Cisco ASA-Firewalllogs erfassen
Unterstützt in:
Google SecOps
SIEM
In diesem Dokument wird beschrieben, wie Sie Cisco ASA-Firewalllogs durch Konfigurieren der Cisco Adaptive Security Appliance erfassen können ASA-Firewall und einen Google Security Operations-Forwarder. Dieses Außerdem werden die unterstützten Protokolltypen und unterstützten Cisco ASA-Versionen aufgeführt.
Weitere Informationen finden Sie unter Datenaufnahme in Google Security Operations.
Übersicht
Das folgende Diagramm der Bereitstellungsarchitektur zeigt, wie Cisco ASA-Firewallgeräte so konfiguriert werden, dass Protokolle an Google Security Operations gesendet werden. Jeder Kunde Bereitstellung sich von dieser Darstellung unterscheiden und komplexer sein.
Das Architekturdiagramm zeigt die folgenden Komponenten:
Cisco ASA-Geräte Cisco ASDM zum Konfigurieren des Remote-Loggings auf allen Cisco ASA-Geräten installiert ist. Die Cisco ASA-Geräte sind über ein VPN mit einem zentralen Cisco ASA-Gerät verbunden.
Central Cisco ASA-Gerät Um Protokolle von jedem Cisco ASA-Gerät zu erfassen, verwendet Syslog im zentralen Cisco ASA-Gerät konfiguriert. Das zentrale Cisco ASA-Gerät leitet die die erfassten Protokolle an einen Google Security Operations-Forwarder weiterleiten.
Google Security Operations-Weiterleitung Der Google Security Operations-Forwarder Softwarekomponente, die im Kundennetzwerk bereitgestellt wird und Syslog unterstützt. Der Google Security Operations-Weiterleiter leitet die Protokolle an Google Security Operations weiter.
Google Security Operations Google Security Operations speichert und analysiert die Protokolle, die von den Cisco ASA-Geräten generiert werden.
Mit einem Datenaufnahmelabel wird der Parser identifiziert, der Roh-Logdaten in das strukturierte UDM-Format normalisiert. Die Informationen in diesem Dokument gelten für den Parser
mit dem Aufnahmelabel CISCO_ASA_FIREWALL.
Hinweise
Verwenden Sie eine Cisco ASA-Softwareversion, die vom Google Security Operations-Parser unterstützt wird. Der Google Security Operations-Parser unterstützt die Cisco ASA-Softwareversion 9.16(1).
Prüfen Sie die Cisco ASA-Nachrichten-IDs, die vom Google Security Operations-Parser unterstützt werden. Informationen zur Liste der Nachrichten-IDs, die vom Google Security Operations-Parser unterstützt werden, finden Sie unter Cisco ASA-Nachrichten-IDs:
Achten Sie darauf, dass alle Systeme in der Bereitstellungsarchitektur konfiguriert sind in der Zeitzone UTC angegeben.
Bevor Sie den Cisco ASA-Firewall-Parser verwenden, prüfen Sie den Änderungen an Feldzuordnungen zwischen dem vorherigen und dem aktuellen ASA-Firewallparser von Cisco. Im Rahmen der Migration dass die Regeln, Suchanfragen, Dashboards oder anderen Prozesse, werden für die Originalfelder die aktualisierten Felder verwendet.
Im vorherigen Parser ist z. B. für die Nachrichten-ID
605005dertarget_servicewird dem UDM-Feldnetwork.application_protocolzugeordnet. Im aktuellen ASA-Firewall-Parser von Cisco Das Feldtarget_servicewird dem UDM-Feldtarget.applicationzugeordnet. Wenn Sie zum aktuellen Cisco ASA-Firewallparser migrieren und das Feldtarget_servicein Ihren Regeln verwenden, Sie müssen die Regeln so ändern, dass das UDM-Feldtarget.applicationdes aktuellen Parsers verwendet wird.
Cisco ASA und den Google Security Operations-Weiterleiter konfigurieren
So konfigurieren Sie Cisco ASA und den Google Security Operations-Forwarder:
Remote-Logging mit dem Cisco Adaptive Security Device Manager (ASDM) konfigurieren. Weitere Informationen finden Sie unter Konfigurieren Sie mithilfe von ASDM.
Wenn Sie die Remote-Protokollierung konfigurieren, um Protokolle nach Schweregrad zu filtern, müssen Sie die folgenden Schweregrade angeben:
- Schweregrad 1 – Warnmeldungen
- Schweregrad 2 – Kritische Meldungen
- Schweregrad 3 – Fehlermeldungen
- Schweregrad 4 – Warnmeldungen
- Schweregrad 5 – Benachrichtigungsnachrichten
- Schweregrad 6 – Meldungen zur Information
- Schweregrad 7 – Fehlerbehebungsmeldungen
Google Security Operations-Weiterleitung zum Senden von Logs konfigurieren Google Security Operations Weitere Informationen finden Sie unter Forwarder unter Linux installieren und konfigurieren. Das folgende Beispiel zeigt eine Google Security Operations-Forwarder-Konfiguration:
- syslog: common: enabled: true data_type: CISCO_ASA_FIREWALL batch_n_seconds: 10 batch_n_bytes: 1048576 tcp_address: 192.0.2.1:10514 connection_timeout_sec: 60
Feldzuordnungsreferenz
In diesem Abschnitt wird erläutert, wie der Parser Grok-Muster auf Ordnen Sie die IDs von Cisco ASA-Firewallnachrichten den Google Security Operations UDM-Feldern zu. Sie können Grok-Muster, um zusätzlich zu regulären Ausdrücken vordefinierte Muster zu erstellen um Lognachrichten abzugleichen und Werte aus der Lognachricht in Tokens zu extrahieren.
Zuordnungsbedingungen
In der folgenden Tabelle sind die Zuordnungsbedingungen aufgeführt, mit denen das UDM-Feld bestimmt wird. für einige der häufig verwendeten Felder und Beispiellogs:
| Common log fields | Mapping conditions | Examples |
|---|---|---|
| src_ip | if src_ip holds hostname then it is mapped to 'principal.hostname',
else "principal.ip" is set to "src_ip" |
{'Message':'2021-12-21T23:50:49-08:00 QAT : %ASA-6-302013: Built inbound TCP connection 3124260595 for trans-vrf:xyzhost/40297 (192.0.2.1/xxxxx) to qat-vrf:198.51.100.1/xxxxx (198.51.100.1/xxxxx)','tagCountry':'US'} |
| dst_ip | if dst_ip holds hostname then it is mapped to 'target.hostname',
else "target.ip" is set to "dst_ip" |
{'Message':'2021-12-21T23:50:49-08:00 QAT : %ASA-6-302014: Teardown TCP connection 3124210259 for trans-vrf:203.0.113.1/xxxx to qat-vrf:192.0.2.1/xxxxx duration 0:00:29 bytes 9190 TCP FINs','tagCountry':'US'}" |
| direction | if 'src_interface_name' != 'dst_interface_name' and
if [src_interface_name] == "OUTSIDE" or [dst_interface_name] in ["INSIDE", "DMZ"] then, "event.idm.read_only_udm.network.direction" is set to "INBOUND" else if [src_interface_name] in ["INSIDE", "DMZ"] or [dst_interface_name] == "OUTSIDE" then, "event.idm.read_only_udm.network.direction" is set to "OUTBOUND" else if [src_interface_name] =~ "INT" or [dst_interface_name] =~ "EXT" then, "event.idm. read_only_udm.network.direction" is set to "OUTBOUND" else if [src_interface_name] =~ "EXT" or [dst_interface_name] =~ "INT" then, "event.idm. read_only_udm.network.direction" is set to "INBOUND" if [cisco_message_number] == "302021" then, "event.idm.read_only_udm.network.direction" is set to "OUTBOUND" if [cisco_message_number] in ["106016", "106017", "106021", "402116"] then, "event.idm.read_only_udm.network.direction" is set to "INBOUND" |
{'Message':'2021-12-21T23:50:49-08:00 ecnp01094fe03 : %ASA-4-106023: Deny tcp src Outside:
192.0.2.1/xxxxx dst Inside:198.51.100.1/xxxxx by access-group "OutsideToInside" [0x0, 0x0]','tagCountry':'US'}"
Here, direction is INBOUND. |
| src_mapped_ip | if [src_mapped_ip] != [src_ip] then, merge "principal.ip" is set to "src_mapped_ip" | {'Message':'2021-12-21T23:50:49-08:00 QAT : %ASA-6-302013: Built inbound TCP connection 3124260595 for trans-vrf:xyzhost/40297 (192.0.2.1/xxxxx) to qat-vrf:198.51.100.1/xxxxx (198.51.100.1/xxxxx)','tagCountry':'US'} |
| dst_mapped_ip | if [dst_mapped_ip] != [dst_ip] then, merge "target.ip" is set to "dst_mapped_ip" | {'Message':'2021-12-21T23:50:49-08:00 QAT : %ASA-6-302013: Built inbound TCP connection 3124260595 for trans-vrf:xyzhost/40297 (203.0.113.1/xxxxx) to qat-vrf:198.51.100.1/xxxxx (198.51.100.1/xxxxx)','tagCountry':'US'}198.51.100.1 |
| category | if [category] == "Clustering" then "target.resource.resource_type" is set to "CLUSTER" | None |
| security_description | if [cisco_message_number] in ["212001","212002"] and
if error_code is 1, then "security_description" is set to "1 - ASA cannot open the SNMP transport for the interface." if [cisco_message_number] == "212003" and if error_code is 1, then "security_description" is set to "1 - ASA cannot find a supported transport type for the interface.", if error_code is 5, then "security_description" is set to "5 - ASA received no data from the UDP channel for the interface.", if error_code is 7, then "security_description" is set to "7 - ASA received an incoming request that exceeded the supported buffer size.", if error_code is 14, then "security_description" is set to "14 - ASA cannot determine the source IP address from the UDP channel.", if error_code is 22, then "security_description" is set to "22 - ASA received an invalid parameter." if [cisco_message_number] == "212004" and if error_code is 1, then "security_description" is set to "1 - ASA cannot find a supported transport type for the interface.", if error_code is 2, then "security_description" is set to "2 - ASA sent an invalid parameter.", if error_code is 3, then "security_description" is set to "3 - ASA was unable to set the destination IP address in the UDP channel.", if error_code is 4, then "security_description" is set to "4 - ASA sent a PDU length that exceeded the supported UDP segment size.", if error_code is 5, then "security_description" is set to "5 - ASA was unable to allocate a system block to construct the PDU." |
None |
| src_fwuser | if [src_username] == "" and [src_fwuser] != "", then mapped "src_fwuser" with "principal.user.userid" | <174>Dec 21 2021 23:52:18: %ASA-6-602303: IPSEC: An outbound LAN-to-LAN SA (SPI= 0x20211643) between 198.51.100.1 and 192.0.2.1(user= 192.0.2.1) has been created. |
| dst_fwuser | if [user_name] == "" and [dst_fwuser] != "", then mapped "dst_fwuser" with "target.user.userid" | <166>Dec 22 01:56:14 enal-fw1 : %ASA-6-315011: SSH session from 192.0.2.1 on interface inside for user "*****" disconnected by SSH server, reason: "Internal error"(0x00) |
| src_port | "src_port" is set to "principal.port" | {'Message':'2021-12-21T23:50:49-08:00 QAT : %ASA-6-302013: Built inbound TCP connection 3124260595 for trans-vrf:xyzhost/40297 (192.0.2.1/xxxxx) to qat-vrf:198.51.100.1/xxxxx (198.51.100.1/xxxxx)','tagCountry':'US'} |
| action | if [action] =~ "(built|permitted|succeeded|accept|successful|created|received|passed|
est-allowed|up|granted)" then "security_result.action" is set to "ALLOW"
else if [action] =~ "(deny|denied|denied by acl|shunned|dropped|rejected|no matching connection |invalid|terminated|terminating|deleted|discarded|rejecting|deleting|rejected|reset|dropping| teardown|down|restricted)" then "security_result.action" is set to "BLOCK" else if [action] =~ "(failure|failed)" then "security_result.action" is set to "FAIL" |
{'Message':'2021-12-21T23:50:49-08:00 QAT : %ASA-6-302013: Built inbound TCP connection 3124260595 for trans-vrf:xyzhost/40297 (192.0.2.1/xxxxx) to qat-vrf:198.51.100.1/xxxxx (198.51.100.1/xxxxx)','tagCountry':'US'} |
| target_platform | if [target_platform] =~ /(?i)win/, then "target.platform" is set to "WINDOWS"
else if [target_platform] =~ /(?i)linux/, then "target.platform" is set to "LINUX" else if [target_platform] =~ /(?i)mac/ or [target_platform] =~ /(?i)osx/, then "target.platform" is set to "MAC" |
None |
| protocol | For protocol enum value mapping we have used @include["parse_ip_protocol.include"] | {'Message':'2021-12-21T23:50:49-08:00 QAT : %ASA-6-302014: Teardown TCP connection 3124210259 for trans-vrf:192.0.2.1/xxxx to qat-vrf:198.51.100.1/xxxxx duration 0:00:29 bytes 9190 TCP FINs','tagCountry':'US'}" |
| application_protocol | For application_protocol enum value mapping we have used @include["parse_app_protocol.include"] | <162>%ASA-2-106007: Deny inbound UDP from 198.51.100.1/xxxxx to 192.0.2.1/xx due to DNS Query |
| dst_port | "dst_port" is set to "target.port" | {'Message':'2021-12-21T23:50:49-08:00 QAT : %ASA-6-302014: Teardown TCP connection 3124210259 for trans-vrf:192.0.2.1/xxxx to qat-vrf:198.51.100.1/xxxxx duration 0:00:29 bytes 9190 TCP FINs','tagCountry':'US'}" |
| cisco_severity | if [cisco_severity] == "1"
"security_result.severity" is set to "INFORMATIONAL" "security_result.severity_details" is set to "Immediate action needed" else if [cisco_severity] == "2" "security_result.severity" is set to "HIGH" "security_result.severity_details" is set to "Critical condition" else if [cisco_severity] == "3" { "security_result.severity" is set to "ERROR" "security_result.severity_details" is set to "Error condition" else if [cisco_severity] == "4" { "security_result.severity" is set to "INFORMATIONAL" "security_result.severity_details" is set to "Warning condition" else if [cisco_severity] == "5" { "security_result.severity" is set to "INFORMATIONAL" "security_result.severity_details" is set to "Normal but significant condition" else if [cisco_severity] == "6" { "security_result.severity" is set to "INFORMATIONAL" "security_result.severity_details" is set to "Informational message only" |
{'Message':'2021-12-21T23:50:49-08:00 QAT : %ASA-6-302014: Teardown TCP connection 3124210259 for trans-vrf:198.51.100.1/xxxx to qat-vrf:192.0.2.1/xxxxx duration 0:00:29 bytes 9190 TCP FINs','tagCountry':'US'}" |
| asa_device_ip | "asa_device_ip" is set to "observer.ip" | <163>198.50.100.0 %ASA-3-202010: PAT pool exhausted. Unable to create UDP connection from 198.50.100.2/63201 to 198.50.100.1/443 |
Referenz für die Feldzuordnung: Cisco ASA-Firewall-Ereignis-IDs zu UDM-Feldern
In der folgenden Tabelle sind die Nachrichten-IDs, grok-Muster und entsprechenden UDM-Felder aufgeführt:
| Message IDs | Grok pattern | UDM field |
|---|---|---|
| 103001 | ((Primary|Secondary|ASA)) No response from other firewall (reason code = {reason_code}) | reason_code is set to about.labels.key/value |
| 103002, 103003 | ((Primary|Secondary|ASA)) Other firewall network interface {interface_number} <message_text> | interface_number is set to about.labels.key/value |
| 103004 | ((Primary|Secondary|ASA)) Other firewall reports this firewall failed. Reason: {summary} | summary is set to security_result.summary |
| 103005 | ((Primary|Secondary|ASA)) Other firewall reporting failure. Reason: {summary} | summary is set to security_result.summary |
| 103006, 103007 | ((Primary|Secondary|ASA)) Mate version {target_version_num} is not <message_text> with ours {principal_version_num} | target_version_num is set to target.labels.key/value, principal_version_num is set to principal.labels.key/value |
| 104001, 104002, 104500, 104501 |
((Primary|Secondary|ASA)) Switching to {role} (cause: {summary}) ((Primary|Secondary|ASA)) Switching to {role} - {cause} |
role is set to about.labels.key/value, summary is set to security_result.summary |
| 105003, 105004 | (<message_text>) Monitoring on interface {interface_name} <message_text> | interface_name is set to about.labels.key/value |
| 105005 | (<message_text>) Lost Failover communications with mate on interface {interface_name} | interface_name is set to about.labels.key/value |
| 105006, 105007 | ((Primary|Secondary|ASA)) Link status <message_text> on interface {interface_name} | interface_name is set to about.labels.key/value |
| 105008 | (<message_text>) Testing interface {interface_name} | interface_name is set to about.labels.key/value |
| 105009 | (<message_text>) Testing on interface {interface_name} <message_text> | interface_name is set to about.labels.key/value |
| 105021 | ({failover_unit}) Standby unit failed to sync due to a locked {context_name} config. Lock held by {lock_owner_name} | failover_unit is set to about.labels.key/value, context_name is set to about.labels.key/value, lock_owner_name is set to about.labels.key/value |
| 105044 | ((Primary|Secondary|ASA)) Mate operational mode {target_mode} is not compatible with my mode {principal_mode} | target_mode is set to target.labels.key/value, principal_mode is set to principal.labels.key/value |
| 105045 | ((Primary|Secondary|ASA)) Mate license ({target_license}) is not compatible with my license ({principal_license}) | target_license is set to target.labels.key/value, principal_license is set to principal.labels.key/value |
| 105047 | Mate has a {target_io_card_name} card in slot {slot_number} which is different from my {principal_io_card_name} | target_io_card_name is set to target.labels.key/value, slot_number is set to about.labels.key/value, principal_io_card_name is set to principal.labels.key/value |
| 105048 | ({unit_name}) Mate's service module ({target_service}) is different from mine ({src_service}) | unit_name is set to about.labels.key/value, target_service is set to target.application, src_service is set to principal.application |
| 105502 | ((Primary|Secondary|ASA)) Restarting Cloud HA on this unit, reason: {summary} | summary is set to security_result.summary |
| 105503 | ((Primary|Secondary|ASA)) Internal state change from {previous_state} to {new_state} | previous_state is set to about.labels.key/value, new_state is set to about.labels.key/value |
| 105504 | ((Primary|Secondary|ASA)) Connected to peer {dst_ip}:{dst_port} | dst_ip is set to target.ip, dst_port is set to target.port |
| 105505 | ((Primary|Secondary|ASA)) Failed to connect to peer unit {dst_ip}:{dst_port} | dst_ip is set to target.ip, dst_port is set to target.port |
| 105506, 105507 | ((Primary|Secondary|ASA)) Unable to <message_text> socket on port {dst_port} for <message_text>, error: {error} | dst_port is set to target.port, error is set to about.labels.key/value |
| 105508 | ((Primary|Secondary|ASA)) Error creating failover connection socket on port {dst_port} | dst_port is set to target.port |
| 105509 | ((Primary|Secondary|ASA)) Error sending {message_name} message to peer unit {dst_ip}, error: {error} | message_name is set to about.labels.key/value, dst_ip is set to target.ip, error is set to about.labels.key/value |
| 105510 | ((Primary|Secondary|ASA)) Error receiving message from peer unit {dst_ip}, error: {error} | dst_ip is set to target.ip, error is set to about.labels.key/value |
| 105511 | ((Primary|Secondary|ASA)) Incomplete read of message header of message from peer unit {dst_ip}: bytes {received_bytes} read of expected {header_length} <message_text> | dst_ip is set to target.ip, received_bytes is set to network.received_bytes, header_length is set to about.labels.key/value |
| 105512 | ((Primary|Secondary|ASA)) Error receiving message body of message from peer unit {dst_ip}, error: {error} | dst_ip is set to target.ip, error is set to about.labels.key/value |
| 105513 | ((Primary|Secondary|ASA)) Incomplete read of message body of message from peer unit {dst_ip}: bytes {received_bytes} read of expected {message_length} <message_text> | dst_ip is set to target.ip, received_bytes is set to network.received_bytes, message_length is set to about.labels.key/value |
| 105514 | ((Primary|Secondary|ASA)) Error occurred when responding to {message_name} message received from peer unit {dst_ip}, error: {error} | message_name is set to about.labels.key/value, dst_ip is set to target.ip, error is set to about.labels.key/value |
| 105515 | ((Primary|Secondary|ASA)) Error receiving {message_name} message from peer unit {dst_ip}, error: {error} | message_name is set to about.labels.key/value, dst_ip is set to target.ip, error is set to about.labels.key/value |
| 105516 | ((Primary|Secondary|ASA)) Incomplete read of message header of {message_name} message from peer unit {dst_ip}: bytes {received_bytes} read of expected {header_length} <message_text> | message_name is set to about.labels.key/value, dst_ip is set to target.ip, received_bytes is set to network.received_bytes, header_length is set to about.labels.key/value |
| 105517 | ((Primary|Secondary|ASA)) Error receiving message body of {message_name} message from peer unit {dst_ip}, error: {error} | message_name is set to about.labels.key/value, dst_ip is set to target.ip, error is set to about.labels.key/value |
| 105518 | ((Primary|Secondary|ASA)) Incomplete read of message body of {message_name} message from peer unit {dst_ip}: bytes {received_bytes} read of expected {message_length} <message_text> | message_name is set to about.labels.key/value, dst_ip is set to target.ip, received_bytes is set to network.received_bytes, message_length is set to about.labels.key/value |
| 105519 | ((Primary|Secondary|ASA)) Invalid response to {message_name} message received from peer unit {dst_ip}: type {message_type}, version {message_version}, length {message_length} | message_name is set to about.labels.key/value, dst_ip is set to target.ip, message_type is set to about.labels.key/value, message_version is set to about.labels.key/value, message_length is set to about.labels.key/value |
| 105522 | ((Primary|Secondary|ASA)) Updating route {route_table_name} | route_table_name is set to about.labels.key/value |
| 105523 | ((Primary|Secondary|ASA)) Updated route {route_table_name} | route_table_name is set to about.labels.key/value |
| 105526 | ((Primary|Secondary|ASA)) Unexpected status in response to access token request: {status} | status is set to about.labels.key/value |
| 105531 | ((Primary|Secondary|ASA)) Failed to obtain route-table information needed for change request for route-table {route_table_name} | route_table_name is set to about.labels.key/value |
| 105532 | ((Primary|Secondary|ASA)) Unexpected status in response to route-table change request for route-table {route_table_name}: {status} | route_table_name is set to about.labels.key/value, status is set to about.labels.key/value |
| 105533 | ((Primary|Secondary|ASA)) Failure reading response to route-table change request for route-table {route_table_name} | route_table_name is set to about.labels.key/value |
| 105534 | ((Primary|Secondary|ASA)) No provisioning state in response to route-table change request route-table {route_table_name} | route_table_name is set to about.labels.key/value |
| 105535 | ((Primary|Secondary|ASA)) No response to route-table change request for route-table {route_table_name} from | route_table_name is set to about.labels.key/value |
| 105536 | ((Primary|Secondary|ASA)) Failed to obtain Azure authentication header for route status request for route {route_name} | route_name is set to about.labels.key/value |
| 105537 | ((Primary|Secondary|ASA)) Unexpected status in response to route state request for route {route_name}: {status} | route_name is set to about.labels.key/value, status is set to about.labels.key/value |
| 105538 | ((Primary|Secondary|ASA)) Failure reading response to route state request for route {route_name} | route_name is set to about.labels.key/value |
| 105539 | ((Primary|Secondary|ASA)) No response to route state request for route {route_name} from <message_text> | route_name is set to about.labels.key/value |
| 105541 | ((Primary|Secondary|ASA)) Failed to update route-table {route_table_name}, provisioning state: {state_string} | route_table_name is set to about.labels.key/value, state_string is set to about.labels.key/value |
| 105545 | ((Primary|Secondary|ASA)) Error starting load balancer probe socket on port {src_port}, error code: {internal_error_code} | src_port is set to principal.port, internal_error_code is set to about.labels.key/value |
| 106001 | (?P<direction>Inbound) (?P<protocol>TCP) connection {action} from {src_ip}(/{src_port})? to {dst_ip}/{dst_port} flags {flag} on interface {interface_name} | direction is set to network.direction, protocol is set to network.ip_protocol, action is set to security_result.action, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, flag is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 106002 | {protocol} Connection {action} by {direction} list {acl_id} src {src_ip} dest {dst_ip} | protocol is set to network.ip_protocol, action is set to security_result.action, direction is set to network.direction, acl_id is set to about.labels.key/value, src_ip is set to principal.ip, dst_ip is set to target.ip |
| 106006 | (?P<action>Deny) (?P<direction>inbound) (?P<protocol>UDP) from {src_ip}(/{src_port})? to {dst_ip}/{dst_port} on interface {interface_name} | action is set to security_result.action, direction is set to network.direction, protocol is set to network.ip_protocol, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, interface_name is set to about.labels.key/value |
| 106007 | (?P<action>Deny) (?P<direction>inbound) (?P<protocol>UDP) from {src_ip}(/{src_port})? to {dst_ip}/{dst_port} due to {application_protocol} (?P<tag>Query|Response) | action is set to security_result.action, direction is set to network.direction, protocol is set to network.ip_protocol, , src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, application_protocol is set to network.application_protocol |
| 106010 | (?P<action>Deny) (?P<direction>inbound) {protocol}<message_text>src {src_interface_name}:{src_ip}(/{src_port})? dst {dst_interface_name}:{dst_ip}(/{dst_port})? | action is set to security_result.action, direction is set to network.direction, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 106011 | (?P<action>Deny) (?P<direction>inbound) <message_text> protocol src {src_interface_name}:{src_ip}(/{src_port})? dst {dst_interface_name}:{dst_ip}(/{dst_port})? | action is set to security_result.action, direction is set to network.direction, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 106012 | (?P<action>Deny) IP from {src_ip} to {dst_ip}, IP options{ip_options} | action is set to security_result.action, src_ip is set to principal.ip, dst_ip is set to target.ip, ip_options is set to about.labels.key/value |
| 106013 | (?P<action>Dropping) echo request from {src_ip} to PAT address {dst_ip} | action is set to security_result.action, src_ip is set to principal.ip, dst_ip is set to target.ip |
| 106014 | (?P<action>Deny) (?P<direction>inbound) (?P<protocol>ICMP|icmp) src {src_interface_name}:{src_ip}<message_text>dst {dst_interface_name}:{dst_ip}<message_text>(type {icmp_type}, code {icmp_code}) | action is set to security_result.action, direction is set to network.direction, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, icmp_type is set to about.labels.key/value, icmp_code is set to about.labels.key/value |
| 106015 | (?P<action>Deny) (?P<protocol>TCP) <message_text> from {src_ip}(/{src_port})? to {dst_ip}/{dst_port} flags {tcp_flags} on interface {interface_name} | action is set to security_result.action, protocol is set to network.ip_protocol, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, tcp_flags is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 106016 | (?P<action>Deny) IP spoof from ({src_ip}) to {dst_ip} on interface {interface_name} | action is set to security_result.action, src_ip is set to principal.ip, dst_ip is set to target.ip, interface_name is set to about.labels.key/value
"security_result.category" is set to "NETWORK_SUSPICIOUS" "network.direction" is set to "INBOUND" |
| 106017 | (?P<action>Deny) IP due to Land Attack from {src_ip} to {dst_ip} | action is set to security_result.action, src_ip is set to principal.ip, dst_ip is set to target.ip
"security_result.category" is set to "NETWORK_SUSPICIOUS" "network.direction" is set to "INBOUND" |
| 106018 | (?P<protocol>ICMP|icmp) packet type {icmp_type} denied by outbound list {acl_id} src {src_ip} dest {dst_ip} | protocol is set to network.ip_protocol, icmp_type is set to about.labels.key/value, acl_id is set to about.labels.key/value, src_ip is set to principal.ip, dst_ip is set to target.ip |
| 106020 | (?P<action>Deny) IP teardrop fragment (size={received_bytes}, offset={offset}) from {src_ip} to {dst_ip} | action is set to security_result.action, received_bytes is set to network.received_bytes, offset is set to about.labels.key/value, src_ip is set to principal.ip, dst_ip is set to target.ip |
| 106021 | (?P<action>Deny) {protocol} reverse path check from {src_ip} to {dst_ip} on interface {interface_name} | action is set to security_result.action, protocol is set to network.ip_protocol, src_ip is set to principal.ip, dst_ip is set to target.ip, interface_name is set to about.labels.key/value
"security_result.category" is set to "NETWORK_SUSPICIOUS" "network.direction" is set to "INBOUND" |
| 106022 | (?P<action>Deny) {protocol} connection spoof from {src_ip} to {dst_ip} on interface {interface_name} | action is set to security_result.action, protocol is set to network.ip_protocol, src_ip is set to principal.ip, dst_ip is set to target.ip, interface_name is set to about.labels.key/value |
| 106023 | (?P<action>Deny) (protocol )?{protocol} src {src_interface_name}:{src_ip}(/{src_port})?<message_text>dst {dst_interface_name}:{dst_ip}((/|.){dst_port})?( (type {icmp_type}, code {icmp_code}))?<message_text>by access-group \?{policy_id}\"? {hashcode1}, {hashcode2}]" | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, icmp_type is set to about.labels.key/value, icmp_code is set to about.labels.key/value, policy_id is set to about.labels.key/value, hashcode1 is set to about.labels.key/value, hashcode2 is set to about.labels.key/value |
| 106025, 106026 | Failed to determine the security context for the packet:<message_text>:{src_ip} {dst_ip} {src_port} {dst_port} protocol | src_ip is set to principal.ip, dst_ip is set to target.ip, src_port is set to principal.port, dst_port is set to target.port |
| 106027 | {acl_id}: (?P<action>Deny) src {src_ip} dst {dst_ip} by access-group \{access_list_entry}\"" | action is set to security_result.action, acl_id is set to about.labels.key/value, src_ip is set to principal.ip, dst_ip is set to target.ip, access_list_entry is set to about.labels.key/value |
| 106027 | (?P<action>Deny)<message_text>src<message_text>:{src_ip} dst<message_text>:{dst_ip} by access-group \{access_list_entry}\"" | action is set to security_result.action, src_ip is set to principal.ip, dst_ip is set to target.ip, access_list_entry is set to about.labels.key/value |
| 106102 | access-list {acl_id} (?P<action>permitted|denied) {protocol} for user {user_name} {src_interface_name}/{src_ip}({src_port})<message_text> -> {dst_interface_name}/{dst_ip}({dst_port})<message_text>hit-cnt {hit_count} (?P<tag>first hit|<message_text>-second interval) {hashcode1}, {hashcode2}] | action is set to security_result.action, , acl_id is set to about.labels.key/value, protocol is set to network.ip_protocol, user_name is set to target.user.userid, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, hit_count is set to about.labels.key/value, hashcode1 is set to about.labels.key/value, hashcode2 is set to about.labels.key/value |
| 106102 | access-list {acl_id} (?P<action>permitted|denied) {protocol} for user {user_name} {src_interface_name}/{src_ip}({src_port})<message_text>{dst_interface_name}/{dst_ip}({dst_port})<message_text>hit-cnt {hit_count} (?P<tag>first hit|<message_text>-second interval) {hashcode1}, {hashcode2}] | action is set to security_result.action, , acl_id is set to about.labels.key/value, protocol is set to network.ip_protocol, user_name is set to target.user.userid, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, hit_count is set to about.labels.key/value, hashcode1 is set to about.labels.key/value, hashcode2 is set to about.labels.key/value |
| 106100 | access-list {acl_id} (?P<action>permitted|denied|est-allowed) {protocol} {src_interface_name}/{src_ip}({src_port})<message_text> -> {dst_interface_name}/{dst_ip}({dst_port})<message_text>hit-cnt {hit_count} (?P<tag>first hit|<message_text>-second interval) {hashcode1}, {hashcode2}] | action is set to security_result.action, , acl_id is set to about.labels.key/value, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, hit_count is set to about.labels.key/value, hashcode1 is set to about.labels.key/value, hashcode2 is set to about.labels.key/value |
| 106100 | access-list {acl_id} (?P<action>permitted|denied|est-allowed) {protocol} {src_interface_name}/{src_ip}({src_port})<message_text>{dst_interface_name}/{dst_ip}({dst_port})<message_text>hit-cnt {hit_count} (?P<tag>first hit|<message_text>-second interval) {hashcode1}, {hashcode2}] | action is set to security_result.action, , acl_id is set to about.labels.key/value, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, hit_count is set to about.labels.key/value, hashcode1 is set to about.labels.key/value, hashcode2 is set to about.labels.key/value |
| 106101 | Number of cached deny-flows for ACL log has reached limit ({limit}) | limit is set to about.labels.key/value |
| 106103 | access-list {acl_id} (?P<action>denied) {protocol} for user {user_name} {src_interface_name}/{src_ip}({src_port})<message_text> -> {dst_interface_name}/{dst_ip}({dst_port})<message_text>hit-cnt {hit_count} {hashcode1}, {hashcode2}] | action is set to security_result.action, acl_id is set to about.labels.key/value, protocol is set to network.ip_protocol, user_name is set to target.user.userid, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, hit_count is set to about.labels.key/value, hashcode1 is set to about.labels.key/value, hashcode2 is set to about.labels.key/value |
| 106103 | access-list {acl_id} (?P<action>denied) {protocol} for user {user_name} {src_interface_name}/{src_ip}({src_port})<message_text>{dst_interface_name}/{dst_ip}({dst_port})<message_text>hit-cnt {hit_count} {hashcode1}, {hashcode2}] | action is set to security_result.action, acl_id is set to about.labels.key/value, protocol is set to network.ip_protocol, user_name is set to target.user.userid, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, hit_count is set to about.labels.key/value, hashcode1 is set to about.labels.key/value, hashcode2 is set to about.labels.key/value |
| 107001 | (?P<application_protocol>RIP) auth failed from {dst_ip}: version={version_number}, type={type}, mode={mode}, sequence={sequence_number} on interface {interface_name} | application_protocol is set to network.application_protocol, dst_ip is set to target.ip, version_number is set to about.labels.key/value, type is set to about.labels.key/value, mode is set to about.labels.key/value, sequence_number is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 107002 | (?P<application_protocol>RIP) pkt failed from {dst_ip}: version={version_number} on interface {interface_name} | application_protocol is set to network.application_protocol, dst_ip is set to target.ip, version_number is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 108002 | (?P<application_protocol>SMTP) replaced string: out {src_ip} in {dst_ip} data: {summary} | application_protocol is set to network.application_protocol, src_ip is set to principal.ip, dst_ip is set to target.ip, summary is set to security_result.summary |
| 108003 | Terminating ESMTP/SMTP connection; malicious pattern detected in the mail address from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port}. Data:{summary} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, summary is set to security_result.summary |
| 108004 | {action_class}: {action} ESMTP <message_text> from {src_interface_name}:{src_ip} to {dst_interface_name}:{dst_ip};{summary} | action_class is set to about.labels.key/value, action is set to security_result.action, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, summary is set to security_result.summary |
| 108005 | {action_class}: Received ESMTP <message_text> from {src_interface_name}:{src_ip} to {dst_interface_name}:{dst_ip};{summary} | action_class is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, summary is set to security_result.summary |
| 108007 | TLS started on ESMTP session between client {src_interface_name}:{src_ip}(/{src_port})? and server {dst_interface_name}:{dst_ip}(/{dst_port})? | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 109001 | Auth start for user {user_name} from {src_ip}(/{src_port})? to {dst_ip}(/{dst_port})? | user_name is set to target.user.userid, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 109002 | Auth from {src_ip}(/{src_port})? to {dst_ip}/{dst_port} failed (server {src_ip} failed) on interface {interface_name} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, src_ip is set to principal.ip, interface_name is set to about.labels.key/value |
| 109003 | Auth from {src_ip} to {dst_ip}/{dst_port} failed (all servers failed) on interface {interface_name}, so marking all servers ACTIVE again | src_ip is set to principal.ip, dst_ip is set to target.ip, dst_port is set to target.port, interface_name is set to about.labels.key/value |
| 109005, 109006, 109007 | Authentication (?P<action>succeeded|failed|permitted|denied) for user {user_name} from {src_ip}(/{src_port})? to {dst_ip}/{dst_port} on interface {interface_name} | action is set to security_result.action, user_name is set to target.user.userid, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, interface_name is set to about.labels.key/value |
| 109007 | Authorization (?P<action>permitted) for user {user_name} from {src_ip}(/{src_port})? to {dst_ip}/{dst_port} on interface {interface_name} | action is set to security_result.action, user_name is set to target.user.userid, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, interface_name is set to about.labels.key/value |
| 109008 | Authorization (?P<action>denied) for user {user_name} from {src_ip}(/{src_port})? to {dst_ip}/{dst_port} on interface {interface_name} | action is set to security_result.action, user_name is set to target.user.userid, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, interface_name is set to about.labels.key/value |
| 109010 | Auth from {src_ip}(/{src_port})? to {dst_ip}/{dst_port} failed (too many pending auths) on interface {interface_name} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, interface_name is set to about.labels.key/value |
| 109011 | Authen Session Start: user {user_name}, sid {sid} | user_name is set to target.user.userid, sid is set to about.labels.key/value |
| 109012 | Authen Session End: user {user_name}, sid {sid}, elapsed {elapsed_number_seconds} seconds | user_name is set to target.user.userid, sid is set to about.labels.key/value, elapsed_number_seconds is set to about.labels.key/value |
| 109016 | Can't find authorization ACL {acl_id} for user {user_name} | acl_id is set to about.labels.key/value, user_name is set to target.user.userid |
| 109017 | User at {dst_ip} exceeded auth proxy connection limit | dst_ip is set to target.ip |
| 109018 | Downloaded ACL {acl_id} is empty | acl_id is set to about.labels.key/value |
| 109019 | Downloaded ACL {acl_id} has parsing error; ACE | acl_id is set to about.labels.key/value |
| 109023 | User from {src_ip}/{src_port} to {dst_ip}/{dst_port} on interface {interface_name} must authenticate before using this service | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, interface_name is set to about.labels.key/value |
| 109024 | Authorization (?P<action>denied) from {src_ip}/{src_port} to {dst_ip}/{dst_port} (not authenticated) on interface {interface_name} using {protocol} | action is set to security_result.action, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, interface_name is set to about.labels.key/value, protocol is set to network.ip_protocol |
| 109025 | Authorization (?P<action>denied) (acl={acl_id}) for user {user_name} from {src_ip}/{src_port} to {dst_ip}/{dst_port} on interface {interface_name} using {protocol} | action is set to security_result.action, acl_id is set to about.labels.key/value, user_name is set to target.user.userid, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, interface_name is set to about.labels.key/value, protocol is set to network.ip_protocol |
| 109027 | Unable to decipher response message Server = {dst_ip}, User = {user_name} | dst_ip is set to target.ip, user_name is set to target.user.userid |
| 109028 | aaa bypassed for same-security traffic from {ingress_interface}:{src_ip}/{src_port} to {egress_interface}:{dst_ip}/{dst_port} | ingress_interface is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, egress_interface is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 109029 | Parsing downloaded ACL: {error} | error is set to about.labels.key/value |
| 109030 | Autodetect ACL convert wildcard did not convert ACL {access_list} {src_ip}|{dst_ip} netmask {subnet_mask} | access_list is set to about.labels.key/value, src_ip is set to principal.ip, dst_ip is set to target.ip, subnet_mask is set to about.labels.key/value |
| 109031 | NT Domain Authentication Failed: rejecting guest login for {user_name} | user_name is set to target.user.userid |
| 109032 | Unable to install ACL {access_list}, downloaded for user {user_name}; Error in ACE: {access_list_entry} | access_list is set to about.labels.key/value, user_name is set to target.user.userid, access_list_entry is set to about.labels.key/value |
| 109033 | Authentication {action} for admin user {user_name} from {dst_ip}. Interactive challenge processing is not supported for {protocol} connections | action is set to security_result.action, user_name is set to target.user.userid, dst_ip is set to target.ip, protocol is set to network.ip_protocol |
| 109034 | Authentication {action} for network user {user_name} from {src_ip}/{src_port} to {dst_ip}/{dst_port}. Interactive challenge processing is not supported for {protocol} connections | action is set to security_result.action, user_name is set to target.user.userid, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, protocol is set to network.ip_protocol |
| 109035 | Exceeded maximum number ({max_num}) of DAP attribute instances for user {user_name} | max_num is set to about.labels.key/value, user_name is set to target.user.userid |
| 109036, 109037 | Exceeded <message_text> attribute values for the {attribute_name} attribute for user {user_name} | attribute_name is set to about.labels.key/value, user_name is set to target.user.userid |
| 109038 | Attribute {attribute_name} value {string_from_server} from AAA server could not be parsed as a {type} | attribute_name is set to about.labels.key/value, string_from_server is set to about.labels.key/value, type is set to about.labels.key/value |
| 109039 | AAA Authentication:Dropping an unsupported <message_text> packet from {ingress_interface}:{src_ip} to {egress_interface}:{dst_ip} | ingress_interface is set to about.labels.key/value, src_ip is set to principal.ip, egress_interface is set to about.labels.key/value, dst_ip is set to target.ip |
| 109040 | User at {src_ip} exceeded auth proxy rate limit of 10 connections/sec | src_ip is set to principal.ip |
| 109100 | Received CoA update from {dst_ip} for user {user_name}, with session ID(:)? {session_id}, changing authorization attributes | dst_ip is set to target.ip, user_name is set to target.user.userid, session_id is set to network.session_id |
| 109101 | Received CoA disconnect request from {dst_ip} for user {user_name}, with audit-session-id: {session_id} | dst_ip is set to target.ip, user_name is set to target.user.userid, session_id is set to network.session_id |
| 109102 | Received CoA {action_details} from {dst_ip}, but cannot find named session {session_id} | action_details is set to security_result.action_details, dst_ip is set to target.ip, session_id is set to network.session_id |
| 109103 | CoA {action_details} from {dst_ip} failed for user {user_name}, with session ID: {session_id} | action_details is set to security_result.action_details, dst_ip is set to target.ip, user_name is set to target.user.userid, session_id is set to network.session_id |
| 109104 | CoA {action_details} from {dst_ip} failed for user {user_name}, session ID: {session_id}. Action not supported | action_details is set to security_result.action_details, dst_ip is set to target.ip, user_name is set to target.user.userid, session_id is set to network.session_id |
| 109105 | Failed to determine the egress interface for locally generated traffic destined to <{protocol}><{dst_ip}>:<{dst_port}> | protocol is set to network.ip_protocol, dst_ip is set to target.ip, dst_port is set to target.port |
| 110002 | Failed to locate egress interface for( <message_text>-)?{protocol} from {src_interface_name}:{src_ip}/{src_port} to {dst_ip}/{dst_port} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 110003 | Routing failed to locate next hop for {protocol} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 110004 | Egress interface changed from {old_interface_name} to {new_interface_name} on {protocol} connection {session_id} for <message_text> :{dst_ip}/{dst_port} (<message_text>) to <message_text> :{src_ip}/{src_port} (<message_text>) | old_interface_name is set to about.labels.key/value, new_interface_name is set to about.labels.key/value, protocol is set to network.ip_protocol, session_id is set to network.session_id, dst_ip is set to target.ip, dst_port is set to target.port, src_ip is set to principal.ip, src_port is set to principal.port |
| 111001 | Begin configuration: {dst_ip} writing to <message_text> | dst_ip is set to target.ip |
| 111002, 111007 | Begin configuration: {dst_ip} reading from <message_text> | dst_ip is set to target.ip |
| 111003 | {dst_ip} Erase configuration | dst_ip is set to target.ip |
| 111004, 111005 | {dst_ip} end configuration: | dst_ip is set to target.ip |
| 111008 | User {user_name} executed the {command} command | user_name is set to target.user.userid, command is set to target.process.command_line |
| 111010 | User {user_name}, running {target_service} from IP {src_ip}, executed {command} | user_name is set to target.user.userid, target_service is set to target.application, src_ip is set to principal.ip, command is set to target.process.command_line
"target.resource.resource_type" is set to "SETTING" |
| 113003 | AAA group policy for user {user_name} is being set to {policy_name} | user_name is set to target.user.userid, policy_name is set to target.resource.name |
| 113004 | AAA user <message_text> {action} : server ={dst_ip}<message_text>user = {user_name} | action is set to security_result.action, dst_ip is set to target.ip, user_name is set to target.user.userid |
