server-side Server Address
|inet
|The server-side server IP address
|-
|policy_id
|Policy ID
|bigint
|bigint
|The session
|The policy
|-
|-
|time_stamp
|username
|Timestamp
|Username
|timestamp without time zone
|text
|The time of the event
|The username associated with this session
|-
|-
|end_time
|hostname
|End Time
|Hostname
|timestamp without time zone
|text
|The time the session ended
|The hostname of the local address
|-
|-
|bypassed
|request_id
|Bypassed
|Request ID
|boolean
|bigint
|True if the session was bypassed, false otherwise
|The FTP request ID
|-
|-
|entitled
|method
|Entitled
|Method
|boolean
|character(1)
|True if the session is entitled to premium functionality
|The FTP method
|-
|-
|protocol
|uri
|Protocol
|URI
|smallint
|text
|The IP protocol of session
|The FTP URI
|-
|-
|icmp_type
|virus_blocker_lite_clean
|ICMP Type
|Virus Blocker Lite Clean
|smallint
|boolean
|The ICMP type of session if ICMP
|The cleanliness of the file according to Virus Blocker Lite
|-
|-
|hostname
|virus_blocker_lite_name
|Hostname
|Virus Blocker Lite Name
|text
|text
|The hostname of the local address
|The name of the malware according to Virus Blocker Lite
|-
|-
|username
|virus_blocker_clean
|Username
|Virus Blocker Clean
|boolean
|The cleanliness of the file according to Virus Blocker
|-
|virus_blocker_name
|Virus Blocker Name
|text
|text
|The username associated with this session
|The name of the malware according to Virus Blocker
|-
|-
|policy_id
|}
|Policy ID
<section end='ftp_events' />
|smallint
 
|The policy
 
== ipsec_user_events ==
<section begin='ipsec_user_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|policy_rule_id
|event_id
|Policy Rule ID
|Event ID
|smallint
|bigint
|The ID of the matching policy rule (0 means none)
|The unique event ID
|-
|-
|local_addr
|time_stamp
|Local Address
|Timestamp
|inet
|timestamp without time zone
|The IP address of the local participant
|The time of the event
|-
|-
|remote_addr
|connect_stamp
|Remote Address
|Connect Time
|inet
|timestamp without time zone
|The IP address of the remote participant
|The time the connection started
|-
|-
|c_client_addr
|goodbye_stamp
|Client-side Client Address
|End Time
|inet
|timestamp without time zone
|The client-side client IP address
|The time the connection ended
|-
|-
|c_server_addr
|client_address
|Client-side Server Address
|Client Address
|inet
|text
|The client-side server IP address
|The remote IP address of the client
|-
|-
|c_server_port
|client_protocol
|Client-side Server Port
|Client Protocol
|integer
|text
|The client-side server port
|The protocol the client used to connect
|-
|-
|c_client_port
|client_username
|Client-side Client Port
|Client Username
|integer
|text
|The client-side client port
|The username of the client
|-
|-
|s_client_addr
|net_process
|Server-side Client Address
|Net Process
|inet
|text
|The server-side client IP address
|The PID of the PPP process for L2TP connections or the connection ID for Xauth connections
|-
|-
|s_server_addr
|net_interface
|Server-side Server Address
|Net Interface
|inet
|text
|The server-side server IP address
|The PPP interface for L2TP connections or the client interface for Xauth connections
|-
|-
|s_server_port
|elapsed_time
|Server-side Server Port
|Elapsed Time
|integer
|text
|The server-side server port
|The total time the client was connected
|-
|-
|s_client_port
|rx_bytes
|Server-side Client Port
|Bytes Received
|integer
|bigint
|The server-side client port
|The number of bytes received from the client in this connection
|-
|-
|client_intf
|tx_bytes
|Client Interface
|Bytes Sent
|smallint
|bigint
|The client interface
|The number of bytes sent to the client in this connection
|-
|-
|server_intf
|}
|Server Interface
<section end='ipsec_user_events' />
|smallint
 
|The server interface
 
== ipsec_tunnel_stats ==
<section begin='ipsec_tunnel_stats' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|time_stamp
|Timestamp
|timestamp without time zone
|The time of the event
|-
|-
|client_country
|tunnel_name
|Client Country
|Tunnel Name
|text
|text
|The client Country
|The name of the IPsec tunnel
|-
|-
|client_latitude
|in_bytes
|Client Latitude
|In Bytes
|real
|bigint
|The client Latitude
|The number of bytes received during this time frame
|-
|-
|client_longitude
|out_bytes
|Client Longitude
|Out Bytes
|real
|The client Longitude
|-
|server_country
|Server Country
|text
|The server Country
|-
|server_latitude
|Server Latitude
|real
|The server Latitude
|-
|server_longitude
|Server Longitude
|real
|The server Longitude
|-
|c2p_bytes
|From-Client Bytes
|bigint
|bigint
|The number of bytes the client sent to Untangle (client-to-pipeline)
|The number of bytes transmitted during this time frame
|-
|-
|p2c_bytes
|event_id
|To-Client Bytes
|Event ID
|bigint
|bigint
|The number of bytes Untangle sent to client (pipeline-to-client)
|The unique event ID
|-
|-
|s2p_bytes
|}
|From-Server Bytes
<section end='ipsec_tunnel_stats' />
|bigint
 
|The number of bytes the server sent to Untangle (client-to-pipeline)
 
== interface_stat_events ==
<section begin='interface_stat_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|p2s_bytes
|time_stamp
|To-Server Bytes
|Timestamp
|bigint
|timestamp without time zone
|The number of bytes Untangle sent to server (pipeline-to-client)
|The time of the event
|-
|-
|filter_prefix
|interface_id
|Filter Block
|Interface ID
|text
|integer
|The network filter that blocked the connection
|The interface ID
|-
|-
|firewall_blocked
|rx_rate
|Firewall Blocked
|Rx Rate
|boolean
|double precision
|True if Firewall blocked the session, false otherwise
|The RX rate (bytes/s)
|-
|-
|firewall_flagged
|tx_rate
|Firewall Flagged
|Tx Rate
|boolean
|double precision
|True if Firewall flagged the session, false otherwise
|The TX rate (bytes/s)
|-
|-
|firewall_rule_index
|}
|Firewall Rule ID
<section end='interface_stat_events' />
|integer
 
|The matching rule in Firewall (if any)
 
== configuration_backup_events ==
<section begin='configuration_backup_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|application_control_lite_protocol
|time_stamp
|Application Control Lite Protocol
|Timestamp
|text
|timestamp without time zone
|The application protocol according to Application Control Lite
|The time of the event
|-
|-
|application_control_lite_blocked
|success
|Application Control Lite Blocked
|Success
|boolean
|boolean
|True if Application Control Lite blocked the session
|The result of the backup (true if the backup succeeded, false otherwise)
|-
|-
|captive_portal_blocked
|description
|Captive Portal Blocked
|Text detail of the event
|boolean
|text
|True if Captive Portal blocked the session
|Text detail of the event
|-
|-
|captive_portal_rule_index
|destination
|Captive Portal Rule ID
|Destination
|integer
|The matching rule in Captive Portal (if any)
|-
|application_control_application
|Application Control Application
|text
|text
|The application according to Application Control
|The location of the backup
|-
|-
|application_control_protochain
|event_id
|Application Control Protochain
|Event ID
|text
|bigint
|The protochain according to Application Control
|The unique event ID
|-
|}
<section end='configuration_backup_events' />
 
 
== directory_connector_login_events ==
<section begin='directory_connector_login_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|time_stamp
|Timestamp
|timestamp without time zone
|The time of the event
|-
|-
|application_control_category
|login_name
|Application Control Category
|Login Name
|text
|text
|The category according to Application Control
|The login name
|-
|-
|application_control_blocked
|domain
|Application Control Blocked
|Domain
|boolean
|text
|True if Application Control blocked the session
|The AD domain
|-
|-
|application_control_flagged
|type
|Application Control Flagged
|Type
|boolean
|text
|True if Application Control flagged the session
|The type of event (I=Login,U=Update,O=Logout)
|-
|-
|application_control_confidence
|client_addr
|Application Control Confidence
|Client Address
|integer
|inet
|True if Application Control confidence of this session's identification
|The client IP address
|-
|-
|application_control_ruleid
|}
|Application Control Rule ID
<section end='directory_connector_login_events' />
|integer
 
|The matching rule in Application Control (if any)
 
|-
== server_events ==
|application_control_detail
<section begin='server_events' />
|Application Control Detail
 
|text
{| border="1" cellpadding="2" width="90%%" align="center"
|The text detail from the Application Control engine
!Column Name
!Human Name
!Type
!Description
|-
|-
|bandwidth_control_priority
|time_stamp
|Bandwidth Control Priority
|Timestamp
|integer
|timestamp without time zone
|The priority given to this session
|The time of the event
|-
|-
|bandwidth_control_rule
|load_1
|Bandwidth Control Rule ID
|CPU load (1-min)
|integer
|numeric(6,2)
|The matching rule in Bandwidth Control rule (if any)
|The 1-minute CPU load
|-
|-
|ssl_inspector_ruleid
|load_5
|SSL Inspector Rule ID
|CPU load (5-min)
|integer
|numeric(6,2)
|The matching rule in SSL Inspector rule (if any)
|The 5-minute CPU load
|-
|load_15
|CPU load (15-min)
|numeric(6,2)
|The 15-minute CPU load
|-
|-
|ssl_inspector_status
|cpu_user
|SSL Inspector Status
|CPU User Utilization
|text
|numeric(6,3)
|The status/action of the SSL session (INSPECTED/IGNORED/BLOCKED/UNTRUSTED/ABANDONED)
|The user CPU percent utilization
|-
|-
|ssl_inspector_detail
|cpu_system
|SSL Inspector Detail
|CPU System Utilization
|text
|numeric(6,3)
|Additional text detail about the SSL connection (SNI, IP Address)
|The system CPU percent utilization
|-
|-
|}
|mem_total
<section end='sessions' />
|Total Memory
 
|bigint
 
|The total bytes of memory
== session_minutes ==
<section begin='session_minutes' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|session_id
|mem_free
|Session ID
|Memory Free
|bigint
|bigint
|The session
|The number of free bytes of memory
|-
|-
|time_stamp
|disk_total
|Timestamp
|Disk Size
|timestamp without time zone
|The time of the event
|-
|c2s_bytes
|From-Client Bytes
|bigint
|bigint
|The number of bytes the client sent
|The total disk size in bytes
|-
|-
|s2c_bytes
|disk_free
|From-Server Bytes
|Disk Free
|bigint
|bigint
|The number of bytes the server sent
|The free disk space in bytes
|-
|-
|start_time
|swap_total
|Start Time
|Swap Size
|timestamp without time zone
|bigint
|The start time of the session
|The total swap size in bytes
|-
|-
|end_time
|swap_free
|End Time
|Swap Free
|timestamp without time zone
|bigint
|The time the session ended
|The free disk swap in bytes
|-
|-
|bypassed
|active_hosts
|Bypassed
|Active Hosts
|boolean
|integer
|True if the session was bypassed, false otherwise
|The number of active hosts
|-
|-
|entitled
|}
|Entitled
<section end='server_events' />
|boolean
 
|True if the session is entitled to premium functionality
 
|-
== web_cache_stats ==
|protocol
<section begin='web_cache_stats' />
|Protocol
 
|smallint
{| border="1" cellpadding="2" width="90%%" align="center"
|The IP protocol of session
!Column Name
!Human Name
!Type
!Description
|-
|-
|icmp_type
|time_stamp
|ICMP Type
|Timestamp
|smallint
|timestamp without time zone
|The ICMP type of session if ICMP
|The time of the event
|-
|-
|hostname
|hits
|Hostname
|Hits
|text
|bigint
|The hostname of the local address
|The number of cache hits during this time frame
|-
|-
|username
|misses
|Username
|Misses
|text
|bigint
|The username associated with this session
|The number of cache misses during this time frame
|-
|-
|policy_id
|bypasses
|Policy ID
|Bypasses
|smallint
|bigint
|The policy
|The number of cache user bypasses during this time frame
|-
|-
|policy_rule_id
|systems
|Policy Rule ID
|System bypasses
|smallint
|bigint
|The ID of the matching policy rule (0 means none)
|The number of cache system bypasses during this time frame
|-
|-
|local_addr
|hit_bytes
|Local Address
|Hit Bytes
|inet
|bigint
|The IP address of the local participant
|The number of bytes saved from cache hits
|-
|-
|remote_addr
|miss_bytes
|Remote Address
|Miss Bytes
|inet
|bigint
|The IP address of the remote participant
|The number of bytes not saved from cache misses
|-
|-
|c_client_addr
|event_id
|Client-side Client Address
|Event ID
|inet
|bigint
|The client-side client IP address
|The unique event ID
|-
|-
|c_server_addr
|}
|Client-side Server Address
<section end='web_cache_stats' />
|inet
 