| 113005 | AAA user (authorization|authentication) {action} : reason = {summary} : server = {src_ip}: user = {user_name}(: user IP = {dst_ip})? | action is set to security_result.action, summary is set to security_result.summary, src_ip is set to principal.ip, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 113006 | User {user_name} locked out on exceeding {failed_attempts} successive failed authentication attempts | user_name is set to target.user.userid, failed_attempts is set to about.labels.key/value |
| 113007 | User {user_name} unlocked by {administrator} | user_name is set to target.user.userid, administrator is set to about.labels.key/value |
| 113008 | AAA transaction status ACCEPT: user = {user_name} | user_name is set to target.user.userid
"auth_type" is set to "VPN" |
| 113009 | AAA retrieved default group policy {group_policy} for user {user_name} | group_policy is set to about.labels.key/value, user_name is set to target.user.userid |
| 113010 | AAA challenge received for user {user_name} from server {src_ip} | user_name is set to target.user.userid, src_ip is set to principal.ip |
| 113011 | AAA retrieved user specific group policy {group_policy} for user {user_name} | group_policy is set to about.labels.key/value, user_name is set to target.user.userid |
| 113012 | AAA user authentication Successful: local database: user = {user_name} | user_name is set to target.user.userid |
| 113013 | AAA unable to complete the request Error: reason = {summary}: user = {user_name} | summary is set to security_result.summary, user_name is set to target.user.userid |
| 113014 | AAA (authorization|authentication) server not accessible: server ={src_ip}: user = {user_name} | src_ip is set to principal.ip, user_name is set to target.user.userid |
| 113015 | AAA user authentication Rejected: reason = {summary}: local database: user = {user_name}(: user IP = {dst_ip})? | summary is set to security_result.summary, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 113016 | AAA credentials rejected: reason = {summary}: server = {src_ip}: user = {user_name}(: user IP = {dst_ip})? | summary is set to security_result.summary, src_ip is set to principal.ip, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 113017 | AAA credentials rejected: reason = {summary}: local database: user = {user_name}(: user IP = {dst_ip})? | summary is set to security_result.summary, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 113018 | User: {user_name}, Unsupported downloaded ACL Entry: {acl_entry} , Action: {action} | user_name is set to target.user.userid, acl_entry is set to about.labels.key/value, action is set to security_result.action |
| 113019 | Group = {group_name}, Username = {user_name}, IP = {dst_ip}, Session disconnected. Session Type: {session_type}, Duration: {duration}, Bytes xmt: {sent_bytes}, Bytes rcv: {received_bytes}, Reason: {summary} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, session_type is set to about.labels.key/value, duration is set to network.session_duration, sent_bytes is set to network.sent_bytes, received_bytes is set to network.received_bytes, summary is set to security_result.summary |
| 113020 | Kerberos error: Clock skew with server {src_ip} greater than 300 seconds | src_ip is set to principal.ip |
| 113021 | Attempted console login failed(.)? (user|User) {user_name} did NOT have appropriate Admin Rights | user_name is set to target.user.userid |
| 113022 | AAA Marking {protocol}(.)? server {dst_ip} in aaa-server group {group_name} as FAILED | protocol is set to network.ip_protocol, dst_ip is set to target.ip, group_name is set to target.user.group_identifiers |
| 113023 | AAA Marking {protocol}(.)? server {dst_ip} in (aaa-|)server group {group_name} as ACTIVE | protocol is set to network.ip_protocol, dst_ip is set to target.ip, group_name is set to target.user.group_identifiers |
| 113024 | Group {group_name}: Authenticating {connection} connection from {dst_ip} with username, {user_name}, from client certificate | group_name is set to target.user.group_identifiers, connection is set to about.labels.key/value, dst_ip is set to target.ip, user_name is set to target.user.userid |
| 113025 | Group {group_name}: {dn_fields} Could not authenticate {connection} connection from {dst_ip} | group_name is set to target.user.group_identifiers, dn_fields is set to about.labels.key/value, connection is set to about.labels.key/value, dst_ip is set to target.ip |
| 113026 | Error {summary} while executing Lua script for group {group_name} | summary is set to security_result.summary, group_name is set to target.user.group_identifiers |
| 113029 | Group {group_name} User {user_name} IP {dst_ip} Session could not be established: session limit of {limit} reached | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, limit is set to about.labels.key/value |
| 113030 | Group {group_name} User {user_name} IP {dst_ip} User ACL {acl_id} from AAA doesn't exist on the device, (?P<action>terminating) connection | action is set to security_result.action, group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, acl_id is set to about.labels.key/value |
| 113031 | Group {group_name} User {user_name} IP {dst_ip} AnyConnect vpn-filter {vpn_filter} is an IPv6 ACL; ACL not applied | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, vpn_filter is set to about.labels.key/value |
| 113032 | Group {group_name} User {user_name} IP {dst_ip} AnyConnect ipv6-vpn-filter {vpn_filter} is an IPv4 ACL; ACL not applied | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, vpn_filter is set to about.labels.key/value |
| 113033 | Group {group_name} User {user_name} IP {dst_ip} AnyConnect session not allowed. ACL parse error | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 113034 | Group {group_name} User {user_name} IP {dst_ip} User ACL {acl_id} from AAA ignored, AV-PAIR ACL used instead | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, acl_id is set to about.labels.key/value |
| 113035 | Group {group_name} User {user_name} IP {dst_ip} Session terminated: AnyConnect not enabled or invalid AnyConnect image on the ASA | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 113036 | Group {group_name} User {user_name} IP {dst_ip} AAA parameter {parameter_name} value invalid | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, parameter_name is set to about.labels.key/value |
| 113038 | Group {group_name} User {user_name} IP {dst_ip} Unable to create AnyConnect parent session | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 113039 | Group {group_name} User {user_name} IP {dst_ip} AnyConnect parent session started | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 113040 | Terminating the VPN connection attempt from {attempted_group}. Reason: This connection is group locked to {locked_group} | attempted_group is set to about.labels.key/value, locked_group is set to about.labels.key/value |
| 113041 | Redirect ACL configured for {dst_ip} does not exist on the device | dst_ip is set to target.ip |
| 113042 | Non-HTTP connection from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port}( for user username at {dst_ip1})? (?P<summary>(?P<action>denied) by redirect filter; only HTTP connections are supported for redirection) | summary is set to security_result.summary, action is set to security_result.action, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_ip1 is set to target.ip |
| 113045 | AAA SDI server {src_ip} in aaa-server group {group_name}: status changed from {previous_state} to {current_state} | src_ip is set to principal.ip, group_name is set to target.user.group_identifiers, previous_state is set to about.labels.key/value, current_state is set to about.labels.key/value |
| 114001 | Failed to initialize 4GE SSM I/O card (error {summary}) | summary is set to security_result.summary |
| 114002 | Failed to initialize SFP in 4GE SSM I/O card (error {summary}) | summary is set to security_result.summary |
| 114003 | Failed to run cached commands in 4GE SSM I/O card (error {summary}) | summary is set to security_result.summary |
| 114006, 114007, 114009, 114010, 114011, 114012, 114013, 114014, 114015, 114016, 114017, 114018, 114019 | Failed to (?P<tag>set mac address table|get port statistics|get current msr|set multicast address|set multicast hardware address|delete multicast address|delete multicast hardware address|set mac address|set mode|set multicast mode|get link status|set port speed|set media type) in 4GE SSM I/O card (error {error}) | , error is set to about.labels.key/value |
| 114021, 114022, 114023 | Failed to (?P<tag>set multicast address table|pass broadcast traffic|cache/flush mac table) in 4GE SSM I/O card due to {error} | , error is set to about.labels.key/value |
| 115000 | Critical assertion in process: {target_process_name} fiber: {fiber_name} , component: {component_name} , subcomponent: {subcomponent_name} , file: {target_file_full_path} , line: {line_number} , cond: {condition} | target_process_name is set to target.process.pid, fiber_name is set to about.labels.key/value, component_name is set to about.labels.key/value, subcomponent_name is set to about.labels.key/value, target_file_full_path is set to target.file.full_path, line_number is set to about.labels.key/value, condition is set to about.labels.key/value |
| 115001 | Error in process: {target_process_name} fiber: {fiber_name} , component: {component_name} , subcomponent: {subcomponent_name} , file: {target_file_full_path} , line: {line_number} , cond: {condition} | target_process_name is set to target.process.pid, fiber_name is set to about.labels.key/value, component_name is set to about.labels.key/value, subcomponent_name is set to about.labels.key/value, target_file_full_path is set to target.file.full_path, line_number is set to about.labels.key/value, condition is set to about.labels.key/value |
| 115002 | Warning in process: {target_process_name} fiber: {fiber_name} , component: {component_name} , subcomponent: {subcomponent_name} , file: {target_file_full_path} , line: {line_number} , cond: {condition} | target_process_name is set to target.process.pid, fiber_name is set to about.labels.key/value, component_name is set to about.labels.key/value, subcomponent_name is set to about.labels.key/value, target_file_full_path is set to target.file.full_path, line_number is set to about.labels.key/value, condition is set to about.labels.key/value |
| 120003 | Process event {event_group} {event_title} | event_group is set to about.labels.key/value, event_title is set to about.labels.key/value |
| 120003 | {event_group} is processing <message_text> event {event_title} | event_group is set to about.labels.key/value, event_title is set to about.labels.key/value |
| 120004 | Event {event_group} {event_title} is dropped. Reason {summary} | event_group is set to about.labels.key/value, event_title is set to about.labels.key/value, summary is set to security_result.summary |
| 120005 | Message {event_group} to (?P<destination_email>) is dropped. Reason {summary} | destination_email is set to security_result.about.email, event_group is set to about.labels.key/value, summary is set to security_result.summary |
| 120005 | Message {event_group} to {redirect_url} is dropped. Reason {summary} | event_group is set to about.labels.key/value, redirect_url is set to target.url, summary is set to security_result.summary |
| 120006 | Delivering message {event_group} to (?P<destination_email>) failed. Reason {summary} | destination_email is set to security_result.about.email, event_group is set to about.labels.key/value, summary is set to security_result.summary |
| 120006 | Delivering message {event_group} to {redirect_url} failed. Reason {summary} | event_group is set to about.labels.key/value, redirect_url is set to target.url, summary is set to security_result.summary |
| 120007 | Message {event_group} to (?P<destination_email>) delivered | destination_email is set to security_result.about.email, event_group is set to about.labels.key/value |
| 120007 | Message {event_group} to {redirect_url} delivered | event_group is set to about.labels.key/value, redirect_url is set to target.url |
| 120008 | SCH client {client_name} is activated | client_name is set to about.labels.key/value |
| 120009 | SCH client {client_name} is deactivated | client_name is set to about.labels.key/value |
| 120010 | Notify command {action_details} to SCH client {client_name} failed. Reason {summary} | action_details is set to security_result.action_details, client_name is set to about.labels.key/value, summary is set to security_result.summary |
| 120012 | User {user_name} chose to {choice} call-home anonymous reporting at the prompt | user_name is set to target.user.userid, choice is set to about.labels.key/value |
| 121001 | msgId {message_id}. Telemetry support on the chassis: {status} | message_id is set to about.labels.key/value, status is set to about.labels.key/value |
| 121002 | Telemetry support on the blade: {status} | status is set to about.labels.key/value |
| 121003 | msgId {message_id}. Telemetry request from the chassis received. SSE connector status: {connector_status}. Telemetry config on the blade: {blade_status}. Telemetry data {data_status} | message_id is set to about.labels.key/value, connector_status is set to about.labels.key/value, blade_status is set to about.labels.key/value, data_status is set to about.labels.key/value |
| 199001 | Reload command executed from Telnet (remote {dst_ip}) | dst_ip is set to target.ip |
| 199011 | Close on bad channel in <message_text> {process_or_fiber}, channel ID {channel_id} , channel state {channel_state} <message_text> name of the process/fiber that caused the bad channel close operation | process_or_fiber is set to about.labels.key/value, channel_id is set to about.labels.key/value, channel_state is set to about.labels.key/value |
| 199012 | Stack smash during {new_stack_call} in <message_text> {process_or_fiber}, call target {call_target}, stack size {stack_size}, | new_stack_call is set to about.labels.key/value, process_or_fiber is set to about.labels.key/value, call_target is set to target.labels.key/value, stack_size is set to about.labels.key/value |
| 199020 | System memory utilization has reached {memory_utilization}%. System will reload if memory usage reaches the configured trigger level of {trigger_level}% | memory_utilization is set to about.labels.key/value, trigger_level is set to about.labels.key/value |
| 199021 | System memory utilization has reached the configured watchdog trigger level of {trigger_level}%. System will now reload | trigger_level is set to about.labels.key/value |
| 199027 | Restore operation was aborted at {time} | time is set to about.labels.key/value |
| 201002 | Too many {protocol} connections on <message_text> {dst_ip} ! {max_embryonic_conn} {max_conn} | protocol is set to network.ip_protocol, dst_ip is set to target.ip, max_embryonic_conn is set to about.labels.key/value, max_conn is set to about.labels.key/value |
| 201003 | Embryonic limit exceeded {max_embryonic_conn}/{max_conn} for {dst_ip}/{dst_port} ({dst_ip1}) {dst_ip2}/{dst_port} on {interface_number} {interface_name} | max_embryonic_conn is set to about.labels.key/value, max_conn is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_ip1 is set to target.ip, dst_ip2 is set to target.ip, dst_port is set to target.port, interface_number is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 201004 | Too many {protocol} connections on <message_text> {dst_ip}!{max_udp_conn} | protocol is set to network.ip_protocol, dst_ip is set to target.ip, max_udp_conn is set to about.labels.key/value |
| 201005 | {protocol} data connection failed for {dst_ip} {dst_ip1} | protocol is set to network.ip_protocol, dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 201006 | {protocol} backconnection failed for {dst_ip}/{dst_port} | protocol is set to network.ip_protocol, dst_ip is set to target.ip, dst_port is set to target.port |
| 201009 | {protocol} connection limit of {max_conn} for host {dst_ip} on {interface_name} exceeded | protocol is set to network.ip_protocol, max_conn is set to about.labels.key/value, dst_ip is set to target.ip, interface_name is set to about.labels.key/value |
| 201010 | Embryonic connection limit exceeded {embryonic_conn}/{max_conn} for {direction} packet from {src_ip}/{src_port} to {dst_ip}/{dst_port} on interface {interface_name} | embryonic_conn is set to about.labels.key/value, max_conn is set to about.labels.key/value, direction is set to network.direction, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, interface_name is set to about.labels.key/value |
| 201011 | Connection limit exceeded {cur_conn_count}/{conf_conn_count} for {direction} packet from {src_ip}(/{src_port})? to {dst_ip}/{dst_port} on interface {interface_name} | cur_conn_count is set to about.labels.key/value, conf_conn_count is set to about.labels.key/value, direction is set to network.direction, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, interface_name is set to about.labels.key/value |
| 201012 | Per-client embryonic connection limit exceeded {cur_num}/{conf_limit} for (input|output) packet from {src_ip}(/{src_port})? to {dst_ip}/{dst_port} on interface {interface_name} | cur_num is set to about.labels.key/value, conf_limit is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, interface_name is set to about.labels.key/value |
| 201013 | Per-client connection limit exceeded {cur_num}/{conf_limit} for (input|output) packet from {src_ip}(/{src_port})? to {dst_ip}/{dst_port} on interface {interface_name} | cur_num is set to about.labels.key/value, conf_limit is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, interface_name is set to about.labels.key/value |
| 202005 | Non-embryonic in embryonic list {dst_ip}/{dst_port} {src_ip}/{src_port} | dst_ip is set to target.ip, dst_port is set to target.port, src_ip is set to principal.ip, src_port is set to principal.port |
| 202010 | <message_text> pool exhausted( for {pool_name})?.*:{src_ip}/{src_port}.*:{dst_ip}(/{dst_port})? | pool_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 208005 | ({function}:{line_number}) {summary} | function is set to about.labels.key/value, line_number is set to about.labels.key/value, summary is set to security_result.summary |
| 209003 | Fragment database limit of number exceeded: src = {src_ip} , dest = {dst_ip} , proto = {protocol} , id = <message_text> | src_ip is set to principal.ip, dst_ip is set to target.ip, protocol is set to network.ip_protocol |
| 209004 | Invalid IP fragment, size = {bytes_exceed} maximum size = {max_bytes} : src = {src_ip} , dest = {dst_ip} , proto = {protocol} , id = <message_text> | bytes_exceed is set to about.labels.key/value, max_bytes is set to about.labels.key/value, src_ip is set to principal.ip, dst_ip is set to target.ip, protocol is set to network.ip_protocol |
| 209006 | Fragment queue threshold exceeded, dropped {protocol}.*{src_ip}/{src_port} to (IP )?{dst_ip}/{dst_port}( on {dst_interface_name})? | protocol is set to network.ip_protocol, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, dst_interface_name is set to target.labels.key/value |
| 210001 | LU <message_text> error = {error_number} | error_number is set to about.labels.key/value |
| 210005 | LU allocate .* protocol {protocol} connection from ingress interface {src_interface_name}:{src_ip}(/{src_port})? to egress interface {dst_interface_name}:{dst_ip}(/{dst_port})? | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 210005 | LU allocate connection failed for {protocol} connection from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}(/{dst_port})? | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 210006 | LU look NAT for {dst_ip} failed | dst_ip is set to target.ip |
| 210007 | LU allocate xlate failed for |
src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_ip1 is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_ip1 is set to target.ip, dst_port is set to target.port |
| 210008 | LU no xlate for {src_ip}(/{src_port})? {dst_ip}(/{dst_port})? | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 210010 | LU make {protocol} connection for {dst_ip}:{dst_port} {src_ip}:{src_port} | protocol is set to network.ip_protocol, dst_ip is set to target.ip, dst_port is set to target.port, src_ip is set to principal.ip, src_port is set to principal.port |
| 210020 | LU PAT port {dst_port} reserve failed | dst_port is set to target.port |
| 210021 | LU create static xlate {dst_ip} | dst_ip is set to target.ip |
| 211004 | WARNING: Minimum Memory Requirement for ASA version {image_version} not met for ASA image. <message_text> MB required, <message_text> MB found | image_version is set to about.labels.key/value |
| 212001, 212002 | Unable to open {protocol} (trap )?channel ({protocol} port {dst_port}) on interface {interface_number} , error code = {error_code} | protocol is set to network.ip_protocol, protocol is set to network.ip_protocol, dst_port is set to target.port, interface_number is set to about.labels.key/value, error_code is set to security_result.description |
| 212003 | Unable to receive an {protocol} request on interface {interface_number} , error code = {error_code} | protocol is set to network.ip_protocol, interface_number is set to about.labels.key/value, error_code is set to security_result.description |
| 212004 | Unable to send an {protocol} response to IP (a|A)ddress {dst_ip}Port {dst_port}(I|i)nterface {interface_name}, error code = (-)?{error_code} | protocol is set to network.ip_protocol, dst_ip is set to target.ip, dst_port is set to target.port, interface_name is set to about.labels.key/value, error_code is set to security_result.description |
| 212005 | incoming {protocol} request ({received_bytes} bytes) (from IP address {src_ip} Port {src_port})?(on)? (i|I)nterface (")?%{interface_name}(")? exceeds | protocol is set to network.ip_protocol, interface_name is set to about.labels.key/value, received_bytes is mapped to network.received_bytes, src_ip is mapped to principal.ip, src_port is mapped to principal.port |
| 212006 | Dropping {protocol} request from {src_ip}(/{src_port})? to ifc :{dst_ip1}/{dst_port} because: {summary} {user_name} | protocol is set to network.ip_protocol, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip1 is set to target.ip, dst_port is set to target.port, summary is set to security_result.summary, user_name is set to target.user.userid |
| 212009 | Configuration request for {protocol} group {group_name} failed. User {user_name} ,{summary} | protocol is set to network.ip_protocol, group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, summary is set to security_result.summary |
| 212010 | Configuration request for {protocol} user {user_name} failed. Host {target_hostname} {summary} | protocol is set to network.ip_protocol, user_name is set to target.user.userid, target_hostname is set to target.hostname, summary is set to security_result.summary |
| 212011 | {protocol} engineBoots is set to maximum value. Reason: {summary} User intervention necessary | protocol is set to network.ip_protocol, summary is set to security_result.summary |
| 213001 | PPTP control daemon socket io {io_string}, errno = {error_string} | io_string is set to about.labels.key/value, error_string is set to about.labels.key/value |
| 213002 | PPTP tunnel hashtable insert failed, peer = {dst_ip} | dst_ip is set to target.ip |
| 213003 | PPP virtual interface {interface_number} isn't opened | interface_number is set to about.labels.key/value |
| 213004 | PPP virtual interface {interface_number} client ip allocation failed | interface_number is set to about.labels.key/value |
| 213007 | L2TP: Failed to install Redirect URL:{redirect_url} Redirect ACL: non_exist for {dst_ip} | redirect_url is set to target.url, dst_ip is set to target.ip |
| 214001 | Terminating manager session from {dst_ip} on interface {interface_name}. Reason: {summary} | dst_ip is set to target.ip, interface_name is set to about.labels.key/value, summary is set to security_result.summary |
| 215001 | Bad route_compress() call, sdb = {sdb} | sdb is set to about.labels.key/value |
| 216001 | internal error in: {function}: {summary} | function is set to about.labels.key/value, summary is set to security_result.summary |
| 216002 | Unexpected event (major: {major_id}, minor: {minor_id}) received by {task_string} in {function} at line: {line_number} | major_id is set to about.labels.key/value, minor_id is set to about.labels.key/value, task_string is set to about.labels.key/value, function is set to about.labels.key/value, line_number is set to about.labels.key/value |
| 216003 | Unrecognized timer {timer_pointer}, {timer_id} received by {task_string} in {function} at line: {line_number} | timer_pointer is set to about.labels.key/value, timer_id is set to about.labels.key/value, task_string is set to about.labels.key/value, function is set to about.labels.key/value, line_number is set to about.labels.key/value |
| 216004 | prevented: {error} in {function} at <message_text> - {stack_trace} | error is set to about.labels.key/value, function is set to about.labels.key/value, stack_trace is set to about.labels.key/value |
| 216005 | ERROR: Duplex-mismatch on {interface_name} resulted in transmitter lockup. A soft reset of the switch was performed | interface_name is set to about.labels.key/value |
| 218002 | Module ({slot}) is a registered proto-type for Cisco Lab use only, and not certified for live network operation | slot is set to about.labels.key/value |
| 218003 | Module Version in {slot} is obsolete. The module in slot = <message_text> is obsolete and must be returned via RMA to Cisco Manufacturing. If it is a lab unit, it must be returned to Proto Services for upgrade | slot is set to about.labels.key/value |
| 219002 | {api_name} error, slot = {slot_number}, device = {device_number}, address = {address}, byte count = {count}. Reason: {summary} | api_name is set to about.labels.key/value, slot_number is set to about.labels.key/value, device_number is set to about.labels.key/value, address is set to about.labels.key/value, count is set to about.labels.key/value, summary is set to security_result.summary |
| 302003 | Built H245 connection for (foreign_address|faddr) {src_ip}(/{src_port})? (local_address|laddr) {dst_ip}(/{dst_port})? | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 302004 | Pre-allocate H323 (?P<protocol>UDP) backconnection for (foreign_address|faddr) {src_ip}(/{src_port} )?to (local_address|laddr) {dst_ip}(/{dst_port})? | protocol is set to network.ip_protocol, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 302010 | {connections_in_use} in use, {connections_most_used} most used | connections_in_use is set to about.labels.key/value, connections_most_used is set to about.labels.key/value |
| 302012 | Pre-allocate H225 Call Signalling Connection for faddr {src_ip}(/{src_port})? to laddr {dst_ip} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip |
| 302013 | (?P<action>Built)(?: (?P<direction>Inbound|inbound|Outbound|outbound))? (?P<protocol>TCP)( connection)? {session_id} for {src_interface_name}:{src_ip}/{src_port}( ({src_mapped_ip}/{src_mapped_port}))?(?:({src_fwuser}))? to {dst_interface_name}:{dst_ip}/{dst_port}( ({dst_mapped_ip}/{dst_mapped_port}))?(({dst_fwuser}))?<message_text> | action is set to security_result.action, direction is set to network.direction, protocol is set to network.ip_protocol, session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, src_fwuser is set to principal.user.userid/principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, dst_fwuser is set to target.user.userid/target.labels.key/value |
| 302014, 302015, 302016 | (?P<action>Built|Teardown)(?: (?P<direction>Inbound|inbound|Outbound|outbound))? {protocol} connection {session_id} for {src_interface_name}(:| ){src_ip}/{src_port}( ({src_mapped_interface}?{src_mapped_ip}/{src_mapped_port}))?(?:({src_fwuser}))? to {dst_interface_name}(:| ){dst_ip}/{dst_port}( ({dst_mapped_ip}/{dst_mapped_port}))?(({dst_fwuser}))?(?: duration {duration} bytes {sent_bytes})?<message_text> | action is set to security_result.action, direction is set to network.direction, protocol is set to network.ip_protocol, session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_interface is set to principal.labels.key/value, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, src_fwuser is set to principal.user.userid/principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, dst_fwuser is set to target.user.userid/target.labels.key/value, duration is set to network.session_duration, sent_bytes is set to network.sent_bytes |
| 302017 | Built (?P<direction>inbound|outbound) (?P<protocol>GRE) connection {session_id} from {src_interface_name}:{src_ip} ({src_translated_address}) (?:({src_fwuser}))?to {dst_interface_name}:{dst_ip}/{real_cid} ({dst_translated_address}/{translated_cid})(?:({dst_fwuser}))?<message_text> | direction is set to network.direction, protocol is set to network.ip_protocol, session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_translated_address is set to principal.nat_ip, src_fwuser is set to principal.user.userid/principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, real_cid is set to about.labels.key/value, dst_translated_address is set to target.nat_ip, translated_cid is set to about.labels.key/value, dst_fwuser is set to target.user.userid/target.labels.key/value |
| 302018 | Teardown (?P<protocol>GRE) connection {session_id} from {src_interface_name}:{src_ip} ({src_translated_address}) (?:({src_fwuser}) )?to {dst_interface_name}:{dst_ip}/{real_cid} ({dst_translated_address}/{translated_cid})(?:({dst_fwuser}))? duration {duration} bytes {bytes_transferred}<message_text> | protocol is set to network.ip_protocol, session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_translated_address is set to principal.nat_ip, src_fwuser is set to principal.user.userid/principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, real_cid is set to about.labels.key/value, dst_translated_address is set to target.nat_ip, translated_cid is set to about.labels.key/value, dst_fwuser is set to target.user.userid/target.labels.key/value, duration is set to network.session_duration, bytes_transferred is set to about.labels.key/value |
| 302019 | H.323 {library_name} ASN Library failed to initialize, error {error_code} | library_name is set to about.labels.key/value, error_code is set to security_result.description |
| 302020, 302021 | (?P<action>Built|Teardown)((?P<direction>Inbound|inbound|Outbound|outbound))?{protocol} connection for faddr {dst_ip}/{icmp_seq_num}(?:({fwuser}))? gaddr {src_xlated_ip}/{icmp_code_xlated} laddr {src_ip}/{icmp_code_laddr}(?: type {icmp_type} code {icmp_code})? | action is set to security_result.action, direction is set to network.direction, protocol is set to network.ip_protocol, dst_ip is set to target.ip, icmp_seq_num is set to about.labels.key/value, fwuser is set to about.labels.key/value, src_xlated_ip is set to principal.labels.key/value, icmp_code_xlated is set to about.labels.key/value, src_ip is set to principal.ip, icmp_code_laddr is set to about.labels.key/value, icmp_type is set to about.labels.key/value, icmp_code is set to about.labels.key/value |
| 302022, 302023, 302024, 302025, 302027 | (?P<action>Built|Teardown)(?: <message_text>)?( stub)? {protocol} connection for {src_interface_name}:{src_ip}/{src_port}(?: ({src_mapped_ip}(?:/{src_mapped_port})?))? to {dst_interface_name}:{dst_ip}/{dst_port}(?: ({dst_mapped_ip}(?:/{dst_mapped_port})?))?(?: duration {duration} forwarded bytes {sent_bytes} )?{summary} | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, duration is set to network.session_duration, sent_bytes is set to network.sent_bytes, summary is set to security_result.summary |
| 302022, 302023, 302024, 302025, 302027 | (?P<action>Built|Teardown)(?: <message_text>)?( stub)? {protocol} connection for {src_interface_name}:{src_ip}/{src_port}(?: ({src_mapped_ip}(?:({src_mapped_port})?))? to {dst_interface_name}:{dst_ip}/{dst_port}(?: ({dst_mapped_ip}(?:/{dst_mapped_port})?))?(?: duration {duration} forwarded bytes {sent_bytes} )?{summary} | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, duration is set to network.session_duration, sent_bytes is set to network.sent_bytes, summary is set to security_result.summary |
| 302026 | (?P<action>Built|Teardown)(?: <message_text>)? stub (?P<protocol>ICMP) connection for {src_interface_name}:{src_ip}/{src_port}(?: ({src_mapped_ip} ))? to {dst_interface_name}:{dst_ip}/{dst_port}(?: ({dst_mapped_ip} ))? | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip |
| 302033 | Pre-allocated H323 GUP Connection for faddr {src_interface_name}:{src_ip}(/{src_port})? to laddr {dst_interface_name}:{dst_ip}(/{dst_port})? | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 302034 | Unable to pre-allocate H323 GUP Connection for faddr {src_interface_name}:{src_ip}(/{src_port})? to laddr {dst_interface_name}:{dst_ip}(/{dst_port})? | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 302035 | Built (?P<direction>inbound|outbound) SCTP connection {session_id} for {src_interface_name}:{src_ip}(/{src_port})? ({mapped_outside_ip}/{mapped_outside_port})(((?:{outside_idfw_user})?(,)?(?:{outside_sg_info})?))? to {dst_interface_name}:{dst_ip}/{dst_port} ({mapped_inside_ip}/{mapped_inside_port})(((?:{inside_idfw_user})?(,)?(?:{inside_sg_info})?))? | direction is set to network.direction, session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, mapped_outside_ip is set to about.labels.key/value, mapped_outside_port is set to about.labels.key/value, outside_idfw_user is set to about.labels.key/value, outside_sg_info is set to about.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, mapped_inside_ip is set to about.labels.key/value, mapped_inside_port is set to about.labels.key/value, inside_idfw_user is set to about.labels.key/value, inside_sg_info is set to about.labels.key/value |
| 302035 | Built (?P<direction>inbound|outbound) SCTP connection {session_id} for {src_interface_name}:{src_ip}(/{src_port})? ({mapped_outside_ip}/{mapped_outside_port})<message_text> to {dst_interface_name}:{dst_ip}/{dst_port} ({mapped_inside_ip}/{mapped_inside_port}) | direction is set to network.direction, session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, mapped_outside_ip is set to about.labels.key/value, mapped_outside_port is set to about.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, mapped_inside_ip is set to about.labels.key/value, mapped_inside_port is set to about.labels.key/value |
| 302036 | Teardown SCTP connection {session_id} for {src_interface_name}:{src_ip}(/{src_port})? (((?:{outside_idfw_user})?(,)?(?:{outside_sg_info})?))? to {dst_interface_name}:{dst_ip}/{dst_port} (((?:{inside_idfw_user})?(,)?(?:{inside_sg_info})?))? duration {duration} bytes {received_bytes} {summary} | session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, outside_idfw_user is set to about.labels.key/value, outside_sg_info is set to about.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, inside_idfw_user is set to about.labels.key/value, inside_sg_info is set to about.labels.key/value, duration is set to network.session_duration, received_bytes is set to network.received_bytes, summary is set to security_result.summary |
| 302036 | Teardown SCTP connection {session_id} for {src_interface_name}:{src_ip}(/{src_port})? <message_text> to {dst_interface_name}:{dst_ip}/{dst_port} <message_text> duration {duration} bytes {received_bytes} {summary} | session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, duration is set to network.session_duration, received_bytes is set to network.received_bytes, summary is set to security_result.summary |
| 302302 | ACL = (?P<action>deny); no <message_text> created | action is set to security_result.action |
| 302303 | Built TCP state-bypass connection {session_id} from {src_interface_name}:{src_ip}(/{src_port})? <message_text> to {dst_interface_name}:{dst_ip}/{dst_port} <message_text> | session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 302304 | Teardown TCP state-bypass connection {session_id} from {src_interface_name}:{src_ip}(/{src_port})?((<message_text>))? to {dst_interface_name}:{dst_ip}/{dst_port} duration {duration} bytes {received_bytes} {summary} | session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, duration is set to network.session_duration, received_bytes is set to network.received_bytes, summary is set to security_result.summary |
| 302305 | Built SCTP state-bypass connection {session_id} for {src_interface_name}:{src_ip}(/{src_port})? ({mapped_outside_ip}/{mapped_outside_port})(((?:{outside_idfw_user})?(,)?(?:{outside_sg_info})?))? to {dst_interface_name}:{dst_ip}/{dst_port} ({mapped_inside_ip}/{mapped_inside_port})(((?:{inside_idfw_user})?(,)?(?:{inside_sg_info})?))? | session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, mapped_outside_ip is set to about.labels.key/value, mapped_outside_port is set to about.labels.key/value, outside_idfw_user is set to about.labels.key/value, outside_sg_info is set to about.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, mapped_inside_ip is set to about.labels.key/value, mapped_inside_port is set to about.labels.key/value, inside_idfw_user is set to about.labels.key/value, inside_sg_info is set to about.labels.key/value |
| 302305 | Built SCTP state-bypass connection {session_id} for {src_interface_name}:{src_ip}(/{src_port})? ({mapped_outside_ip}/{mapped_outside_port})<message_text> to {dst_interface_name}:{dst_ip}/{dst_port} ({mapped_inside_ip}/{mapped_inside_port}) | session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, mapped_outside_ip is set to about.labels.key/value, mapped_outside_port is set to about.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, mapped_inside_ip is set to about.labels.key/value, mapped_inside_port is set to about.labels.key/value |
| 302306 | Teardown SCTP state-bypass connection {session_id} for {src_interface_name}:{src_ip}(/{src_port})? (((?:{outside_idfw_user})?(,)?(?:{outside_sg_info})?))? to {dst_interface_name}:{dst_ip}/{dst_port} (((?:{inside_idfw_user})?(,)?(?:{inside_sg_info})?))? duration {duration} bytes {received_bytes} {summary} | session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, outside_idfw_user is set to about.labels.key/value, outside_sg_info is set to about.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, inside_idfw_user is set to about.labels.key/value, inside_sg_info is set to about.labels.key/value, duration is set to network.session_duration, received_bytes is set to network.received_bytes, summary is set to security_result.summary |
| 302306 | Teardown SCTP state-bypass connection {session_id} for {src_interface_name}:{src_ip}(/{src_port})? <message_text>to {dst_interface_name}:{dst_ip}/{dst_port} <message_text> duration {duration} bytes {received_bytes} {summary} | session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, duration is set to network.session_duration, received_bytes is set to network.received_bytes, summary is set to security_result.summary |
| 302311 | Failed to create a new {protocol} connection from {ingress_interface}:{src_ip}(/{src_port})? to {egress_interface}:{dst_ip}/{dst_port} due to application cache memory allocation failure. The app-cache memory threshold level is {threshold}% and threshold check is | protocol is set to network.ip_protocol, ingress_interface is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, egress_interface is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, threshold is set to about.labels.key/value |
| 303002 | (?P<application_protocol>FTP) connection from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}/{dst_port}, user ({user_name} )?(Stored|Retrieved) file {filename} | application_protocol is set to network.application_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, filename is set to about.labels.key/value |
| 303004 | (?P<application_protocol>FTP) {cmd} command unsupported - failed strict inspection, (?P<action>terminating) connection from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}(/{dst_port})? | application_protocol is set to network.application_protocol, action is set to security_result.action, cmd is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 303005 | Strict (?P<application_protocol>FTP) inspection matched {match_string} in policy-map {policy_name}, {action_details} from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}(/{dst_port})? | application_protocol is set to network.application_protocol, match_string is set to about.labels.key/value, policy_name is set to target.resource.name, action_details is set to security_result.action_details, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 304001 | {src_ip}(({idfw_user}))? Accessed( JAVA)? URL {dst_ip}:{redirect_url} | src_ip is set to principal.ip, idfw_user is set to about.labels.key/value, dst_ip is set to target.ip, redirect_url is set to target.url |
| 304002 | Access (?P<action>denied) URL {redirect_url} SRC {src_ip}(({idfw_user}))? DEST {dst_ip} | action is set to security_result.action, redirect_url is set to target.url, src_ip is set to principal.ip, idfw_user is set to about.labels.key/value, dst_ip is set to target.ip |
| 304003, 304004 | URL Server {dst_ip} <message_text> <message_text> URL {redirect_url} | dst_ip is set to target.ip, redirect_url is set to target.url |
| 304006, 304007 | URL Server {dst_ip} not responding | dst_ip is set to target.ip |
| 305005 | No translation group found for {protocol} src {src_interface_name}:{src_ip}(/{src_port})?(({idfw_user}))? dst {dst_interface_name}:{dst_ip}(/{dst_port})? | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, idfw_user is set to about.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 305006 | (?P<tag>outbound static|identity|portmap|regular) translation creation failed for {protocol} src {src_interface_name}:{src_ip}(/{src_port})?(({idfw_user}) )?dst {dst_interface_name}:{dst_ip}(/{dst_port})?((type {icmp_type}, code {icmp_code}))? | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, idfw_user is set to about.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, icmp_type is set to about.labels.key/value, icmp_code is set to about.labels.key/value |
| 305007 | addrpool_free(): Orphan IP {dst_ip} on interface {interface_number} | dst_ip is set to target.ip, interface_number is set to about.labels.key/value |
| 305009 | ^(?P<action>Built) (dynamic|static) translation from (?P<src_interface_name>^:]*)(({acl_name}))?:{src_ip}(({src_fwuser}))? to (?P<dst_interface_name>[^:]*):{dst_ip} | action is set to security_result.action, src_interface_name is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, acl_name is set to about.labels.key/value, src_ip is set to principal.ip, src_fwuser is set to principal.user.userid/principal.labels.key/value, dst_ip is set to target.ip |
| 305010 | ^(?P<action>Teardown) (dynamic|static) translation from {src_interface_name}:{src_ip}(({src_fwuser}))?to {dst_interface_name}:{dst_ip} duration {duration} | action is set to security_result.action, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_fwuser is set to principal.user.userid/principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, duration is set to network.session_duration |
| 305011 | ^(?P<action>|Built) (dynamic|static) {protocol} translation from {src_interface_name}:{src_ip}/{src_port}(({src_fwuser}))? to {dst_interface_name}:{dst_ip}/{dst_port} | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_fwuser is set to principal.user.userid/principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 305012 | (?P<action>Teardown) (dynamic|static) (?P<protocol>TCP|UDP|ICMP|SCTP) translation from {src_interface_name}:{src_ip}/{src_port}({src_fwuser})? to {dst_interface_name}:{dst_ip}/{dst_port} duration {duration} | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_fwuser is set to principal.user.userid/principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, duration is set to network.session_duration |
| 305013 | Asymmetric NAT rules matched for forward and reverse flows; Connection (for )?{protocol} src {src_interface_name}:{src_ip}(/{src_port})?({src_fwuser})? dst {dst_interface_name}:{dst_ip}(/{dst_port})?<message_text>(?P<summary>(?P<action>denied) due to NAT reverse path failure) | summary is set to security_result.summary, action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_fwuser is set to principal.user.userid/principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 305014 | Allocated block of ports for translation from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 305016 | Unable to create protocol connection from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} due to {summary} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, summary is set to security_result.summary |
| 305017 | Pba-interim-logging: Active (?P<protocol>ICMP) block of ports for translation from {src_ip} to {dst_ip}/<message_text> | protocol is set to network.ip_protocol, src_ip is set to principal.ip, dst_ip is set to target.ip |
| 305018 | MAP translation from {src_interface_name}:{src_ip}/{src_port}-{dst_interface_name}:{dst_ip}/{dst_port} to {src_translated_interface}:{src_translated_address}/{src_translated_port}-{dst_translated_interface}:{dst_translated_address}/{dst_translated_port} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, src_translated_interface is set to principal.labels.key/value, src_translated_address is set to principal.nat_ip, src_translated_port is set to principal.nat_port, dst_translated_interface is set to target.labels.key/value, dst_translated_address is set to target.nat_ip, dst_translated_port is set to target.nat_port |