|The client-side server IP address
 
== http_query_events ==
<section begin='http_query_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|c_server_port
|event_id
|Client-side Server Port
|Event ID
|integer
|bigint
|The client-side server port
|The unique event ID
|-
|time_stamp
|Timestamp
|timestamp without time zone
|The time of the event
|-
|session_id
|Session ID
|bigint
|The session
|-
|client_intf
|Client Interface
|smallint
|The client interface
|-
|server_intf
|Server Interface
|smallint
|The server interface
|-
|-
|c_client_port
|c_client_addr
|Client-side Client Port
|Client-side Client Address
|integer
|inet
|The client-side client port
|The client-side client IP address
|-
|-
|s_client_addr
|s_client_addr
Line 1,955: Line 2,005:
|inet
|inet
|The server-side client IP address
|The server-side client IP address
|-
|c_server_addr
|Client-side Server Address
|inet
|The client-side server IP address
|-
|-
|s_server_addr
|s_server_addr
Line 1,961: Line 2,016:
|The server-side server IP address
|The server-side server IP address
|-
|-
|s_server_port
|c_client_port
|Server-side Server Port
|Client-side Client Port
|integer
|integer
|The server-side server port
|The client-side client port
|-
|-
|s_client_port
|s_client_port
Line 1,971: Line 2,026:
|The server-side client port
|The server-side client port
|-
|-
|client_intf
|c_server_port
|Client Interface
|Client-side Server Port
|smallint
|integer
|The client interface
|The client-side server port
|-
|-
|server_intf
|s_server_port
|Server Interface
|Server-side Server Port
|smallint
|integer
|The server interface
|The server-side server port
|-
|-
|client_country
|policy_id
|Client Country
|Policy ID
|text
|bigint
|The client Country
|The policy
|-
|-
|client_latitude
|username
|Client Latitude
|Username
|real
|text
|The client Latitude
|The username associated with this session
|-
|-
|client_longitude
|hostname
|Client Longitude
|Hostname
|real
|The client Longitude
|-
|server_country
|Server Country
|text
|text
|The server Country
|The hostname of the local address
|-
|-
|server_latitude
|request_id
|Server Latitude
|Request ID
|real
|bigint
|The server Latitude
|The HTTP request ID
|-
|-
|server_longitude
|method
|Server Longitude
|Method
|real
|character(1)
|The server Longitude
|The HTTP method
|-
|-
|filter_prefix
|uri
|Filter Block
|URI
|text
|text
|The network filter that blocked the connection
|The HTTP URI
|-
|-
|firewall_blocked
|term
|Firewall Blocked
|Search Term
|boolean
|text
|True if Firewall blocked the session, false otherwise
|The search term
|-
|-
|firewall_flagged
|host
|Firewall Flagged
|Host
|boolean
|text
|True if Firewall flagged the session, false otherwise
|The HTTP host
|-
|-
|firewall_rule_index
|c2s_content_length
|Firewall Rule ID
|Client-to-server Content Length
|integer
|bigint
|The matching rule in Firewall (if any)
|The client-to-server content length
|-
|s2c_content_length
|Server-to-client Content Length
|bigint
|The server-to-client content length
|-
|-
|application_control_lite_protocol
|s2c_content_type
|Application Control Lite Protocol
|Server-to-client Content Type
|text
|text
|The application protocol according to Application Control Lite
|The server-to-client content type
|-
|-
|application_control_lite_blocked
|}
|Application Control Lite Blocked
<section end='http_query_events' />
|boolean
 
|True if Application Control Lite blocked the session
 
== captive_portal_user_events ==
<section begin='captive_portal_user_events' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|captive_portal_blocked
|time_stamp
|Captive Portal Blocked
|Timestamp
|boolean
|timestamp without time zone
|True if Captive Portal blocked the session
|The time of the event
|-
|policy_id
|Policy ID
|bigint
|The policy
|-
|-
|captive_portal_rule_index
|event_id
|Captive Portal Rule ID
|Event ID
|integer
|bigint
|The matching rule in Captive Portal (if any)
|The unique event ID
|-
|-
|application_control_application
|login_name
|Application Control Application
|Login Name
|text
|text
|The application according to Application Control
|The login username
|-
|-
|application_control_protochain
|event_info
|Application Control Protochain
|Event Type
|text
|text
|The protochain according to Application Control
|The type of event (LOGIN, FAILED, TIMEOUT, INACTIVE, USER_LOGOUT, ADMIN_LOGOUT)
|-
|-
|application_control_category
|auth_type
|Application Control Category
|Authorization Type
|text
|text
|The category according to Application Control
|The authorization type for this event
|-
|-
|application_control_blocked
|client_addr
|Application Control Blocked
|Client Address
|boolean
|text
|True if Application Control blocked the session
|The remote IP address of the client
|-
|-
|application_control_flagged
|}
|Application Control Flagged
<section end='captive_portal_user_events' />
|boolean
 
|True if Application Control flagged the session
 
== openvpn_stats ==
<section begin='openvpn_stats' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|application_control_confidence
|time_stamp
|Application Control Confidence
|Timestamp
|integer
|timestamp without time zone
|True if Application Control confidence of this session's identification
|The time of the event
|-
|-
|application_control_ruleid
|start_time
|Application Control Rule ID
|Start Time
|integer
|timestamp without time zone
|The matching rule in Application Control (if any)
|The time the OpenVPN session started
|-
|-
|application_control_detail
|end_time
|Application Control Detail
|End Time
|text
|timestamp without time zone
|The text detail from the Application Control engine
|The time the OpenVPN session ended
|-
|-
|bandwidth_control_priority
|rx_bytes
|Bandwidth Control Priority
|Bytes Received
|integer
|bigint
|The priority given to this session
|The total bytes received from the client during this session
|-
|-
|bandwidth_control_rule
|tx_bytes
|Bandwidth Control Rule ID
|Bytes Sent
|integer
|bigint
|The matching rule in Bandwidth Control rule (if any)
|The total bytes sent to the client during this session
|-
|remote_address
|Remote Address
|inet
|The remote IP address of the client
|-
|pool_address
|Pool Address
|inet
|The pool IP address of the client
|-
|-
|ssl_inspector_ruleid
|remote_port
|SSL Inspector Rule ID
|Remote Port
|integer
|integer
|The matching rule in SSL Inspector rule (if any)
|The remote port of the client
|-
|-
|ssl_inspector_status
|client_name
|SSL Inspector Status
|Client Name
|text
|text
|The status/action of the SSL session (INSPECTED/IGNORED/BLOCKED/UNTRUSTED/ABANDONED)
|The name of the client
|-
|-
|ssl_inspector_detail
|event_id
|SSL Inspector Detail
|Event ID
|text
|bigint
|Additional text detail about the SSL connection (SNI, IP Address)
|The unique event ID
|-
|-
|}
|}
<section end='session_minutes' />
<section end='openvpn_stats' />




== penaltybox ==  
== openvpn_events ==  
<section begin='penaltybox' />
<section begin='openvpn_events' />


{| border="1" cellpadding="2" width="90%%" align="center"
{| border="1" cellpadding="2" width="90%%" align="center"
Line 2,128: Line 2,214:
!Type
!Type
!Description
!Description
|-
|address
|Address
|inet
|The IP address of the host
|-
|reason
|Reason
|text
|The reason for the action
|-
|start_time
|Start Time
|timestamp without time zone
|The time the client entered the penalty box
|-
|end_time
|End Time
|timestamp without time zone
|The time the client exited the penalty box
|-
|-
|time_stamp
|time_stamp
Line 2,154: Line 2,220:
|The time of the event
|The time of the event
|-
|-
|}
|remote_address
<section end='penaltybox' />
|Remote Address
 
|inet
 
|The remote IP address of the client
== quotas ==  
|-
<section begin='quotas' />
|pool_address
|Pool Address
|inet
|The pool IP address of the client
|-
|client_name
|Client Name
|text
|The name of the client
|-
|type
|Type
|text
|The type of the event (CONNECT,DISCONNECT)
|-
|}
<section end='openvpn_events' />
 
 
== intrusion_prevention_events ==  
<section begin='intrusion_prevention_events' />


{| border="1" cellpadding="2" width="90%%" align="center"
{| border="1" cellpadding="2" width="90%%" align="center"
Line 2,172: Line 2,258:
|The time of the event
|The time of the event
|-
|-
|address
|sig_id
|Address
|Signature ID
|inet
|bigint
|The IP address of the host
|This ID of the rule
|-
|-
|action
|gen_id
|Action
|Grouping ID
|integer
|bigint
|The action (1=Quota Given, 2=Quota Exceeded)
|The grouping ID for the rule, The gen_id + sig_id specify the rule's unique identifier
|-
|-
|size
|class_id
|Size
|Classtype ID
|bigint
|bigint
|The size of the quota
|The numeric ID for the classtype
|-
|source_addr
|Source Address
|inet
|The source IP address of the packet
|-
|-
|reason
|source_port
|Reason
|Source Port
|text
|integer
|The reason for the action
|The source port of the packet (if applicable)
|-
|-
|}
|dest_addr
<section end='quotas' />
|Destination Address
 
 
== host_table_updates ==
<section begin='host_table_updates' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|address
|Address
|inet
|inet
|The IP address of the host
|The destination IP address of the packet
|-
|-
|key
|dest_port
|Key
|Destination Port
|text
|integer
|The key being updated
|The destination port of the packet (if applicable)
|-
|-
|value
|protocol
|Value
|Protocol
|text
|integer
|The new value for the key
|The protocol of the packet
|-
|-
|time_stamp
|blocked
|Timestamp
|Blocked
|timestamp without time zone
|boolean
|The time of the event
|If the packet was blocked/dropped
|-
|category
|Category
|text
|The application specific grouping
|-
|classtype
|Classtype
|text
|The generalized threat rule grouping (unrelated to gen_id)
|-
|msg
|Message
|text
|The "title" or "description" of the rule
|-
|-
|}
|}
<section end='host_table_updates' />
<section end='intrusion_prevention_events' />




== device_table_updates ==  
== syslog ==  
<section begin='device_table_updates' />
<section begin='syslog' />


{| border="1" cellpadding="2" width="90%%" align="center"
{| border="1" cellpadding="2" width="90%%" align="center"
Line 2,238: Line 2,331:
!Description
!Description
|-
|-
|mac_address
|time_stamp
|MAC Address
|Timestamp
|text
|timestamp without time zone
|The MAC address of the device
|The time of the event
|-
|-
|key
|description
|Key
|Text detail of the event
|text
|The key being updated
|-
|value
|Value
|text
|The new value for the key
|-
|time_stamp
|Timestamp
|timestamp without time zone
|The time of the event
|-
|}
<section end='device_table_updates' />
 
 
== alerts ==
<section begin='alerts' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|time_stamp
|Timestamp
|timestamp without time zone
|The time of the event
|-
|description
|Text detail of the event
|text
|text
|The description from the alert rule.
|The description from the alert rule.
Line 2,292: Line 2,352:
|-
|-
|}
|}
<section end='alerts' />
<section end='syslog' />




== configuration_backup_events ==  
== user_table_updates ==  
<section begin='configuration_backup_events' />
<section begin='user_table_updates' />


{| border="1" cellpadding="2" width="90%%" align="center"
{| border="1" cellpadding="2" width="90%%" align="center"
Line 2,304: Line 2,364:
!Description
!Description
|-
|-
|time_stamp
|username
|Timestamp
|Username
|timestamp without time zone
|text
|The time of the event
|The username
|-
|-
|success
|key
|Success
|Key
|boolean
|text
|The result of the backup (true if the backup succeeded, false otherwise)
|The key being updated
|-
|-
|description
|value
|Text detail of the event
|Value
|text
|text
|Text detail of the event
|The new value for the key
|-
|-
|destination
|old_value
|Destination
|Old Value
|text
|text
|The location of the backup
|The old value for the key
|-
|event_id
|Event ID
|bigint
|The unique event ID
|-
|}
<section end='configuration_backup_events' />
 
 
== settings_changes ==
<section begin='settings_changes' />
 
{| border="1" cellpadding="2" width="90%%" align="center"
!Column Name
!Human Name
!Type
!Description
|-
|-
|time_stamp
|time_stamp
Line 2,346: Line 2,388:
|timestamp without time zone
|timestamp without time zone
|The time of the event
|The time of the event
|-
|settings_file
|Settings File
|text
|The name of the file changed
|-
|username
|Username
|text
|The username logged in at the time of the change
|-
|hostname
|Hostname
|text
|The remote hostname
|-
|-
|}
|}
<section end='settings_changes' />
<section end='user_table_updates' />

Revision as of 20:24, 14 June 2017

Database Tables

admin_logins

<section begin='admin_logins' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
login Login text The login name
local Local boolean True if it is a login attempt through a local process
client_addr Client Address inet The client IP address
succeeded Succeeded boolean True if the login succeeded, false otherwise
reason Reason character(1) The reason for the login (if applicable)