| 305019 | MAP node address {dst_ip}/{dst_port} has inconsistent Port Set ID encoding | dst_ip is set to target.ip, dst_port is set to target.port |
| 305020 | MAP node with address {dst_ip} is not allowed to use port {dst_port} | dst_ip is set to target.ip, dst_port is set to target.port |
| 308001 | (Console|console) enable password incorrect for {incorrect_password_attempts} tries (from {dst_ip}) | incorrect_password_attempts is set to about.labels.key/value, dst_ip is set to target.ip |
| 308001 | (Console|console) enable password incorrect for {incorrect_password_attempts} tries (from ssh (remote {dst_ip})) | incorrect_password_attempts is set to about.labels.key/value, dst_ip is set to target.ip |
| 308002 | static {static_global_address} {static_inside_address} netmask <message_text> overlapped with {global_address} {inside_address} | static_global_address is set to about.labels.key/value, static_inside_address is set to about.labels.key/value, global_address is set to about.labels.key/value, inside_address is set to about.labels.key/value |
| 312001 | RIP hdr failed from {dst_ip}: cmd={cmd}, version={version} domain={target_hostname} on interface {interface_name} | dst_ip is set to target.ip, cmd is set to about.labels.key/value, version is set to about.labels.key/value, target_hostname is set to target.hostname, interface_name is set to about.labels.key/value |
| 313001, 313004 | (?P<action>Denied) (?P<protocol>ICMP|icmp) type={icmp_type}, code={icmp_code} from {src_ip} on interface {dst_interface_name}( to {dst_ip})? | action is set to security_result.action, protocol is set to network.ip_protocol, icmp_type is set to about.labels.key/value, icmp_code is set to about.labels.key/value, src_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip |
| 313004 | (?P<action>Denied) {protocol} type={icmp_type}, from laddr {src_ip} on interface {dst_interface_name} to {dst_ip}: no matching session | action is set to security_result.action, protocol is set to network.ip_protocol, icmp_type is set to about.labels.key/value, src_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip |
| 313005 | No matching connection for (?P<protocol>ICMP|icmp) error message: icmp src {src_interface_name}:{src_ip}(({src_fwuser}))? dst {dst_interface_name}:{dst_ip} (type {icmp_type}, code {icmp_code}) on {src_interface_name} interface.s+ Original IP payload: <message_text> src {ori_src_ip}(/{src_port})? dst {ori_dst_ip}(/{dst_port})?<message_text>, | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_fwuser is set to principal.user.userid/principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, icmp_type is set to about.labels.key/value, icmp_code is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, ori_src_ip is set to principal.labels.key/value, src_port is set to principal.port, ori_dst_ip is set to target.labels.key/value, dst_port is set to target.port, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_fwuser is set to principal.user.userid/principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, icmp_type is set to about.labels.key/value, icmp_code is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value |
| 313008 | (?P<action>Denied) IPv6-ICMP type={icmp_type}, code={icmp_code} from {src_ip} on interface {dst_interface_name}( to {dst_ip})? | action is set to security_result.action, icmp_type is set to about.labels.key/value, icmp_code is set to about.labels.key/value, src_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip |
| 313009 | (?P<action>Denied) invalid {protocol} code {icmp_code}, for {src_interface_name}:{src_ip}/{src_port} ({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port} ({dst_mapped_ip}/{dst_mapped_port})({user}])?(({user}))?, ICMP id {icmp_id}, ICMP type {icmp_type} | action is set to security_result.action, protocol is set to network.ip_protocol, icmp_code is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, user is set to about.labels.key/value, user is set to about.labels.key/value, icmp_id is set to network.session_id, icmp_type is set to about.labels.key/value |
| 314001 | Pre-(allocated|allocate) RTSP (?P<protocol>UDP) backconnection for {src_interface_name}:{src_ip} to {dst_interface_name}:{dst_ip}(/{dst_port})? | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 314002 | RTSP failed to allocate (?P<protocol>UDP) media connection from {src_interface_name}:{src_ip} to {dst_interface_name}:{dst_ip}/{dst_port}: {summary} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, summary is set to security_result.summary |
| 314003 | Dropped RTSP traffic from {src_interface_name}:{src_ip} due to: {summary} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, summary is set to security_result.summary |
| 314004 | RTSP client {src_interface_name}:{src_ip} accessed RTSP URL {rtsp_url} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, rtsp_url is set to about.labels.key/value |
| 314005 | RTSP client {src_interface_name}:{src_ip} denied access to URL {rtsp_url} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, rtsp_url is set to about.labels.key/value |
| 314006 | RTSP client {src_interface_name}:{src_ip} exceeds configured rate limit of {rate} for {request_method} messages | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, rate is set to about.labels.key/value, request_method is set to about.labels.key/value |
| 315011 | (?P<application_protocol>SSH) session from {src_ip} on interface {src_interface_name} for user {dst_fwuser}( disconnected by SSH server, reason:)? {summary} | application_protocol is set to network.application_protocol, src_ip is set to principal.ip, src_interface_name is set to principal.labels.key/value, dst_fwuser is set to target.user.userid/target.labels.key/value, summary is set to security_result.summary |
| 315012 | Weak SSH cipher ({cipher_name}) provided from client {dst_ip} on interface {dst_interface_name}. Connection failed. Not FIPS 140-2 compliant | cipher_name is set to network.tls.cipher, dst_ip is set to target.ip, dst_interface_name is set to target.labels.key/value |
| 315012 | Weak SSH MAC ({mac_address}) provided from client {dst_ip} on interface {dst_interface_name}. Connection failed. Not FIPS 140-2 compliant | mac_address is set to about.labels.key/value, dst_ip is set to target.ip, dst_interface_name is set to target.labels.key/value |
| 315013 | SSH session from {dst_ip} on interface {dst_interface_name} for user {user_name} rekeyed successfully | dst_ip is set to target.ip, dst_interface_name is set to target.labels.key/value, user_name is set to target.user.userid |
| 316001 | Denied new tunnel to {dst_ip}. VPN peer limit ({platform_vpn_peer_limit}) exceeded | dst_ip is set to target.ip, platform_vpn_peer_limit is set to about.labels.key/value |
| 316002 | VPN Handle error: protocol={protocol}, src {src_interface_name}:{src_ip}, dst {dst_interface_name}:{dst_ip} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip |
| 317002 | Bad path index of number for {src_ip}, {max_num} max | src_ip is set to principal.ip, max_num is set to about.labels.key/value |
| 317003 | IP routing table creation failure -{summary} | summary is set to security_result.summary |
| 317005 | IP routing table limit exceeded -{summary} | summary is set to security_result.summary |
| 317006 | Pdb index error {pdb}, {pdb_index}, {pdb_type} | pdb is set to about.labels.key/value, pdb_index is set to about.labels.key/value, pdb_type is set to about.labels.key/value |
| 317007 | Added {route_type} route {dst_ip} {netmask} via {gateway_address} <message_text> on {interface_name} {route_type} | route_type is set to about.labels.key/value, dst_ip is set to target.ip, netmask is set to about.labels.key/value, gateway_address is set to about.labels.key/value, interface_name is set to about.labels.key/value, route_type is set to about.labels.key/value |
| 317008 | Community list check with bad list {list_number} | list_number is set to about.labels.key/value |
| 317012 | Interface IP route counter negative - {interface_name} | interface_name is set to about.labels.key/value |
| 318004 | area <message_text> lsid {src_ip} mask {netmask} adv {dst_ip} type <message_text> | src_ip is set to principal.ip, netmask is set to about.labels.key/value, dst_ip is set to target.ip |
| 318005, 318105 | lsid {src_ip} adv {dst_ip}<message_text>gateway {gateway_address}<message_text> network {network_address} mask {netmask}<message_text> | src_ip is set to principal.ip, dst_ip is set to target.ip, gateway_address is set to about.labels.key/value, network_address is set to about.labels.key/value, netmask is set to about.labels.key/value |
| 318007 | OSPF is enabled on {interface_name} during idb initialization | interface_name is set to about.labels.key/value |
| 318008, 613011 | OSPF process {process_number} is changing router-id. Reconfigure virtual link neighbors with our new router-id | process_number is set to about.labels.key/value |
| 318009 | OSPF: Attempted reference of stale data encountered in {function}, line: {line_number} | function is set to about.labels.key/value, line_number is set to about.labels.key/value |
| 318012 | Process {target_process_name} (re-originates|flushes) LSA ID {src_ip} type-<message_text>adv-rtr {dst_ip}<message_text> | target_process_name is set to target.process.pid, src_ip is set to principal.ip, dst_ip is set to target.ip |
| 318107 | OSPF is enabled on {interface_name} during idb initialization | interface_name is set to about.labels.key/value |
| 318108 | OSPF process {process_number} is changing router-id. Reconfigure virtual link neighbors with our new router-id | process_number is set to about.labels.key/value |
| 318110 | Invalid encrypted key {encrypted_key} | encrypted_key is set to about.labels.key/value |
| 318111 | SPI {spi} is already in use with ospf process {process_number} | spi is set to about.labels.key/value, process_number is set to about.labels.key/value |
| 318112 | SPI {spi} is already in use by a process other than ospf process {process_number} | spi is set to about.labels.key/value, process_number is set to about.labels.key/value |
| 318113 | s {interface_name} is already configured with SPI {spi} | interface_name is set to about.labels.key/value, spi is set to about.labels.key/value |
| 318114 | The key length used with SPI {spi} is not valid | spi is set to about.labels.key/value |
| 318115, 318118 | {error} (error )?occurred when attempting to <message_text> <message_text> (IPsec|IPSec) policy <message_text> SPI {spi} | error is set to about.labels.key/value, spi is set to about.labels.key/value |
| 318116 | SPI {spi} is not being used by ospf process {process_number} | spi is set to about.labels.key/value, process_number is set to about.labels.key/value |
| 318117 | The policy for SPI {spi} could not be removed because it is in use | spi is set to about.labels.key/value |
| 318119 | Unable to close secure socket with SPI {spi} on interface {interface_name} | spi is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 318121 | IPsec reported a GENERAL ERROR: message {summary}, count {total_msgs} | summary is set to security_result.summary, total_msgs is set to about.labels.key/value |
| 318122 | IPsec sent a {specified_message_} message {specified_message} to OSPFv3 for interface {specified_interface}. Recovery attempt {recovery_attempts} | specified_message_ is set to about.labels.key/value, specified_message is set to about.labels.key/value, specified_interface is set to about.labels.key/value, recovery_attempts is set to about.labels.key/value |
| 318123 | IPsec sent a {specified_message_} message {specified_message} to OSPFv3 for interface {interface_name}. Recovery aborted | specified_message_ is set to about.labels.key/value, specified_message is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 318125 | Init failed for interface {interface_name} | interface_name is set to about.labels.key/value |
| 318126 | Interface {interface_name} is attached to more than one area | interface_name is set to about.labels.key/value |
| 319001, 319002 | Acknowledge for <message_text> update for IP address {dst_ip} not received<message_text> | dst_ip is set to target.ip |
| 319003 | Arp update for IP address {dst_ip} to NP<message_text> | dst_ip is set to target.ip |
| 319004 | Route update for IP address {dst_ip} failed<message_text> | dst_ip is set to target.ip |
| 321001, 321002 | Resource {resource} (rate )?limit of {resource_limit} reached | resource is set to target.resource.name, resource_limit is set to about.labels.key/value |
| 321003, 321004 | Resource {resource} (rate )?log level of {log_level} reached | resource is set to target.resource.name, log_level is set to about.labels.key/value |
| 321005 | System CPU utilization reached {utilization}% | utilization is set to about.labels.key/value |
| 321006 | System (M|m)emory usage reached {utilization}\s*% | utilization is set to about.labels.key/value |
| 321007 | System is low on free memory blocks of size {block_size} ({free_blocks} CNT out of {max_blocks} MAX) | block_size is set to about.labels.key/value, free_blocks is set to about.labels.key/value, max_blocks is set to about.labels.key/value |
| 322001 | (?P<action>Deny) MAC address {src_mac}, possible spoof attempt on interface {interface_name} | action is set to security_result.action, src_mac is set to principal.mac, interface_name is set to about.labels.key/value |
| 322002 | ARP inspection check failed for arp {action_details} received from host {src_mac} on interface {interface_name}. This host is advertising MAC Address {mac_address_1} for IP Address {dst_ip} , which is <message_text> bound to MAC Address {mac_address_2} | action_details is set to security_result.action_details, src_mac is set to principal.mac, interface_name is set to about.labels.key/value, mac_address_1 is set to about.labels.key/value, dst_ip is set to target.ip, mac_address_2 is set to about.labels.key/value |
| 322003 | ARP inspection check failed for arp {action_details} received from host {src_mac} on interface {interface_name}\s*. This host is advertising MAC Address {mac_address_1} for IP Address {dst_ip} , which is not bound to any MAC Address | action_details is set to security_result.action_details, src_mac is set to principal.mac, interface_name is set to about.labels.key/value, mac_address_1 is set to about.labels.key/value, dst_ip is set to target.ip |
| 322004 | No management IP address configured for transparent firewall. Dropping protocol {protocol} packet from {input_interface}:{src_ip}(/{src_port})? to {output_interface}:{dst_ip}(/{dst_port})? | protocol is set to network.ip_protocol, input_interface is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, output_interface is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 323001 | Module {module_id} experienced a control channel communication(s)? failure | module_id is set to about.labels.key/value |
| 323001 | Module in slot {slot_number} experienced a control channel communication(s)? failure | slot_number is set to about.labels.key/value |
| 323002 | Module {module_id} is not able to shut down, shut down request not answered | module_id is set to about.labels.key/value |
| 323002 | Module in slot {slot_number} is not able to shut down, shut down request not answered | slot_number is set to about.labels.key/value |
| 323003 | Module {module_id} is not able to reload, reload request not answered | module_id is set to about.labels.key/value |
| 323003 | Module in slot {slot_number} is not able to reload, reload request not answered | slot_number is set to about.labels.key/value |
| 323004 | Module {info} failed to write software {new_version_number} (currently {current_version_number}), {summary}. Hw-module reset is required before further use | info is set to about.labels.key/value, new_version_number is set to about.labels.key/value, current_version_number is set to about.labels.key/value, summary is set to security_result.summary |
| 323005 | Module {module_id} (?P<tag>cannot|can not) be started completely | module_id is set to about.labels.key/value |
| 323005 | Module in slot {slot_number} cannot be started completely | slot_number is set to about.labels.key/value |
| 324000 | Drop GTPv {version} message {msg_type} from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}/{dst_port} Reason: {summary} | version is set to about.labels.key/value, msg_type is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, summary is set to security_result.summary |
| 324001 | GTPv0 packet parsing error from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}/{dst_port}, TID: {tid_value}, Reason: {summary} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, tid_value is set to about.labels.key/value, summary is set to security_result.summary |
| 324002 | No PDPMCB] exists to process GTPv0 {msg_type} from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}/{dst_port}, TID: {tid_value} | msg_type is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, tid_value is set to about.labels.key/value |
| 324003 | No matching request to process GTPv {version} {msg_type} from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}(/{dst_port})? | version is set to about.labels.key/value, msg_type is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 324004 | GTP packet with version{version} from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}(/{dst_port})? is not supported | version is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 324005 | Unable to create tunnel from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}(/{dst_port})? | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 324006 | GSN {dst_ip} tunnel limit {tunnel_limit} exceeded, PDP Context TID {tid_value} failed | dst_ip is set to target.ip, tunnel_limit is set to about.labels.key/value, tid_value is set to about.labels.key/value |
| 324007 | Unable to create GTP connection for response from {src_ip}(/{src_port})? to {dst_ip}(/{dst_port})? | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 324010 | Subscriber {imsi} PDP Context activated on network MCC/MNC {mccmnc} (<message_text>)( CellID {cell_id})? | imsi is set to about.labels.key/value, mccmnc is set to about.labels.key/value, cell_id is set to about.labels.key/value |
| 324300 | Radius Accounting Request from {dst_ip} has an incorrect request authenticator | dst_ip is set to target.ip |
| 324301 | Radius Accounting Request has a bad header length {header_length}, packet length {packet_length} | header_length is set to about.labels.key/value, packet_length is set to about.labels.key/value |
| 325001 | Router {ipv6_address} on {interface_name} has conflicting ND (Neighbor Discovery) settings | ipv6_address is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 325002 | Duplicate address {ipv6_address}/{src_mac} on {interface_name} | ipv6_address is set to about.labels.key/value, src_mac is set to principal.mac, interface_name is set to about.labels.key/value |
| 325003 | <message_text>source address check failed.{action} packet from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}(/{dst_port})? with source MAC address {src_mac} | action is set to security_result.action, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, src_mac is set to principal.mac |
| 325004 | IPv6 Extension Header {header_type} action configuration. {protocol} from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}(/{dst_port})? | header_type is set to about.labels.key/value, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 325006 | IPv6 Extension Header not in order: Type {header_type} occurs after Type <message_text>\s*. (?P<protocol>TCP) <message_text> from inside {src_interface_name}\s*:{src_ip}\s*/{src_port} to {dst_interface_name}\s*:{dst_ip}\s*/{dst_port} | protocol is set to network.ip_protocol, header_type is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 326001 | Unexpected error in the timer library: {error} | error is set to about.labels.key/value |
| 326005 | Mrib notification failed for ({dst_ip}, {dst_ip1}) | dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 326006, 326007 | Entry-(?P<tag>creation|update) failed for ({dst_ip}, {dst_ip1}) | dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 326012 | Initialization of {functionality} functionality failed | functionality is set to about.labels.key/value |
| 326014 | Initialization failed: error_message {error_message} | error_message is set to security_result.description |
| 326015 | Communication error: error_message {error_message} | error_message is set to security_result.description |
| 326016 | Failed to set un-numbered interface for {interface_name} ({info}) | interface_name is set to about.labels.key/value, info is set to about.labels.key/value |
| 326026 | Server unexpected error: {error_message} | error_message is set to security_result.description |
| 326027 | Corrupted update: {error_message} | error_message is set to security_result.description |
| 326028 | Asynchronous error: {error_message} | error_message is set to security_result.description |
| 328001 | Attempt made to overwrite a set stub function in {function} | function is set to about.labels.key/value |
| 328002 | Attempt made in {register_key} to register with out of bounds key | register_key is set to about.labels.key/value |
| 329001 | The <message_text> subblock named {sub_block_name} was not removed | sub_block_name is set to about.labels.key/value |
| 331001 | Dynamic DNS Update for '{target_hostname}'= {dst_ip} failed | target_hostname is set to target.hostname, dst_ip is set to target.ip |
| 331002 | Dynamic DNS {type} RR for ('{target_hostname}' - {dst_ip}|{dst_ip}- '{target_hostname}') successfully updated in DNS server {dst_ip} | type is set to about.labels.key/value, target_hostname is set to target.hostname, dst_ip is set to target.ip, dst_ip is set to target.ip, target_hostname is set to target.hostname, dst_ip is set to target.ip |
| 332003, 332004 | Web Cache {dst_ip}/{service_id} <message_text> | dst_ip is set to target.ip, service_id is set to about.labels.key/value |
| 333001, 333003 | {protocol} association <message_text>- context:{session_id} | protocol is set to network.ip_protocol, session_id is set to network.session_id |
| 333002 | Timeout waiting for EAP response- context:{session_id} | session_id is set to network.session_id |
| 333009, 333010 | {protocol}-SQ response .* - context:{session_id} | protocol is set to network.ip_protocol, session_id is set to network.session_id |
| 334001, 334002, 334003 | EAPoUDP association .* - {dst_ip} | dst_ip is set to target.ip |
| 334004 | Authentication request for NAC Clientless host - {dst_ip} | dst_ip is set to target.ip |
| 334005 | Host put into NAC Hold state - {dst_ip} | dst_ip is set to target.ip |
| 334006 | {response} failed to get a response from host - {dst_ip} | response is set to about.labels.key/value, dst_ip is set to target.ip |
| 334007 | {response} association terminated - {dst_ip} | response is set to about.labels.key/value, dst_ip is set to target.ip |
| 334008 | <message_text> EAP association initiated - {dst_ip} , EAP context: {session_id} | dst_ip is set to target.ip, session_id is set to network.session_id |
| 334009 | Audit request for <message_text> Clientless host - {dst_ip} | dst_ip is set to target.ip |
| 335001 | NAC session initialized - {dst_ip} | dst_ip is set to target.ip |
| 335002 | Host is on the NAC Exception List - {dst_ip} , OS: {target_platform} | dst_ip is set to target.ip, target_platform is set to target.platform |
| 335003 | NAC Default ACL applied, ACL:{acl_name} - {dst_ip} | acl_name is set to about.labels.key/value, dst_ip is set to target.ip |
| 335004 | NAC is disabled for host - {dst_ip} | dst_ip is set to target.ip |
| 335005 | NAC Downloaded ACL parse failure - {dst_ip} | dst_ip is set to target.ip |
| 335006 | NAC Applying ACL: {acl_name} - {dst_ip} | acl_name is set to about.labels.key/value, dst_ip is set to target.ip |
| 335008 | NAC (IPsec|IPSec) terminate from dynamic ACL:{acl_name} - {dst_ip} | acl_name is set to about.labels.key/value, dst_ip is set to target.ip |
| 335009 | NAC Revalidate request by administrative action - {dst_ip} | dst_ip is set to target.ip |
| 335010 | NAC Revalidate All request by administrative action - {num_of_sessions} sessions | num_of_sessions is set to about.labels.key/value |
| 335011 | NAC Revalidate Group request by administrative action for {group_name} group - {num_of_sessions} sessions | group_name is set to target.user.group_identifiers, num_of_sessions is set to about.labels.key/value |
| 335012 | NAC Initialize request by administrative action - {dst_ip} | dst_ip is set to target.ip |
| 335013 | NAC Initialize All request by administrative action - {num_of_sessions} sessions | num_of_sessions is set to about.labels.key/value |
| 335014 | NAC Initialize Group request by administrative action for {group_name} group - {num_of_sessions} sessions | group_name is set to target.user.group_identifiers, num_of_sessions is set to about.labels.key/value |
| 336001 | Route {route_name} stuck-in-active state in EIGRP-{dst_ip} {eigrp_router}. Cleaning up | route_name is set to about.labels.key/value, dst_ip is set to target.ip, eigrp_router is set to about.labels.key/value |
| 336002 | Handle {handle_id} is not allocated in pool | handle_id is set to about.labels.key/value |
| 336003 | No buffers available for {no_of_bytes} byte packet | no_of_bytes is set to about.labels.key/value |
| 336004 | Negative refcount in pakdesc {packet_identifier} | packet_identifier is set to about.labels.key/value |
| 336005 | Flow control error, {error_message} , on {interface_name} | error_message is set to security_result.description, interface_name is set to about.labels.key/value |
| 336006 | {no_of_peers} peers exist on IIDB {interface_name} | no_of_peers is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 336008 | Lingering DRDB deleting IIDB, dest {dst_ip}, {next_hop_address} ({interface_name}), origin {origin_str} | dst_ip is set to target.ip, next_hop_address is set to about.labels.key/value, interface_name is set to about.labels.key/value, origin_str is set to about.labels.key/value |
| 336009 | {pdm_name} {autonomous_system_id}: Internal Error | pdm_name is set to about.labels.key/value, autonomous_system_id is set to about.labels.key/value |
| 336010 | {protocol}-<message_text> {table_id} {autonomous_system_id}: Neighbor {neighbor_address} (<message_text>) is {event_msg}: {security_description} | protocol is set to network.ip_protocol, table_id is set to about.labels.key/value, autonomous_system_id is set to about.labels.key/value, neighbor_address is set to about.labels.key/value, interface_name is set to about.labels.key/value, event_msg is set to about.labels.key/value, security_description is set to security_result.description |
| 336012 | Interface {interface_name} going down and {neighbor_links} links exist | interface_name is set to about.labels.key/value, neighbor_links is set to about.labels.key/value |
| 336013 | Route iproute, {iproute_successors} successors, {db_successors} rdbs | iproute_successors is set to about.labels.key/value, db_successors is set to about.labels.key/value |
| 336015 | Unable to open socket for AS {as_number} | as_number is set to about.labels.key/value |
| 336016 | Unknown timer type {timer_type} expiration | timer_type is set to about.labels.key/value |
| 336019 | {target_file_full_path} {as_number}: {prefix_source} threshold prefix level ({prefix_threshold}) reached | target_file_full_path is set to target.file.full_path, as_number is set to about.labels.key/value, prefix_source is set to about.labels.key/value, prefix_threshold is set to about.labels.key/value |
| 337000 | Created BFD session with local discriminator <{id}> on <{real_interface}> with neighbor <{dst_ip} | id is set to about.labels.key/value, real_interface is set to about.labels.key/value, dst_ip is set to target.ip |
| 337001 | Terminated BFD session with local discriminator <{id}> on <{real_interface}> with neighbor <{dst_ip}> due to <{summary}> | id is set to about.labels.key/value, real_interface is set to about.labels.key/value, dst_ip is set to target.ip, summary is set to security_result.summary |
| 337005 | Phone Proxy SRTP: Media session not found for media_term_ip/media_term_port for packet from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 338001 | Dynamic filter monitored blacklisted protocol traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port} , (<message_text>), source malicious address resolved from local or dynamic list: domain name, threat-level: {threat_level}, category: {category} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, threat_level is set to about.labels.key/value, category is set to security_result.category_details |
| 338003 | Dynamic filter monitored blacklisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port} , (<message_text>), source {malicious_address} resolved from (local|dynamic) list: {ip_address}/{subnet_mask}, threat-level: {threat_level}, category: {category} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, malicious_address is set to about.labels.key/value, ip_address is set to about.labels.key/value, subnet_mask is set to about.labels.key/value, threat_level is set to about.labels.key/value, category is set to security_result.category_details |
| 338004 | Dynamic (Filter|filter) (permitted|monitored) blacklisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port}({dst_mapped_ip}/{dst_mapped_port}), destination {malicious_address} resolved from (local|dynamic) list: {ip_address}/{subnet_mask}, threat-level: {threat_level}, category: {category} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, malicious_address is set to about.labels.key/value, ip_address is set to about.labels.key/value, subnet_mask is set to about.labels.key/value, threat_level is set to about.labels.key/value, category is set to security_result.category_details |
| 338005 | Dynamic filter dropped blacklisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port}({dst_mapped_ip}/{dst_mapped_port}), source {malicious_address} resolved from (local|dynamic) list: {domain_name}, threat-level: {threat_level}, category: {category} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, malicious_address is set to about.labels.key/value, domain_name is set to about.labels.key/value, threat_level is set to about.labels.key/value, category is set to security_result.category_details |
| 338006 | Dynamic filter dropped blacklisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port}({dst_mapped_ip}/{dst_mapped_port}), destination {malicious_address} resolved from (local|dynamic) list: {domain_name}, threat-level: {threat_level}, category: {category} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, malicious_address is set to about.labels.key/value, domain_name is set to about.labels.key/value, threat_level is set to about.labels.key/value, category is set to security_result.category_details |
| 338007 | Dynamic filter dropped blacklisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port}({dst_mapped_ip}/{dst_mapped_port}), source {malicious_address} resolved from (local|dynamic) list: {ip_address}/{subnet_mask}, threat-level: {threat_level}, category: {category} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, malicious_address is set to about.labels.key/value, ip_address is set to about.labels.key/value, subnet_mask is set to about.labels.key/value, threat_level is set to about.labels.key/value, category is set to security_result.category_details |
| 338008 | Dynamic (Filter|filter) dropped blacklisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port}({dst_mapped_ip}/{dst_mapped_port}), destination {malicious_address} resolved from (local|dynamic) list: {ip_address}/{subnet_mask}, threat-level: {threat_level}, category: {category} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, malicious_address is set to about.labels.key/value, ip_address is set to about.labels.key/value, subnet_mask is set to about.labels.key/value, threat_level is set to about.labels.key/value, category is set to security_result.category_details |
| 338103 | Dynamic filter {filter_action} whitelisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port}, (<message_text>), source {malicious_address} resolved from (local|dynamic) list: {ip_address}/{subnet_mask} | filter_action is set to about.labels.key/value, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, malicious_address is set to about.labels.key/value, ip_address is set to about.labels.key/value, subnet_mask is set to about.labels.key/value |
| 338101 | Dynamic filter {filter_action} whitelisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port}, (<message_text>), source {malicious_address} resolved from (local|dynamic) list: {domain_name} | filter_action is set to about.labels.key/value, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, malicious_address is set to about.labels.key/value, domain_name is set to about.labels.key/value |
| 338102 | Dynamic filter {filter_action} whitelisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port}({dst_mapped_ip}/{dst_mapped_port}), destination {malicious_address} resolved from (local|dynamic) list: {domain_name} | filter_action is set to about.labels.key/value, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, malicious_address is set to about.labels.key/value, domain_name is set to about.labels.key/value |
| 338104 | Dynamic filter {filter_action} whitelisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port}({dst_mapped_ip}/{dst_mapped_port}), destination {malicious_address} resolved from (local|dynamic) list: {ip_address}/{subnet_mask} | filter_action is set to about.labels.key/value, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, malicious_address is set to about.labels.key/value, ip_address is set to about.labels.key/value, subnet_mask is set to about.labels.key/value |
| 338201 | Dynamic filter monitored greylisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port}, (<message_text>), source {malicious_address} resolved from (local|dynamic) list: {domain_name}, threat-level: {threat_level}, category: {category} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, malicious_address is set to about.labels.key/value, domain_name is set to about.labels.key/value, threat_level is set to about.labels.key/value, category is set to security_result.category_details |
| 338202 | Dynamic filter monitored greylisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port}({dst_mapped_ip}/{dst_mapped_port}), destination {malicious_address} resolved from (local|dynamic) list: {domain_name}, threat-level: {threat_level}, category: {category} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, malicious_address is set to about.labels.key/value, domain_name is set to about.labels.key/value, threat_level is set to about.labels.key/value, category is set to security_result.category_details |
| 338203 | Dynamic filter dropped greylisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port}({dst_mapped_ip}/{dst_mapped_port}), source {malicious_address} resolved from (local|dynamic) list: {domain_name}, threat-level: {threat_level}, category: {category} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, malicious_address is set to about.labels.key/value, domain_name is set to about.labels.key/value, threat_level is set to about.labels.key/value, category is set to security_result.category_details |
| 338204 | Dynamic (Filter|filter) dropped greylisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port}({dst_mapped_ip}/{dst_mapped_port}), destination ({malicious_address}|malicious address) resolved from (local|dynamic) list: {domain_name}, threat-level: {threat_level}, category: {category} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, malicious_address is set to about.labels.key/value, domain_name is set to about.labels.key/value, threat_level is set to about.labels.key/value, category is set to security_result.category_details |
| 338002 | Dynamic (Filter|filter) (permitted|monitored) blacklisted {protocol} traffic from {src_interface_name}:{src_ip}/{src_port}({src_mapped_ip}/{src_mapped_port}) to {dst_interface_name}:{dst_ip}/{dst_port}({dst_mapped_ip}/{dst_mapped_port}), destination {malicious_address} resolved from (local|dynamic) list: {domain_name}( threat-level: {threat_level}, category: {category})? | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_mapped_ip is set to principal.ip, src_mapped_port is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_mapped_ip is set to target.ip, dst_mapped_port is set to target.labels.key/value, malicious_address is set to about.labels.key/value, domain_name is set to about.labels.key/value, threat_level is set to about.labels.key/value, category is set to security_result.category_details |
| 338301 | Intercepted DNS reply for domain {domain_name} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} , matched {administrator_list} | domain_name is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, administrator_list is set to about.labels.key/value |
| 338302 | Address {dst_ip} discovered for domain {domain_name} from {administrator_list} , Adding rule | dst_ip is set to target.ip, domain_name is set to about.labels.key/value, administrator_list is set to about.labels.key/value |
| 338303 | Address {dst_ip} ({domain_name}) timed out(.|,) Removing rule | dst_ip is set to target.ip, domain_name is set to about.labels.key/value |
| 338304 | Successfully downloaded dynamic filter data file from updater server {redirect_url} | redirect_url is set to target.url |
| 338305 | Failed to download dynamic filter data file from updater server {redirect_url} | redirect_url is set to target.url |
| 338306 | Failed to authenticate with dynamic filter updater server {redirect_url} | redirect_url is set to target.url |
| 338308 | Dynamic filter updater server dynamically changed from {src_hostname} : {src_port} to {target_hostname} : {dst_port} | src_hostname is set to principal.hostname, src_port is set to principal.port, target_hostname is set to target.hostname, dst_port is set to target.port |
| 338310 | Failed to update from dynamic filter updater server {redirect_url}, reason: {summary} | redirect_url is set to target.url, summary is set to security_result.summary |
| 339001 | <message_text> certificate update failed for <{num_tries}> | num_tries is set to about.labels.key/value |
| 339002 | Umbrella device registration failed with error code <{error_code}> | error_code is set to security_result.description |
| 339005 | Umbrella device registration failed after <{num_tries}> retries | num_tries is set to about.labels.key/value |
| 339006 | Umbrella resolver {current_resolver} {dst_ip} is reachable, resuming Umbrella redirect | current_resolver is set to about.labels.key/value, dst_ip is set to target.ip |
| 339007 | Umbrella resolver {current_resolver} {dst_ip} is unreachable, moving to fail-open. Starting probe to resolver | current_resolver is set to about.labels.key/value, dst_ip is set to target.ip |
| 339008 | Umbrella resolver {current_resolver} {dst_ip} is unreachable, moving to fail-close | current_resolver is set to about.labels.key/value, dst_ip is set to target.ip |
| 340001 | Loopback-proxy error: {summary} context id {context_id} , context type = {version_protocol}/{request_type}/{address_type} client socket (internal)= {src_ip}/{src_port} server socket (internal)= {server_address_internal} /{server_port_internal} server socket (external)= {server_address_external} /{server_port_external} remote socket (external)= {dst_ip}/{dst_port} | summary is set to security_result.summary, context_id is set to about.labels.key/value, version_protocol is set to network.tls.version_protocol, request_type is set to about.labels.key/value, address_type is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, server_address_internal is set to about.labels.key/value, server_port_internal is set to about.labels.key/value, server_address_external is set to about.labels.key/value, server_port_external is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 340002 | Loopback-proxy info: {summary} context id {context_id} , context type = {version_protocol}/{request_type}/{address_type} client socket (internal)= {src_ip}/{src_port} server socket (internal)= {server_address_internal}/{server_port_internal} server socket (external)= {server_address_external}/{server_port_external} remote socket (external)= {dst_ip}/{dst_port} | summary is set to security_result.summary, context_id is set to about.labels.key/value, version_protocol is set to network.tls.version_protocol, request_type is set to about.labels.key/value, address_type is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, server_address_internal is set to about.labels.key/value, server_port_internal is set to about.labels.key/value, server_address_external is set to about.labels.key/value, server_port_external is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 341001, 341002 | Policy Agent (started|stopped) successfully for {dst_service} {dst_ip} | dst_ip is set to target.ip |
| 341003 | Policy Agent failed to start for {dst_service} {dst_ip} | dst_ip is set to target.ip |
| 341004 | Storage device not available: Attempt to shutdown module {software_module_name} failed | software_module_name is set to about.labels.key/value |
| 341005 | Storage device not available. Shutdown issued for module {software_module_name} | software_module_name is set to about.labels.key/value |
| 341006 | Storage device not available. Failed to stop recovery of module {software_module_name} | software_module_name is set to about.labels.key/value |
| 341007 | Storage device not available. Further recovery of module {software_module_name} was stopped.* | software_module_name is set to about.labels.key/value |
| 341008 | Storage device not found. Auto-boot of module {software_module_name} cancelled.* | software_module_name is set to about.labels.key/value |
| 341010 | Storage device with serial number {serial_number} (inserted into|removed from) bay {bay_no} | serial_number is set to about.labels.key/value, bay_no is set to about.labels.key/value |
| 341011 | Storage device with serial number {serial_number} in bay {bay_no} faulty | serial_number is set to about.labels.key/value, bay_no is set to about.labels.key/value |
| 342002 | REST API Agent failed, reason: {summary} | summary is set to security_result.summary |
| 342006, 342008 | Failed to (install|uninstall) REST API image, reason: <{summary}> | summary is set to security_result.summary |
| 400000 to 400050 | {label} {protocol} (?P<summary><message_text>) from {src_ip} to {dst_ip} on interface {dst_interface_name} | summary is set to security_result.summary, label is set to about.labels.key/value, protocol is set to network.ip_protocol, src_ip is set to principal.ip, dst_ip is set to target.ip, dst_interface_name is set to target.labels.key/value |
| 400000 to 400050 | {label} (?P<summary><message_text>) from {src_ip} to {dst_ip} on interface {dst_interface_name} | summary is set to security_result.summary, label is set to about.labels.key/value, src_ip is set to principal.ip, dst_ip is set to target.ip, dst_interface_name is set to target.labels.key/value |
| 401002 | Shun added: IP_address {src_ip} port {src_port} | src_ip is set to principal.ip, src_port is set to principal.port |
| 401003 | Shun deleted: {src_ip} | src_ip is set to principal.ip |
| 401004 | Shunned packet:<message_text>= {src_ip} on interface {src_interface_name} | src_ip is set to principal.ip, src_interface_name is set to principal.labels.key/value |
| 401004 | Shunned packet:{src_ip} {pkg_direction} {dst_ip} on interface {dst_interface} | src_ip is set to principal.ip, pkg_direction is set to about.labels.key/value, dst_ip is set to target.ip, dst_interface is set to about.labels.key/value |
| 401005 | Shun add failed: unable to allocate resources for<message_text> {src_ip} port {src_port} | src_ip is set to principal.ip, src_port is set to principal.port |
| 402114 | IPSEC: Received an {protocol} packet (SPI={spi} , sequence number={seq_number}) from {src_ip} to {dst_ip} with an invalid SPI | protocol is set to network.ip_protocol, spi is set to about.labels.key/value, seq_number is set to about.labels.key/value, src_ip is set to principal.ip, dst_ip is set to target.ip |
| 402115 | IPSEC: Received a packet from {src_ip} to {dst_ip} containing {received_protocol} data instead of {expected_protocol} data | src_ip is set to principal.ip, dst_ip is set to target.ip, received_protocol is set to about.labels.key/value, expected_protocol is set to about.labels.key/value |
| 402116 | IPSEC: Received an {protocol} packet (SPI={spi}, sequence number={seq_number}) from {src_ip} ({src_username}) to {dst_ip}. The decapsulated inner packet doesn't match the negotiated policy in the SA. The packet specifies its destination as {dst_ip1}, its source as {src_ip1}, and its protocol as tcp. The SA specifies its local proxy as {src_ip2}/{local_proxy_port} and its remote_proxy as {dst_ip2}/{remote_proxy_subnetmask}/{remote_transport_protocol}/{remote_proxy_port} | protocol is set to network.ip_protocol, spi is set to about.labels.key/value, seq_number is set to about.labels.key/value, src_ip is set to principal.ip, src_username is set to principal.user.userid, dst_ip is set to target.ip, dst_ip1 is set to target.ip, src_ip1 is set to principal.ip, src_ip2 is set to principal.ip, local_proxy_subnetmask is set to about.labels.key/value, local_transport_protocol is set to about.labels.key/value, local_proxy_port is set to about.labels.key/value, dst_ip2 is set to target.ip, remote_proxy_subnetmask is set to about.labels.key/value, remote_transport_protocol is set to about.labels.key/value, remote_proxy_port is set to about.labels.key/value