<section end='admin_logins' />


sessions

<section begin='sessions' />

Column Name Human Name Type Description
session_id Session ID bigint The session
time_stamp Timestamp timestamp without time zone The time of the event
end_time End Time timestamp without time zone The time the session ended
bypassed Bypassed boolean True if the session was bypassed, false otherwise
entitled Entitled boolean True if the session is entitled to premium functionality
protocol Protocol smallint The IP protocol of session
icmp_type ICMP Type smallint The ICMP type of session if ICMP
hostname Hostname text The hostname of the local address
username Username text The username associated with this session
policy_id Policy ID smallint The policy
policy_rule_id Policy Rule ID smallint The ID of the matching policy rule (0 means none)
c_client_addr Client-side Client Address inet The client-side client IP address
c_server_addr Client-side Server Address inet The client-side server IP address
c_server_port Client-side Server Port integer The client-side server port
c_client_port Client-side Client Port integer The client-side client port
s_client_addr Server-side Client Address inet The server-side client IP address
s_server_addr Server-side Server Address inet The server-side server IP address
s_server_port Server-side Server Port integer The server-side server port
s_client_port Server-side Client Port integer The server-side client port
client_intf Client Interface smallint The client interface
server_intf Server Interface smallint The server interface
client_country Client Country text The client Country
client_latitude Client Latitude real The client Latitude
client_longitude Client Longitude real The client Longitude
server_country Server Country text The server Country
server_latitude Server Latitude real The server Latitude
server_longitude Server Longitude real The server Longitude
c2p_bytes From-Client Bytes bigint The number of bytes the client sent to Untangle (client-to-pipeline)
p2c_bytes To-Client Bytes bigint The number of bytes Untangle sent to client (pipeline-to-client)
s2p_bytes From-Server Bytes bigint The number of bytes the server sent to Untangle (client-to-pipeline)
p2s_bytes To-Server Bytes bigint The number of bytes Untangle sent to server (pipeline-to-client)
filter_prefix Filter Block text The network filter that blocked the connection (filter,shield,invalid)
firewall_blocked Firewall Blocked boolean True if Firewall blocked the session, false otherwise
firewall_flagged Firewall Flagged boolean True if Firewall flagged the session, false otherwise
firewall_rule_index Firewall Rule ID integer The matching rule in Firewall (if any)
application_control_lite_protocol Application Control Lite Protocol text The application protocol according to Application Control Lite
application_control_lite_blocked Application Control Lite Blocked boolean True if Application Control Lite blocked the session
captive_portal_blocked Captive Portal Blocked boolean True if Captive Portal blocked the session
captive_portal_rule_index Captive Portal Rule ID integer The matching rule in Captive Portal (if any)
application_control_application Application Control Application text The application according to Application Control
application_control_protochain Application Control Protochain text The protochain according to Application Control
application_control_category Application Control Category text The category according to Application Control
application_control_blocked Application Control Blocked boolean True if Application Control blocked the session
application_control_flagged Application Control Flagged boolean True if Application Control flagged the session
application_control_confidence Application Control Confidence integer True if Application Control confidence of this session's identification
application_control_ruleid Application Control Rule ID integer The matching rule in Application Control (if any)
application_control_detail Application Control Detail text The text detail from the Application Control engine
bandwidth_control_priority Bandwidth Control Priority integer The priority given to this session
bandwidth_control_rule Bandwidth Control Rule ID integer The matching rule in Bandwidth Control rule (if any)
ssl_inspector_ruleid SSL Inspector Rule ID integer The matching rule in SSL Inspector rule (if any)
ssl_inspector_status SSL Inspector Status text The status/action of the SSL session (INSPECTED,IGNORED,BLOCKED,UNTRUSTED,ABANDONED)
ssl_inspector_detail SSL Inspector Detail text Additional text detail about the SSL connection (SNI, IP Address)
local_addr Local Address inet The IP address of the local participant
remote_addr Remote Address inet The IP address of the remote participant
tags Tags text The tags on this session

<section end='sessions' />


session_minutes

<section begin='session_minutes' />

Column Name Human Name Type Description
session_id Session ID bigint The session
time_stamp Timestamp timestamp without time zone The time of the event
c2s_bytes From-Client Bytes bigint The number of bytes the client sent
s2c_bytes From-Server Bytes bigint The number of bytes the server sent
start_time Start Time timestamp without time zone The start time of the session
end_time End Time timestamp without time zone The time the session ended
bypassed Bypassed boolean True if the session was bypassed, false otherwise
entitled Entitled boolean True if the session is entitled to premium functionality
protocol Protocol smallint The IP protocol of session
icmp_type ICMP Type smallint The ICMP type of session if ICMP
hostname Hostname text The hostname of the local address
username Username text The username associated with this session
policy_id Policy ID smallint The policy
policy_rule_id Policy Rule ID smallint The ID of the matching policy rule (0 means none)
c_client_addr Client-side Client Address inet The client-side client IP address
c_server_addr Client-side Server Address inet The client-side server IP address
c_server_port Client-side Server Port integer The client-side server port
c_client_port Client-side Client Port integer The client-side client port
s_client_addr Server-side Client Address inet The server-side client IP address
s_server_addr Server-side Server Address inet The server-side server IP address
s_server_port Server-side Server Port integer The server-side server port
s_client_port Server-side Client Port integer The server-side client port
client_intf Client Interface smallint The client interface
server_intf Server Interface smallint The server interface
client_country Client Country text The client Country
client_latitude Client Latitude real The client Latitude
client_longitude Client Longitude real The client Longitude
server_country Server Country text The server Country
server_latitude Server Latitude real The server Latitude
server_longitude Server Longitude real The server Longitude
filter_prefix Filter Block text The network filter that blocked the connection (filter,shield,invalid)
firewall_blocked Firewall Blocked boolean True if Firewall blocked the session, false otherwise
firewall_flagged Firewall Flagged boolean True if Firewall flagged the session, false otherwise
firewall_rule_index Firewall Rule ID integer The matching rule in Firewall (if any)
application_control_lite_protocol Application Control Lite Protocol text The application protocol according to Application Control Lite
application_control_lite_blocked Application Control Lite Blocked boolean True if Application Control Lite blocked the session
captive_portal_blocked Captive Portal Blocked boolean True if Captive Portal blocked the session
captive_portal_rule_index Captive Portal Rule ID integer The matching rule in Captive Portal (if any)
application_control_application Application Control Application text The application according to Application Control
application_control_protochain Application Control Protochain text The protochain according to Application Control
application_control_category Application Control Category text The category according to Application Control
application_control_blocked Application Control Blocked boolean True if Application Control blocked the session
application_control_flagged Application Control Flagged boolean True if Application Control flagged the session
application_control_confidence Application Control Confidence integer True if Application Control confidence of this session's identification
application_control_ruleid Application Control Rule ID integer The matching rule in Application Control (if any)
application_control_detail Application Control Detail text The text detail from the Application Control engine
bandwidth_control_priority Bandwidth Control Priority integer The priority given to this session
bandwidth_control_rule Bandwidth Control Rule ID integer The matching rule in Bandwidth Control rule (if any)
ssl_inspector_ruleid SSL Inspector Rule ID integer The matching rule in SSL Inspector rule (if any)
ssl_inspector_status SSL Inspector Status text The status/action of the SSL session (INSPECTED,IGNORED,BLOCKED,UNTRUSTED,ABANDONED)
ssl_inspector_detail SSL Inspector Detail text Additional text detail about the SSL connection (SNI, IP Address)
local_addr Local Address inet The IP address of the local participant
remote_addr Remote Address inet The IP address of the remote participant
tags Tags text The tags on this session

<section end='session_minutes' />


quotas

<section begin='quotas' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
action Action integer The action (1=Quota Given, 2=Quota Exceeded)
size Size bigint The size of the quota
reason Reason text The reason for the action
entity Entity text The IP entity given the quota (address/username)

<section end='quotas' />


host_table_updates

<section begin='host_table_updates' />

Column Name Human Name Type Description
address Address inet The IP address of the host
key Key text The key being updated
value Value text The new value for the key
time_stamp Timestamp timestamp without time zone The time of the event
old_value Old Value text The old value for the key

<section end='host_table_updates' />


device_table_updates

<section begin='device_table_updates' />

Column Name Human Name Type Description
mac_address MAC Address text The MAC address of the device
key Key text The key being updated
value Value text The new value for the key
time_stamp Timestamp timestamp without time zone The time of the event
old_value Old Value text The old value for the key

<section end='device_table_updates' />


alerts

<section begin='alerts' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
description Text detail of the event text The description from the alert rule.
summary_text Summary Text text The summary text of the alert
json JSON Text text The summary JSON representation of the event causing the alert

<section end='alerts' />


settings_changes

<section begin='settings_changes' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
settings_file Settings File text The name of the file changed
username Username text The username logged in at the time of the change
hostname Hostname text The remote hostname

<section end='settings_changes' />


wan_failover_test_events

<section begin='wan_failover_test_events' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
interface_id Interface ID integer This interface ID
name Interface Name text This name of the interface
description Text detail of the event text The description from the test rule
success Success boolean The result of the test (true if the test succeeded, false otherwise)
event_id Event ID bigint The unique event ID

<section end='wan_failover_test_events' />


wan_failover_action_events

<section begin='wan_failover_action_events' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
interface_id Interface ID integer This interface ID
action Action text This action (CONNECTED,DISCONNECTED)
os_name Interface O/S Name text This O/S name of the interface
name Interface Name text This name of the interface
event_id Event ID bigint The unique event ID

<section end='wan_failover_action_events' />


mail_msgs

<section begin='mail_msgs' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
session_id Session ID bigint The session
client_intf Client Interface smallint The client interface
server_intf Server Interface smallint The server interface
c_client_addr Client-side Client Address inet The client-side client IP address
s_client_addr Server-side Client Address inet The server-side client IP address
c_server_addr Client-side Server Address inet The client-side server IP address
s_server_addr Server-side Server Address inet The server-side server IP address
c_client_port Client-side Client Port integer The client-side client port
s_client_port Server-side Client Port integer The server-side client port
c_server_port Client-side Server Port integer The client-side server port
s_server_port Server-side Server Port integer The server-side server port
policy_id Policy ID bigint The policy
username Username text The username associated with this session
msg_id Message ID bigint The message ID
subject Subject text The email subject
hostname Hostname text The hostname of the local address
event_id Event ID bigint The unique event ID
sender Sender text The address of the sender
receiver Receiver text The address of the receiver
virus_blocker_lite_clean Virus Blocker Lite Clean boolean The cleanliness of the file according to Virus Blocker Lite
virus_blocker_lite_name Virus Blocker Lite Name text The name of the malware according to Virus Blocker Lite
virus_blocker_clean Virus Blocker Clean boolean The cleanliness of the file according to Virus Blocker
virus_blocker_name Virus Blocker Name text The name of the malware according to Virus Blocker
spam_blocker_lite_score Spam Blocker Lite Score real The score of the email according to Spam Blocker Lite
spam_blocker_lite_is_spam Spam Blocker Lite Spam boolean The spam status of the email according to Spam Blocker Lite
spam_blocker_lite_tests_string Spam Blocker Lite Tests text The tess results for Spam Blocker Lite
spam_blocker_lite_action Spam Blocker Lite Action character(1) The action taken by Spam Blocker Lite
spam_blocker_score Spam Blocker Score real The score of the email according to Spam Blocker
spam_blocker_is_spam Spam Blocker Spam boolean The spam status of the email according to Spam Blocker
spam_blocker_tests_string Spam Blocker Tests text The tess results for Spam Blocker
spam_blocker_action Spam Blocker Action character(1) The action taken by Spam Blocker
phish_blocker_score Phish Blocker Score real The score of the email according to Phish Blocker
phish_blocker_is_spam Phish Blocker Phish boolean The phish status of the email according to Phish Blocker
phish_blocker_tests_string Phish Blocker Tests text The tess results for Phish Blocker
phish_blocker_action Phish Blocker Action character(1) The action taken by Phish Blocker