"security_result.category" is set to "NETWORK_SUSPICIOUS" "network.direction" is set to "INBOUND" |
| 402117 | IPSEC: Received a non-IPsec ({protocol}) packet from {src_ip} to {dst_ip} | protocol is set to network.ip_protocol, src_ip is set to principal.ip, dst_ip is set to target.ip |
| 402118 | IPSEC: Received an {protocol} packet (SPI={spi}, sequence number={seq_number}) from {src_ip} ({src_username}) to {dst_ip} containing an illegal IP fragment of length {frag_len} with offset {frag_offset} | protocol is set to network.ip_protocol, spi is set to about.labels.key/value, seq_number is set to about.labels.key/value, src_ip is set to principal.ip, src_username is set to principal.user.userid, dst_ip is set to target.ip, frag_len is set to about.labels.key/value, frag_offset is set to about.labels.key/value |
| 402119 | IPSEC: Received an {protocol} packet (SPI={spi}, sequence number={seq_number}) from {src_ip} ({src_username}) to {dst_ip} that failed anti-replay checking | protocol is set to network.ip_protocol, spi is set to about.labels.key/value, seq_number is set to about.labels.key/value, src_ip is set to principal.ip, src_username is set to principal.user.userid, dst_ip is set to target.ip |
| 402120 | IPSEC: Received an {protocol} packet (SPI={spi} , sequence number={seq_number}) from {src_ip} ({src_username}) to {dst_ip} that failed authentication | protocol is set to network.ip_protocol, spi is set to about.labels.key/value, seq_number is set to about.labels.key/value, src_ip is set to principal.ip, src_username is set to principal.user.userid, dst_ip is set to target.ip |
| 402121 | IPSEC: Received an {protocol} packet (SPI={spi} , sequence number={seq_number}) from {src_ip} ({src_username}) to {dst_ip} that was dropped by (IPsec|IPSec) ({summary}) | protocol is set to network.ip_protocol, spi is set to about.labels.key/value, seq_number is set to about.labels.key/value, src_ip is set to principal.ip, src_username is set to principal.user.userid, dst_ip is set to target.ip, summary is set to security_result.summary |
| 402122 | Received a cleartext packet from {src_ip} to {dst_ip} that was to be encapsulated in (IPsec|IPSec) that was dropped by (IPsec|IPSec) ({summary}) | src_ip is set to principal.ip, dst_ip is set to target.ip, summary is set to security_result.summary |
| 402123 | {category}: The {accel_type} hardware accelerator encountered an error (code={error_message}) while executing crypto command {command} | category is set to security_result.category_details, accel_type is set to about.labels.key/value, error_message is set to security_result.description, command is set to target.process.command_line |
| 402124 | {category}: The ASA hardware accelerator encountered an error (HWErrAddr= {hardware_error_address}, Core= {crypto_core}, HwErrCode= {hardware_error_code}, IstatReg= 0x8, PciErrReg= 0x0, CoreErrStat= 0x41, CoreErrAddr={core_error_address},<message_text>) | category is set to security_result.category_details, hardware_error_address is set to about.labels.key/value, crypto_core is set to about.labels.key/value, hardware_error_code is set to about.labels.key/value, core_error_address is set to about.labels.key/value |
| 402125 | The ASA hardware accelerator {ring} timed out ({parameters}) | ring is set to about.labels.key/value, parameters is set to about.labels.key/value |
| 402126 | {category}: The ASA created Crypto Archive File {target_file_full_path} as a Soft Reset was necessary | category is set to security_result.category_details, target_file_full_path is set to target.file.full_path |
| 402127 | {category}: The ASA is skipping the writing of latest Crypto Archive File as the maximum # of files, {max_num}, allowed have been written to {target_file_full_path}. Please {summary} if you want more Crypto Archive Files saved | category is set to security_result.category_details, max_num is set to about.labels.key/value, target_file_full_path is set to target.file.full_path, summary is set to security_result.summary |
| 402128 | {category}: An attempt to allocate a large memory block failed, size: {block_size}, limit: {limit} | category is set to security_result.category_details, block_size is set to about.labels.key/value, limit is set to about.labels.key/value |
| 402129 | {category}: An attempt to release a DMA memory block failed, location: {address} | category is set to security_result.category_details, address is set to about.labels.key/value |
| 402130 | {category}: Received an ESP packet (SPI = {spi}, sequence number={sequence_number}) from {src_ip} (user={user_name}) to {dst_ip} with incorrect (IPsec|IPSec) padding | category is set to security_result.category_details, spi is set to about.labels.key/value, sequence_number is set to about.labels.key/value, src_ip is set to principal.ip, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 402131 | {category}: {summary} changing the {accel_instance} hardware accelerator's configuration bias from {old_config_bias} to {new_config_bias} | category is set to security_result.category_details, summary is set to security_result.summary, accel_instance is set to about.labels.key/value, old_config_bias is set to about.labels.key/value, new_config_bias is set to about.labels.key/value |
| 402140 | {category}: {summary}: modulus len {length} | category is set to security_result.category_details, summary is set to security_result.summary, length is set to about.labels.key/value |
| 402141 | {category}: {summary}: key set {crypto_type}, reason {error_message} | category is set to security_result.category_details, summary is set to security_result.summary, crypto_type is set to about.labels.key/value, error_message is set to security_result.description |
| 402142 | {category}: {summary}: algorithm {algorithm}, mode {mode} | category is set to security_result.category_details, summary is set to security_result.summary, algorithm is set to about.labels.key/value, mode is set to about.labels.key/value |
| 402144 | {category}: Digital signature error: signature algorithm {signature} , hash algorithm {algo_hash} | category is set to security_result.category_details, signature is set to about.labels.key/value, algo_hash is set to about.labels.key/value |
| 402146 | {category}: Keyed hash generation error: algorithm {algo_hash}, key len {length} | category is set to security_result.category_details, algo_hash is set to about.labels.key/value, length is set to about.labels.key/value |
| 402145 | {category}: Hash generation error: algorithm {algo_hash} | category is set to security_result.category_details, algo_hash is set to about.labels.key/value |
| 402147 | {category}: HMAC generation error: algorithm {algorithm} | category is set to security_result.category_details, algorithm is set to about.labels.key/value |
| 402149 | {category}: weak {encryption_type} ({length}). Operation disallowed. Not FIPS 140-2 compliant | category is set to security_result.category_details, encryption_type is set to about.labels.key/value, length is set to about.labels.key/value |
| 402150 | {category}: Deprecated hash algorithm used for RSA {operation} ({algo_hash}). Operation disallowed. Not FIPS 140-2 compliant | category is set to security_result.category_details, operation is set to about.labels.key/value, algo_hash is set to about.labels.key/value |
| 403101 | PPTP session state not established, but received an X{protocol} packet, tunnel_id={tunnel_id}, session_id={session_id} | protocol is set to network.ip_protocol, tunnel_id is set to about.labels.key/value, session_id is set to network.session_id |
| 403102 | PPP virtual interface {interface_name} rcvd pkt with invalid protocol: {protocol}, reason: {summary} | interface_name is set to about.labels.key/value, protocol is set to network.ip_protocol, summary is set to security_result.summary |
| 403104 | PPP virtual interface {interface_name} requires mschap for MPPE | interface_name is set to about.labels.key/value |
| 403106 | PPP virtual interface {interface_name} requires RADIUS for MPPE | interface_name is set to about.labels.key/value |
| 403107 | PPP virtual interface {interface_name} missing aaa server group info | interface_name is set to about.labels.key/value |
| 403108 | PPP virtual interface {interface_name} missing client ip address option | interface_name is set to about.labels.key/value |
| 403109 | Rec'd packet not an PPTP packet. ({dst_ip}) dest_address={dst_ip}, src_addr={src_ip}, data:.* | dst_ip is set to target.ip, dst_ip is set to target.ip, src_ip is set to principal.ip |
| 403110 | PPP virtual interface {interface_name} , user: {src_username} missing MPPE key from {resource} | interface_name is set to about.labels.key/value, src_username is set to principal.user.userid, resource is set to target.resource.name |
| 403500 | PPPoE - Service name 'any' not received in PADO. {interface_name} AC:{ac_name} | interface_name is set to about.labels.key/value, ac_name is set to about.labels.key/value |
| 403501 | PPPoE - Bad host-unique in PADO - packet dropped. {interface_name} AC:{ac_name} | interface_name is set to about.labels.key/value, ac_name is set to about.labels.key/value |
| 403502 | PPPoE - Bad host-unique in PADS - dropping packet. {interface_name} AC:{ac_name} | interface_name is set to about.labels.key/value, ac_name is set to about.labels.key/value |
| 403503 | PPPoE:PPP link down:{summary} | summary is set to security_result.summary |
| 403504 | PPPoE:No 'vpdn group {group_name}' for PPPoE is created | group_name is set to target.user.group_identifiers |
| 403505 | PPPoE:PPP - Unable to set default route to {dst_ip} at {interface_name} | dst_ip is set to target.ip, interface_name is set to about.labels.key/value |
| 403506 | PPPoE:failed to assign PPP {dst_ip} netmask {subnet_mask} at {interface_name} | dst_ip is set to target.ip, subnet_mask is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 403507 | PPPoE:PPPoE client on interface {interface_name} failed to locate PPPoE vpdn group {group_name} | interface_name is set to about.labels.key/value, group_name is set to target.user.group_identifiers |
| 405001 | Received ARP {action_details} collision from {dst_ip}/{dst_mac} on interface {interface_name} with existing ARP entry {src_ip}/{src_mac} | action_details is set to security_result.action_details, dst_ip is set to target.ip, dst_mac is set to target.mac, interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_mac is set to principal.mac |
| 405002 | Received mac mismatch collision from {dst_ip}/{dst_mac} for authenticated host | dst_ip is set to target.ip, dst_mac is set to target.mac |
| 405003 | IP address collision detected between host {src_ip} at {src_mac} and interface {interface_name}, {dst_mac} | src_ip is set to principal.ip, src_mac is set to principal.mac, interface_name is set to about.labels.key/value, dst_mac is set to target.mac |
| 405101 | Unable to Pre-allocate H225 Call Signalling Connection for (foreign_address|faddr) {dst_ip} /{dst_port}] to (local_address|laddr) {src_ip} [/{src_port}] | dst_ip is set to target.ip, dst_port is set to target.port, src_ip is set to principal.ip, src_port is set to principal.port |
| 405102 | Unable to Pre-allocate H245 Connection for (foreign_address|faddr) {dst_ip} /{dst_port}] to (local_address|laddr) {src_ip} [/{src_port}] | dst_ip is set to target.ip, dst_port is set to target.port, src_ip is set to principal.ip, src_port is set to principal.port |
| 405103 | H225 message from {src_ip}/{src_port} to {dst_ip}/{dst_port} contains bad protocol discriminator {hex} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, hex is set to about.labels.key/value |
| 405104 | H225 message<message_text>received from {dst_ip}/{dst_port} to {src_ip}/{src_port} before SETUP | dst_ip is set to target.ip, dst_port is set to target.port, src_ip is set to principal.ip, src_port is set to principal.port |
| 405105 | H323 RAS message AdmissionConfirm received from {dst_ip}/{dst_port} to {src_ip}/{src_port} without an AdmissionRequest | dst_ip is set to target.ip, dst_port is set to target.port, src_ip is set to principal.ip, src_port is set to principal.port |
| 405106 | H323 {channel_number} channel is not created from <message_text> | channel_number is set to about.labels.key/value |
| 405201 | ILS {ILS_message_type} from {src_interface_name}:{src_ip} to {dst_interface_name}:/{dst_ip} has wrong embedded address {embedded_ip_address} | ILS_message_type is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, embedded_ip_address is set to about.labels.key/value |
| 405300 | Radius Accounting Request received from {dst_ip} is not allowed | dst_ip is set to target.ip |
| 405301 | Attribute {attribute_number} does not match for user {dst_ip} | attribute_number is set to about.labels.key/value, dst_ip is set to target.ip |
| 406001 | FTP port command low port: {src_ip}/{src_port} to {dst_ip} on interface {interface_name} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, interface_name is set to about.labels.key/value |
| 406002 | FTP port command different address: IP_address({src_ip}) to {dst_ip} on interface {interface_name} | src_ip is set to principal.ip, dst_ip is set to target.ip, interface_name is set to about.labels.key/value |
| 407001 | Deny traffic for local-host {interface_name}:{dst_ip} , license limit of {license_limit_number} exceeded | interface_name is set to about.labels.key/value, dst_ip is set to target.ip, license_limit_number is set to about.labels.key/value |
| 407002 | Embryonic limit {nconns}/{elimit} for through connections exceeded.{dst_ip}/{dst_port} to {global_address} ({src_ip})/{src_port} on interface {interface_name} | nconns is set to about.labels.key/value, elimit is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, global_address is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, interface_name is set to about.labels.key/value |
| 408001 | IP route counter negative - {summary}, {dst_ip} Attempt: {attempt_number} | summary is set to security_result.summary, dst_ip is set to target.ip, attempt_number is set to about.labels.key/value |
| 408002 | ospf process {route_id} {route_name} {route_type} update {address1} {netmask1} {distance1}/{metric1}] via source {src_ip} :{interface1} {address2} {netmask2} [{distance2}/{metric2}] {interface2} | route_id is set to about.labels.key/value, route_name is set to about.labels.key/value, route_type is set to about.labels.key/value, address1 is set to about.labels.key/value, netmask1 is set to about.labels.key/value, distance1 is set to about.labels.key/value, metric1 is set to about.labels.key/value, src_ip is set to principal.ip, interface1 is set to about.labels.key/value, address2 is set to about.labels.key/value, netmask2 is set to about.labels.key/value, distance2 is set to about.labels.key/value, metric2 is set to about.labels.key/value, interface2 is set to about.labels.key/value |
| 408003 | can't track this type of object {hex} | hex is set to about.labels.key/value |
| 408101 | KEYMAN : Type {encrption_type} encryption unknown. Interpreting keystring as literal | encrption_type is set to about.labels.key/value |
| 408102 | KEYMAN : Bad encrypted keystring for {encrypted_key} id {encrypted_key_id} | encrypted_key is set to about.labels.key/value, encrypted_key_id is set to about.labels.key/value |
| 409002 | db_free: external LSA {dst_ip} {subnet_mask} | dst_ip is set to target.ip, subnet_mask is set to about.labels.key/value |
| 409003 | Received invalid packet: {summary} from {dst_ip} , {interface_name} | summary is set to security_result.summary, dst_ip is set to target.ip, interface_name is set to about.labels.key/value |
| 409004 | Received reason from unknown neighbor {dst_ip} | dst_ip is set to target.ip |
| 409005 | Invalid length number in OSPF packet from {dst_ip} (ID {src_ip}), {interface_name} | dst_ip is set to target.ip, src_ip is set to principal.ip, interface_name is set to about.labels.key/value |
| 409006 | Invalid lsa: {summary} Type {lsa_number} , LSID <message_text> from {dst_ip} , <message_text> , {interface_name} | summary is set to security_result.summary, lsa_number is set to about.labels.key/value, dst_ip is set to target.ip, interface_name is set to about.labels.key/value |
| 409007 | Found LSA with the same host bit set but using different mask LSA ID {src_ip} {src_netmask} New: Destination {dst_ip} {dst_netmask} | src_ip is set to principal.ip, src_netmask is set to principal.labels.key/value, dst_ip is set to target.ip, dst_netmask is set to target.labels.key/value |
| 409008, 409106 | Found generating default LSA with non-zero mask LSA type: {lsa_number} Mask: {netmask} metric: {metric_number} area: {area} | lsa_number is set to about.labels.key/value, netmask is set to about.labels.key/value, metric_number is set to about.labels.key/value, area is set to about.labels.key/value |
| 409010, 409108 | Virtual link information found in non-backbone area: {area} | area is set to about.labels.key/value |
| 409011 | OSPF detected duplicate router-id {duplicate_ip} from {dst_ip} on interface {interface_name} | duplicate_ip is set to about.labels.key/value, dst_ip is set to target.ip, interface_name is set to about.labels.key/value |
| 409012 | Detected router with duplicate router ID {dst_ip} in area {area} | dst_ip is set to target.ip, area is set to about.labels.key/value |
| 409013 | Detected router with duplicate router ID {duplicate_ip} in Type-4 LSA advertised by {dst_ip} | duplicate_ip is set to about.labels.key/value, dst_ip is set to target.ip |
| 409014 | No valid authentication send {authentication_key} is available on interface {interface_name} | authentication_key is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 409015 | Key ID {key_id} received on interface {interface_name} | key_id is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 409016 | Key chain name {key_chain_name} on {interface_name} is invalid | key_chain_name is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 409017 | Key ID {key_id} in key chain {key_chain_name} is invalid | key_id is set to about.labels.key/value, key_chain_name is set to about.labels.key/value |
| 409023 | Attempting AAA Fallback method {method_name} for {request_type} request for user {user_name} :{auth_server} group {server_tag} unreachable | method_name is set to about.labels.key/value, request_type is set to about.labels.key/value, user_name is set to target.user.userid, auth_server is set to about.labels.key/value, server_ |
| 409101 | Received invalid packet: {packet} from {sender} , <message_text> | packet is set to about.labels.key/value, sender is set to about.labels.key/value |
| 409102 | Received packet with incorrect area from {sender} , {packet} , area {interface_area_id_str} , packet area {packet_area_id_str} | sender is set to about.labels.key/value, packet is set to about.labels.key/value, interface_area_id_str is set to about.labels.key/value, packet_area_id_str is set to about.labels.key/value |
| 409103 | Received {packet} from unknown neighbor {neighbor} | packet is set to about.labels.key/value, neighbor is set to about.labels.key/value |
| 409104 | Invalid length {packet_length} in OSPF packet type {packet_type} from {sender} (ID {packet_id}), {packet} | packet_length is set to about.labels.key/value, packet_type is set to about.labels.key/value, sender is set to about.labels.key/value, packet_id is set to about.labels.key/value, packet is set to about.labels.key/value |
| 409105 | Invalid lsa: {lsa_name} : Type 0x {lsa_type} , Length 0x {lsa_length} , LSID {lsid} from {sender} | lsa_name is set to about.labels.key/value, lsa_type is set to about.labels.key/value, lsa_length is set to about.labels.key/value, lsid is set to about.labels.key/value, sender is set to about.labels.key/value |
| 409107 | OSPFv3 process {target_process_name} could not pick a router-id, please configure manually | target_process_name is set to target.process.pid |
| 409109 | OSPF detected duplicate router-id {router_id} from <message_text> on interface {interface_name} | router_id is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 409110 | Detected router with duplicate router ID {router_id} in area {area_id_str} | router_id is set to about.labels.key/value, area_id_str is set to about.labels.key/value |
| 409111 | Multiple interfaces ({interface_name}) on a single link detected | interface_name is set to about.labels.key/value |
| 409114 | Doubly linked list prev linkage is NULL {summary} | summary is set to security_result.summary |
| 409115 | Unrecognized timer {timer} in OSPF {ofps} | timer is set to about.labels.key/value, ofps is set to about.labels.key/value |
| 409116 | Error for timer {timer} in OSPF process {target_process_name} | timer is set to about.labels.key/value, target_process_name is set to target.process.pid |
| 409117 | Can't find LSA database type {database_type}, area {area_id_str}, interface {interface_name} | database_type is set to about.labels.key/value, area_id_str is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 409120, 613029 | Router-ID {router_id} is in use by ospf process {ospf_process} | router_id is set to about.labels.key/value, ospf_process is set to about.labels.key/value |
| 409128 | OSPFv3<message_text>Area {area_id_str}: Router {router} originating invalid<message_text>, ID {id}, Metric {metric_number} on Link ID {link_id} Link Type {link_type} | area_id_str is set to about.labels.key/value, router is set to about.labels.key/value, id is set to about.labels.key/value, metric_number is set to about.labels.key/value, link_id is set to about.labels.key/value, link_type is set to about.labels.key/value |
| 410001 | ({action} )?(?P<protocol>UDP) DNS <message_text> from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port};<message_text>length <message_text> bytes exceeds (remaining packet length|protocol|configured)( limit of)? <message_text> bytes | protocol is set to network.ip_protocol, action is set to security_result.action, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 410002 | (?P<action>Dropped) {dropped_requests} (?P<protocol>DNS) responses with mis-matched id in the past {seconds}<message_text> from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | action is set to security_result.action, protocol is set to network.ip_protocol, dropped_requests is set to about.labels.key/value, seconds is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 410003, 410004 | {action_class}:{action} DNS (query|response) from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | action_class is set to about.labels.key/value, action is set to security_result.action, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 411001, 411002 | Line protocol on (interface|Interface) {interface_name} changed state to <message_text> | interface_name is set to about.labels.key/value |
| 411005 | Interface {interface_name} experienced a hardware transmit hang. The interface has been reset | interface_name is set to about.labels.key/value |
| 412001 | MAC {src_mac} moved from {src_interface_name} to {dst_interface_name} | src_mac is set to principal.mac, src_interface_name is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value |
| 412002 | Detected bridge table full while inserting MAC {src_mac} on interface {src_interface_name}. Number of entries = {no_of_fields} | src_mac is set to principal.mac, src_interface_name is set to principal.labels.key/value, no_of_fields is set to about.labels.key/value |
| 413001, 413002 | Module {module_id} is not able to (shut down|reload). Module Error: {summary} | module_id is set to about.labels.key/value, summary is set to security_result.summary |
| 413003 | Module {module_name} one is not a recognized type | module_name is set to about.labels.key/value |
| 413004 | Module {module_name} one failed to write software {new_version_number} (currently {current_version_number}), {summary}. Trying again | module_name is set to about.labels.key/value, new_version_number is set to about.labels.key/value, current_version_number is set to about.labels.key/value, summary is set to security_result.summary |
| 413005 | Module {product_id} in slot {slot_number}, application is not supported {target_service} version {app_version} type {app_type} | product_id is set to about.labels.key/value, slot_number is set to about.labels.key/value, target_service is set to target.application, app_version is set to about.labels.key/value, app_type is set to about.labels.key/value |
| 413005 | Module {module_id}, application is not supported {target_service} version {app_version} type {app_type} | module_id is set to about.labels.key/value, target_service is set to target.application, app_version is set to about.labels.key/value, app_type is set to about.labels.key/value |
| 413006 | {product_id} Module software version mismatch; slot {slot_number} is<message_text>version {running_version}. Slot <message_text>requires {required_version} | product_id is set to about.labels.key/value, slot_number is set to about.labels.key/value, running_version is set to about.labels.key/value, required_version is set to about.labels.key/value |
| 413007 | An unsupported ASA and IPS configuration is installed. {mpc_description} with {ips_description} is not supported | mpc_description is set to about.labels.key/value, ips_description is set to about.labels.key/value |
| 414001 | Failed to save logging buffer using file name {src_file_full_path} to FTP server {src_ip} on interface {interface_name}: {summary} | src_file_full_path is set to src.file.full_path, src_ip is set to principal.ip, interface_name is set to about.labels.key/value, summary is set to security_result.summary |
| 414002 | Failed to save logging buffer to flash:/syslog directory using file name: {src_file_full_path}: {summary} | src_file_full_path is set to src.file.full_path, summary is set to security_result.summary |
| 414003 | (?P<protocol>TCP) Syslog Server {src_interface_name}:{src_ip}/{src_port} not responding, New connections are (?P<action>permitted|denied) based on logging permit-hostdown policy | protocol is set to network.ip_protocol, action is set to security_result.action, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port |
| 414004 | (?P<protocol>TCP) Syslog Server {src_interface_name}:{src_ip}/{src_port}- Connection restored | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port |
| 414005 | (?P<protocol>TCP) Syslog Server {src_interface_name}:{src_ip}/{src_port} connected, New connections are permitted based on logging permit-hostdown policy | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port |
| 415001, 415002 | HTTP - matched {matched_string} in policy-map {map_name}, header field <message_text> exceeded {connection_action} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | matched_string is set to about.labels.key/value, map_name is set to about.labels.key/value, connection_action is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 415003, 415005, 415018 | HTTP - matched {matched_string} in policy-map {map_name}, <message_text> length exceeded {connection_action} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | matched_string is set to about.labels.key/value, map_name is set to about.labels.key/value, connection_action is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 415004 | HTTP - matched {matched_string} in policy-map {map_name}, content-type verification failed {connection_action} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | matched_string is set to about.labels.key/value, map_name is set to about.labels.key/value, connection_action is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 415006, 415007, 415008, 415009 | HTTP - matched {matched_string} in policy-map {map_name}, <message_text> matched {connection_action} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | matched_string is set to about.labels.key/value, map_name is set to about.labels.key/value, connection_action is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 415010 | matched {matched_string} in policy-map {map_name}, transfer encoding matched {connection_action} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | matched_string is set to about.labels.key/value, map_name is set to about.labels.key/value, connection_action is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 415011 | HTTP - policy-map {map_name} :Protocol violation {connection_action} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | map_name is set to about.labels.key/value, connection_action is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 415012 | HTTP - matched {matched_string} in policy-map {map_name}, (Unknown|unknown) mime-type {connection_action} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | matched_string is set to about.labels.key/value, map_name is set to about.labels.key/value, connection_action is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 415013 | HTTP - policy-map {map_name}:(Malformed|malformed) chunked encoding {connection_action} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | map_name is set to about.labels.key/value, connection_action is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 415014 | HTTP - matched {matched_string} in policy-map {map_name}, Mime-type in response wasn't found in the accept-types of the request {connection_action} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | matched_string is set to about.labels.key/value, map_name is set to about.labels.key/value, connection_action is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 415015 | HTTP - matched {matched_string} in policy-map {map_name}, transfer-encoding unknown {connection_action} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | matched_string is set to about.labels.key/value, map_name is set to about.labels.key/value, connection_action is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 415017 | HTTP - {matched_string} in policy-map {map_name}, <message_text> matched {connection_action} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | matched_string is set to about.labels.key/value, map_name is set to about.labels.key/value, connection_action is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 415016 | policy-map {policy_name}:Maximum number of unanswered HTTP requests exceeded {connection_action} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | policy_name is set to target.resource.name, connection_action is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 415019 | HTTP - matched {matched_string} in policy-map {map_name}, status line matched {connection_action} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | matched_string is set to about.labels.key/value, map_name is set to about.labels.key/value, connection_action is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 415020 | HTTP - matched {matched_string} in policy-map {map_name}, a non-ASCII character was matched {connection_action} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | matched_string is set to about.labels.key/value, map_name is set to about.labels.key/value, connection_action is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 416001 | (?P<action>Dropped) (?P<protocol>UDP) SNMP packet from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port}; version ({version_protocol}) is not allowed (through|thru) the firewall | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, version_protocol is set to network.tls.version_protocol |
| 417004 | Filter violation error: conn {modified_attribute_number} <message_text> | modified_attribute_number is set to about.labels.key/value |
| 417006 | No memory for {operation} ) in {dst_operation}. Handling: {another_mechanism} | operation is set to about.labels.key/value, dst_operation is set to about.labels.key/value, another_mechanism is set to about.labels.key/value |
| 418001 | Through-the-device packet to/from management-only network is denied: {protocol} src {src_interface_name}:{src_ip}/{src_port} dst {dst_interface_name}:{dst_ip}/{dst_port}
Through-the-device packet to/from management-only network is denied: {protocol} from {src_interface_name} {src_ip} ({src_port}) ([<message_text>], {src_sg_info} )] to {dst_interface_name} {dst_ip} ({dst_port}) [(<message_text> ), {dst_sg_info} ] |
protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_sg_info is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_sg_info is set to target.labels.key/value |
| 418018 | neighbor {dst_ip} IPv4 Unicast topology base removed from session {summary} | dst_ip is set to target.ip, summary is set to security_result.summary |
| 418018 | neighbor {dst_ip} (Down|Up){summary} | dst_ip is set to target.ip, summary is set to security_result.summary |
| 418019 | (sent to|received from) neighbor {dst_ip}, Reason: {summary}, Bytes: {bytes_transferred} | dst_ip is set to target.ip, summary is set to security_result.summary, bytes_transferred is set to about.labels.key/value |
| 418019 | (sent to|received from) neighbor {dst_ip}<message_text>bytes {bytes_transferred} | dst_ip is set to target.ip, bytes_transferred is set to about.labels.key/value |
| 418019 | (received from|sent to) neighbor {dst_ip}<message_text>{bytes_transferred} bytes | dst_ip is set to target.ip, bytes_transferred is set to about.labels.key/value |
| 419001 | Dropping {protocol} packet from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} , {summary} : MSS exceeded, MSS {mss_size} , data {data_size} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, summary is set to security_result.summary, mss_size is set to about.labels.key/value, data_size is set to about.labels.key/value |
| 419002 | (Received )?(duplicate|Duplicate) TCP SYN from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} with different initial sequence number | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 419003 | Cleared {protocol} urgent flag from {dst_interface_name}:{src_ip}/{src_port} to {src_interface_name}:{dst_ip}/{dst_port} | protocol is set to network.ip_protocol, dst_interface_name is set to target.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_interface_name is set to principal.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 419004 | TCP connection {connection_id} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} is probed by DCD | connection_id is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 419005 | TCP connection {connection_id} from {src_interface_name}:{src_ip}/{src_port} duration {duration} data {bytes_transferred}, is kept open by DCD as valid connection | connection_id is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, duration is set to network.session_duration, bytes_transferred is set to about.labels.key/value |
| 419006 | TCP connection {connection_id} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} duration{duration} data {bytes_transferred}, DCD probe was not responded from (client|server) interface {interface_name} | connection_id is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, duration is set to network.session_duration, bytes_transferred is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 420001 | IPS card not up and fail-close mode used, dropping ICMP packet {src_interface_name}:{src_ip} to {dst_interface_name}:{dst_ip} (type {icmp_type}, code {icmp_code} ) | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, icmp_type is set to about.labels.key/value, icmp_code is set to about.labels.key/value |
| 420002 | IPS requested to drop {protocol} packet(s)?( from)? {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}(/{dst_port})?( (type {icmp_type}, code {icmp_code} ))? | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, icmp_type is set to about.labels.key/value, icmp_code is set to about.labels.key/value |
| 420003 | IPS requested to reset TCP connection from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 420004 | Virtual Sensor {sensor_name} was added on the AIP SSM | sensor_name is set to about.labels.key/value |
| 420005 | Virtual Sensor {sensor_name} was deleted on the AIP SSM | sensor_name is set to about.labels.key/value |
| 420006 | Virtual Sensor not present and fail-close mode used, dropping {protocol} packet from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 420007 | {target_service} cannot be enabled for the module in slot {slot_id}. The module's current software version does not support this feature. Upgrade the software on the module in slot slot_id to support this feature. Received backplane header version {version_number}, required backplane header version version_number or higher. | target_service is set to target.application, slot_id is set to about.labels.key/value, version_number is set to about.labels.key/value |
| 421001 | (TCP|UDP) flow from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} is dropped because {target_service} has failed | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, target_service is set to target.application |
| 421002 | (TCP|UDP) flow from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} bypassed {target_service} checking because the protocol is not supported | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, target_service is set to target.application |
| 421005 | {interface_name} :{dst_ip} is counted as a user of {target_service} | interface_name is set to about.labels.key/value, dst_ip is set to target.ip, target_service is set to target.application |
| 421006 | There are {no_of_users} users of {target_service} accounted during the past 24 hours | no_of_users is set to about.labels.key/value, target_service is set to target.application |
| 421007 | {protocol} flow from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} is skipped because {target_service} has failed | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, target_service is set to target.application |
| 422004 | IP SLA Monitor {sla_operation_number}: Duplicate event received. Event number {sla_operation_event_id} | sla_operation_number is set to about.labels.key/value, sla_operation_event_id is set to about.labels.key/value |
| 422006 | IP SLA Monitor Probe {sla_id}:{summary} | sla_id is set to about.labels.key/value, summary is set to security_result.summary |
| 423001, 423002 | (?P<action>Allowed|Dropped) (invalid|mismatched) NBNS {pkt_type_name} with {summary} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | action is set to security_result.action, pkt_type_name is set to about.labels.key/value, summary is set to security_result.summary, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 423003, 423004 | (?P<action>Allowed|Dropped) (invalid|mismatched) NBDGM {pkt_type_name} with {summary} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | action is set to security_result.action, pkt_type_name is set to about.labels.key/value, summary is set to security_result.summary, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 423005 | (?P<action>Allowed|Dropped) NBDGM {pkt_type_name} fragment with {summary} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | action is set to security_result.action, pkt_type_name is set to about.labels.key/value, summary is set to security_result.summary, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 424001 | Packet (?P<action>denied) {protocol} {src_interface_name}:{src_ip}/{src_port}( ({src_fwuser}))? {dst_interface_name}:{dst_ip}/{dst_port}( ({dst_fwuser}))?. (Ingress|Egress) interface is in a backup state | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_fwuser is set to principal.user.userid/principal.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, dst_fwuser is set to target.user.userid/target.labels.key/value |
| 424002 | Connection to the backup interface is (?P<action>denied): {protocol} {src_interface_name}:{src_ip}(/{src_port})? {dst_interface_name}:{dst_ip}(/{dst_port})? | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 425003, 425004 | Interface {src_interface_name} (added|removed) (into|from) redundant interface {dst_interface_name} | src_interface_name is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value |
| 425001, 425002 | Redundant interface {src_interface_name} (removed|created) | src_interface_name is set to principal.labels.key/value |
| 425005 | Interface {src_interface_name} become active in redundant interface {dst_interface_name} | src_interface_name is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value |
| 425006 | Redundant interface {dst_interface_name} switch active member to {src_interface_name} failed | dst_interface_name is set to target.labels.key/value, src_interface_name is set to principal.labels.key/value |
| 426001, 426002 | PORT-CHANNEL:Interface {src_interface_name} <message_text> <message_text> EtherChannel interface Port-channel {port_channel} | src_interface_name is set to principal.labels.key/value, port_channel is set to about.labels.key/value |
| 426003 | PORT-CHANNEL:Interface {src_interface_name} has become standby in EtherChannel interface Port-channel {port_channel} | src_interface_name is set to principal.labels.key/value, port_channel is set to about.labels.key/value |
| 426004 | PORT-CHANNEL: Interface {src_interface_name} is not compatible with {dst_interface_name} and will be suspended <message_text> | src_interface_name is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value |
| 426101, 426102 | PORT-CHANNEL:Interface {src_interface_name} is <message_text> to <message_text> <message_text> EtherChannel interface {port_channel} by CLACP | src_interface_name is set to principal.labels.key/value, port_channel is set to about.labels.key/value |
| 426103 | PORT-CHANNEL:Interface {src_interface_name} is selected to move from standby to bundle in EtherChannel interface {port_channel} by CLACP | src_interface_name is set to principal.labels.key/value, port_channel is set to about.labels.key/value |
| 426104 | PORT-CHANNEL:Interface {src_interface_name} is unselected in EtherChannel interface {port_channel} by CLACP | src_interface_name is set to principal.labels.key/value, port_channel is set to about.labels.key/value |
| 428002 | WAAS confirmed from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}/{dst_port}, inspection services bypassed on this connection | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 429001 | CXSC card not up and fail-close mode used. (?P<action>Dropping) {protocol} packet from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}(/{dst_port})? | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 429002, 429003 | CXSC service card requested to (?P<action>drop|reset) {protocol} (packet|connection) from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}(/{dst_port})? | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 429004 | Unable to set up authentication-proxy rule for the cx action on interface {src_interface_name} for {policy_type} service-policy | src_interface_name is set to principal.labels.key/value, policy_type is set to about.labels.key/value |
| 429005 | Set up authentication-proxy {protocol} rule for the CXSC action on interface {dst_interface_name} for traffic destined to {dst_ip}/{dst_port} for {policy_type} service-policy | protocol is set to network.ip_protocol, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, policy_type is set to about.labels.key/value |
| 429006 | Cleaned up authentication-proxy rule for the CXSC action on interface {dst_interface_name} for traffic destined to {dst_ip} for {policy_type} service-policy | dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, policy_type is set to about.labels.key/value |
| 429007 | CXSC redirect will override Scansafe redirect for flow from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}/{dst_port} with {user_name} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid |
| 429008 | Unable to respond to VPN query from CX for session {session_id}. Reason {summary} | session_id is set to network.session_id, summary is set to security_result.summary |
| 4302310 | SCTP packet received from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}/{dst_port} contains unsupported<message_text> | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 431001, 431002 | <message_text> conformance: (?P<action>Dropping) <message_text> packet from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}/{dst_port}, Drop reason: {summary} | action is set to security_result.action, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, summary is set to security_result.summary |
| 434001 | SFR card not up and fail-close mode used, (?P<action>dropping) {protocol} packet from ingress {src_interface_name}:{src_ip}(/{src_port})? to egress {dst_interface_name}:{dst_ip}(/{dst_port})? | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 434002, 434003 | SFR requested to (?P<action>drop|reset) {protocol} (packet|connection) from (ingress )?{src_interface_name}:{src_ip}(/{src_port})? to (egress )?{dst_interface_name}:{dst_ip}(/{dst_port})? | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 434004 | SFR requested <message_text> to bypass further packet redirection and process<message_text>flow from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}/{dst_port} locally | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 434007 | SFR redirect will override Scansafe redirect for flow from ingress {src_interface_name}:{src_ip}(/{src_port})? to egress {dst_interface_name}:{dst_ip}/{dst_port} ({user_name}) | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid |
| 444004 | Temporary license key {temporary_key} has expired. Applying permanent license key {permanent_key} | temporary_key is set to about.labels.key/value, permanent_key is set to about.labels.key/value |
| 444005 | Timebased activation key {activation_key} will expire in {days_left} days | activation_key is set to about.labels.key/value, days_left is set to about.labels.key/value |
| 444007 | Timebased activation key {activation_key} has expired. Reverting to (permanent|timebased) license key. The following features will be affected: {feature_affected} | activation_key is set to about.labels.key/value, feature_affected is set to about.labels.key/value |
| 444008 | {target_license} license has expired, and the system is scheduled to reload in {days_left} days. Apply a new activation key to enable <message_text> license and prevent the automatic reload | target_license is set to target.labels.key/value, days_left is set to about.labels.key/value |
| 444009 | {target_license} license has expired 30 days ago. The system will now reload | target_license is set to target.labels.key/value |
| 444100 | Shared {request} request failed. Reason: {summary} | request is set to about.labels.key/value, summary is set to security_result.summary |
| 444101 | Shared license service is active. License server address:{dst_ip} | dst_ip is set to target.ip |
| 444103 | Shared {license_type} license usage is over 90% capacity | license_type is set to about.labels.key/value |
| 444104 | Shared {license_type} license availability: {license_availability} | license_type is set to about.labels.key/value, license_availability is set to about.labels.key/value |
| 444105 | Released {license_availability} shared {license_type} license<message_text>License server has been unreachable for 24 hours | license_availability is set to about.labels.key/value, license_type is set to about.labels.key/value |
| 444106 | Shared license backup server {dst_ip} is not available | dst_ip is set to target.ip |
| 444107 | Shared license service {status} on interface {dst_interface_name} | status is set to about.labels.key/value, dst_interface_name is set to target.labels.key/value |
| 444108 | Shared license {status} client id {user_name} | status is set to about.labels.key/value, user_name is set to target.user.userid |
| 444109 | Shared license backup server role changed to {status} | status is set to about.labels.key/value |
| 444110 | Shared license server backup has {days_left} remaining as active license server | days_left is set to about.labels.key/value |
| 444111 | Shared license backup service has been terminated due to the primary license server {dst_ip} being unavailable for more than {days_left} days. The license server needs to be brought back online to continue using shared licensing | dst_ip is set to target.ip, days_left is set to about.labels.key/value |
| 446001 | Maximum TLS Proxy session limit of {max_session} reached | max_session is set to about.labels.key/value |
| 446003 | (?P<action>Denied) TLS Proxy session from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}/{dst_port}, UC-IME license is disabled | action is set to security_result.action, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 447001 | ASP DP to CP {queue_name} was full. Queue length {queue_length}, limit {queue_limit} | queue_name is set to about.labels.key/value, queue_length is set to about.labels.key/value, queue_limit is set to about.labels.key/value |
| 448001 | (?P<action>Denied) SRTP crypto session setup on flow from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}/{dst_port}, licensed K8 SRTP crypto session of {k8_limit} exceeded | action is set to security_result.action, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, k8_limit is set to about.labels.key/value |
| 450001 | Deny traffic for protocol {protocol_id} src {src_interface_name}:{src_ip}(/{src_port})? dst {dst_interface_name}:{dst_ip}/{dst_port}, licensed host limit of {maximum_host} exceeded | protocol_id is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, maximum_host is set to about.labels.key/value |
| 500001 | ActiveX content in java script is modified: src {src_ip} dest {dst_ip} on interface {interface_name} | src_ip is set to principal.ip, dst_ip is set to target.ip, interface_name is set to about.labels.key/value |
| 500002 | Java content in java script is modified: src {src_ip} dest {dst_ip} on interface {interface_name} | src_ip is set to principal.ip, dst_ip is set to target.ip, interface_name is set to about.labels.key/value |
| 500003 | Bad {protocol} hdr length (hdrlen={hdr_len}, pktlen={pkt_len}) from {src_ip}(/{src_port})? to {dst_ip}/{dst_port}, flags: {tcp_flags}, on interface {interface_name} | protocol is set to network.ip_protocol, hdr_len is set to about.labels.key/value, pkt_len is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, tcp_flags is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 500004 | Invalid transport field for protocol={protocol}, from {src_ip}(/{src_port})? to {dst_ip}(/{dst_port})? | protocol is set to network.ip_protocol, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 500005 | connection terminated for {protocol} from {input_interface} :{src_ip}(/{src_port})? to {output_interface} :{dst_ip}/{dst_port} due to invalid combination of inspections on same flow. Inspect {inspect_name} is not compatible with filter {filter_name} | protocol is set to network.ip_protocol, input_interface is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, output_interface is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, inspect_name is set to about.labels.key/value, filter_name is set to about.labels.key/value |
| 502101 | New user added to local dbase: Uname: {user_name} Priv: {privilege_level} Encpass: {encrypted_pass} | user_name is set to target.user.userid, privilege_level is set to about.labels.key/value, encrypted_pass is set to about.labels.key/value |
| 502102 | User deleted from local dbase: Uname: {user_name} Priv: {privilege_level} Encpass: {encrypted_pass} | user_name is set to target.user.userid, privilege_level is set to about.labels.key/value, encrypted_pass is set to about.labels.key/value |
| 502103 | User priv level changed: Uname: {user_name} From: {old_privilege_level} To: {new_privilege_level} | user_name is set to target.user.userid, old_privilege_level is set to about.labels.key/value, new_privilege_level is set to about.labels.key/value |
| 502111 | New group policy added: name: {group_policy} Type: {policy_type} | group_policy is set to about.labels.key/value, policy_type is set to about.labels.key/value |
| 502112 | Group policy deleted: name: {group_policy} Type: {policy_type} | group_policy is set to about.labels.key/value, policy_type is set to about.labels.key/value |
| 503001, 503101 | Process {process_number}, Nbr {src_ip} on {interface_name} from .*, {summary} | process_number is set to about.labels.key/value, src_ip is set to principal.ip, interface_name is set to about.labels.key/value, summary is set to security_result.summary |
| 503002 | The last key has expired for interface {interface_name}, packets sent using last valid key | interface_name is set to about.labels.key/value |
| 503003 | Packet <message_text> on interface {interface_name} with expired Key ID {key_id} | interface_name is set to about.labels.key/value, key_id is set to about.labels.key/value |
| 503004 | Key ID {key_id} in key chain {key_chain_name} does not have a key | key_id is set to about.labels.key/value, key_chain_name is set to about.labels.key/value |
| 503005 | Key ID {key_id} in key chain {key_chain_name} does not have a cryptographic algorithm | key_id is set to about.labels.key/value, key_chain_name is set to about.labels.key/value |
| 504001 | Security context {context_name} was added to the system | context_name is set to about.labels.key/value |
| 504002 | Security context {context_name} was removed from the system | context_name is set to about.labels.key/value |
| 505002 | Module {ips_description} is reloading. Please wait | ips_description is set to about.labels.key/value |
| 505005 | Module {module_name} is initializing control communication.* | module_name is set to about.labels.key/value |
| 505007 | Module {prod_id} in slot {slot_number} is recovering. Please wait.* | prod_id is set to about.labels.key/value, slot_number is set to about.labels.key/value |
| 505007 | Module {module_id} is recovering.* | module_id is set to about.labels.key/value |
| 505008 | Module {module_id} in slot {slot_number} software is being updated to {newver} (currently {version}) | module_id is set to about.labels.key/value, slot_number is set to about.labels.key/value, newver is set to about.labels.key/value, version is set to about.labels.key/value |
| 505008 | Module {module_id} software is being updated to {newver} (currently {version}) | module_id is set to about.labels.key/value, newver is set to about.labels.key/value, version is set to about.labels.key/value |
| 505009 | Module {modual} one software was updated to {new_version_number} | modual is set to about.labels.key/value, new_version_number is set to about.labels.key/value |
| 505010 | Module in slot {slot_number} removed | slot_number is set to about.labels.key/value |
| 505011 | Module {module_name}(,)? data channel communication is UP | module_name is set to about.labels.key/value |
| 505016 | Module {prod_id} in slot {slot_number} application changed from: {src_service} version {src_application_version} state {src_application_state} to: {target_service} {dst_application_version} state {dst_application_state} | prod_id is set to about.labels.key/value, slot_number is set to about.labels.key/value, src_service is set to principal.application, src_application_version is set to principal.labels.key/value, src_application_state is set to principal.labels.key/value, target_service is set to target.application, dst_application_version is set to target.labels.key/value, dst_application_state is set to target.labels.key/value |
| 505016 | Module {module_id} application changed from: {src_service} version {src_application_version} state {src_application_state} to: {target_service} {dst_application_version} state {dst_application_state} | module_id is set to about.labels.key/value, src_service is set to principal.application, src_application_version is set to principal.labels.key/value, src_application_state is set to principal.labels.key/value, target_service is set to target.application, dst_application_version is set to target.labels.key/value, dst_application_state is set to target.labels.key/value |
| 505012 | Module {prod_id} in slot {slot_number}, application stopped {target_service}, version {version} | prod_id is set to about.labels.key/value, slot_number is set to about.labels.key/value, target_service is set to target.application, version is set to about.labels.key/value |
| 505012 | Module {module_id}, application stopped {target_service}, version {version} | module_id is set to about.labels.key/value, target_service is set to target.application, version is set to about.labels.key/value |
| 505013 | Module {prod_id} in slot {slot_number}(,)? application (changed from:)?(reloading)? {src_service}(,)? version {version}( to: {target_service} version {new_version_number})? | prod_id is set to about.labels.key/value, slot_number is set to about.labels.key/value, src_service is set to principal.application, version is set to about.labels.key/value, target_service is set to target.application, new_version_number is set to about.labels.key/value |
| 505013 | Module {module_id} application changed from: {src_service} version {version} to: {target_service} version {new_version_number} | module_id is set to about.labels.key/value, src_service is set to principal.application, version is set to about.labels.key/value, target_service is set to target.application, new_version_number is set to about.labels.key/value |
| 505014 | Module {prod_id} in slot {slot_number}, application down {target_service}, version {version} {summary} | prod_id is set to about.labels.key/value, slot_number is set to about.labels.key/value, target_service is set to target.application, version is set to about.labels.key/value, summary is set to security_result.summary |
| 505014 | Module {module_id}, application down {target_service}, version {version} {summary} | module_id is set to about.labels.key/value, target_service is set to target.application, version is set to about.labels.key/value, summary is set to security_result.summary |
| 505015 | Module {prod_id} in slot {slot_number}, application up {target_application}, version {version} | prod_id is set to about.labels.key/value, slot_number is set to about.labels.key/value, version is set to about.labels.key/value |
| 505015 | Module {module_id}, application up {target_service}, version {version} | module_id is set to about.labels.key/value, target_service is set to target.application, version is set to about.labels.key/value |
| 507001 | (?P<action>Terminating) (?P<protocol>TCP)-Proxy connection from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port}- reassembly limit of {limit} bytes exceeded | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, limit is set to about.labels.key/value |
| 507003 | The flow of type {protocol} from the originating interface:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} (?P<action>terminated) by inspection engine, {summary} | action is set to security_result.action, protocol is set to network.ip_protocol, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, summary is set to security_result.summary |
| 507003 | {protocol} flow from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} (?P<action>terminated) by inspection engine, {summary} | action is set to security_result.action, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, summary is set to security_result.summary |
| 508001 | DCERPC {message_type} non-standard {version_type} version {version_number} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port}, (?P<action>terminating) connection | action is set to security_result.action, message_type is set to about.labels.key/value, version_type is set to about.labels.key/value, version_number is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 508002 | DCERPC response has low endpoint port {port_number} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port}, (?P<action>terminating) connection | action is set to security_result.action, port_number is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 509001 | Connection attempt from {src_interface_name}:{src_ip}/{src_port}( ((?:{outside_idfw_user})?(,)?(?:{outside_sg_info})?))? to {dst_interface_name}:{dst_ip}/{dst_port}( ((?:{inside_idfw_user})?(,)?(?:{inside_sg_info})?))? was prevented by no forward" command" | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, outside_idfw_user is set to about.labels.key/value, outside_sg_info is set to about.labels.key/value, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, inside_idfw_user is set to about.labels.key/value, inside_sg_info is set to about.labels.key/value |
| 520003 | bad id in {summary} (id:<message_text>) | summary is set to security_result.summary |
| 520010 | Bad queue elem – {queue_pointer}: flink {forward_pointer}, blink {backward_pointer}, flink-blink {flink_blink_ptr}, blink-flink {blink_flink_ptr} | queue_pointer is set to about.labels.key/value, forward_pointer is set to about.labels.key/value, backward_pointer is set to about.labels.key/value, flink_blink_ptr is set to about.labels.key/value, blink_flink_ptr is set to about.labels.key/value |
| 520013 | Regular expression access check with bad list {acl_id} | acl_id is set to about.labels.key/value |
| 520021 | Error deleting trie entry, {summary} | summary is set to security_result.summary |
| 520022 | Error adding mask entry, {summary} | summary is set to security_result.summary |
| 520023 | Invalid pointer to head of tree, 0x {radix_node_ptr} | radix_node_ptr is set to about.labels.key/value |
| 520024 | Orphaned mask {orphaned_mask}, refcount= {radix_mask_ptrs} ref count at {radix_node_address}, next= {radix_node_nxt} | orphaned_mask is set to about.labels.key/value, radix_mask_ptrs is set to about.labels.key/value, radix_node_address is set to about.labels.key/value, radix_node_nxt is set to about.labels.key/value |
| 520025 | No memory for radix initialization: {summary} | summary is set to security_result.summary |
| 602101 | PMTU-D packet {no_of_bytes} bytes greater than effective mtu {mtu_number}(,)? dest_addr={dst_ip}, src_addr={src_ip}, prot={protocol} | no_of_bytes is set to about.labels.key/value, mtu_number is set to about.labels.key/value, dst_ip is set to target.ip, src_ip is set to principal.ip, protocol is set to network.ip_protocol |
| 602103 | (?P<category>IPSEC): Received an {protocol} Destination Unreachable from {src_ip} with suggested PMTU of {rcvd_mtu}; PMTU updated for SA with peer {dst_ip}, SPI {spi}, tunnel name {user_name}, old PMTU {old_mtu}, new PMTU {new_mtu} | category is set to security_result.category_details, protocol is set to network.ip_protocol, src_ip is set to principal.ip, rcvd_mtu is set to about.labels.key/value, dst_ip is set to target.ip, spi is set to about.labels.key/value, user_name is set to target.user.userid, old_mtu is set to about.labels.key/value, new_mtu is set to about.labels.key/value |
| 602104 | (?P<category>IPSEC): Received an {protocol} Destination Unreachable from {src_ip}, PMTU is unchanged because suggested PMTU of {rcvd_mtu} is equal to or greater than the current PMTU of {curr_mtu}, for SA with peer {dst_ip}, SPI {spi}, tunnel name {user_name} | category is set to security_result.category_details, protocol is set to network.ip_protocol, src_ip is set to principal.ip, rcvd_mtu is set to about.labels.key/value, curr_mtu is set to about.labels.key/value, dst_ip is set to target.ip, spi is set to about.labels.key/value, user_name is set to target.user.userid |
| 602303, 602304 | (?P<category>IPSEC): An (?P<direction>inbound|outbound|INBOUND|OUTBOUND|Inbound|Outbound) {tunnel_type} SA (SPI={spi}) between {src_ip} and {dst_ip} ({src_fwuser}) has been (?P<action_details>created|deleted) | category is set to security_result.category_details, direction is set to network.direction, action_details is set to security_result.action_details, tunnel_type is set to about.labels.key/value, spi is set to about.labels.key/value, src_ip is set to principal.ip, dst_ip is set to target.ip, src_fwuser is set to principal.user.userid/principal.labels.key/value |
| 602305 | (?P<category>IPSEC): SA creation error, source {src_ip}, destination {dst_ip}, reason {summary} | category is set to security_result.category_details, src_ip is set to principal.ip, dst_ip is set to target.ip, summary is set to security_result.summary |
| 602306 | (?P<category>IPSEC): SA change peer IP error, SPI: <message_text>, (src {src_ip}, dest {dst_ip} is set to src {src_ip1}, dest: {dst_ip1}), reason {summary} | category is set to security_result.category_details, src_ip is set to principal.ip, dst_ip is set to target.ip, src_ip1 is set to principal.ip, dst_ip1 is set to target.ip, summary is set to security_result.summary |
| 602306 | %(?P<category>IPSEC): SA change peer IP error, SPI: <message_text>, (src {old_src_port}, dest {old_dst_port} is set to src {src_port}, dest: {dst_port}), reason {summary} | category is set to security_result.category_details, old_src_port is set to principal.labels.key/value, old_dst_port is set to target.labels.key/value, src_port is set to principal.port, dst_port is set to target.port, summary is set to security_result.summary |
| 603101 | PPTP received out of seq or duplicate pkt, tnl_id={tunnel_id}, sess_id={session_id}, seq={sequence_number} | tunnel_id is set to about.labels.key/value, session_id is set to network.session_id, sequence_number is set to about.labels.key/value |
| 603102 | PPP virtual interface {interface_name} - user: {user_name} aaa authentication {status} | interface_name is set to about.labels.key/value, user_name is set to target.user.userid, status is set to about.labels.key/value |
| 603104 | PPTP Tunnel created, tunnel_id is {tunnel_id}, remote_peer_ip is {dst_ip}, ppp_virtual_interface_id is {ppp_virtual_interface_id}, client_dynamic_ip is {dst_ip1}, username is {user_name}, MPPE_key_strength is {mppe_key_strength} | tunnel_id is set to about.labels.key/value, dst_ip is set to target.ip, ppp_virtual_interface_id is set to about.labels.key/value, dst_ip1 is set to target.ip, user_name is set to target.user.userid, mppe_key_strength is set to about.labels.key/value |
| 603105 | PPTP Tunnel deleted, tunnel_id = {tunnel_id}, remote_peer_ip= {dst_ip} | tunnel_id is set to about.labels.key/value, dst_ip is set to target.ip |
| 603106 | L2TP Tunnel created, tunnel_id is {tunnel_id}, remote_peer_ip is {dst_ip}, ppp_virtual_interface_id is {ppp_virtual_interface_id}, client_dynamic_ip is {dst_ip1}, username is {user_name} | tunnel_id is set to about.labels.key/value, dst_ip is set to target.ip, ppp_virtual_interface_id is set to about.labels.key/value, dst_ip1 is set to target.ip, user_name is set to target.user.userid |
| 603107 | L2TP Tunnel deleted, tunnel_id = {tunnel_id}, remote_peer_ip = {dst_ip} | tunnel_id is set to about.labels.key/value, dst_ip is set to target.ip |
| 603108 | Built PPTP Tunnel at {interface_name}, tunnel-id = {tunnel_id}, remote-peer = {dst_ip}, virtual-interface = {virtual_interface_number}, client-dynamic-ip = {dst_ip1}, username = {user_name}, MPPE-key-strength = {mppe_key_strength} | interface_name is set to about.labels.key/value, tunnel_id is set to about.labels.key/value, dst_ip is set to target.ip, virtual_interface_number is set to about.labels.key/value, dst_ip1 is set to target.ip, user_name is set to target.user.userid, mppe_key_strength is set to about.labels.key/value |
| 603109 | Teardown PPPOE Tunnel at {interface_name}, tunnel-id = {tunnel_id}, remote-peer = {dst_ip} | interface_name is set to about.labels.key/value, tunnel_id is set to about.labels.key/value, dst_ip is set to target.ip |
| 603110 | Failed to establish L2TP session, tunnel_id = {tunnel_id}, remote_peer_ip ={dst_ip}, user = {user_name}. Multiple sessions per tunnel are not supported | tunnel_id is set to about.labels.key/value, dst_ip is set to target.ip, user_name is set to target.user.userid |
| 604101 | DHCP client interface {interface_name}: Allocated ip = {dst_ip}, mask = {netmask}, gw = {gateway_address} | interface_name is set to about.labels.key/value, dst_ip is set to target.ip, netmask is set to about.labels.key/value, gateway_address is set to about.labels.key/value |
| 604102 | DHCP client interface {interface_name}: address released | interface_name is set to about.labels.key/value |
| 604103 | DHCP daemon interface {interface_name}: address granted {dst_mac} ({dst_ip}) | interface_name is set to about.labels.key/value, dst_mac is set to target.mac, dst_ip is set to target.ip |
| 604104 | DHCP daemon interface {interface_name}: address released {build_number} ({dst_ip}) | interface_name is set to about.labels.key/value, build_number is set to about.labels.key/value, dst_ip is set to target.ip |
| 604105 | {category}: Unable to send DHCP reply to client {dst_mac} on interface {interface_name}. Reply exceeds options field size ({options_field_size}) by {number_of_octets} octets | category is set to security_result.category_details, dst_mac is set to target.mac, interface_name is set to about.labels.key/value, options_field_size is set to about.labels.key/value, number_of_octets is set to about.labels.key/value |
| 604201 | DHCPv6 PD client on interface {interface_name} received delegated prefix {prefix} from DHCPv6 PD server {sname} with preferred lifetime {preferred_lifetime} seconds and valid lifetime (<|){lease_time_seconds}(|>) seconds | interface_name is set to about.labels.key/value, prefix is set to about.labels.key/value, sname is set to network.dhcp.sname, preferred_lifetime is set to about.labels.key/value, lease_time_seconds is set to network.dhcp.lease_time_seconds
if ([sysloghost] != "" or ![is_not_src_ip]) then, "event.idm.read_only_udm.network.application_protocol" is set to "DHCP" |
| 604202 | DHCPv6 PD client on interface {interface_name} releasing delegated prefix {prefix} received from DHCPv6 PD server {sname} | interface_name is set to about.labels.key/value, prefix is set to about.labels.key/value, sname is set to network.dhcp.sname
if ([sysloghost] != "" or ![is_not_src_ip]) then, "event.idm.read_only_udm.network.application_protocol" is set to "DHCP" |
| 604203 | DHCPv6 PD client on interface {interface_name} renewed delegated prefix {prefix} from DHCPv6 PD server {sname} with preferred lifetime {preferred_lifetime} seconds and valid lifetime (<|){lease_time_seconds}(|>) seconds | interface_name is set to about.labels.key/value, prefix is set to about.labels.key/value, sname is set to network.dhcp.sname, preferred_lifetime is set to about.labels.key/value, lease_time_seconds is set to network.dhcp.lease_time_seconds
if ([sysloghost] != "" or ![is_not_src_ip]) then, "event.idm.read_only_udm.network.application_protocol" is set to "DHCP" |
| 604204 | DHCPv6 delegated prefix {prefix} got expired on interface {interface_name}, received from DHCPv6 PD server {sname} | prefix is set to about.labels.key/value, interface_name is set to about.labels.key/value, sname is set to network.dhcp.sname
if ([sysloghost] != "" or ![is_not_src_ip]) then, "event.idm.read_only_udm.network.application_protocol" is set to "DHCP" |
| 604205 | DHCPv6 client on interface {interface_name} allocated address (<|){dst_ip}(|>) from DHCPv6 server {sname} with preferred lifetime {preferred_lifetime} seconds and valid lifetime (<|){lease_time_seconds}(|>) seconds | interface_name is set to about.labels.key/value, dst_ip is set to target.ip, sname is set to network.dhcp.sname, preferred_lifetime is set to about.labels.key/value, lease_time_seconds is set to network.dhcp.lease_time_seconds
if ([sysloghost] != "" or ![is_not_src_ip]) then, "event.idm.read_only_udm.network.application_protocol" is set to "DHCP" |
| 604206 | DHCPv6 client on interface {interface_name} releasing address (<|){dst_ip}(|>) received from DHCPv6 server {sname} | interface_name is set to about.labels.key/value, dst_ip is set to target.ip, sname is set to network.dhcp.sname
if ([sysloghost] != "" or ![is_not_src_ip]) then, "event.idm.read_only_udm.network.application_protocol" is set to "DHCP" |
| 604207 | DHCPv6 client on interface {interface_name} renewed address (<|){dst_ip}(|>) from DHCPv6 server {sname} with preferred lifetime {preferred_lifetime} seconds and valid lifetime (<|){lease_time_seconds}(|>) seconds | interface_name is set to about.labels.key/value, dst_ip is set to target.ip, sname is set to network.dhcp.sname, preferred_lifetime is set to about.labels.key/value, lease_time_seconds is set to network.dhcp.lease_time_secondsif ([sysloghost] != "" or ![is_not_src_ip]) then,
"event.idm.read_only_udm.network.application_protocol" is set to "DHCP" |
| 604208 | DHCPv6 client address (<|){dst_ip}(|>) got expired on interface {interface_name}, received from DHCPv6 server {sname} | dst_ip is set to target.ip, interface_name is set to about.labels.key/value, sname is set to network.dhcp.sname
if ([sysloghost] != "" or ![is_not_src_ip]) then, "event.idm.read_only_udm.network.application_protocol" is set to "DHCP" |
| 605004, 605005 | Login (?P<action>denied|permitted) from {src_ip}(/{src_port})? to ({interface_name}:)?{dst_ip}(/{target_service})? for user {user_name} | action is set to security_result.action, src_ip is set to principal.ip, src_port is set to principal.port, interface_name is set to about.labels.key/value, dst_ip is set to target.ip, target_service is set to target.application, user_name is set to target.user.userid
if [dst_port] == "ssh", then "dst_port" is set to "22" else if [dst_port] == "https", then "dst_port" is set to "443" |
| 606001, 606002 | ASDM session number {session_id} from {dst_ip} (started|ended) | session_id is set to network.session_id, dst_ip is set to target.ip |
| 606003 | ASDM logging session number {session_id} from {dst_ip} started( <message_text> session ID assigned)? | session_id is set to network.session_id, dst_ip is set to target.ip |
| 606004 | ASDM logging session number {session_id} from {dst_ip} ended | session_id is set to network.session_id, dst_ip is set to target.ip |
| 607001 | Pre-allocate (?P<application_protocol>SIP) {connection_type} secondary channel for {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip} from <message_text> message | application_protocol is set to network.application_protocol, connection_type is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip |
| 607002 | {action_class}: (?P<action_details>Dropped|Dropped connection for|Reset connection for|Masked header flags for) SIP {req_resp} {info} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port}; {summary} | action_details is set to security_result.action_details, action_class is set to about.labels.key/value, req_resp is set to about.labels.key/value, info is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, summary is set to security_result.summary |
| 607003 | {action_class}: Received SIP {req_resp} {info} from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port}; {summary} | action_class is set to about.labels.key/value, req_resp is set to about.labels.key/value, info is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, summary is set to security_result.summary |
| 607004 | Phone Proxy: (?P<action>Dropping) SIP message from {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}/{dst_port} with source MAC {src_mac} due to secure phone database mismatch | action is set to security_result.action, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, src_mac is set to principal.mac |
| 608001 | Pre-allocate Skinny {connection_type} secondary channel for {src_interface_name}:{src_ip}(/{src_port})? to {dst_interface_name}:{dst_ip}(/{dst_port})? from {summary} | connection_type is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, summary is set to security_result.summary |
| 608002, 608003 | Dropping Skinny message for {input_interface}:{src_ip}(/{src_port})? to {output_interface}:{dst_ip}/{dst_port}, SCCP Prefix length {prefix_length} too (small|large) | input_interface is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, output_interface is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, prefix_length is set to about.labels.key/value |
| 608004 | Dropping Skinny message for {input_interface}:{src_ip}(/{src_port})? to {output_interface}:{dst_ip}/{dst_port}, message id {message_id} not allowed | input_interface is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, output_interface is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, message_id is set to about.labels.key/value |
| 608005 | Dropping Skinny message for {input_interface}:{src_ip}(/{src_port})? to {output_interface}:{dst_ip}/{dst_port}, message id {message_id} registration not complete | input_interface is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, output_interface is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, message_id is set to about.labels.key/value |
| 610001 | NTP daemon interface {interface_name}: Packet (?P<action>denied) from {dst_ip} | action is set to security_result.action, interface_name is set to about.labels.key/value, dst_ip is set to target.ip |
| 610002 | NTP daemon interface {interface_name}: Authentication failed for packet from {dst_ip} | interface_name is set to about.labels.key/value, dst_ip is set to target.ip |
| 610,101 | Authorization failed: Cmd: {command} Cmdtype: {command_modifier} | command is set to target.process.command_line, command_modifier is set to about.labels.key/value |
| 611101 | User authentication (?P<action>succeeded): IP( address)?(,|:) {dst_ip}(,|:) Uname: {user_name} | action is set to security_result.action, dst_ip is set to target.ip, user_name is set to target.user.userid |
| 611102 | User authentication (?P<action>failed): IP( address)?(=|:) {dst_ip}, Uname: {user_name} | action is set to security_result.action, dst_ip is set to target.ip, user_name is set to target.user.userid |
| 611103 | User logged out: Uname: {user_name} | user_name is set to target.user.userid |
| 611301 | (?P<category>VPNClient): NAT configured for Client Mode with no split tunneling: NAT address: {mapped_address} | category is set to security_result.category_details, mapped_address is set to about.labels.key/value |
| 611303 | (?P<category>VPNClient): NAT configured for Client Mode with split tunneling: NAT address: {mapped_address} Split Tunnel Networks: {dst_ip}/{netmask} | category is set to security_result.category_details, mapped_address is set to about.labels.key/value, dst_ip is set to target.ip, netmask is set to about.labels.key/value |
| 611304 | (?P<category>VPNClient): NAT exemption configured for Network Extension Mode with split tunneling: Split Tunnel Networks: {dst_ip}/{netmask} | category is set to security_result.category_details, dst_ip is set to target.ip, netmask is set to about.labels.key/value |
| 611305 | (?P<category>VPNClient): DHCP Policy installed: Primary DNS: {dst_ip} Secondary DNS: {dst_ip1} Primary WINS: {src_ip} Secondary WINS: {src_ip1} | category is set to security_result.category_details, dst_ip is set to target.ip, dst_ip1 is set to target.ip, src_ip is set to principal.ip, src_ip1 is set to principal.ip |
| 611307 | (?P<category>VPNClient): Head end: {dst_ip} | category is set to security_result.category_details, dst_ip is set to target.ip |
| 611309 | (?P<category>VPNClient): Disconnecting from head end and uninstalling previously downloaded policy: Head End: {dst_ip} | category is set to security_result.category_details, dst_ip is set to target.ip |
| 611310, 611311 | (?P<category>VPNClient): XAUTH (?P<action>Succeeded|Failed): Peer: {dst_ip} | category is set to security_result.category_details, action is set to security_result.action, dst_ip is set to target.ip |
| 611312 | (?P<category>VPNClient): Backup Server List: {summary} | category is set to security_result.category_details, summary is set to security_result.summary |
| 611313 | (?P<category>VPNClient): Backup Server List Error: {summary} | category is set to security_result.category_details, summary is set to security_result.summary |
| 611314 | (?P<category>VPNClient): Load Balancing Cluster with Virtual IP: {dst_ip} has redirected the to server {dst_ip1} | category is set to security_result.category_details, dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 611315 | (?P<category>VPNClient): Disconnecting from Load Balancing Cluster member {dst_ip} | category is set to security_result.category_details, dst_ip is set to target.ip |
| 611318 | VPNClient: User Authentication Enabled: Auth Server IP: {dst_ip} Auth Server Port: {dst_port} Idle Timeout: {idle_timeout} | dst_ip is set to target.ip, dst_port is set to target.port, idle_timeout is set to about.labels.key/value |
| 612001 | Auto Update succeeded:{target_file_full_path}, version:{version} | target_file_full_path is set to target.file.full_path, version is set to about.labels.key/value |
| 612002 | Auto Update failed:{target_file_full_path}, version:{version}, reason:{summary} | target_file_full_path is set to target.file.full_path, version is set to about.labels.key/value, summary is set to security_result.summary |
| 612003 | Auto Update failed to contact:{redirect_url}, reason:{summary} | redirect_url is set to target.url, summary is set to security_result.summary |
| 613001 | Checksum Failure in database in area {area} Link State Id {dst_ip} Old Checksum {old_checksum} New Checksum {new_checksum} | area is set to about.labels.key/value, dst_ip is set to target.ip, old_checksum is set to about.labels.key/value, new_checksum is set to about.labels.key/value |
| 613002, 613102 | interface {dst_interface_name} has zero bandwidth | dst_interface_name is set to target.labels.key/value |
| 613003 | {dst_ip} {netmask} changed from area {src_area} to area {dst_area} | dst_ip is set to target.ip, netmask is set to about.labels.key/value, src_area is set to principal.labels.key/value, dst_area is set to target.labels.key/value |
| 613007 | area {area} lsid {src_ip} mask {netmask} type<message_text> | area is set to about.labels.key/value, src_ip is set to principal.ip, netmask is set to about.labels.key/value |
| 613013 | OSPF LSID {src_ip} adv {dst_ip}<message_text>gateway {gateway_address}<message_text>{dst_ip1}/{netmask}<message_text> | src_ip is set to principal.ip, dst_ip is set to target.ip, gateway_address is set to about.labels.key/value, dst_ip1 is set to target.ip, netmask is set to about.labels.key/value |
| 613014 | Base topology enabled on interface {dst_interface_name} attached to MTR compatible mode area {area} | dst_interface_name is set to target.labels.key/value, area is set to about.labels.key/value |
| 613015 | Process 1 flushes LSA ID {src_ip} type-<message_text>adv-rtr {dst_ip}<message_text> | src_ip is set to principal.ip, dst_ip is set to target.ip |
| 613016 | Area {area} router-LSA of length {sent_bytes} bytes plus update overhead bytes is too large to flood | area is set to about.labels.key/value, sent_bytes is set to network.sent_bytes |
| 613017 | Bad LSA mask:<message_text>LSID {src_ip} Mask {netmask} from {dst_ip} | src_ip is set to principal.ip, netmask is set to about.labels.key/value, dst_ip is set to target.ip |
| 613025 | Invalid build flag number for LSA {src_ip},<message_text> | src_ip is set to principal.ip |
| 613027 | OSPF process {process_number} removed from interface {dst_interface_name} | process_number is set to about.labels.key/value, dst_interface_name is set to target.labels.key/value |
| 613028 | Unrecognized virtual interface {dst_interface_name}. Treat it as loopback stub route | dst_interface_name is set to target.labels.key/value |
| 613034 | Neighbor {dst_ip} not configured | dst_ip is set to target.ip |
| 613035 | Could not allocate or find neighbor {dst_ip} | dst_ip is set to target.ip |
| 613040 | OSPF-1 Area {area}: Router {dst_ip} originating invalid type number LSA, ID {src_ip}, Metric {metric1} on Link ID {dst_ip1} Link Type {link_type} | area is set to about.labels.key/value, dst_ip is set to target.ip, src_ip is set to principal.ip, metric1 is set to about.labels.key/value, dst_ip1 is set to target.ip, link_type is set to about.labels.key/value |
| 613041 | OSPF-100 Areav {area}: LSA ID {src_ip}, Type {type}, Adv-rtr {dst_ip}, LSA counter DoNotAge | area is set to about.labels.key/value, src_ip is set to principal.ip, type is set to about.labels.key/value, dst_ip is set to target.ip |
| 613042 | OSPF process {process_number} lacks forwarding address for type 7 LSA {src_ip} in NSSA <message_text> | process_number is set to about.labels.key/value, src_ip is set to principal.ip |
| 613101 | Checksum Failure in database in area {area} Link State Id {state_id} Old Checksum {old_checksum} New Checksum {new_checksum} | area is set to about.labels.key/value, state_id is set to about.labels.key/value, old_checksum is set to about.labels.key/value, new_checksum is set to about.labels.key/value |
| 613103 | <message_text> changed from area {old_area_id_str} to area {new_area_id_str} | old_area_id_str is set to about.labels.key/value, new_area_id_str is set to about.labels.key/value |
| 613104 | Unrecognized virtual interface {interface_name} | interface_name is set to about.labels.key/value |
| 614001 | Split DNS: request patched from server: {dst_ip} to server: {dst_ip1} | dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 614002 | Split DNS: reply from server:{dst_ip} reverse patched back to original server:{dst_ip1} | dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 616001 | Pre-allocate MGCP {data_channel} connection for {input_interface}:{src_ip} to {output_interface}:{dst_ip}/{dst_port} from {message_type} message | data_channel is set to about.labels.key/value, input_interface is set to about.labels.key/value, src_ip is set to principal.ip, output_interface is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, message_type is set to about.labels.key/value |
| 617001 | GTPv version {message_type} from {src_interface_name}:{src_ip}/{src_port} not accepted by {dst_interface_name}:{dst_ip}/{dst_port} | message_type is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 617002 | Removing v1 PDP Context with TID {tid_value} from GGSN {ggsn_ip_address} and SGSN {sgsn_ip_address}, Reason: {summary} or Removing v1 primary PDP Context with TID tid from GGSN {ggsn_ip_address_} and SGSN {sgsn_ip_address_}, Reason: <message_text> | tid_value is set to about.labels.key/value, ggsn_ip_address is set to about.labels.key/value, sgsn_ip_address is set to about.labels.key/value, summary is set to security_result.summary, ggsn_ip_address_ is set to about.labels.key/value, sgsn_ip_address_ is set to about.labels.key/value |
| 617003 | GTP Tunnel created from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 617004 | GTP connection created for response from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 617100 | Teardown {num_conns} connection(s|) for user {dst_ip} | num_conns is set to about.labels.key/value, dst_ip is set to target.ip |
| 618001 | Denied STUN packet {message_type} from (<|){ingress_interface}(|>):(<|){src_ip}(|>)/(<|){src_port}(|>) to (<|){egress_interface}(|>):(<|){dst_ip}(|>)/(<|){dst_port}(|>) for connection (<|){session_id}(>|), {summary} | message_type is set to about.labels.key/value, ingress_interface is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, egress_interface is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, session_id is set to network.session_id, summary is set to security_result.summary |
| 620001 | Pre-allocate CTIQBE (RTP|RTCP) secondary channel for {dst_interface_name}:{dst_ip}(/{dst_port})? to {src_interface_name}:{src_ip}(/{src_port})? from {summary} | dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, summary is set to security_result.summary |
| 620002 | Unsupported CTIQBE version: hex: from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 621001, 621002 | Interface {interface_name} does not support multicast, not enabled | interface_name is set to about.labels.key/value |
| 621006 | Mrib disconnected, ({dst_ip},{dst_ip1}) event cancelled | dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 621007 | Bad register from {interface_name}:{src_ip} to {dst_ip} for <message_text> | interface_name is set to about.labels.key/value, src_ip is set to principal.ip, dst_ip is set to target.ip |
| 622001 | (?P<action_details>Adding|Removing) tracked route <message_text>, distance {distance1}, table {route_table_name}, on interface {interface_name} | action_details is set to security_result.action_details, distance1 is set to about.labels.key/value, route_table_name is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 622101 | Starting regex table compilation for {match_command}; table entries = {table_entries} entries | match_command is set to about.labels.key/value, table_entries is set to about.labels.key/value |
| 622102 | Completed regex table compilation for {match_command}; table size = {table_size} bytes | match_command is set to about.labels.key/value, table_size is set to about.labels.key/value |
| 702305 | (?P<category>IPSEC): An (?P<direction>inbound|outbound|INBOUND|OUTBOUND|Inbound|Outbound) {tunnel_type} SA (SPI={spi}) between {src_ip} and {dst_ip} ({src_fwuser}) is rekeying due to sequence number rollover | category is set to security_result.category_details, direction is set to network.direction, tunnel_type is set to about.labels.key/value, spi is set to about.labels.key/value, src_ip is set to principal.ip, dst_ip is set to target.ip, src_fwuser is set to principal.user.userid/principal.labels.key/value |
| 709008 | (Primary|Secondary) Configuration sync in progress. Command: {command} executed from <message_text> will not be replicated to or executed by the standby unit | command is set to target.process.command_line |
| 710003 | (?P<protocol>TCP|UDP) access denied by ACL from {src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | protocol is set to network.ip_protocol, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 711002 | Task ran for {elapsed_time} msec(s)?, (P|p)rocess = {target_process_name}, PC = {instruction_pointer}(,)? Trace(be|)back ={traceback} | elapsed_time is set to about.labels.key/value, target_process_name is set to target.process.pid, instruction_pointer is set to about.labels.key/value, traceback is set to about.labels.key/value |
| 711004 | Task ran for {elapsed_time} msec, Process = {target_process_name}, PC = {instruction_pointer}, Call stack = {stack_call} | elapsed_time is set to about.labels.key/value, target_process_name is set to target.process.pid, instruction_pointer is set to about.labels.key/value, stack_call is set to about.labels.key/value |
| 713004 | device scheduled for reboot or shutdown, IKE key acquire message on interface {interface_number}, for Peer {dst_ip} ignored | interface_number is set to about.labels.key/value, dst_ip is set to target.ip |
| 713201 | Duplicate Phase {phase} packet detected. {action_details} | phase is set to about.labels.key/value, action_details is set to security_result.action_details |
| 713202 | Duplicate {dst_ip} packet detected | dst_ip is set to target.ip |
| 713006 | Failed to obtain state for message Id {message_id}, Peer Address: {dst_ip} | message_id is set to about.labels.key/value, dst_ip is set to target.ip |