<section end='mail_msgs' />


mail_addrs

<section begin='mail_addrs' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
session_id Session ID bigint The session
client_intf Client Interface smallint The client interface
server_intf Server Interface smallint The server interface
c_client_addr Client-side Client Address inet The client-side client IP address
s_client_addr Server-side Client Address inet The server-side client IP address
c_server_addr Client-side Server Address inet The client-side server IP address
s_server_addr Server-side Server Address inet The server-side server IP address
c_client_port Client-side Client Port integer The client-side client port
s_client_port Server-side Client Port integer The server-side client port
c_server_port Client-side Server Port integer The client-side server port
s_server_port Server-side Server Port integer The server-side server port
policy_id Policy ID bigint The policy
username Username text The username associated with this session
msg_id Message ID bigint The message ID
subject Subject text The email subject
addr Address text The address of this event
addr_name Address Name text The name for this address
addr_kind Address Kind character(1) The type for this address (F=From, T=To, C=CC, G=Envelope From, B=Envelope To, X=Unknown)
hostname Hostname text The hostname of the local address
event_id Event ID bigint The unique event ID
sender Sender text The address of the sender
virus_blocker_lite_clean Virus Blocker Lite Clean boolean The cleanliness of the file according to Virus Blocker Lite
virus_blocker_lite_name Virus Blocker Lite Name text The name of the malware according to Virus Blocker Lite
virus_blocker_clean Virus Blocker Clean boolean The cleanliness of the file according to Virus Blocker
virus_blocker_name Virus Blocker Name text The name of the malware according to Virus Blocker
spam_blocker_lite_score Spam Blocker Lite Score real The score of the email according to Spam Blocker Lite
spam_blocker_lite_is_spam Spam Blocker Lite Spam boolean The spam status of the email according to Spam Blocker Lite
spam_blocker_lite_action Spam Blocker Lite Action character(1) The action taken by Spam Blocker Lite
spam_blocker_lite_tests_string Spam Blocker Lite Tests text The tess results for Spam Blocker Lite
spam_blocker_score Spam Blocker Score real The score of the email according to Spam Blocker
spam_blocker_is_spam Spam Blocker Spam boolean The spam status of the email according to Spam Blocker
spam_blocker_action Spam Blocker Action character(1) The action taken by Spam Blocker
spam_blocker_tests_string Spam Blocker Tests text The tess results for Spam Blocker
phish_blocker_score Phish Blocker Score real The score of the email according to Phish Blocker
phish_blocker_is_spam Phish Blocker Phish boolean The phish status of the email according to Phish Blocker
phish_blocker_tests_string Phish Blocker Tests text The tess results for Phish Blocker
phish_blocker_action Phish Blocker Action character(1) The action taken by Phish Blocker

<section end='mail_addrs' />


smtp_tarpit_events

<section begin='smtp_tarpit_events' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
ipaddr Client Address inet The client IP address
hostname Hostname text The hostname of the local address
policy_id Policy ID bigint The policy
vendor_name Vendor Name character varying(255) The "vendor name" of the app that logged the event
event_id Event ID bigint The unique event ID

<section end='smtp_tarpit_events' />


http_events

<section begin='http_events' />

Column Name Human Name Type Description
request_id Request ID bigint The HTTP request ID
time_stamp Timestamp timestamp without time zone The time of the event
session_id Session ID bigint The session
client_intf Client Interface smallint The client interface
server_intf Server Interface smallint The server interface
c_client_addr Client-side Client Address inet The client-side client IP address
s_client_addr Server-side Client Address inet The server-side client IP address
c_server_addr Client-side Server Address inet The client-side server IP address
s_server_addr Server-side Server Address inet The server-side server IP address
c_client_port Client-side Client Port integer The client-side client port
s_client_port Server-side Client Port integer The server-side client port
c_server_port Client-side Server Port integer The client-side server port
s_server_port Server-side Server Port integer The server-side server port
policy_id Policy ID smallint The policy
username Username text The username associated with this session
hostname Hostname text The hostname of the local address
method Method character(1) The HTTP method
uri URI text The HTTP URI
host Host text The HTTP host
domain Domain text The HTTP domain (shortened host)
referer Referer text The Referer URL
c2s_content_length Client-to-server Content Length bigint The client-to-server content length
s2c_content_length Server-to-client Content Length bigint The server-to-client content length
s2c_content_type Server-to-client Content Type text The server-to-client content type
ad_blocker_cookie_ident Ad Blocker Cookie text This name of cookie blocked by Ad Blocker
ad_blocker_action Ad Blocker Action character(1) This action of Ad Blocker on this request
web_filter_reason Web Filter Reason character(1) This reason Web Filter blocked/flagged this request
web_filter_category Web Filter Category text This category according to Web Filter
web_filter_blocked Web Filter Blocked boolean If Web Filter blocked this request
web_filter_flagged Web Filter Flagged boolean If Web Filter flagged this request
virus_blocker_lite_clean Virus Blocker Lite Clean boolean The cleanliness of the file according to Virus Blocker Lite
virus_blocker_lite_name Virus Blocker Lite Name text The name of the malware according to Virus Blocker Lite
virus_blocker_clean Virus Blocker Clean boolean The cleanliness of the file according to Virus Blocker
virus_blocker_name Virus Blocker Name text The name of the malware according to Virus Blocker

<section end='http_events' />


ftp_events

<section begin='ftp_events' />

Column Name Human Name Type Description
event_id Event ID bigint The unique event ID
time_stamp Timestamp timestamp without time zone The time of the event
session_id Session ID bigint The session
client_intf Client Interface smallint The client interface
server_intf Server Interface smallint The server interface
c_client_addr Client-side Client Address inet The client-side client IP address
s_client_addr Server-side Client Address inet The server-side client IP address
c_server_addr Client-side Server Address inet The client-side server IP address
s_server_addr Server-side Server Address inet The server-side server IP address
policy_id Policy ID bigint The policy
username Username text The username associated with this session
hostname Hostname text The hostname of the local address
request_id Request ID bigint The FTP request ID
method Method character(1) The FTP method
uri URI text The FTP URI
virus_blocker_lite_clean Virus Blocker Lite Clean boolean The cleanliness of the file according to Virus Blocker Lite
virus_blocker_lite_name Virus Blocker Lite Name text The name of the malware according to Virus Blocker Lite
virus_blocker_clean Virus Blocker Clean boolean The cleanliness of the file according to Virus Blocker
virus_blocker_name Virus Blocker Name text The name of the malware according to Virus Blocker

<section end='ftp_events' />


ipsec_user_events

<section begin='ipsec_user_events' />

Column Name Human Name Type Description
event_id Event ID bigint The unique event ID
time_stamp Timestamp timestamp without time zone The time of the event
connect_stamp Connect Time timestamp without time zone The time the connection started
goodbye_stamp End Time timestamp without time zone The time the connection ended
client_address Client Address text The remote IP address of the client
client_protocol Client Protocol text The protocol the client used to connect
client_username Client Username text The username of the client
net_process Net Process text The PID of the PPP process for L2TP connections or the connection ID for Xauth connections
net_interface Net Interface text The PPP interface for L2TP connections or the client interface for Xauth connections
elapsed_time Elapsed Time text The total time the client was connected
rx_bytes Bytes Received bigint The number of bytes received from the client in this connection
tx_bytes Bytes Sent bigint The number of bytes sent to the client in this connection