| 713010 | IKE area: failed to find centry for message Id {message_id} | message_id is set to about.labels.key/value |
| 713012 | Unknown protocol ({protocol}). Not adding SA w/spi=SPI {spi} | protocol is set to network.ip_protocol, spi is set to about.labels.key/value |
| 713014 | Unknown Domain of Interpretation (DOI): {domain_of_interpretation} | domain_of_interpretation is set to about.labels.key/value |
| 713016 | (Group = {g_ip}, IP = {src_ip}, )?Unknown identification type, Phase (1 or )?2, Type {id_type} | id_type is set to about.labels.key/value, g_ip is mapped to principal.nat_ip, src_ip is mapped to principal.ip |
| 713017 | Identification type not supported, Phase 1 or 2, Type {id_type} | id_type is set to about.labels.key/value |
| 713018 | Unknown ID type during find of group name for certs, Type {id_type} | id_type is set to about.labels.key/value |
| 713022 | No Group found matching {peer_id} or {dst_ip} for Pre-shared key peer {dst_ip1} | peer_id is set to about.labels.key/value, dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 713032, 713033 | Received invalid (remote|local) Proxy Range {dst_ip}-{dst_ip1} | dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 713041 | IKE Initiator:<message_text>Intf {dst_interface_name}, IKE Peer {dst_ip}local Proxy Address {local_proxy_addr}, remote Proxy Address {remote_proxy_addr},Crypto map ({crypto_map_tag}) | dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, local_proxy_addr is set to principal.ip, remote_proxy_addr is set to target.ip, crypto_map_ |
| 713042 | IKE Initiator unable to find policy: Intf {dst_interface_name}, Src: {src_ip}, Dst: {dst_ip} | dst_interface_name is set to target.labels.key/value, src_ip is set to principal.ip, dst_ip is set to target.ip |
| 713043 | <message_text>address {dst_ip} session already in progress | dst_ip is set to target.ip |
| 713048 | Error processing payload: Payload ID: {payload_id} | payload_id is set to about.labels.key/value |
| 713049 | (Group = {group_name}, IP = {dst_ip}, )?Security negotiation complete for {tunnel_type} (Group )?({group_name})s+(Initiator|Responder), Inbound SPI= {initiator_spi}, Outbound SPI= {responder_spi} | group_name is set to target.user.group_identifiers, dst_ip is set to target.ip, tunnel_type is set to about.labels.key/value, group_name is set to target.user.group_identifiers, initiator_spi is set to about.labels.key/value, responder_spi is set to about.labels.key/value |
| 713050 | Connection terminated for peer {dst_ip}. Reason: termination reason Remote Proxy {remote_proxy_addr}, Local Proxy {local_proxy_addr} | dst_ip is set to target.ip, remote_proxy_addr is set to target.ip, local_proxy_addr is set to principal.ip |
| 713056 | Tunnel rejected: SA ({sa_name}) not found for group ({group_name})! | sa_name is set to about.labels.key/value, group_name is set to target.user.group_identifiers |
| 713060 | Tunnel Rejected: User ({user_name}) not member of group ({group_name}), group-lock check failed | user_name is set to target.user.userid, group_name is set to target.user.group_identifiers |
| 713061 | Tunnel rejected: Crypto Map Policy not found for Src:{src_ip}, Dst: {dst_ip}! | src_ip is set to principal.ip, dst_ip is set to target.ip |
| 713062 | IKE Peer address same as our interface address {dst_ip} | dst_ip is set to target.ip |
| 713063 | IKE Peer address not configured for destination {dst_ip} | dst_ip is set to target.ip |
| 713065 | IKE Remote Peer did not negotiate the following: {proposal_attribute} | proposal_attribute is set to about.labels.key/value |
| 713068 | Received non-routine Notify message: {notify_type}({notify_value}) | notify_type is set to about.labels.key/value, notify_value is set to about.labels.key/value |
| 713072 | Password for user ({user_name}) too long, truncating to {truncated_length} characters | user_name is set to target.user.userid, truncated_length is set to about.labels.key/value |
| 713073 | (Group = {group_name}, IP = {dst_ip}, )?Responder forcing change of <message_text> rekeying duration from {end_time} to {start_time} seconds | group_name is set to target.user.group_identifiers, dst_ip is set to target.ip, end_time is set to about.labels.key/value, start_time is set to about.labels.key/value |
| 713074 | (Group = {group_name}, IP = {dst_ip}, )?Responder forcing change of (IPsec|IPSec) rekeying duration from {end_time} to {start_time} Kbs | group_name is set to target.user.group_identifiers, dst_ip is set to target.ip, end_time is set to about.labels.key/value, start_time is set to about.labels.key/value |
| 713075, 713076 | (Group = {group_name}, IP = {dst_ip}, )?Overriding Initiator()?'s (IPsec|IPSec) rekeying duration from {end_time} to {start_time} (seconds|Kbs) | group_name is set to target.user.group_identifiers, dst_ip is set to target.ip, end_time is set to about.labels.key/value, start_time is set to about.labels.key/value |
| 713078 | Temp buffer for building mode config attributes exceeded: bufsize {available_size}, used {used_value} | available_size is set to about.labels.key/value, used_value is set to about.labels.key/value |
| 713081 | Unsupported certificate encoding type {encoding_type} | encoding_type is set to about.labels.key/value |
| 713084 | Received invalid phase 1 port value ({dst_port}) in ID payload | dst_port is set to target.port |
| 713085 | Received invalid phase 1 protocol ({protocol}) in ID payload | protocol is set to network.ip_protocol |
| 713088 | Set Cert filehandle failure: no (IPsec|IPSec) SA in group {group_name} | group_name is set to target.user.group_identifiers |
| 713098 | Aborting: No identity cert specified in (IPsec|IPSec) SA ({sa_name})! | sa_name is set to about.labels.key/value |
| 713102 | Phase 1 ID Data length {packet_length} too long - reject tunnel! | packet_length is set to about.labels.key/value |
| 713107 | {dst_ip} request attempt failed! | dst_ip is set to target.ip |
| 713112 | Failed to process CONNECTED notify (SPI {spi_value})! | spi_value is set to about.labels.key/value |
| 713118 | Detected invalid Diffie-Helmann {group_name}, in IKE area | group_name is set to target.user.group_identifiers |
| 713119 | Group {group_name} IP {dst_ip} PHASE 1 COMPLETED | group_name is set to target.user.group_identifiers, dst_ip is set to target.ip |
| 713119 | Group = {group_name}, IP = {dst_ip}, PHASE 1 COMPLETED | group_name is set to target.user.group_identifiers, dst_ip is set to target.ip |
| 713120 | PHASE 2 COMPLETED (msgid={message_id}) | message_id is set to about.labels.key/value |
| 713122 | (IP = {dst_ip}, )?Keep-alives configured {keepalive_type} but peer( {dst_ip})?( does not)? support keep-alives<message_text> | dst_ip is set to target.ip, keepalive_type is set to about.labels.key/value, dst_ip is set to target.ip |
| 713123 | IKE lost contact with remote peer, deleting connection (keepalive type: {keepalive_type}) | keepalive_type is set to about.labels.key/value |
| 713124 | Received DPD sequence number {rcv_sequence} in {summary} | rcv_sequence is set to about.labels.key/value, summary is set to security_result.summary |
| 713128 | Connection attempt to VCPIP redirected to VCA peer {dst_ip} via load balancing | dst_ip is set to target.ip |
| 713129 | Received unexpected Transaction Exchange payload type: {payload_id} | payload_id is set to about.labels.key/value |
| 713130 | Received unsupported transaction mode attribute: {attribute_id} | attribute_id is set to about.labels.key/value |
| 713131 | Received unknown transaction mode attribute: {attribute_id} | attribute_id is set to about.labels.key/value |
| 713132 | Cannot obtain an {dst_ip} for remote peer | dst_ip is set to target.ip |
| 713133 | Mismatch: Overriding phase 2 DH Group(DH group {group_name}) with phase 1 group(DH group {group_number}())? | group_name is set to target.user.group_identifiers, group_number is set to about.labels.key/value |
| 713135 | message received, redirecting tunnel to {dst_ip} | dst_ip is set to target.ip |
| 713136 | IKE session establishment timed out( {ike_state_name})?, aborting! | ike_state_name is set to about.labels.key/value |
| 713137 | Reaper overriding refCnt( {ref_count})? and tunnelCnt( {tunnel_count})? -- deleting SA! | ref_count is set to about.labels.key/value, tunnel_count is set to about.labels.key/value |
| 713138 | Group {group_name} not found and BASE GROUP default preshared key not configured | group_name is set to target.user.group_identifiers |
| 713139 | {group_name} not found, using BASE GROUP default preshared key | group_name is set to target.user.group_identifiers |
| 713141 | Client-reported firewall does not match configured firewall: {action} tunnel. Received -- Vendor: {vendor_id}, Product {product_id}, Caps: {capability_value}. Expected -- Vendor: {expected_vendor_id}, Product: {expected_product_id}, Caps: {expected_capability_value} | action is set to security_result.action, vendor_id is set to about.labels.key/value, product_id is set to about.labels.key/value, capability_value is set to about.labels.key/value, expected_vendor_id is set to about.labels.key/value, expected_product_id is set to about.labels.key/value, expected_capability_value is set to about.labels.key/value |
| 713142 | Client did not report firewall in use, but there is a configured firewall: {action} tunnel. Expected -- Vendor: {expected_vendor_id}, Product {expected_product_id}, Caps: {expected_capability_value} | action is set to security_result.action, expected_vendor_id is set to about.labels.key/value, expected_product_id is set to about.labels.key/value, expected_capability_value is set to about.labels.key/value |
| 713144 | Ignoring received malformed firewall record; reason -{summary} | summary is set to security_result.summary |
| 713269 | Detected Hardware Client in network extension mode, adding static route for address: {dst_ip}, mask:/{prefix_length} | dst_ip is set to target.ip, prefix_length is set to about.labels.key/value |
| 713145 | Detected Hardware Client in network extension mode, adding static route for address: {dst_ip}, mask: {netmask} | dst_ip is set to target.ip, netmask is set to about.labels.key/value |
| 713270 | Could not add route for Hardware Client in network extension mode, address: {dst_ip}, mask:/{prefix_length} | dst_ip is set to target.ip, prefix_length is set to about.labels.key/value |
| 713271 | Terminating tunnel to Hardware Client in network extension mode, deleting static route for address: {dst_ip}, mask:/{prefix_length} | dst_ip is set to target.ip, prefix_length is set to about.labels.key/value |
| 713272 | Terminating tunnel to Hardware Client in network extension mode, unable to delete static route for address: {dst_ip}, mask:/{prefix_length} | dst_ip is set to target.ip, prefix_length is set to about.labels.key/value |
| 713146 | Could not add route for Hardware Client in network extension mode, address: {dst_ip}, mask: {netmask} | dst_ip is set to target.ip, netmask is set to about.labels.key/value |
| 713147 | Terminating tunnel to Hardware Client in network extension mode, deleting static route for address: {dst_ip}, mask: {netmask} | dst_ip is set to target.ip, netmask is set to about.labels.key/value |
| 713148 | Terminating tunnel to Hardware Client in network extension mode, unable to delete static route for address: {dst_ip}, mask: {netmask} | dst_ip is set to target.ip, netmask is set to about.labels.key/value |
| 713149 | Hardware client security attribute {attribute_name} was enabled but not requested | attribute_name is set to about.labels.key/value |
| 713152 | Unable to obtain any rules from filter {acl_id} to send to client for CPP, (?P<action>terminating) connection | action is set to security_result.action, acl_id is set to about.labels.key/value |
| 713154 | DNS lookup for {peer_description} Server {server_name} failed! | peer_description is set to about.labels.key/value, server_name is set to about.labels.key/value |
| 713155 | DNS lookup for Primary VPN Server {server_name} successfully resolved after a previous failure. Resetting any Backup Server init | server_name is set to about.labels.key/value |
| 713156 | Initializing Backup Server {dst_ip} | dst_ip is set to target.ip |
| 713157 | Timed out on initial contact to server {dst_ip} Tunnel could not be established | dst_ip is set to target.ip |
| 713161 | Remote user (session Id -{session_id}) network access has been (?P<action>restricted) by the Firewall Server | action is set to security_result.action, session_id is set to network.session_id |
| 713162, 713163 | Remote user (session Id -{session_id}) has been (?P<action>rejected|terminated) by the Firewall Server | action is set to security_result.action, session_id is set to network.session_id |
| 713176 | {device_type} memory resources are critical, IKE key acquire message on interface {interface_number}, for Peer {dst_ip} ignored | device_type is set to about.labels.key/value, interface_number is set to about.labels.key/value, dst_ip is set to target.ip |
| 713177 | Received remote Proxy Host FQDN in ID Payload: Host Name: {target_hostname} Address {dst_ip}, Protocol {protocol}, Port {dst_port} | target_hostname is set to target.hostname, dst_ip is set to target.ip, protocol is set to network.ip_protocol, dst_port is set to target.port |
| 713179 | IKE AM Initiator received a packet from its peer without a {payload_type} payload | payload_type is set to about.labels.key/value |
| 713184 | Client Type: {client_type} Client Application Version: {version} | client_type is set to about.labels.key/value, version is set to about.labels.key/value |
| 713186 | Invalid secondary domain name list received from the authentication server. List Received: {list_text} Character {index} ({value}) is illegal | list_text is set to about.labels.key/value, index is set to about.labels.key/value, value is set to about.labels.key/value |
| 713189 | Attempted to assign network or broadcast {src_ip}, removing ({dst_ip}) from pool | src_ip is set to principal.ip, dst_ip is set to target.ip |
| 713193 | Received packet with missing payload, Expected payload: {payload_id} | payload_id is set to about.labels.key/value |
| 713194 | Sending (IKE|IPsec) Delete With Reason message: {summary} | summary is set to security_result.summary |
| 713196 | Remote L2L Peer {dst_ip} initiated a tunnel with same outer and inner addresses. Peer could be Originate Only - Possible misconfiguration! | dst_ip is set to target.ip |
| 713197 | The configured Confidence Interval of {interval} seconds is invalid for this {tunnel_type} connection. Enforcing the second default | interval is set to about.labels.key/value, tunnel_type is set to about.labels.key/value |
| 713198 | User Authorization failed: {user_name} User authorization failed. Username could not be found in the certificate | user_name is set to target.user.userid |
| 713199 | Reaper corrected an SA that has not decremented the concurrent IKE negotiations counter ({counter_value})! | counter_value is set to about.labels.key/value |
| 713205 | Could not add static route for client address: {dst_ip} | dst_ip is set to target.ip |
| 713208 | Cannot create dynamic rule for Backup L2L entry rule {rule_id} | rule_id is set to about.labels.key/value |
| 713265 | Adding static route for L2L peer coming in on a dynamic map. address: {dst_ip}, mask:/{prefix_length} | dst_ip is set to target.ip, prefix_length is set to about.labels.key/value |
| 713266 | Could not add route for L2L peer coming in on a dynamic map. address: {dst_ip}, mask:/{prefix_length} | dst_ip is set to target.ip, prefix_length is set to about.labels.key/value |
| 713267 | Deleting static route for L2L peer that came in on a dynamic map. address: {dst_ip}, mask:/{prefix_length} | dst_ip is set to target.ip, prefix_length is set to about.labels.key/value |
| 713268 | Could not delete route for L2L peer that came in on a dynamic map. address: {dst_ip}, mask:/{prefix_length} | dst_ip is set to target.ip, prefix_length is set to about.labels.key/value |
| 713211 | Adding static route for L2L peer coming in on a dynamic map. address: {dst_ip}, mask: {netmask} | dst_ip is set to target.ip, netmask is set to about.labels.key/value |
| 713212 | Could not add route for L2L peer coming in on a dynamic map. address: {dst_ip}, mask: {netmask} | dst_ip is set to target.ip, netmask is set to about.labels.key/value |
| 713213 | Deleting static route for L2L peer that came in on a dynamic map. address: {dst_ip}, mask: {netmask} | dst_ip is set to target.ip, netmask is set to about.labels.key/value |
| 713214 | Could not delete route for L2L peer that came in on a dynamic map. address: {dst_ip}, mask: {netmask} | dst_ip is set to target.ip, netmask is set to about.labels.key/value |
| 713215 | No match against Client Type and Version rules. Client: {client_type} is( not)? allowed by default | client_type is set to about.labels.key/value |
| 713216 | Rule: {action} Client type]: {version} Client: {client_type} not allowed | action is set to security_result.action, version is set to about.labels.key/value, client_type is set to about.labels.key/value |
| 713216 | Rule: {action} Client type]: {version} Client: {client_type} allowed | action is set to security_result.action, version is set to about.labels.key/value, client_type is set to about.labels.key/value |
| 713217 | Skipping unrecognized rule: action: {action} client type: {client_type} client version: {version} | action is set to security_result.action, client_type is set to about.labels.key/value, version is set to about.labels.key/value |
| 713226 | Connection failed with peer {dst_ip}, no trust-point defined in tunnel-group {tunnel_group} | dst_ip is set to target.ip, tunnel_group is set to target.group.group_display_name |
| 713227 | Rejecting new (IPsec|IPSec) SA negotiation for peer {dst_ip}. A negotiation was already in progress for local Proxy {local_proxy_addr}/{local_netmask}, remote Proxy {remote_proxy_addr}/{remote_netmask} | dst_ip is set to target.ip, local_proxy_addr is set to principal.ip, local_netmask is set to about.labels.key/value, remote_proxy_addr is set to target.ip, remote_netmask is set to about.labels.key/value |
| 713228 | Group = {group_name}, Username = {user_name}, IP = {dst_ip}(,)? Assigned private IP address {dst_ip1} to remote user | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 713229 | Auto Update - Notification to client {dst_ip} of update string: {summary} | dst_ip is set to target.ip, summary is set to security_result.summary |
| 713230 | Internal Error, ike_lock trying to lock bit that is already locked for type {semaphore} | semaphore is set to about.labels.key/value |
| 713231 | Internal Error, ike_lock trying to unlock bit that is not locked for type {semaphore} | semaphore is set to about.labels.key/value |
| 713232 | SA lock refCnt = {sa_lock_value}, bitmask = {bitmask_hex}, p1_decrypt_cb = {p1_decrypt_cb}, qm_decrypt_cb = {qm_decrypt_cb}, qm_hash_cb = {qm_hash_cb}, qm_spi_ok_cb = {qm_spi_ok_cb}, qm_dh_cb = {qm_dh_cb}, qm_secret_key_cb = {qm_secret_key_cb}, qm_encrypt_cb = {qm_encrypt_cb} | sa_lock_value is set to about.labels.key/value, bitmask_hex is set to about.labels.key/value, p1_decrypt_cb is set to about.labels.key/value, qm_decrypt_cb is set to about.labels.key/value, qm_hash_cb is set to about.labels.key/value, qm_spi_ok_cb is set to about.labels.key/value, qm_dh_cb is set to about.labels.key/value, qm_secret_key_cb is set to about.labels.key/value, qm_encrypt_cb is set to about.labels.key/value |
| 713237 | ACL update ({access_list}) received during re-key re-authentication will not be applied to the tunnel | access_list is set to about.labels.key/value |
| 713239 | {dst_ip}: Tunnel Rejected: The maximum tunnel count allowed has been reached | dst_ip is set to target.ip |
| 713240 | Received DH key with bad length: received length={message_length} expected length={expected_msg_length} | message_length is set to about.labels.key/value, expected_msg_length is set to about.labels.key/value |
| 713241 | IE Browser Proxy Method {setting_number} is Invalid | setting_number is set to about.labels.key/value |
| 713243 | {summary} Unable to find the requested certificate | summary is set to security_result.summary |
| 713244 | {summary} Received Legacy Authentication Method(LAM) type {lam_type} is different from the last type received {last_lam_type} | summary is set to security_result.summary, lam_type is set to about.labels.key/value, last_lam_type is set to about.labels.key/value |
| 713245 | {summary} Unknown Legacy Authentication Method(LAM) type {lam_type} received | summary is set to security_result.summary, lam_type is set to about.labels.key/value |
| 713246 | {summary} Unknown Legacy Authentication Method(LAM) attribute type {lam_type} received | summary is set to security_result.summary, lam_type is set to about.labels.key/value |
| 713247 | {summary} Unexpected error: in Next Card Code mode while not doing SDI | summary is set to security_result.summary |
| 713248 | {summary} Rekey initiation is being disabled during CRACK authentication | summary is set to security_result.summary |
| 713249 | <message_text> Received unsupported authentication results: {summary} | summary is set to security_result.summary |
| 713250 | {summary} Received unknown Internal Address attribute: {attribute} | summary is set to security_result.summary, attribute is set to about.labels.key/value |
| 713251 | {summary} Received authentication failure message | summary is set to security_result.summary |
| 713252 | Group = {group_name}, Username = {user_name}, IP = {dst_ip}, Integrity Firewall Server is not available. VPN Tunnel creation rejected for client | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 713253 | Group = {group_name}, Username = {user_name}, IP = {dst_ip}, Integrity Firewall Server is not available. Entering ALLOW mode. VPN Tunnel created for client | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 713254 | Group = {group_name}, Username = {user_name}, IP = {dst_ip}, Invalid {protocol} port = {dst_port}, valid range is {port_range} , except port 4500, which is reserved for <message_text> | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, protocol is set to network.ip_protocol, dst_port is set to target.port, port_range is set to about.labels.key/value |
| 713255 | IP = {dst_ip}, Received ISAKMP Aggressive Mode message 1 with unknown tunnel group name {group_name} | dst_ip is set to target.ip, group_name is set to target.user.group_identifiers |
| 713256 | IP = {dst_ip}, Sending spoofed ISAKMP Aggressive Mode message 2 due to receipt of unknown tunnel group. Aborting connection | dst_ip is set to target.ip |
| 713257 | Phase {mismatch_phase} failure:Mismatched attribute types for class {attribute_class}:Rcv'd: {attribute_received} Cfg'd: {attribute_configured} | mismatch_phase is set to about.labels.key/value, attribute_class is set to about.labels.key/value, attribute_received is set to about.labels.key/value, attribute_configured is set to about.labels.key/value |
| 713258 | IP = {dst_ip}, Attempting to establish a phase2 tunnel on {src_interface_name} interface but phase1 tunnel is on {dst_interface_name} interface. Tearing down old phase1 tunnel due to a potential routing change | dst_ip is set to target.ip, src_interface_name is set to principal.labels.key/value, dst_interface_name is set to target.labels.key/value |
| 713259 | Group = {group_name}, Username = {user_name}, IP = {dst_ip}, Session is being torn down. Reason: {summary} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, summary is set to security_result.summary |
| 713260 | Output interface {dst_interface_name} to peer was not found | dst_interface_name is set to target.labels.key/value |
| 713261 | IPV6 address on output interface {dst_interface_name} was not found | dst_interface_name is set to target.labels.key/value |
| 713262 | Rejecting new IPSec SA negotiation for peer {dst_ip}. A negotiation was already in progress for local Proxy {local_proxy_addr}/{local_prefix_length}, remote Proxy {remote_proxy_addr}/{remote_prefix_length} | dst_ip is set to target.ip, local_proxy_addr is set to principal.ip, local_prefix_length is set to about.labels.key/value, remote_proxy_addr is set to target.ip, remote_prefix_length is set to about.labels.key/value |
| 713274 | (Deleting|Could not delete) static route for client address: {dst_ip} {dst_ip1} address of client whose route is being removed | dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 713275 | IKEv1 Unsupported certificate keytype {keytype} found at trustpoint {trustpoint} | keytype is set to about.labels.key/value, trustpoint is set to about.labels.key/value |
| 713276 | Dropping new negotiation - IKEv1 in-negotiation context limit of {limit} reached | limit is set to about.labels.key/value |
| 716001 | Group {group_name} User {user_name} IP {dst_ip} WebVPN session started | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 716002 | Group {group_policy} User {user_name} IP {dst_ip} WebVPN session terminated: User requested | group_policy is set to about.labels.key/value, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 716003 | Group {group_name} User {user_name} IP ip WebVPN access "(?P<action>GRANTED): {redirect_url}" | action is set to security_result.action, group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, redirect_url is set to target.url |
| 716004 | Group {group_name} User {user_name} WebVPN access (?P<action>DENIED) to specified location: {redirect_url} | action is set to security_result.action, group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, redirect_url is set to target.url |
| 716005 | Group {group_name} User {user_name} WebVPN ACL Parse Error: {summary} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, summary is set to security_result.summary |
| 716006 | Group {group_name} User {user_name} WebVPN session terminated. Idle timeout | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid |
| 716007 | Group {group_name} User {user_name} WebVPN Unable to create session | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid |
| 716009 | Group {group_name} User {user_name} WebVPN session not allowed. WebVPN ACL parse error | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid |
| 716022 | Unable to connect to proxy server {summary} | summary is set to security_result.summary |
| 716023 | Group {group_name} User {user_name} Session could not be established: session limit of {maximum_sessions} reached | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, maximum_sessions is set to about.labels.key/value |
| 716038 | Group {group_name} User {user_name} IP {dst_ip} Authentication: successful, Session Type: WebVPN | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 716039 | Authentication: rejected, group = {group_name} user = {user_name}, Session Type: {session_type} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, session_type is set to about.labels.key/value |
| 716039 | Group <{group_name}> User {user_name} IP <{dst_ip}> Authentication: rejected, Session Type: {session_type} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, session_type is set to about.labels.key/value |
| 716040 | Reboot pending, new sessions disabled. (?P<action>Denied) {user_name} login | action is set to security_result.action, user_name is set to target.user.userid |
| 716041 | access-list {acl_id} action url {redirect_url} hit_cnt {hit_count} | acl_id is set to about.labels.key/value, redirect_url is set to target.url, hit_count is set to about.labels.key/value |
| 716042 | access-list {acl_id} action (?P<protocol>tcp) {src_interface_name}/{src_ip} ({src_port}) - {dst_interface_name}/{dst_ip} ({dst_port}) hit-cnt {hit_count} | protocol is set to network.ip_protocol, acl_id is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, hit_count is set to about.labels.key/value |
| 716043 | Group {group_name}, User {user_name}, IP {dst_ip}: WebVPN Port Forwarding Java applet started. Created new hosts file mappings | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 716044 | Group {group_name} User {user_name} IP {dst_ip} AAA parameter {parameter_name} value {parameter_value} out of range | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, parameter_name is set to about.labels.key/value, parameter_value is set to about.labels.key/value |
| 716045 | Group {group_name} User {user_name} IP {dst_ip} AAA parameter {parameter_name} value invalid | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, parameter_name is set to about.labels.key/value |
| 716046 | Group {group_name} User {user_name} IP {dst_ip} User ACL {access_list_entry} from AAA doesn't exist on the device, terminating connection | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, access_list_entry is set to about.labels.key/value |
| 716047 | Group {group_name} User {user_name} IP {dst_ip} User ACL {access_list_entry} from AAA ignored, AV-PAIR ACL used instead | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, access_list_entry is set to about.labels.key/value |
| 716048 | Group {group_name} User {user_name} IP {dst_ip} No memory to parse ACL | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 716049 | Group {group_name} User {user_name} IP {dst_ip} Empty SVC ACL | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 716050 | Error adding to ACL: {ace_command_line} | ace_command_line is set to about.labels.key/value |
| 716051 | Group {group_name} User {user_name} IP {dst_ip} Error adding dynamic ACL for user | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 716052 | Group {group_name} User {user_name} IP {dst_ip} Pending session terminated | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 716053, 716054 | SSO Server (added|deleted): name: {server_name} Type: {server_type} | server_name is set to about.labels.key/value, server_type is set to about.labels.key/value |
| 716055 | Group {group_name} User {user_name} IP {dst_ip} Authentication to SSO server name: {server_name} type {server_type} succeeded | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, server_name is set to about.labels.key/value, server_type is set to about.labels.key/value |
| 716056 | Group {group_name} User {user_name} IP {dst_ip} Authentication to SSO server name: {server_name} type {server_type} failed reason: {summary} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, server_name is set to about.labels.key/value, server_type is set to about.labels.key/value, summary is set to security_result.summary |
| 716057 | Group {group_name} User {user_name} IP {dst_ip} Session terminated, no {license_type} license available | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, license_type is set to about.labels.key/value |
| 716058 | Group {group_name} User {user_name} IP {dst_ip} AnyConnect session lost connection. Waiting to resume | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 716059 | Group {group_name} User {user_name} IP {dst_ip} AnyConnect session resumed. Connection from {src_ip} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, src_ip is set to principal.ip |
| 716060 | Group {group_name} User {user_name} IP {dst_ip} Terminated AnyConnect session in inactive state to accept a new connection. License limit reached | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 716061 | Group {group_name} User {user_name} IP {dst_ip} IPv6 User Filter {dst_ip1} configured for AnyConnect. This setting has been deprecated, terminating connection | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 716500, 716501 | internal error in: {function}: Fiber library cannot (attach|locate) AK47 instance | function is set to about.labels.key/value |
| 716502 | internal error in: {function}: Fiber library cannot allocate default arena | function is set to about.labels.key/value |
| 716503, 716504 | internal error in: {function}: Fiber library cannot allocate fiber (stacks|descriptors) pool | function is set to about.labels.key/value |
| 716505 | internal error in: {function}: Fiber has joined fiber in unfinished state | function is set to about.labels.key/value |
| 716508, 716509, 716510 | internal error in: {function}: Fiber scheduler is scheduling (finished|alien|rotten) fiber. Cannot (continue|continuing) terminating | function is set to about.labels.key/value |
| 716512 | internal error in: {function}: Fiber has joined fiber waited upon by someone else | function is set to about.labels.key/value |
| 716513 | internal error in: {function}: Fiber in callback blocked on other channel | function is set to about.labels.key/value |
| 716515 | internal error in: {function}: OCCAM failed to allocate memory for AK47 instance | function is set to about.labels.key/value |
| 716516 | internal error in: {function}: OCCAM has corrupted ROL array. Cannot continue terminating | function is set to about.labels.key/value |
| 716517 | internal error in: {function}: OCCAM cached block has no associated arena | function is set to about.labels.key/value |
| 716518 | internal error in: {function}: OCCAM pool has no associated arena | function is set to about.labels.key/value |
| 716519 | internal error in: {function}: OCCAM has corrupted pool list. Cannot continue terminating | function is set to about.labels.key/value |
| 716520 | internal error in: {function}: OCCAM pool has no block list | function is set to about.labels.key/value |
| 716521 | internal error in: {function}: OCCAM no realloc allowed in named pool | function is set to about.labels.key/value |
| 716522 | internal error in: {function}: OCCAM corrupted standalone block | function is set to about.labels.key/value |
| 716600 | Rejected {received_kb}KB Hostscan data from IP (<)?{src_ip}(>)?. Hostscan results exceed (default|configured) limit of {configured_kb}KB | received_kb is set to about.labels.key/value, src_ip is set to principal.ip, configured_kb is set to about.labels.key/value |
| 716601 | Rejected {received_kb} KB Hostscan data from IP {src_ip}. System-wide limit on the amount of Hostscan data stored on FTD exceeds the limit of {configured_kb} KB | received_kb is set to about.labels.key/value, src_ip is set to principal.ip, configured_kb is set to about.labels.key/value |
| 716602 | Memory allocation error. Rejected {received_kb} KB Hostscan data from IP {src_ip} | received_kb is set to about.labels.key/value, src_ip is set to principal.ip |
| 717002 | Certificate enrollment failed for trustpoint {trustpoint_name}. Reason:{summary} | trustpoint_name is set to about.labels.key/value, summary is set to security_result.summary |
| 717003 | Certificate received from Certificate Authority for trustpoint {trustpoint_name} | trustpoint_name is set to about.labels.key/value |
| 717004, 717006 | PKCS #12 (import|export) failed for trustpoint {trustpoint_name} | trustpoint_name is set to about.labels.key/value |
| 717005, 717007 | PKCS #12 (import|export) succeeded for trustpoint {trustpoint_name} | trustpoint_name is set to about.labels.key/value |
| 717008 | Insufficient memory to {target_process_name} | target_process_name is set to target.process.pid |
| 717009 | Certificate validation failed. Reason:{summary} | summary is set to security_result.summary |
| 717010 | CRL polling failed for trustpoint {trustpoint_name} | trustpoint_name is set to about.labels.key/value |
| 717012 | Failed to refresh CRL cache entry from the server for trustpoint {trustpoint_name} at {time_of_failure} | trustpoint_name is set to about.labels.key/value, time_of_failure is set to about.labels.key/value |
| 717013 | Removing a cached CRL to accommodate an incoming CRL. Issuer: {issuer} | issuer is set to about.labels.key/value |
| 717014 | Unable to cache a CRL received from <message_text> due to size limitations (CRL size = {crl_size}, available cache space = {cache_space}) | crl_size is set to about.labels.key/value, cache_space is set to about.labels.key/value |
| 717015 | CRL received from {issuer} is too large to process (CRL size = {crl_size}, maximum CRL size = {max_crl_size}) | issuer is set to about.labels.key/value, crl_size is set to about.labels.key/value, max_crl_size is set to about.labels.key/value |
| 717016 | Removing expired CRL from the CRL cache. Issuer: {issuer} | issuer is set to about.labels.key/value |
| 717017 | Failed to query CA certificate for trustpoint {trustpoint_name} from {enrollment_url} | trustpoint_name is set to about.labels.key/value, enrollment_url is set to about.labels.key/value |
| 717018 | CRL received from {issuer} has too many entries to process (number of entries = {number_of_entries}, maximum number allowed = {max_allowed}) | issuer is set to about.labels.key/value, number_of_entries is set to about.labels.key/value, max_allowed is set to about.labels.key/value |
| 717019 | Failed to insert CRL for trustpoint {trustpoint_name}. Reason: {summary} | trustpoint_name is set to about.labels.key/value, summary is set to security_result.summary |
| 717020 | Failed to install device certificate for trustpoint {label}. Reason: {summary} | label is set to about.labels.key/value, summary is set to security_result.summary |
| 717021 | Certificate data could not be verified. Locate Reason:{summary} serial number: {serial_number}, subject name: {subject_name}, key length {length} bits | summary is set to security_result.summary, serial_number is set to about.labels.key/value, subject_name is set to about.labels.key/value, length is set to about.labels.key/value |
| 717022 | Certificate was successfully validated. {certificate_identifiers} | certificate_identifiers is set to about.labels.key/value |
| 717023 | SSL failed to set device certificate for trustpoint {trustpoint_name}. Reason: {summary} | trustpoint_name is set to about.labels.key/value, summary is set to security_result.summary |
| 717024 | Checking CRL from trustpoint: {trustpoint_name} for {summary} | trustpoint_name is set to about.labels.key/value, summary is set to security_result.summary |
| 717025 | Validating certificate chain containing {number_of_certs} certificate | number_of_certs is set to about.labels.key/value |
| 717026 | Name lookup failed for hostname {target_hostname} during PKI operation | target_hostname is set to target.hostname |
| 717027 | Certificate chain failed validation. {summary} | summary is set to security_result.summary |
| 717028 | Certificate chain was successfully validated {info} | info is set to about.labels.key/value |
| 717029 | Identified client certificate within certificate chain. serial number: {serial_number}, subject name: {subject_name} | serial_number is set to about.labels.key/value, subject_name is set to about.labels.key/value |
| 717030 | Found a suitable trustpoint {trustpoint_name} to validate certificate | trustpoint_name is set to about.labels.key/value |
| 717031 | Failed to find a suitable trustpoint for the issuer: {issuer} Reason: {summary} | issuer is set to about.labels.key/value, summary is set to security_result.summary |
| 717035 | OCSP status is being checked for certificate. {certificate_identifiers} | certificate_identifiers is set to about.labels.key/value |
| 717036 | Looking for a tunnel group match based on certificate maps for peer certificate with {certificate_identifiers} | certificate_identifiers is set to about.labels.key/value |
| 717037 | Tunnel group search using certificate maps failed for peer certificate: {certificate_identifiers} | certificate_identifiers is set to about.labels.key/value |
| 717038 | Tunnel group match found. Tunnel Group: {tunnel_group},Peer certificate: {certificate_identifiers} | tunnel_group is set to target.group.group_display_name, certificate_identifiers is set to about.labels.key/value |
| 717039 | Local CA Server internal error detected: {error_message} | error_message is set to security_result.description |
| 717040 | Local CA Server has failed and is being disabled. Reason: {summary} | summary is set to security_result.summary |
| 717041 | Local CA Server event: {info} | info is set to about.labels.key/value |
| 717042 | Failed to enable Local CA Server.Reason: {summary} | summary is set to security_result.summary |
| 717043 | Local CA Server certificate enrollment related info for user: {user_name}. Info: {info} | user_name is set to target.user.userid, info is set to about.labels.key/value |
| 717044 | Local CA server certificate enrollment related error for user: {user_name}. Error: {error_message} | user_name is set to target.user.userid, error_message is set to security_result.description |
| 717045 | Local CA Server CRL info: {info} | info is set to about.labels.key/value |
| 717046 | Local CA Server CRL error: {error_message} | error_message is set to security_result.description |
| 717047 | (Revoked|Unrevoked) certificate issued to user: {user_name}, with serial number {serial_number} | user_name is set to target.user.userid, serial_number is set to about.labels.key/value |
| 717049 | Local CA Server certificate is due to expire in {days_left} days and a replacement certificate is available for export | days_left is set to about.labels.key/value |
| 717050 | SCEP Proxy: Processed request type {request_type} from IP {src_ip}, User {user_name}, TunnelGroup {tunnel_group}, GroupPolicy {group_name} to CA IP {dst_ip} | request_type is set to about.labels.key/value, src_ip is set to principal.ip, user_name is set to target.user.userid, tunnel_group is set to target.group.group_display_name, group_name is set to target.user.group_identifiers, dst_ip is set to target.ip |
| 717051 | SCEP Proxy: Denied processing the request type {request_type} received from IP {src_ip}, User {user_name}, TunnelGroup {tunnel_group}, GroupPolicy {group_name} to CA {dst_ip}. Reason: {summary} | request_type is set to about.labels.key/value, src_ip is set to principal.ip, user_name is set to target.user.userid, tunnel_group is set to target.group.group_display_name, group_name is set to target.user.group_identifiers, dst_ip is set to target.ip, summary is set to security_result.summary |
| 717052 | Group {group_name} User {user_name} IP {dst_ip} Session disconnected due to periodic certificate authentication failure. Subject Name {subject_name} Issuer Name {issuer} Serial Number {serial_number} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, subject_name is set to about.labels.key/value, issuer is set to about.labels.key/value, serial_number is set to about.labels.key/value |
| 717053 | Group {group_name} User {user_name} IP {dst_ip} Periodic certificate authentication succeeded. Subject Name {subject_name} Issuer Name {issuer} Serial Number {serial_number} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, subject_name is set to about.labels.key/value, issuer is set to about.labels.key/value, serial_number is set to about.labels.key/value |
| 717054 | The {type} certificate in the trustpoint {trustpoint_name} is due to expire in {days_left} days. Expiration {expiration} Subject Name {subject_name} Issuer Name {issuer} Serial Number {serial_number} | type is set to about.labels.key/value, trustpoint_name is set to about.labels.key/value, days_left is set to about.labels.key/value, expiration is set to about.labels.key/value, subject_name is set to about.labels.key/value, issuer is set to about.labels.key/value, serial_number is set to about.labels.key/value |
| 717055 | The {type} certificate in the trustpoint {trustpoint_name} has expired. Expiration {expiration} Subject Name {subject_name} Issuer Name {issuer}( Serial Number {serial_number})? | type is set to about.labels.key/value, trustpoint_name is set to about.labels.key/value, expiration is set to about.labels.key/value, subject_name is set to about.labels.key/value, issuer is set to about.labels.key/value, serial_number is set to about.labels.key/value |
| 717056 | Attempting {type} revocation check from {src_interface_name}:{src_ip}/{src_port} to {dst_ip}/{dst_port} using {protocol} | type is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, protocol is set to network.ip_protocol |
| 717059 | Peer certificate with serial number: (<|){serial_number}(>|), subject: (<|){subject_name}(>|), issuer: (<|){issuer}(>|) matched the configured certificate map {map_name} | serial_number is set to about.labels.key/value, subject_name is set to about.labels.key/value, issuer is set to about.labels.key/value, map_name is set to about.labels.key/value |
| 717060 | Peer certificate with serial number: (<|){serial_number}(>|), subject: (<|){subject_name}(>|), issuer: (<|){issuer}(>|) failed to match the configured certificate map {map_name} | serial_number is set to about.labels.key/value, subject_name is set to about.labels.key/value, issuer is set to about.labels.key/value, map_name is set to about.labels.key/value |
| 717061 | Starting {protocol} certificate enrollment for the trustpoint {trustpoint_name} with the CA {dst_ip}. Request Type {request_type} Mode {mode} | protocol is set to network.ip_protocol, trustpoint_name is set to about.labels.key/value, dst_ip is set to target.ip, request_type is set to about.labels.key/value, mode is set to about.labels.key/value |
| 717062 | {protocol} Certificate enrollment succeeded for the trustpoint {trustpoint_name} with the CA {dst_ip}. Received a new certificate with Subject Name {subject_name} Issuer Name {issuer} Serial Number {serial_number} | protocol is set to network.ip_protocol, trustpoint_name is set to about.labels.key/value, dst_ip is set to target.ip, subject_name is set to about.labels.key/value, issuer is set to about.labels.key/value, serial_number is set to about.labels.key/value |
| 717063 | {protocol} Certificate enrollment failed for the trustpoint {trustpoint_name} with the CA {dst_ip} | protocol is set to network.ip_protocol, trustpoint_name is set to about.labels.key/value, dst_ip is set to target.ip |