<section end='ipsec_user_events' />


ipsec_tunnel_stats

<section begin='ipsec_tunnel_stats' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
tunnel_name Tunnel Name text The name of the IPsec tunnel
in_bytes In Bytes bigint The number of bytes received during this time frame
out_bytes Out Bytes bigint The number of bytes transmitted during this time frame
event_id Event ID bigint The unique event ID

<section end='ipsec_tunnel_stats' />


interface_stat_events

<section begin='interface_stat_events' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
interface_id Interface ID integer The interface ID
rx_rate Rx Rate double precision The RX rate (bytes/s)
tx_rate Tx Rate double precision The TX rate (bytes/s)

<section end='interface_stat_events' />


configuration_backup_events

<section begin='configuration_backup_events' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
success Success boolean The result of the backup (true if the backup succeeded, false otherwise)
description Text detail of the event text Text detail of the event
destination Destination text The location of the backup
event_id Event ID bigint The unique event ID

<section end='configuration_backup_events' />


directory_connector_login_events

<section begin='directory_connector_login_events' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
login_name Login Name text The login name
domain Domain text The AD domain
type Type text The type of event (I=Login,U=Update,O=Logout)
client_addr Client Address inet The client IP address

<section end='directory_connector_login_events' />


server_events

<section begin='server_events' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
load_1 CPU load (1-min) numeric(6,2) The 1-minute CPU load
load_5 CPU load (5-min) numeric(6,2) The 5-minute CPU load
load_15 CPU load (15-min) numeric(6,2) The 15-minute CPU load
cpu_user CPU User Utilization numeric(6,3) The user CPU percent utilization
cpu_system CPU System Utilization numeric(6,3) The system CPU percent utilization
mem_total Total Memory bigint The total bytes of memory
mem_free Memory Free bigint The number of free bytes of memory
disk_total Disk Size bigint The total disk size in bytes
disk_free Disk Free bigint The free disk space in bytes
swap_total Swap Size bigint The total swap size in bytes
swap_free Swap Free bigint The free disk swap in bytes
active_hosts Active Hosts integer The number of active hosts

<section end='server_events' />


web_cache_stats

<section begin='web_cache_stats' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
hits Hits bigint The number of cache hits during this time frame
misses Misses bigint The number of cache misses during this time frame
bypasses Bypasses bigint The number of cache user bypasses during this time frame
systems System bypasses bigint The number of cache system bypasses during this time frame
hit_bytes Hit Bytes bigint The number of bytes saved from cache hits
miss_bytes Miss Bytes bigint The number of bytes not saved from cache misses
event_id Event ID bigint The unique event ID

<section end='web_cache_stats' />


http_query_events

<section begin='http_query_events' />

Column Name Human Name Type Description
event_id Event ID bigint The unique event ID
time_stamp Timestamp timestamp without time zone The time of the event
session_id Session ID bigint The session
client_intf Client Interface smallint The client interface
server_intf Server Interface smallint The server interface
c_client_addr Client-side Client Address inet The client-side client IP address
s_client_addr Server-side Client Address inet The server-side client IP address
c_server_addr Client-side Server Address inet The client-side server IP address
s_server_addr Server-side Server Address inet The server-side server IP address
c_client_port Client-side Client Port integer The client-side client port
s_client_port Server-side Client Port integer The server-side client port
c_server_port Client-side Server Port integer The client-side server port
s_server_port Server-side Server Port integer The server-side server port
policy_id Policy ID bigint The policy
username Username text The username associated with this session
hostname Hostname text The hostname of the local address
request_id Request ID bigint The HTTP request ID
method Method character(1) The HTTP method
uri URI text The HTTP URI
term Search Term text The search term
host Host text The HTTP host
c2s_content_length Client-to-server Content Length bigint The client-to-server content length
s2c_content_length Server-to-client Content Length bigint The server-to-client content length
s2c_content_type Server-to-client Content Type text The server-to-client content type

<section end='http_query_events' />


captive_portal_user_events

<section begin='captive_portal_user_events' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
policy_id Policy ID bigint The policy
event_id Event ID bigint The unique event ID
login_name Login Name text The login username
event_info Event Type text The type of event (LOGIN, FAILED, TIMEOUT, INACTIVE, USER_LOGOUT, ADMIN_LOGOUT)
auth_type Authorization Type text The authorization type for this event
client_addr Client Address text The remote IP address of the client

<section end='captive_portal_user_events' />


openvpn_stats

<section begin='openvpn_stats' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
start_time Start Time timestamp without time zone The time the OpenVPN session started
end_time End Time timestamp without time zone The time the OpenVPN session ended
rx_bytes Bytes Received bigint The total bytes received from the client during this session
tx_bytes Bytes Sent bigint The total bytes sent to the client during this session
remote_address Remote Address inet The remote IP address of the client
pool_address Pool Address inet The pool IP address of the client
remote_port Remote Port integer The remote port of the client
client_name Client Name text The name of the client
event_id Event ID bigint The unique event ID

<section end='openvpn_stats' />


openvpn_events

<section begin='openvpn_events' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
remote_address Remote Address inet The remote IP address of the client
pool_address Pool Address inet The pool IP address of the client
client_name Client Name text The name of the client
type Type text The type of the event (CONNECT,DISCONNECT)

<section end='openvpn_events' />


intrusion_prevention_events

<section begin='intrusion_prevention_events' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
sig_id Signature ID bigint This ID of the rule
gen_id Grouping ID bigint The grouping ID for the rule, The gen_id + sig_id specify the rule's unique identifier
class_id Classtype ID bigint The numeric ID for the classtype
source_addr Source Address inet The source IP address of the packet
source_port Source Port integer The source port of the packet (if applicable)
dest_addr Destination Address inet The destination IP address of the packet
dest_port Destination Port integer The destination port of the packet (if applicable)
protocol Protocol integer The protocol of the packet
blocked Blocked boolean If the packet was blocked/dropped
category Category text The application specific grouping
classtype Classtype text The generalized threat rule grouping (unrelated to gen_id)
msg Message text The "title" or "description" of the rule

<section end='intrusion_prevention_events' />


syslog

<section begin='syslog' />

Column Name Human Name Type Description
time_stamp Timestamp timestamp without time zone The time of the event
description Text detail of the event text The description from the alert rule.
summary_text Summary Text text The summary text of the alert
json JSON Text text The summary JSON representation of the event causing the alert

<section end='syslog' />


user_table_updates

<section begin='user_table_updates' />

Column Name Human Name Type Description
username Username text The username
key Key text The key being updated
value Value text The new value for the key
old_value Old Value text The old value for the key
time_stamp Timestamp timestamp without time zone The time of the event

<section end='user_table_updates' />