| 717064 | Keypair {key_name} in the trustpoint {trustpoint_name} is regenerated for {mode} {protocol} certificate renewal | key_name is set to about.labels.key/value, trustpoint_name is set to about.labels.key/value, mode is set to about.labels.key/value, protocol is set to network.ip_protocol |
| 718001 | Internal interprocess communication queue send failure: code {error_code} | error_code is set to security_result.description |
| 718002 | Create peer {dst_ip} failure, already at maximum of {no_of_peers} | dst_ip is set to target.ip, no_of_peers is set to about.labels.key/value |
| 718003 | Got unknown peer message {message_id} from {dst_ip}, local version {local_version_number}, remote version {remote_version_number} | message_id is set to about.labels.key/value, dst_ip is set to target.ip, local_version_number is set to about.labels.key/value, remote_version_number is set to about.labels.key/value |
| 718004 | Got unknown internal message {message_id} | message_id is set to about.labels.key/value |
| 718005 | Fail to send to {dst_ip}, port {dst_port} | dst_ip is set to target.ip, dst_port is set to target.port |
| 718006 | Invalid load balancing state transition cur={current_state}][event={message_id}] | current_state is set to about.labels.key/value, message_id is set to about.labels.key/value |
| 718007, 718008 | Socket (bind|open) failure {error_code}]:{summary} | error_code is set to security_result.description, summary is set to security_result.summary |
| 718009, 718011 | Send HELLO (request|response) failure to {dst_ip} | dst_ip is set to target.ip |
| 718010, 718012 | Sent HELLO (request|response) to {dst_ip} | dst_ip is set to target.ip |
| 718013 | Peer {dst_ip} is not answering HELLO | dst_ip is set to target.ip |
| 718014 | Primary peer {dst_ip} is not answering HELLO | dst_ip is set to target.ip |
| 718015, 718016 | Received HELLO (request|response) from {dst_ip} | dst_ip is set to target.ip |
| 718017 | Got timeout for unknown peer {src_ip} msg type {message_type} | src_ip is set to principal.ip, message_type is set to about.labels.key/value |
| 718018 | Send KEEPALIVE request failure to {dst_ip} | dst_ip is set to target.ip |
| 718019 | Sent KEEPALIVE request to {dst_ip} | dst_ip is set to target.ip |
| 718020 | Send KEEPALIVE response failure to {dst_ip} | dst_ip is set to target.ip |
| 718021 | Sent KEEPALIVE response to {dst_ip} | dst_ip is set to target.ip |
| 718022 | Received KEEPALIVE request from {src_ip} | src_ip is set to principal.ip |
| 718023 | Received KEEPALIVE response from {src_ip} | src_ip is set to principal.ip |
| 718025 | Sent CFG UPDATE to {dst_ip} | dst_ip is set to target.ip |
| 718026 | Received CFG UPDATE from {src_ip} | src_ip is set to principal.ip |
| 718029 | Sent OOS indicator to {dst_ip} | dst_ip is set to target.ip |
| 718034 | Sent TOPOLOGY indicator to {dst_ip} | dst_ip is set to target.ip |
| 718035 | Received TOPOLOGY indicator from {src_ip} | src_ip is set to principal.ip |
| 718036 | Process timeout for req-type {type_value}, exid {exchange_id}, peer {src_ip} | type_value is set to about.labels.key/value, exchange_id is set to about.labels.key/value, src_ip is set to principal.ip |
| 718024 | Send CFG UPDATE failure to {dst_ip} | dst_ip is set to target.ip |
| 718027 | Received unexpected KEEPALIVE request from {dst_ip} | dst_ip is set to target.ip |
| 718028 | Send OOS indicator failure to {dst_ip} | dst_ip is set to target.ip |
| 718030 | Received planned OOS from {dst_ip} | dst_ip is set to target.ip |
| 718031 | Received OOS obituary for {dst_ip} | dst_ip is set to target.ip |
| 718032 | Received OOS indicator from {dst_ip} | dst_ip is set to target.ip |
| 718033 | Send TOPOLOGY indicator failure to {dst_ip} | dst_ip is set to target.ip |
| 718037 | Primary processed {number_of_timeouts} timeouts | number_of_timeouts is set to about.labels.key/value |
| 718038 | Secondary processed {number_of_timeouts} timeouts | number_of_timeouts is set to about.labels.key/value |
| 718039 | Process dead peer {dst_ip} | dst_ip is set to target.ip |
| 718040 | Timed-out exchange ID {exchange_id} not found | exchange_id is set to about.labels.key/value |
| 718041 | Timeout msgType={message_type}] processed with no callback | message_type is set to about.labels.key/value |
| 718042 | Unable to ARP for {dst_ip} | dst_ip is set to target.ip |
| 718043 | (Updating|Removing) duplicate peer entry {dst_ip} | dst_ip is set to target.ip |
| 718044, 718045 | (Deleted|Created) peer {dst_ip} | dst_ip is set to target.ip |
| 718047 | Fail to create group policy {policy_name} | policy_name is set to target.resource.name |
| 718046 | Create group policy {policy_name} | policy_name is set to target.resource.name |
| 718048, 718050 | (Create|Delete) of secure tunnel failure for peer {dst_ip} | dst_ip is set to target.ip |
| 718051, 718049 | (Deleted|Created) secure tunnel to peer {dst_ip} | dst_ip is set to target.ip |
| 718052 | Received GRAT-ARP from duplicate primary {dst_mac} | dst_mac is set to target.mac |
| 718053 | Detected duplicate primary, mastership stolen {dst_mac} | dst_mac is set to target.mac |
| 718054 | Detected duplicate primary {dst_mac} and going to secondary | dst_mac is set to target.mac |
| 718055 | Detected duplicate primary {dst_mac} and staying PRIMARY | dst_mac is set to target.mac |
| 718056 | Deleted primary peer, IP {src_ip} | src_ip is set to principal.ip |
| 718057 | Queue send failure from ISR, msg type {error_code} | error_code is set to security_result.description |
| 718058 | State machine return code: {action_routine},{return_code} | action_routine is set to about.labels.key/value, return_code is set to security_result.description |
| 718059 | State machine function trace: state={state_name}, event={event_name}, func={action_routine} | state_name is set to about.labels.key/value, event_name is set to about.labels.key/value, action_routine is set to about.labels.key/value |
| 718060 | Inbound socket select fail: context={context_id} | context_id is set to about.labels.key/value |
| 718061 | Inbound socket read fail: context={context_id} | context_id is set to about.labels.key/value |
| 718062 | Inbound thread is awake (context={context_id}) | context_id is set to about.labels.key/value |
| 718063 | Interface {interface_name} is down | interface_name is set to about.labels.key/value |
| 718064 | Admin. interface {interface_name} is down | interface_name is set to about.labels.key/value |
| 718065 | Cannot continue to run (public=(up|down), private=(up|down), enable={lb_state}, master={dst_ip}, session=(Enable|Disable)) | lb_state is set to about.labels.key/value, dst_ip is set to target.ip |
| 718066 | Cannot add secondary address to interface {interface_name}, ip {dst_ip} | interface_name is set to about.labels.key/value, dst_ip is set to target.ip |
| 718067 | Cannot delete secondary address to interface {interface_name}, ip {dst_ip} | interface_name is set to about.labels.key/value, dst_ip is set to target.ip |
| 718068 | Start VPN Load Balancing in context {context_id} | context_id is set to about.labels.key/value |
| 718069 | Stop VPN Load Balancing in context {context_id} | context_id is set to about.labels.key/value |
| 718070 | Reset VPN Load Balancing in context {context_id} | context_id is set to about.labels.key/value |
| 718071 | Terminate VPN Load Balancing in context {context_id} | context_id is set to about.labels.key/value |
| 718072 | Becoming primary of Load Balancing in context {context_id} | context_id is set to about.labels.key/value |
| 718073 | Becoming secondary of Load Balancing in context {context_id} | context_id is set to about.labels.key/value |
| 718074 | Fail to create access list for peer {context_id} | context_id is set to about.labels.key/value |
| 718075 | Peer {dst_ip} access list not set | dst_ip is set to target.ip |
| 718076 | Fail to create tunnel group for peer {dst_ip} | dst_ip is set to target.ip |
| 718077 | Fail to delete tunnel group for peer {dst_ip} | dst_ip is set to target.ip |
| 718078 | Fail to create crypto map for peer {dst_ip} | dst_ip is set to target.ip |
| 718079 | Fail to delete crypto map for peer {dst_ip} | dst_ip is set to target.ip |
| 718080 | Fail to create crypto policy for peer {dst_ip} | dst_ip is set to target.ip |
| 718081 | Fail to delete crypto policy for peer {dst_ip} | dst_ip is set to target.ip |
| 718082 | Fail to create crypto ipsec for peer {dst_ip} | dst_ip is set to target.ip |
| 718083 | Fail to delete crypto ipsec for peer {dst_ip} | dst_ip is set to target.ip |
| 718084 | (Public|cluster|Cluster) IP not on the same subnet: public {dst_ip}, mask {netmask}, cluster {dst_ip1} | dst_ip is set to target.ip, netmask is set to about.labels.key/value, dst_ip1 is set to target.ip |
| 718085 | Interface {interface_name} has no IP address defined | interface_name is set to about.labels.key/value |
| 718086 | Fail to install LB NP rules: type {rule_type}, dst {interface_name}, port {dst_port} | rule_type is set to about.labels.key/value, interface_name is set to about.labels.key/value, dst_port is set to target.port |
| 718087 | Fail to delete LB NP rules: type {rule_type}, rule {rule_id} | rule_type is set to about.labels.key/value, rule_id is set to about.labels.key/value |
| 718088 | Possible VPN LB misconfiguration. Offending device MAC {mac_address} | mac_address is set to about.labels.key/value |
| 719001 | Email Proxy session could not be established: session limit of {maximum_sessions} has been reached | maximum_sessions is set to about.labels.key/value |
| 719002 | Email Proxy session {session_pointer} from {src_ip} has been terminated due to {summary} error | session_pointer is set to about.labels.key/value, src_ip is set to principal.ip, summary is set to security_result.summary |
| 719003 | Email Proxy session {session_pointer} resources have been freed for {src_ip} | session_pointer is set to about.labels.key/value, src_ip is set to principal.ip |
| 719004 | Email Proxy session {session_pointer} has been successfully established for {src_ip} | session_pointer is set to about.labels.key/value, src_ip is set to principal.ip |
| 719005 | FSM <message_text> has been created using {protocol} for session {session_pointer} from {src_ip} | protocol is set to network.ip_protocol, session_pointer is set to about.labels.key/value, src_ip is set to principal.ip |
| 719006 | Email Proxy session {session_pointer} has timed out for {src_ip} because of network congestion | session_pointer is set to about.labels.key/value, src_ip is set to principal.ip |
| 719007 | Email Proxy session {session_pointer} cannot be found for {src_ip} | session_pointer is set to about.labels.key/value, src_ip is set to principal.ip |
| 719010 | {protocol} Email Proxy feature is disabled on interface {interface_name} | protocol is set to network.ip_protocol, interface_name is set to about.labels.key/value |
| 719011 | {protocol} Email Proxy feature is enabled on interface {interface_name} | protocol is set to network.ip_protocol, interface_name is set to about.labels.key/value |
| 719012 | Email Proxy server listening on port {dst_port} for mail protocol {protocol} | dst_port is set to target.port, protocol is set to network.ip_protocol |
| 719013 | Email Proxy server closing port {dst_port} for mail protocol {protocol} | dst_port is set to target.port, protocol is set to network.ip_protocol |
| 719014 | Email Proxy is changing listen port from {old_dst_port} to {dst_port} for mail protocol {protocol} | old_dst_port is set to target.labels.key/value, dst_port is set to target.port, protocol is set to network.ip_protocol |
| 719015 | Parsed emailproxy session {session_pointer} from {src_ip} username: mailuser = {mail_user}, vpnuser = {vpn_user}, mailserver = {mail_server} | session_pointer is set to about.labels.key/value, src_ip is set to principal.ip, mail_user is set to about.labels.key/value, vpn_user is set to about.labels.key/value, mail_server is set to about.labels.key/value |
| 719016 | Parsed emailproxy session {session_pointer} from {src_ip} password: mailpass = {mail_password}, vpnpass= {vpn_password} | session_pointer is set to about.labels.key/value, src_ip is set to principal.ip, mail_password is set to about.labels.key/value, vpn_password is set to about.labels.key/value |
| 719017 | WebVPN user: {user_name} invalid dynamic ACL | user_name is set to target.user.userid |
| 719018 | WebVPN user: {user_name} ACL ID {acl_id} not found | user_name is set to target.user.userid, acl_id is set to about.labels.key/value |
| 719019 | WebVPN user: {user_name} authorization failed | user_name is set to target.user.userid |
| 719020 | WebVPN user {user_name} authorization completed successfully | user_name is set to target.user.userid |
| 719021 | WebVPN user: {user_name} is not checked against ACL | user_name is set to target.user.userid |
| 719022 | WebVPN user {user_name} has been authenticated | user_name is set to target.user.userid |
| 719023 | WebVPN user {user_name} has not been successfully authenticated. Access denied | user_name is set to target.user.userid |
| 719024 | Email Proxy piggyback auth fail: session = {session_pointer} user={user_name} addr={src_ip} | session_pointer is set to about.labels.key/value, user_name is set to target.user.userid, src_ip is set to principal.ip |
| 719025 | Email Proxy DNS name resolution failed for {target_hostname} | target_hostname is set to target.hostname |
| 719026 | Email Proxy DNS name {target_hostname} resolved to {dst_ip} | target_hostname is set to target.hostname, dst_ip is set to target.ip |
| 720014 | (VPN-(Primary|Secondary)) Phase 2 connection entry (msg_id={message_id}, my cookie={my_cookie}, his cookie={his_cookie}) contains no SA list | message_id is set to about.labels.key/value, my_cookie is set to about.labels.key/value, his_cookie is set to about.labels.key/value |
| 720015 | (VPN-(Primary|Secondary)) Cannot found Phase 1 SA for Phase 2 connection entry (msg_id={message_id},my cookie={my_cookie}, his cookie={his_cookie}) | message_id is set to about.labels.key/value, my_cookie is set to about.labels.key/value, his_cookie is set to about.labels.key/value |
| 720016 | (VPN-(Primary|Secondary)) Failed to initialize default timer {index} | index is set to about.labels.key/value |
| 720018 | (VPN-(Primary|Secondary)) Failed to get a buffer from the underlying core high availability subsystem. Error code {error_code} | error_code is set to security_result.description |
| 720021 | (VPN-(Primary|Secondary)) HA non-block send failed for peer msg {message_id}. HA error {error_code} | message_id is set to about.labels.key/value, error_code is set to security_result.description |
| 720022 | (VPN-(?P<unit_name>Primary|Secondary)) Cannot find trustpoint {trustpoint_name} | unit_name is set to about.labels.key/value, trustpoint_name is set to about.labels.key/value |
| 720023 | (VPN-(?P<unit_name>Primary|Secondary)) HA status callback: Peer is (not )?present | unit_name is set to about.labels.key/value |
| 720024 | (VPN-(?P<unit_name>Primary|Secondary)) HA status callback: Control channel is {status} | unit_name is set to about.labels.key/value, status is set to about.labels.key/value |
| 720025 | (VPN-(?P<unit_name>Primary|Secondary)) HA status callback: Data channel is {status} | unit_name is set to about.labels.key/value, status is set to about.labels.key/value |
| 720026 | (VPN-(?P<unit_name>Primary|Secondary)) HA status callback: Current progression is being aborted | unit_name is set to about.labels.key/value |
| 720027 | (VPN-(?P<unit_name>Primary|Secondary)) HA status callback: My state {current_state} | unit_name is set to about.labels.key/value, current_state is set to about.labels.key/value |
| 720028 | (VPN-(?P<unit_name>Primary|Secondary)) HA status callback: Peer state {current_state} | unit_name is set to about.labels.key/value, current_state is set to about.labels.key/value |
| 720029 | (VPN-(?P<unit_name>Primary|Secondary)) HA status callback: Start VPN bulk sync state | unit_name is set to about.labels.key/value |
| 720030 | (VPN-(?P<unit_name>Primary|Secondary)) HA status callback: Stop bulk sync state | unit_name is set to about.labels.key/value |
| 720031 | (VPN-(?P<unit_name>Primary|Secondary)) HA status callback: Invalid event received. event={event_id} | unit_name is set to about.labels.key/value, event_id is set to about.labels.key/value |
| 720032 | (VPN-(?P<unit_name>Primary|Secondary)) HA status callback: id={id}, seq={sequence_number}, grp={group_number}, event={current_event}, op={operand}, my={current_state}, peer={peer_state} | unit_name is set to about.labels.key/value, id is set to about.labels.key/value, sequence_number is set to about.labels.key/value, group_number is set to about.labels.key/value, current_event is set to about.labels.key/value, operand is set to about.labels.key/value, current_state is set to about.labels.key/value, peer_state is set to about.labels.key/value |
| 720033 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to queue add to message queue | unit_name is set to about.labels.key/value |
| 720034 | (VPN-(?P<unit_name>Primary|Secondary)) Invalid type ({message_type}) for message handler | unit_name is set to about.labels.key/value, message_type is set to about.labels.key/value |
| 720035 | (VPN-(?P<unit_name>Primary|Secondary)) Fail to look up CTCP flow handle | unit_name is set to about.labels.key/value |
| 720036 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to process state update message from( the active)? peer | unit_name is set to about.labels.key/value |
| 720037 | (VPN-(?P<unit_name>Primary|Secondary)) HA progression callback: id={id},seq={sequence_number},grp={group_number},event={current_event},op={operand},my={current_state},peer={peer_state} | unit_name is set to about.labels.key/value, id is set to about.labels.key/value, sequence_number is set to about.labels.key/value, group_number is set to about.labels.key/value, current_event is set to about.labels.key/value, operand is set to about.labels.key/value, current_state is set to about.labels.key/value, peer_state is set to about.labels.key/value |
| 720038 | (VPN-(?P<unit_name>Primary|Secondary)) Corrupted( peer)? message (from active unit|buffer) | unit_name is set to about.labels.key/value |
| 720039 | (VPN-(?P<unit_name>Primary|Secondary)) VPN failover client is transitioning to active state | unit_name is set to about.labels.key/value |
| 720040 | (VPN-(?P<unit_name>Primary|Secondary)) VPN failover client is transitioning to standby state | unit_name is set to about.labels.key/value |
| 720041 | (VPN-(?P<unit_name>Primary|Secondary)) Sending {message_type} message {message_id} to standby unit | unit_name is set to about.labels.key/value, message_type is set to about.labels.key/value, message_id is set to about.labels.key/value |
| 720042 | (VPN-(?P<unit_name>Primary|Secondary)) Receiving {message_type} message {message_id} from active unit | unit_name is set to about.labels.key/value, message_type is set to about.labels.key/value, message_id is set to about.labels.key/value |
| 720043 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to send {message_type} message id to standby unit | unit_name is set to about.labels.key/value, message_type is set to about.labels.key/value |
| 720044 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to receive message from active unit | unit_name is set to about.labels.key/value |
| 720045 | (VPN-(?P<unit_name>Primary|Secondary)) Start bulk syncing of state information on standby unit | unit_name is set to about.labels.key/value |
| 720046 | (VPN-(?P<unit_name>Primary|Secondary)) End bulk syncing of state information on standby unit | unit_name is set to about.labels.key/value |
| 720047 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to sync SDI node secret file for server {dst_ip} on the standby unit | unit_name is set to about.labels.key/value, dst_ip is set to target.ip |
| 720048 | (VPN-(?P<unit_name>Primary|Secondary)) FSM action trace begin: state={current_state}, last event={event_name}, func={function} | unit_name is set to about.labels.key/value, current_state is set to about.labels.key/value, event_name is set to about.labels.key/value, function is set to about.labels.key/value |
| 720049 | (VPN-(?P<unit_name>Primary|Secondary)) FSM action trace end: state={current_state}, last event={event_name}, return={return_code}, func={function} | unit_name is set to about.labels.key/value, current_state is set to about.labels.key/value, event_name is set to about.labels.key/value, return_code is set to security_result.description, function is set to about.labels.key/value |
| 720050 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to remove timer. ID = {message_id} | unit_name is set to about.labels.key/value, message_id is set to about.labels.key/value |
| 720051 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to add new SDI node secret file for server {dst_ip} on the standby unit | unit_name is set to about.labels.key/value, dst_ip is set to target.ip |
| 720052 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to delete SDI node secret file for server {dst_ip} on the standby unit | unit_name is set to about.labels.key/value, dst_ip is set to target.ip |
| 720053 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to add cTCP IKE rule during bulk sync, peer={dst_ip}, port={dst_port} | unit_name is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 720054 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to add new cTCP record, peer={dst_ip}, port={dst_port} | unit_name is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 720055 | (VPN-(?P<unit_name>Primary|Secondary)) VPN Stateful failover can only be run in single/non-transparent mode | unit_name is set to about.labels.key/value |
| 720056 | (VPN-(?P<unit_name>Primary|Secondary)) VPN Stateful failover Message Thread is being disabled | unit_name is set to about.labels.key/value |
| 720057 | (VPN-(?P<unit_name>Primary|Secondary)) VPN Stateful failover Message Thread is enabled | unit_name is set to about.labels.key/value |
| 720058 | (VPN-(?P<unit_name>Primary|Secondary)) VPN Stateful failover Timer Thread is disabled | unit_name is set to about.labels.key/value |
| 720059 | (VPN-(?P<unit_name>Primary|Secondary)) VPN Stateful failover Timer Thread is enabled | unit_name is set to about.labels.key/value |
| 720060 | (VPN-(?P<unit_name>Primary|Secondary)) VPN Stateful failover Sync Thread is disabled | unit_name is set to about.labels.key/value |
| 720061 | (VPN-(?P<unit_name>Primary|Secondary)) VPN Stateful failover Sync Thread is enabled | unit_name is set to about.labels.key/value |
| 720062 | (VPN-(?P<unit_name>Primary|Secondary)) Active unit started bulk sync of state information to( the)? standby unit | unit_name is set to about.labels.key/value |
| 720063 | (VPN-(?P<unit_name>Primary|Secondary)) Active unit completed bulk sync of state information to standby | unit_name is set to about.labels.key/value |
| 720064 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to update cTCP database record for peer={dst_ip}, port={dst_port} during bulk sync | unit_name is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 720065 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to add new cTCP IKE rule, peer={dst_ip}, port={dst_port} | unit_name is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 720066 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to activate IKE database | unit_name is set to about.labels.key/value |
| 720067 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to deactivate IKE database | unit_name is set to about.labels.key/value |
| 720068 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to parse peer message | unit_name is set to about.labels.key/value |
| 720069 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to activate cTCP database | unit_name is set to about.labels.key/value |
| 720070 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to deactivate cTCP database | unit_name is set to about.labels.key/value |
| 720071 | (VPN-(?P<unit_name>Primary|Secondary)) Failed to update cTCP dynamic data | unit_name is set to about.labels.key/value |
| 720072 | Timeout waiting for Integrity Firewall Server {dst_interface_name},{dst_ip}] to become available | dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip |
| 720073 | VPN Session failed to replicate - ACL {acl_name} not found | acl_name is set to about.labels.key/value |
| 721001 | ({device_type}) WebVPN Failover SubSystem started successfully.({device_type}) either WebVPN-primary or WebVPN-secondary | device_type is set to about.labels.key/value, device_type is set to about.labels.key/value |
| 721002 | ({device_type}) HA status change: event {current_event}, my state {current_state}, peer state {peer_state} | device_type is set to about.labels.key/value, current_event is set to about.labels.key/value, current_state is set to about.labels.key/value, peer_state is set to about.labels.key/value |
| 721003 | ({device_type}) HA progression change: event {current_event}, my state {current_state}, peer state {peer_state} | device_type is set to about.labels.key/value, current_event is set to about.labels.key/value, current_state is set to about.labels.key/value, peer_state is set to about.labels.key/value |
| 721004 | ({device_type}) Create access list {access_list_name} on standby unit | device_type is set to about.labels.key/value, access_list_name is set to about.labels.key/value |
| 721005 | ({device_type}) Fail to create access list {access_list_name} on standby unit | device_type is set to about.labels.key/value, access_list_name is set to about.labels.key/value |
| 721006 | ({device_type}) Update access list {access_list_name} on standby unit | device_type is set to about.labels.key/value, access_list_name is set to about.labels.key/value |
| 721007 | ({device_type}) Fail to update access list {access_list_name} on standby unit | device_type is set to about.labels.key/value, access_list_name is set to about.labels.key/value |
| 721008 | ({device_type}) Delete access list {access_list_name} on standby unit | device_type is set to about.labels.key/value, access_list_name is set to about.labels.key/value |
| 721009 | ({device_type}) Fail to delete access list {access_list_name} on standby unit | device_type is set to about.labels.key/value, access_list_name is set to about.labels.key/value |
| 721010 | ({device_type}) Add access list rule {access_list_name}, line {line_number} on standby unit | device_type is set to about.labels.key/value, access_list_name is set to about.labels.key/value, line_number is set to about.labels.key/value |
| 721011 | ({device_type}) Fail to add access list rule {access_list_name}, line {line_number} on standby unit | device_type is set to about.labels.key/value, access_list_name is set to about.labels.key/value, line_number is set to about.labels.key/value |
| 721012 | ({device_type}) Enable APCF XML file {target_file_full_path} on the standby unit | device_type is set to about.labels.key/value, target_file_full_path is set to target.file.full_path |
| 721013 | ({device_type}) Fail to enable APCF XML file {target_file_full_path} on the standby unit | device_type is set to about.labels.key/value, target_file_full_path is set to target.file.full_path |
| 721014 | ({device_type}) Disable APCF XML file {target_file_full_path} on the standby unit | device_type is set to about.labels.key/value, target_file_full_path is set to target.file.full_path |
| 721015 | ({device_type}) Fail to disable APCF XML file {target_file_full_path} on the standby unit | device_type is set to about.labels.key/value, target_file_full_path is set to target.file.full_path |
| 721016 | ({device_type}) WebVPN session for client user {user_name}, IP {dst_ip} has been created | device_type is set to about.labels.key/value, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 721017 | ({device_type}) Fail to create WebVPN session for user {user_name}, IP {dst_ip} | device_type is set to about.labels.key/value, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 721018 | ({device_type}) WebVPN session for client user {user_name}, IP(v4)? {dst_ip} has been deleted | device_type is set to about.labels.key/value, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 721019 | ({device_type}) Fail to delete WebVPN session for client user {user_name}, IP {dst_ip} | device_type is set to about.labels.key/value, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 722006 | Group {group_name} User {user_name} IP {dst_ip} Invalid address {invalid_ip} assigned to SVC connection | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, invalid_ip is set to about.labels.key/value |
| 722015 | Group {group_name} User {user_name} IP {dst_ip} Unknown SVC frame type: {frame_type} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, frame_type is set to about.labels.key/value |
| 722016 | Group {group_name} User {user_name} IP {dst_ip} Bad SVC frame length: {frame_length} expected: {frame_expected_length} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, frame_length is set to about.labels.key/value, frame_expected_length is set to about.labels.key/value |
| 722018 | Group {group_name} User {user_name} IP {dst_ip} Bad SVC protocol version: {svc_version}, expected: {svc_expected_version} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, svc_version is set to about.labels.key/value, svc_expected_version is set to about.labels.key/value |
| 722020, 722041 | TunnelGroup {tunnel_group} GroupPolicy {group_policy} User {user_name} IP {dst_ip} {summary} | tunnel_group is set to target.group.group_display_name, group_policy is set to about.labels.key/value, user_name is set to target.user.userid, dst_ip is set to target.ip, summary is set to security_result.summary |
| 722022 | Group {group_name} User {user_name} IP {dst_ip} {protocol} connection established <message_text> compression | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, protocol is set to network.ip_protocol |
| 722035, 722036 | Group {group_name} User {user_name} IP {dst_ip} <message_text> large packet {received_bytes}(threshold {threshold}) | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, received_bytes is set to network.received_bytes, threshold is set to about.labels.key/value |
| 722044 | Group {group_name} User {user_name} IP {dst_ip} Unable to request {ip_version} address for SSL tunnel | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, ip_version is set to about.labels.key/value |
| 722051 | Group (<)?{group_name}(>)? User (<)?{user_name}(>)? IP (<)?{dst_ip}(>)? IPv4 Address (<)?{src_ip1}(>)? IPv6 address (<)?{src_ip2}(>)? assigned to session | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, dst_ip1 is set to principal.ip, dst_ip2 is set to principal.ip |
| 722053 | Group {group_policy} User {user_name} IP {dst_ip} Unknown client {user_agent} connection | group_policy is set to about.labels.key/value, user_name is set to target.user.userid, dst_ip is set to target.ip, user_agent is set to network.http.user_agent |
| 722054 | Group {group_policy} User {user_name} IP {dst_ip} SVC (?P<action>terminating) connection: Failed to install Redirect URL: {redirect_url} Redirect ACL: non_exist for {dst_ip1} | action is set to security_result.action, group_policy is set to about.labels.key/value, user_name is set to target.user.userid, dst_ip is set to target.ip, redirect_url is set to target.url, dst_ip1 is set to target.ip |
| 722055 | Group {group_name} User {user_name} IP {dst_ip} Client Type: {user_agent} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, user_agent is set to network.http.user_agent |
| 722056 | Unsupported AnyConnect client connection rejected from {dst_ip}. Client info: {user_agent}. Reason: {summary} | dst_ip is set to target.ip, user_agent is set to network.http.user_agent, summary is set to security_result.summary |
| 723001, 723002 | Group {group_name}, User {user_name}, IP {dst_ip}: WebVPN Citrix ICA connection {session_id} is (?P<action>up|down) | action is set to security_result.action, group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, session_id is set to network.session_id |
| 723014 | Group {group_name}, User {user_name}, IP {dst_ip}: WebVPN Citrix {protocol} connection {session_id} to server {server_identifier} on channel {channel_id} initiated | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, protocol is set to network.ip_protocol, session_id is set to network.session_id, server_identifier is set to about.labels.key/value, channel_id is set to about.labels.key/value |
| 725001 | Starting SSL handshake with <message_text> {interface_name}:{src_ip}(/{src_port})? to {dst_ip}/{dst_port} for {protocol} session | interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, protocol is set to network.ip_protocol |
| 725001 | Starting SSL handshake with <message_text> {interface_name}:{src_ip}/{src_port} for {protocol} session | interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, protocol is set to network.ip_protocol |
| 725002 | Device completed SSL handshake with <message_text> {interface_name}:{src_ip}(/{src_port})? to {dst_ip}/{dst_port} for {version_protocol} session | interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, version_protocol is set to network.tls.version_protocol |
| 725002 | Device completed SSL handshake with <message_text> {interface_name}:{src_ip}/{src_port}( for {version_protocol} session)? | interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, version_protocol is set to network.tls.version_protocol |
| 725003, 725005 | SSL <message_text> {interface_name}:{src_ip}/{src_port}( to {dst_ip}/{dst_port})? request<message_text> | interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 725004 | Device requesting certificate from SSL <message_text> {interface_name}:{src_ip}(/{src_port})? to {dst_ip}/{dst_port} for authentication | interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 725006 | Device failed SSL handshake with <message_text> {interface_name}:{src_ip}/{src_port}( to {dst_ip}/{dst_port})? | interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 725007 | SSL session with <message_text> {interface_name}:{src_ip}/{src_port}( to {dst_ip}/{dst_port})? terminated | interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 725008 | SSL <message_text> {interface_name}:{src_ip}(/{src_port})? to {dst_ip}/{dst_port}<message_text> | interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 725009 | Device proposes the following <message_text> cipher((s))?( to)? <message_text> {interface_name}:{src_ip}(/{src_port})? to {dst_ip}(/{dst_port})? | interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 725016 | Device selects trust-point {trust_point} for <message_text> {interface_name}:{src_ip}(/{src_port})? to {dst_ip}(/{dst_port})? | trust_point is set to about.labels.key/value, interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 726001 | Inspected (?P<im_protocol>MSN IM|YAHOO IM) {target_service} Session between Client {user_name} and {user_name_} Packet flow from {src_interface_name}:/{src_ip}(/{src_port})? to {dst_interface_name}:/{dst_ip}/{dst_port} Action: {action} Matched Class {class_map_id} {class_map_name} | im_protocol is set to about.labels.key/value, target_service is set to target.application, user_name is set to target.user.userid, user_name_ is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, action is set to security_result.action, class_map_id is set to about.labels.key/value, class_map_name is set to about.labels.key/value |
| 730004 | Group {group_name} User {user_name} IP {src_ip} VLAN ID {vlan_id} from AAA ignored | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, src_ip is set to principal.ip, vlan_id is set to about.labels.key/value |
| 730005 | Group {group_name} User {user_name} {src_ip} VLAN Mapping error. VLAN {vlan_id} may be out of range, unassigned to any interface or assigned to multiple interfaces | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, src_ip is set to principal.ip, vlan_id is set to about.labels.key/value |
| 730008 | Group {group_name}, User {user_name}, IP {dst_ip}, VLAN MAPPING timeout waiting NACApp | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 730009 | Group {group_name}, User {user_name}, IP {dst_ip}, CAS {src_ip1}, capacity exceeded, (?P<action>terminating) connection | action is set to security_result.action, group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, src_ip1 is set to principal.ip |
| 731001, 731002 | NAC policy <message_text>: name:{policy_name} Type:{policy_type} | policy_name is set to target.resource.name, policy_type is set to about.labels.key/value |
| 731003 | nac-policy <message_text>: name:{policy_name} Type:{policy_type} | policy_name is set to target.resource.name, policy_type is set to about.labels.key/value |
| 732001 | Group {group_name}, User {user_name}, IP {dst_ip}, Fail to parse NAC-SETTINGS {nac_settings_id} , (?P<action>terminating) connection | action is set to security_result.action, group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, nac_settings_id is set to about.labels.key/value |
| 732002 | Group {group_name}, User {user_name}, IP {dst_ip}, NAC-SETTINGS {nac_settings_id} from AAA ignored, existing NAC-SETTINGS {settingsid_in_use} used instead | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, nac_settings_id is set to about.labels.key/value, settingsid_in_use is set to about.labels.key/value |
| 732003 | Group {group_name}, User {user_name}, IP {dst_ip}, NAC-SETTINGS {nac_settings_id} from AAA is invalid, {action} connection | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, nac_settings_id is set to about.labels.key/value, action is set to security_result.action |
| 733100 | <message_text> drop rate(-)?{rate_id} exceeded. Current burst rate is {current_burst_rate} per second, max configured rate is {max_burst_rate}; Current average rate is {current_average_rate} per second, max configured rate is {max_average_val}; Cumulative total count is {total_cnt} | rate_id is set to about.labels.key/value, current_burst_rate is set to about.labels.key/value, max_burst_rate is set to about.labels.key/value, current_average_rate is set to about.labels.key/value, max_average_val is set to about.labels.key/value, total_cnt is set to about.labels.key/value |
| 733101 | <message_text> {dst_ip} (?P<tag>is targeted|is attacking). Current burst rate is {current_burst_rate} per second, max configured rate is {max_burst_rate}; Current average rate is {current_average_rate} per second, max configured rate is {max_average_val}; Cumulative total count is {total_cnt} | , dst_ip is set to target.ip, current_burst_rate is set to about.labels.key/value, max_burst_rate is set to about.labels.key/value, current_average_rate is set to about.labels.key/value, max_average_val is set to about.labels.key/value, total_cnt is set to about.labels.key/value |
| 733102, 733103 | Threat-detection <message_text> host {target_hostname} <message_text> shun list | target_hostname is set to target.hostname |
| 734001 | {category}: User {src_username}, Addr {src_ip}, Connection {connection} : The following DAP records were selected for this connection: {record_names} | category is set to security_result.category_details, src_username is set to principal.user.userid, src_ip is set to principal.ip, connection is set to about.labels.key/value, record_names is set to about.labels.key/value |
| 734002 | {category}: User {src_username}, Addr {src_ip}: Connection (?P<action>terminated) by the following DAP records: {record_names} | action is set to security_result.action, category is set to security_result.category_details, src_username is set to principal.user.userid, src_ip is set to principal.ip, record_names is set to about.labels.key/value |
| 734003 | {category}: User {src_username}, Addr {src_ip}: Session Attribute: {attribute} | category is set to security_result.category_details, src_username is set to principal.user.userid, src_ip is set to principal.ip, attribute is set to about.labels.key/value |
| 734004 | {category}: Processing error: {internal_error_code} | category is set to security_result.category_details, internal_error_code is set to about.labels.key/value |
| 735001, 735002 | {category}: Cooling Fan {device_number_markings}: {summary} | category is set to security_result.category_details, device_number_markings is set to about.labels.key/value, summary is set to security_result.summary |
| 735003, 735004 | {category}: Power Supply {device_number_markings}: {summary} | category is set to security_result.category_details, device_number_markings is set to about.labels.key/value, summary is set to security_result.summary |
| 735007 | {category}: CPU {device_number_markings} : Temp: {temperature_value} {units}, {summary} | category is set to security_result.category_details, device_number_markings is set to about.labels.key/value, temperature_value is set to about.labels.key/value, units is set to about.labels.key/value, summary is set to security_result.summary |
| 735008 | {category}: Chassis Ambient {device_number_markings} : Temp: {temperature_value} {units}, {summary} | category is set to security_result.category_details, device_number_markings is set to about.labels.key/value, temperature_value is set to about.labels.key/value, units is set to about.labels.key/value, summary is set to security_result.summary |
| 735014 and 735013 | Voltage Channel {voltage_channel_number}: {summary} | voltage_channel_number is set to about.labels.key/value, summary is set to security_result.summary |
| 735016 | Chassis Ambient {chassis_sensor_number} : Temp: {temperature_value} {units}, <message_text> | chassis_sensor_number is set to about.labels.key/value, temperature_value is set to about.labels.key/value, units is set to about.labels.key/value |
| 735019, 735018 and 735017 | Power Supply {power_supply_number} : Temp: {temperature_value} {units}, {summary} | power_supply_number is set to about.labels.key/value, temperature_value is set to about.labels.key/value, units is set to about.labels.key/value, summary is set to security_result.summary |
| 735012 and 735011 | Power Supply {voltage_channel_number}: {summary} | voltage_channel_number is set to about.labels.key/value, summary is set to security_result.summary |
| 735015 and 735020 | CPU {cpu_number}: Temp: {temperature_value} {units}(,|) {summary} | cpu_number is set to target.asset.hardware.serial_number, temperature_value is set to about.labels.key/value, units is set to about.labels.key/value, summary is set to security_result.summary |
| 735021 | Chassis {chassis_sensor_number}: Temp: {temperature_value} {units} {summary} | chassis_sensor_number is set to about.labels.key/value, temperature_value is set to about.labels.key/value, units is set to about.labels.key/value, summary is set to security_result.summary |
| 735026, 735025 and 735024 | IO Hub {io_hub_number} : Temp: {temperature_value} {units}, {summary} | io_hub_number is set to about.labels.key/value, temperature_value is set to about.labels.key/value, units is set to about.labels.key/value, summary is set to security_result.summary |
| 735027 | CPU {cpu_number} Voltage Regulator is running beyond the max thermal operating temperature and the device will be shutting down immediately. The chassis and CPU need to be inspected immediately for ventilation issues | cpu_number is set to target.asset.hardware.serial_number |
| 737002 | {category}: Session= {session_id},Received unknown message {num} variables | category is set to security_result.category_details, session_id is set to network.session_id, num is set to about.labels.key/value |
| 737005, 737003 and 737004 | {category}: Session= {session_id}, DHCP configured,<message_text>tunnel-group {tunnel_group} | category is set to security_result.category_details, session_id is set to network.session_id, tunnel_group is set to target.group.group_display_name |
| 737006, 737007 | {category}: Session= {session_id}, Local pool request <message_text> for tunnel-group {tunnel_group} | category is set to security_result.category_details, session_id is set to network.session_id, tunnel_group is set to target.group.group_display_name |
| 737008 | {category}: Session= {session_id}, '{tunnel_group}' not found | category is set to security_result.category_details, session_id is set to network.session_id, tunnel_group is set to target.group.group_display_name |
| 737009, 737010 | {category}: Session= {session_id}, AAA assigned address {dst_ip}, request <message_text> | category is set to security_result.category_details, session_id is set to network.session_id, dst_ip is set to target.ip |
| 737011 | {category}: Session= {session_id}, AAA assigned {dst_ip}, not permitted, retrying | category is set to security_result.category_details, session_id is set to network.session_id, dst_ip is set to target.ip |
| 737012 | {category}: Session= {session_id}, Address assignment failed | category is set to security_result.category_details, session_id is set to network.session_id |
| 737013 | {category}: Session= {session_id}, Error freeing address {dst_ip}, not found | category is set to security_result.category_details, session_id is set to network.session_id, dst_ip is set to target.ip |
| 737014, 737015 | {category}: Session= {session_id}, Freeing <message_text> address {dst_ip} | category is set to security_result.category_details, session_id is set to network.session_id, dst_ip is set to target.ip |
| 737016 | {category}: Session= {session_id}, Freeing local pool {pool_name} address {dst_ip} | category is set to security_result.category_details, session_id is set to network.session_id, pool_name is set to about.labels.key/value, dst_ip is set to target.ip |
| 737017 | {category}: Session= {session_id}, DHCP request attempt {num} <message_text> | category is set to security_result.category_details, session_id is set to network.session_id, num is set to about.labels.key/value |
| 737019 | {category}: Session= {session_id}, Unable to get address from group-policy or tunnel-group local pools | category is set to security_result.category_details, session_id is set to network.session_id |
| 737023 | {category}: Session= {session_id}, Unable to allocate memory to store local pool address {dst_ip} | category is set to security_result.category_details, session_id is set to network.session_id, dst_ip is set to target.ip |
| 737024 | {category}: Session= {session_id}, Client requested address {dst_ip}, already in use, retrying | category is set to security_result.category_details, session_id is set to network.session_id, dst_ip is set to target.ip |
| 73702 | {category}:Session= {session_id}, Duplicate local pool address found, {dst_ip} in quarantine | category is set to security_result.category_details, session_id is set to network.session_id, dst_ip is set to target.ip |
| 737026 | {category}:Session= {session_id}, Client assigned {dst_ip} from local pool {pool_name} | category is set to security_result.category_details, session_id is set to network.session_id, dst_ip is set to target.ip, pool_name is set to about.labels.key/value |
| 737027 | {category}:Session= {session_id}, No data for address request | category is set to security_result.category_details, session_id is set to network.session_id |
| 737028, 737030, 737032 | {category}:Session= {session_id}, Unable to <message_text> {dst_ip} <message_text> standby: {summary} | category is set to security_result.category_details, session_id is set to network.session_id, dst_ip is set to target.ip, summary is set to security_result.summary |
| 737029, 737031 | {category}:Session= {session_id}, <message_text> {dst_ip} <message_text> standby | category is set to security_result.category_details, session_id is set to network.session_id, dst_ip is set to target.ip |
| 737033 | {category}:Session= {session_id}, Unable to assign {addr_allocator} provided IP address {dst_ip} to client. This IP address has already been assigned by {previous_addr_allocator} | category is set to security_result.category_details, session_id is set to network.session_id, addr_allocator is set to about.labels.key/value, dst_ip is set to target.ip, previous_addr_allocator is set to about.labels.key/value |
| 737038 | {category}:Session={session_id}, specified address {dst_ip} was in-use, trying to get another | category is set to security_result.category_details, session_id is set to network.session_id, dst_ip is set to target.ip |
| 737402 | {category}:Pool={pool_name}, Failed to return {dst_ip} to pool <message_text>. Reason: {summary} | category is set to security_result.category_details, pool_name is set to about.labels.key/value, dst_ip is set to target.ip, summary is set to security_result.summary |
| 741000 | Coredump filesystem image created on {created_directory} -size {file_size_mb} MB | created_directory is set to about.labels.key/value, file_size_mb is set to about.labels.key/value |
| 741001 | Coredump filesystem image on {created_directory} - resized from variable {previous_file_size_mb} MB to variable {file_size_mb} MB | created_directory is set to about.labels.key/value, previous_file_size_mb is set to about.labels.key/value, file_size_mb is set to about.labels.key/value |
| 741002 | Coredump log and filesystem contents cleared on {created_directory} | created_directory is set to about.labels.key/value |
| 741003 | Coredump filesystem and its contents removed on {created_directory} | created_directory is set to about.labels.key/value |
| 741006 | Unable to write Coredump Helper configuration, reason {summary} | summary is set to security_result.summary |
| 742003, 742004 | failed to <message_text> primary key for password encryption, reason {summary} | summary is set to security_result.summary |
| 742005 | cipher text {encrypted_pass} is not compatible with the configured primary key or the cipher text has been tampered with | encrypted_pass is set to about.labels.key/value |
| 742008 | password {encrypted_pass} decryption failed due to decoding error | encrypted_pass is set to about.labels.key/value |
| 742010 | encrypted password {encrypted_pass} is not well formed | encrypted_pass is set to about.labels.key/value |
| 743000 | The PCI device with vendor ID: {vendor_id} device ID: {device_id} located at <message_text> | vendor_id is set to about.labels.key/value, device_id is set to target.resource.product_object_id
"target.resource.resource_type" is set to "DEVICE" "device_id" is set to "target.resource.product_object_id" |
| 743004 | System is not fully operational - PCI device with vendor ID {vendor_id}({vendor_name}), device ID {device_id}({device_name}) not found | vendor_id is set to about.labels.key/value, vendor_name is set to about.labels.key/value, device_id is set to target.resource.product_object_id, device_name is set to about.labels.key/value
"target.resource.resource_type" is set to "DEVICE" "device_id" is set to "target.resource.product_object_id" |
| 743010 | EOBC RPC server failed to start for client module {user_name} | user_name is set to target.user.userid |
| 743011 | EOBC RPC call failed, return code {return_code} string | return_code is set to security_result.description |
| 746004 | <message_text>: Total number of activated user groups exceeds the {max_groups} groups for this platform | max_groups is set to about.labels.key/value |
| 747029 | <message_text>: Unit {unit_name} is quitting due to Cluster Control Link down | unit_name is set to about.labels.key/value |
| 746005 | <message_text>: The AD Agent<message_text>{dst_ip} cannot be reached - {summary} | dst_ip is set to target.ip, summary is set to security_result.summary |
| 746007 | <message_text>: NetBIOS response failed from User {user_name} at {dst_ip} | user_name is set to target.user.userid, dst_ip is set to target.ip |
| 746011 | Total number of users created exceeds the maximum number of {max_users} for this platform | max_users is set to about.labels.key/value |
| 746012, 746013 | <message_text>: <message_text> IP-User mapping {dst_ip} - {src_fwuser}\{user_name} -{summary} | dst_ip is set to target.ip, src_fwuser is set to principal.user.userid/principal.labels.key/value, user_name is set to target.user.userid, summary is set to security_result.summary |
| 746014 | <message_text>: FQDN] {target_hostname} address {dst_ip} obsolete | target_hostname is set to target.hostname, dst_ip is set to target.ip
if [target_hostname] != "" and [sysloghost] != "" then "event.idm.read_only_udm.network.application_protocol" is set to "DNS" "network.dns.questions.name" is set to "%{target_hostname}" |
| 746015 | <message_text>: FQDN] {target_hostname} resolved {dst_ip} | target_hostname is set to target.hostname, dst_ip is set to target.ip
if [target_hostname] != "" and [sysloghost] != "" then "event.idm.read_only_udm.network.application_protocol" is set to "DNS" "network.dns.questions.name" is set to "%{target_hostname}"" |
| 746016 | <message_text>: DNS lookup failed, reason: {summary} | summary is set to security_result.summary |
| 746018 | <message_text>: Update import-user {src_fwuser}{group_name} done | src_fwuser is set to principal.user.userid/principal.labels.key/value, group_name is set to target.user.group_identifiers |
| 746017 | <message_text>: Update import-user {src_fwuser}<message_text>{group_name} | src_fwuser is set to principal.user.userid/principal.labels.key/value, group_name is set to target.user.group_identifiers |
| 746010 | <message_text>: update import-user {src_fwuser} {group_name} -{summary} | src_fwuser is set to principal.user.userid/principal.labels.key/value, group_name is set to target.user.group_identifiers, summary is set to security_result.summary |
| 746019 | <message_text>:<message_text> mapping {dst_ip} - {src_fwuser}\{user_name} failed | dst_ip is set to target.ip, src_fwuser is set to principal.user.userid/principal.labels.key/value, user_name is set to target.user.userid |
| 747001 | <message_text>: Recovered from state machine event queue depleted. Event ({event_id},<message_text>) dropped. Current state {state_name}<message_text> | event_id is set to about.labels.key/value, state_name is set to about.labels.key/value |
| 747003 | <message_text>: Recovered from state machine failure to process event ({event_id},<message_text>) at {state_name} | event_id is set to about.labels.key/value, state_name is set to about.labels.key/value |
| 747004 | <message_text>: state machine changed from state {state_name} to {final_state_name} | state_name is set to about.labels.key/value, final_state_name is set to about.labels.key/value |
| 747008 | <message_text>: New cluster member {member_name} with serial number {serial_number_a} rejected due to name conflict with existing unit with serial number {serial_number_b} | member_name is set to about.labels.key/value, serial_number_a is set to about.labels.key/value, serial_number_b is set to about.labels.key/value |
| 747009 | <message_text>: Fatal error due to failure to create RPC server for module {module_name} | module_name is set to about.labels.key/value |
| 747010 | <message_text>: RPC call failed, message {summary}, return code {return_code} | summary is set to security_result.summary, return_code is set to security_result.description |
| 747012, 747013 | <message_text>: Failed to <message_text> global object id {hex_id} in domain {target_hostname} <message_text> peer {unit_name}, continuing operation | hex_id is set to about.labels.key/value, target_hostname is set to target.hostname, unit_name is set to about.labels.key/value |
| 747014 | <message_text>: Failed to <message_text> global object id {hex_id} in domain {target_hostname}, continuing operation | hex_id is set to about.labels.key/value, target_hostname is set to target.hostname |
| 747015 | <message_text>: Forcing stray member {unit_name} to leave the cluster | unit_name is set to about.labels.key/value |
| 747016 | <message_text>: Found a split cluster with both {unit_name_a} and {unit_name_b} as primary units. Primary role retained by {unit_name_a_}, {unit_name_b_} will leave, then join as a secondary | unit_name_a is set to about.labels.key/value, unit_name_b is set to about.labels.key/value, unit_name_a_ is set to about.labels.key/value, unit_name_b_ is set to about.labels.key/value |
| 747017 | <message_text>: Failed to enroll unit {unit_name} due to maximum member limit {limit_value} reached | unit_name is set to about.labels.key/value, limit_value is set to about.labels.key/value |
| 747018 | <message_text>: State progression failed due to timeout in module {module_name} | module_name is set to about.labels.key/value |
| 747019 | <message_text>: New cluster member {member_name} rejected due to Cluster Control Link IP subnet mismatch ({dst_ip}/<message_text> on new unit, {dst_ip1}/<message_text> on local unit) | member_name is set to about.labels.key/value, dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 747020 | <message_text>: New cluster member {unit_name} rejected due to encryption license mismatch | unit_name is set to about.labels.key/value |
| 747021 | <message_text>: Primary unit {unit_name} is quitting due to interface health check failure on {interface_name} | unit_name is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 747022 | <message_text>: Asking secondary unit {unit_name} to quit because it failed interface health check <message_text> times, rejoin will be attempted after <message_text> min. Failed interface: {interface_name} | unit_name is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 747025 | <message_text>: New cluster member {unit_name} rejected due to firewall mode mismatch | unit_name is set to about.labels.key/value |
| 747026 | <message_text>: New cluster member {unit_name} rejected due to cluster interface name mismatch ({new_interface_name} on new unit, {old_interface_name} on local unit) | unit_name is set to about.labels.key/value, new_interface_name is set to about.labels.key/value, old_interface_name is set to about.labels.key/value |
| 747027 | <message_text>: Failed to enroll unit {unit_name} due to insufficient size of cluster pool {pool_name} in {context_name} | unit_name is set to about.labels.key/value, pool_name is set to about.labels.key/value, context_name is set to about.labels.key/value |
| 747028 | <message_text>: New cluster member {unit_name} rejected due to interface mode mismatch ({new_mode_name} on new unit, {old_mode_name} on local unit) | unit_name is set to about.labels.key/value, new_mode_name is set to about.labels.key/value, old_mode_name is set to about.labels.key/value |
| 747030 | <message_text>: Asking secondary unit {unit_name} to quit because it failed interface health check <message_text> times (last failure on {interface_name}), Clustering must be manually enabled on the unit to re-join | unit_name is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 747031 | <message_text>: Platform mismatch between cluster primary ({cluster_platform}) and joining unit {unit_name} ({unit_platform})<message_text> | cluster_platform is set to about.labels.key/value, unit_name is set to about.labels.key/value, unit_platform is set to about.labels.key/value |
| 747032 | <message_text>: Service module mismatch between cluster primary ({cluster_platform}) and joining unit {unit_name} ({unit_platform})in slot {slot_number}<message_text> | cluster_platform is set to about.labels.key/value, unit_name is set to about.labels.key/value, unit_platform is set to about.labels.key/value, slot_number is set to about.labels.key/value |
| 747033 | <message_text>: Interface mismatch between cluster primary and joining unit {unit_name}<message_text> | unit_name is set to about.labels.key/value |
| 747034, 747035 | Unit {unit_name} is quitting due to Cluster Control Link down<message_text> | unit_name is set to about.labels.key/value |
| 747037 | Asking secondary Unit {unit_name} to quit due to its Security Service Module health check failure {number_of_health_check_failure} times, and its Security Service Module state is <message_text> | unit_name is set to about.labels.key/value, number_of_health_check_failure is set to about.labels.key/value |
| 747038 | Asking secondary Unit {unit_name} to quit due to Security Service Module health check failure {number_of_health_check_failure} times, and its Security Service Card Module is <message_text> | unit_name is set to about.labels.key/value, number_of_health_check_failure is set to about.labels.key/value |
| 747040, 747039 | Unit {unit_name} is quitting due to system failure for {number_of_health_check_failure}<message_text> | unit_name is set to about.labels.key/value, number_of_health_check_failure is set to about.labels.key/value |
| 747041 | Primary Unit {unit_name} is quitting due to interface health check failure on {number_of_health_check_failure}<message_text> | unit_name is set to about.labels.key/value, number_of_health_check_failure is set to about.labels.key/value |
| 747042 | <message_text>: Primary received the config hash string request message from an unknown member with id {cluster_member_id} | cluster_member_id is set to about.labels.key/value |
| 747043 | <message_text>: Get config hash string from primary error: ret_code {return_code}, string_len {string_len} | if [return_code] == "0" then "security_result.description" is set to "OK"
else if [return_code] == "1" then "security_result.description" is set to "Failed", string_len is set to about.labels.key/value |
| 747044 | Configuration Hash string verification {summary} | summary is set to security_result.summary |
| 748001 | Module {slot_number} in chassis {chassis_number} is leaving the cluster due to a chassis configuration change | slot_number is set to about.labels.key/value, chassis_number is set to about.labels.key/value |
| 748004, 748003 | Module {slot_number} in chassis {chassis_number} is <message_text> the cluster due to a chassis | slot_number is set to about.labels.key/value, chassis_number is set to about.labels.key/value |
| 748005 | Failed to bundle the ports for module {slot_number} in chassis {chassis_number}; clustering is disabled | slot_number is set to about.labels.key/value, chassis_number is set to about.labels.key/value |
| 748006 | Asking module {slot_number} in chassis {chassis_number} to leave the cluster due to a port bundling failure | slot_number is set to about.labels.key/value, chassis_number is set to about.labels.key/value |
| 748007 | Failed to de-bundle the ports for module {slot_number} in chassis {chassis_number}; traffic may be black holed | slot_number is set to about.labels.key/value, chassis_number is set to about.labels.key/value |
| 748100 | {target_service} application status is changed from {old_status} to {new_status} | target_service is set to target.application, old_status is set to about.labels.key/value, new_status is set to about.labels.key/value |
| 748101 | Peer unit (<|){unit_id}(>|) reported its {target_service} application status is {status} | unit_id is set to about.labels.key/value, target_service is set to target.application, status is set to about.labels.key/value |
| 748102 | Primary unit (<|){unit_id}(>|) is quitting due to {target_service} Application health check failure, and primary's application state is {status} | unit_id is set to about.labels.key/value, target_service is set to target.application, status is set to about.labels.key/value |
| 748103 | Asking secondary unit (<|){unit_id}(>|) to quit due to {target_service} Application health check failure, and secondary's application state is {status} | unit_id is set to about.labels.key/value, target_service is set to target.application, status is set to about.labels.key/value |
| 748201 | {target_service} application on module {module_id} in chassis {chassis_number} is {status} | target_service is set to target.application, module_id is set to about.labels.key/value, chassis_number is set to about.labels.key/value, status is set to about.labels.key/value |
| 748202 | Module {module_id} in chassis {chassis_number} is leaving the cluster due to {target_service} application failure | module_id is set to about.labels.key/value, chassis_number is set to about.labels.key/value, target_service is set to target.application |
| 748203 | Module {module_id} in chassis {chassis_number} is re-joining the cluster due to a service chain application recovery | module_id is set to about.labels.key/value, chassis_number is set to about.labels.key/value |
| 750001 | Local:{src_ip}:{src_port} Remote:{dst_ip}:{dst_port} Username:{src_username} Received request to <message_text> | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, src_username is set to principal.user.userid |
| 750002 | Local:{src_ip}:{src_port} Remote:{dst_ip}:{dst_port} Username:{src_username}( IKEv2)? Received a IKE_INIT_SA request | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, src_username is set to principal.user.userid |
| 750003 | Local: {src_ip}:{src_port} Remote:{dst_ip}:{dst_port} Username:{src_username} Negotiation aborted due to ERROR:{summary} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, src_username is set to principal.user.userid, summary is set to security_result.summary |
| 750004 | Local: {src_ip}:{src_port} Remote:{dst_ip}:{dst_port} Username:{src_username} Sending COOKIE challenge to throttle possible DoS | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, src_username is set to principal.user.userid |
| 750005 | Local: {src_ip}:{src_port} Remote:{dst_ip}:{dst_port} Username:{src_username} (IPsec|IPSec) rekey collision detected. I am lowest nonce initiator, deleting SA with inbound SPI {spi} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, src_username is set to principal.user.userid, spi is set to about.labels.key/value |
| 750006 | Local: {src_ip}:{src_port} Remote:{dst_ip}:{dst_port} Username:{src_username} SA UP. Reason:{summary} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, src_username is set to principal.user.userid, summary is set to security_result.summary |
| 750007 | Local: {src_ip}:{src_port} Remote:{dst_ip}:{dst_port} Username:{src_username} SA DOWN. Reason:{summary} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, src_username is set to principal.user.userid, summary is set to security_result.summary |
| 750008 | Local: {src_ip}:{src_port} Remote:{dst_ip}:{dst_port} Username:{src_username} SA rejected due to system resource low | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, src_username is set to principal.user.userid |
| 750009 | Local:{src_ip}:{src_port} Remote:{dst_ip}:{dst_port} Username:{src_username} SA request rejected due to CAC limit reached: Rejection reason:{summary} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, src_username is set to principal.user.userid, summary is set to security_result.summary |
| 750010 | Local:{src_ip}(:{src_port})? Remote:{dst_ip}(:{dst_port})? Username:{src_username} IKEv2 (L|l)?ocal throttle-request queue depth threshold of {threshold} reached;<message_text> | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, src_username is set to principal.user.userid, threshold is set to about.labels.key/value |
| 750011 | Tunnel Rejected: Selected IKEv2 encryption algorithm \({ikev2_encry_algo}\) is not strong enough to secure proposed (IPsec|IPSEC) encryption algorithm \({ipsec_encry_algo}\) | ikev2_encry_algo is set to about.labels.key/value, ipsec_encry_algo is set to about.labels.key/value |
| 750012 | (Local:{src_ip}:{src_port} Remote:{dst_ip}(:{dst_port})? Username:{user_name} IKEv2 )?Selected IKEv2 encryption algorithm ({ikev2_encry_algo}) is not strong enough to secure proposed (IPsec|IPSEC) encryption algorithm ({ipsec_encry_algo}) | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, ikev2_encry_algo is set to about.labels.key/value, ipsec_encry_algo is set to about.labels.key/value |
| 750013 | IKEv2 SA (iSPI <{initiator_spi}> rRSP <{responder_spi}>) Peer Moved: Previous <{dst_ip}>:<{prev_remote_port}>/<{src_ip}>:<{prev_local_port}>. Updated <{dst_ip1}>:<{dst_port}>/<{src_ip1}>:<{src_port}> | initiator_spi is set to about.labels.key/value, responder_spi is set to about.labels.key/value, dst_ip is set to target.ip, prev_remote_port is set to about.labels.key/value, src_ip is set to principal.ip, prev_local_port is set to about.labels.key/value, dst_ip1 is set to target.ip, dst_port is set to target.port, src_ip1 is set to principal.ip, src_port is set to principal.port |
| 750014 | Local:<{src_ip}>:<{src_port}> Remote:<{dst_ip}>(:<{dst_port}>)? Username:<{user_name}> IKEv2 Session aborted. Reason: <message_text> | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid |
| 750015 | Local:<{src_ip}>:<{src_port}> Remote:<{dst_ip}>(:<{dst_port}>)? Username:<{user_name}> IKEv2 deleting IPSec SA. Reason: invalid SPI notification received for SPI <message_text> | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid |
| 751001 | Local:{src_ip}:{src_port} Remote:{dst_ip}(:{dst_port})? Username:{user_name} Failed to complete Diffie-Hellman operation. Error: {summary} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, summary is set to security_result.summary |
| 751002 | Local:{src_ip}:{src_port} Remote:{dst_ip}(:{dst_port})? Username:{user_name}( IKEv2)? No pre(-)?shared key or trustpoint configured for self in tunnel group {tunnel_group} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, tunnel_group is set to target.group.group_display_name |
| 751004 | Local:{src_ip}:{src_port} Remote:{dst_ip}(:{dst_port})? Username:{user_name} No remote authentication method configured for peer in tunnel group {tunnel_group} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, tunnel_group is set to target.group.group_display_name |
| 751005 | Local:{src_ip}:{src_port} Remote:{dst_ip}(:{dst_port})? Username:{user_name} AnyConnect client reconnect authentication failed. Session ID: {session_id}, Error: {error} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, session_id is set to network.session_id, error is set to about.labels.key/value |
| 751006 | Local:{src_ip}:{src_port} Remote:{dst_ip}(:{dst_port})? Username:{user_name} Certificate authentication failed. Error: {error} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, error is set to about.labels.key/value |
| 751007 | Local:{src_ip}:{src_port} Remote:{dst_ip}(:{dst_port})? Username:{user_name} Configured attribute not supported for IKEv2. Attribute: {attribute} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, attribute is set to about.labels.key/value |
| 751008 | Local:{src_ip}:{src_port} Remote:{dst_ip}(:{dst_port})? Username:{user_name} Group={tunnel_group}, Tunnel rejected: IKEv2 not enabled in group policy | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, tunnel_group is set to target.group.group_display_name |
| 751009 | Local:{src_ip}:{src_port} Remote:{dst_ip}(:{dst_port})? Username:{user_name} Unable to find tunnel group for peer | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid |
| 751010 | Local:{src_ip}:{src_port} Remote:{dst_ip}(:{dst_port})? Username:{user_name} Unable to determine (self-authentication|self auth) method. No crypto map setting or tunnel group found | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid |
| 751011 | Local:{src_ip}:{src_port} Remote:{dst_ip}(:{dst_port})? Username:{user_name} Failed user authentication. Error: {error} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, error is set to about.labels.key/value |
| 751012 | Local:{src_ip}:{src_port} Remote:{dst_ip}(:{dst_port})? Username:{user_name} Failure occurred during Configuration Mode processing. Error: {error} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, error is set to about.labels.key/value |
| 751013 | Local:{src_ip}:{src_port} Remote:{dst_ip}(:{dst_port})? Username:{user_name} Failed to process Configuration Payload request for attribute {attribute_id}. Error: {error} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, attribute_id is set to about.labels.key/value, error is set to about.labels.key/value |
| 751014 | Local:{src_ip}:{src_port} Remote {dst_ip}(:{dst_port})? Username:{user_name} Warning Configuration Payload request for attribute {attribute_id} could not be processed. Error: {error} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, attribute_id is set to about.labels.key/value, error is set to about.labels.key/value |
| 751015 | Local:{src_ip}:{src_port} Remote {dst_ip}(:{dst_port})? Username:{user_name} SA request rejected by CAC. Reason: {summary} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, summary is set to security_result.summary |
| 751016 | Local:{src_ip}:{src_port} Remote {dst_ip}(:{dst_port})? Username:{user_name} L2L peer initiated a tunnel with the same outer and inner addresses. <message_text> | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid |
| 751017 | Local:{src_ip}:{src_port} Remote {dst_ip}(:{dst_port})? Username:{user_name} Configuration Error {error} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, error is set to about.labels.key/value |
| 751018 | Terminating the (?P<target_service>VPN) connection attempt from {attempted_group}. Reason: This connection is group locked to {locked_group} | target_service is set to target.application, attempted_group is set to about.labels.key/value, locked_group is set to about.labels.key/value |
| 751019 | Local:{src_ip} Remote:{dst_ip} Username:{user_name} Failed to obtain an {license_type} license. Maximum license limit {limit} exceeded | src_ip is set to principal.ip, dst_ip is set to target.ip, user_name is set to target.user.userid, license_type is set to about.labels.key/value, limit is set to about.labels.key/value |
| 751020 | Local:{src_ip}:{src_port} Remote:{dst_ip}:{dst_port} Username:{user_name} An <message_text> remote access connection failed. <message_text> | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid |
| 751021 | Local:{src_ip} :{src_port} Remote:{dst_ip} :{dst_port} Username:{user_name} (?P<version_protocol>IKEv1|IKEv2) with {encryption_type} encryption is not supported with this version of the AnyConnect Client. Please upgrade to the latest Anyconnect Client | version_protocol is set to network.tls.version_protocol, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, encryption_type is set to about.labels.key/value |
| 751022 | Local: {src_ip} Remote: {dst_ip} Username:{user_name} Tunnel rejected: Crypto Map Policy not found for remote traffic selector <message_text> | src_ip is set to principal.ip, dst_ip is set to target.ip, user_name is set to target.user.userid |
| 751023 | Local {src_ip} :{src_port} Remote: {dst_ip} :{dst_port} Username:{user_name} Unknown client connection | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid |
| 751024 | Local:{src_ip} Remote:{dst_ip} Username:{user_name} IKEv2 IPv6 User Filter tempipv6 configured. This setting has been deprecated, (?P<action>terminating) connection | action is set to security_result.action, src_ip is set to principal.ip, dst_ip is set to target.ip, user_name is set to target.user.userid |
| 751025 | Local:{src_ip}:{src_port} Remote:{dst_ip}:{dst_port} Username:{user_name} Group:{group_policy} IPv4 Address={assigned_IPv4_addr} IPv6 address={assigned_IPv6_addr} assigned to session | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, group_policy is set to about.labels.key/value, assigned_IPv4_addr is set to about.labels.key/value, assigned_IPv6_addr is set to about.labels.key/value |
| 751026 | Local: {src_ip}:{src_port} Remote: {dst_ip}:{dst_port} Username: {user_name} IKEv2 Client OS: {target_platform} Client: {client_name} {client_version} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, target_platform is set to target.platform, client_name is set to about.labels.key/value, client_version is set to about.labels.key/value |
| 751027 | Local:{src_ip}:{src_port} Remote:{dst_ip}:{dst_port} Username:{user_name} IKEv2 Received INVALID_SELECTORS Notification from peer. Peer received a packet (SPI={spi} ). The decapsulated inner packet <message_text> match the negotiated policy in the SA. Packet destination {dst_ip1}, port <message_text>, source {src_ip1}, port <message_text>, protocol {protocol} | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, spi is set to about.labels.key/value, dst_ip1 is set to target.ip, src_ip1 is set to principal.ip, protocol is set to network.ip_protocol |
| 751028 | Local:<{src_ip}:{src_port}> Remote:<{dst_ip}:{dst_port}> Username:<{user_name}> IKEv2 Overriding configured keepalive values of threshold:<{config_threshold}>/retry:<{config_retry}> to threshold:<{applied_threshold}>/retry:<{applied_retry}> | src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port, user_name is set to target.user.userid, config_threshold is set to about.labels.key/value, config_retry is set to about.labels.key/value, applied_threshold is set to about.labels.key/value, applied_retry is set to about.labels.key/value |
| 752003, 752004 | Tunnel Manager dispatching a KEY_ACQUIRE message to (?P<version_protocol>IKEv1|IKEv2).Map Tag = {map_tag}.Map Sequence Number = {sequence_number} | version_protocol is set to network.tls.version_protocol, map_, sequence_number is set to about.labels.key/value |
| 752005 | Tunnel Manager failed to dispatch a KEY_ACQUIRE message. Memory may be low.Map Tag = {map_tag}.Map Sequence Number = {sequence_number} | map_, sequence_number is set to about.labels.key/value |
| 752006 | Tunnel Manager failed to dispatch a KEY_ACQUIRE message.Probable mis-configuration of the crypto map or tunnel-group.Map Tag = {map_tag}.Map Sequence Number = {sequence_number}(, SRC Addr: {src_ip} port: {src_port} Dst Addr: {dst_ip} port: {dst_port})? | map_, sequence_number is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 752007 | Tunnel Manager failed to dispatch a KEY_ACQUIRE message. Entry already in Tunnel Manager.Map Tag = {map_tag}.Map Sequence Number = {sequence_number} | map_, sequence_number is set to about.labels.key/value |
| 752012 | (?P<version_protocol>IKEv1|IKEv2) was unsuccessful at setting up a tunnel.Map Tag = {map_tag}.Map Sequence Number = {sequence_number} | version_protocol is set to network.tls.version_protocol, map_, sequence_number is set to about.labels.key/value |
| 752013, 752014 | Tunnel Manager dispatching a KEY_ACQUIRE message to (?P<version_protocol>IKEv1|IKEv2) after a failed attempt.(.)?Map Tag = {map_tag}.Map Sequence Number = {sequence_number} | version_protocol is set to network.tls.version_protocol, map_, sequence_number is set to about.labels.key/value |
| 752015 | Tunnel Manager has failed to establish an L2L SA.All configured IKE versions failed to establish the tunnel.Map Tag= {map_tag}.Map Sequence Number = {sequence_number} | map_, sequence_number is set to about.labels.key/value |
| 752016 | {version_protocol} was successful at setting up a tunnel.Map Tag = {map_tag}.Map Sequence Number = {sequence_number} | version_protocol is set to network.tls.version_protocol, map_, sequence_number is set to about.labels.key/value |
| 752017 | IKEv2 Backup L2L tunnel initiation denied on interface {interface_name} matching crypto map {crypto_map_name}, sequence number {sequence_number}. Unsupported configuration | interface_name is set to about.labels.key/value, crypto_map_name is set to about.labels.key/value, sequence_number is set to about.labels.key/value |
| 753001 | Unexpected (?P<version_protocol>IKEv2) packet received from <{dst_ip}>:<{dst_port}>. Error: <{summary}> | version_protocol is set to network.tls.version_protocol, dst_ip is set to target.ip, dst_port is set to target.port, summary is set to security_result.summary |
| 767001 | {inspect_name}: Dropping an unsupported <message_text> from {src_interface_name}:IP {src_ip} to {dst_interface_name}:IP {dst_ip} (fail-close) | inspect_name is set to about.labels.key/value, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip |
| 768001 | QUOTA: {resource} utilization is high: requested {number_requested}, current {current_number}, warning level {warning_level} | resource is set to target.resource.name, number_requested is set to about.labels.key/value, current_number is set to about.labels.key/value, warning_level is set to about.labels.key/value |
| 768002 | QUOTA: {resource} quota exceeded: requested {number_requested}, current {current_number}, limit {resource_limit} | resource is set to target.resource.name, number_requested is set to about.labels.key/value, current_number is set to about.labels.key/value, resource_limit is set to about.labels.key/value |
| 768003 | QUOTA: management session quota exceeded for user {user_name}: {current_number} 3, user {resource_limit} 3 | user_name is set to target.user.userid, current_number is set to about.labels.key/value, resource_limit is set to about.labels.key/value |
| 768004 | QUOTA: management session quota exceeded for ssh/telnet/http protocol: {current_number} 2, protocol {resource_limit} 2 | current_number is set to about.labels.key/value, resource_limit is set to about.labels.key/value |
| 769001 | UPDATE: ASA image {src_file_full_path} was added to system boot list | src_file_full_path is set to src.file.full_path |
| 769002, 769003 | UPDATE: ASA image {src_file_full_path} was <message_text> to {target_file_full_path} | src_file_full_path is set to src.file.full_path, target_file_full_path is set to target.file.full_path |
| 769004 | UPDATE: ASA image {src_file_full_path} failed verification, reason: {summary} | src_file_full_path is set to src.file.full_path, summary is set to security_result.summary |
| 769005 | UPDATE: ASA image {target_file_full_path} passed image verification | target_file_full_path is set to target.file.full_path |
| 769006 | UPDATE: ASA boot system image {image_name} was not found on disk | image_name is set to about.labels.key/value |
| 769007 | UPDATE: Image version is {version_number} | version_number is set to about.labels.key/value |
| 769009 | UPDATE: Image booted {image_name} is different from boot images | image_name is set to about.labels.key/value |
| 770001 | {resource} resource allocation is more than the permitted list of {limit} for this platform. If this condition persists, the ASA will be rebooted | resource is set to target.resource.name, limit is set to about.labels.key/value |
| 770002 | {resource} resource allocation is more than the permitted {limit} for this platform. ASA will be rebooted | resource is set to target.resource.name, limit is set to about.labels.key/value |
| 770003 | {resource} resource allocation is less than the minimum requirement of {value} for this platform. If this condition persists, performance will be lower than normal | resource is set to target.resource.name, value is set to about.labels.key/value |
| 771002 | CLOCK: System clock set, source: {source} , IP {dst_ip} , before: {before_time} , after: {after_time} | source is set to about.labels.key/value, dst_ip is set to target.ip, before_time is set to about.labels.key/value, after_time is set to about.labels.key/value |
| 771001 | CLOCK: System clock set, source: {source} , before: {before_time} , after: {after_time} | source is set to about.labels.key/value, before_time is set to about.labels.key/value, after_time is set to about.labels.key/value |
| 772002 | PASSWORD: console login warning, user {user_name} , cause: {summary} | user_name is set to target.user.userid, summary is set to security_result.summary |
| 772003, 772004 | PASSWORD: {session_type} login failed, user {user_name} , IP {dst_ip} , cause: {summary} | session_type is set to about.labels.key/value, user_name is set to target.user.userid, dst_ip is set to target.ip, summary is set to security_result.summary |
| 772005, 772006 | {action_details}: user {user_name} {action} authentication | action_details is set to security_result.action_details, user_name is set to target.user.userid, action is set to security_result.action |
| 774002 | POST: error {error}, func {function} , engine {target_service} , algorithm {algorithm} , mode {mode} , dir {dir} , key len {length} | error is set to about.labels.key/value, function is set to about.labels.key/value, target_service is set to target.application, algorithm is set to about.labels.key/value, mode is set to about.labels.key/value, dir is set to about.labels.key/value, length is set to about.labels.key/value |
| 775001 | (?P<target_service>Scansafe): {protocol} connection {session_id} from {interface_name}:{src_ip}(/{src_port})? (idfw_user )] to {interface_name_}:{dst_ip}/{dst_port} redirected to {primary_server_interface_name} :{dst_ip1} | target_service is set to target.application, protocol is set to network.ip_protocol, session_id is set to network.session_id, interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, interface_name_ is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, primary_server_interface_name is set to about.labels.key/value, dst_ip1 is set to target.ip |
| 775002 | Reason - {protocol} connection {session_id} from {interface_name}:{src_ip}(/{src_port})? (idfw_user )] to {interface_name_}:{dst_ip}/{dst_port} is action locally | protocol is set to network.ip_protocol, session_id is set to network.session_id, interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, interface_name_ is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 775003 | (?P<target_service>Scansafe):{protocol} connection {session_id} from {interface_name} :{src_ip}(/{src_port})? (idfw_user )] to {interface_name_} :{dst_ip}/{dst_port} is whitelisted | target_service is set to target.application, protocol is set to network.ip_protocol, session_id is set to network.session_id, interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, interface_name_ is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 775004, 775005 | (?P<target_service>Scansafe): Primary server {dst_ip} is <message_text> | target_service is set to target.application, dst_ip is set to target.ip |
| 775006 | Primary server {primary_server_interface_name} :{dst_ip} is not reachable and backup server {backup_server_interface_name} :{dst_ip1} <message_text> | primary_server_interface_name is set to about.labels.key/value, dst_ip is set to target.ip, backup_server_interface_name is set to about.labels.key/value, dst_ip1 is set to target.ip |
| 775007 | (?P<target_service>Scansafe): Primary {primary_server_interface_name} :{dst_ip} and backup {backup_server_interface_name} :{dst_ip1} <message_text> | target_service is set to target.application, primary_server_interface_name is set to about.labels.key/value, dst_ip is set to target.ip, backup_server_interface_name is set to about.labels.key/value, dst_ip1 is set to target.ip |
| 776001 | CTS SXP: Configured source IP {src_ip} {error} | src_ip is set to principal.ip, error is set to about.labels.key/value |
| 776002 | CTS SXP: Invalid message from peer {src_ip} : {error} | src_ip is set to principal.ip, error is set to about.labels.key/value |
| 776003 | CTS SXP: Connection with peer {src_ip} failed: {error} | src_ip is set to principal.ip, error is set to about.labels.key/value |
| 776005 | CTS SXP: Binding {dst_ip} - {sg_name} from {src_ip} instance {connection_instance_num}{error} | dst_ip is set to target.ip, sg_name is set to about.labels.key/value, src_ip is set to principal.ip, connection_instance_num is set to about.labels.key/value, error is set to about.labels.key/value |
| 776006 | CTS SXP: Internal error: {error} | error is set to about.labels.key/value |
| 776007 | CTS SXP: Connection with peer {src_ip} (instance {connection_instance_num}) state changed from {original_state} to {final_state} | src_ip is set to principal.ip, connection_instance_num is set to about.labels.key/value, original_state is set to about.labels.key/value, final_state is set to about.labels.key/value |
| 776008 | CTS SXP: Connection with {src_ip} (instance {connection_instance_num}) state changed from {original_state} to {final_state} | src_ip is set to principal.ip, connection_instance_num is set to about.labels.key/value, original_state is set to about.labels.key/value, final_state is set to about.labels.key/value |
| 776010 | CTS SXP: SXP default source IP is changed {src_ip} {src_ip1} | src_ip is set to principal.ip, src_ip1 is set to principal.ip |
| 776020 | CTS SXP: Unable to locate egress interface to peer {dst_ip}, | dst_ip is set to target.ip |
| 776201 | CTS PAC: CTS PAC for Server {dst_ip}, A-ID {issuer} will expire in {days_left} days | dst_ip is set to target.ip, issuer is set to about.labels.key/value, days_left is set to about.labels.key/value |
| 776202 | CTS PAC for Server {dst_ip}, A-ID {issuer} has expired | dst_ip is set to target.ip, issuer is set to about.labels.key/value |
| 776203 | Unable to retrieve CTS Environment data due to: {summary} | summary is set to security_result.summary |
| 776251 | CTS SGT-MAP: Binding {dst_ip} - {sg_name} from {source_name} added to binding manager | dst_ip is set to target.ip, sg_name is set to about.labels.key/value, source_name is set to about.labels.key/value |
| 776252 | CTS SGT-MAP: CTS SGT-MAP: Binding {dst_ip} - {sg_name} from {source_name} deleted from binding manager. | dst_ip is set to target.ip, sg_name is set to about.labels.key/value, source_name is set to about.labels.key/value |
| 776253 | CTS SGT-MAP: Binding {dst_ip} - {new_sg_name} from {source_name} changed from old sgt: {old_sg_name} from old source {old_source_name} | dst_ip is set to target.ip, new_sg_name is set to about.labels.key/value, source_name is set to about.labels.key/value, old_sg_name is set to about.labels.key/value, old_source_name is set to about.labels.key/value |
| 776254 | CTS SGT-MAP: Binding manager unable to {action_details} Binding {dst_ip} - {sg_name} from {source_name} | action_details is set to security_result.action_details, dst_ip is set to target.ip, sg_name is set to about.labels.key/value, source_name is set to about.labels.key/value |
| 776301 | CTS Policy: Security-group tag {sgt} is mapped to security-group name {sg_name} | sgt is set to about.labels.key/value, sg_name is set to about.labels.key/value |
| 776302 | CTS Policy: Unknown security-group tag {sgt} referenced in policies | sgt is set to about.labels.key/value |
| 776303 | CTS Policy: Security-group name {sg_name} is resolved to security-group tag {sgt} | sg_name is set to about.labels.key/value, sgt is set to about.labels.key/value |
| 776304 | CTS Policy: Unresolved security-group name {sg_name} referenced, policies based on this name will be inactive | sg_name is set to about.labels.key/value |
| 776307 | CTS Policy: Security-group name for security-group tag {sgt} renamed from {old_sg_name} to {new_sg_name} | sgt is set to about.labels.key/value, old_sg_name is set to about.labels.key/value, new_sg_name is set to about.labels.key/value |
| 776308 | CTS Policy: Previously unknown security-group tag {sgt} is now mapped to security-group name {sg_name} | sgt is set to about.labels.key/value, sg_name is set to about.labels.key/value |
| 776309 | CTS Policy: Previously known security-group tag {sgt} is now unknown | sgt is set to about.labels.key/value |
| 776310 | CTS Policy: Security-group name {sg_name} remapped from security-group tag {old_sgt} to {new_sgt} | sg_name is set to about.labels.key/value, old_sgt is set to about.labels.key/value, new_sgt is set to about.labels.key/value |
| 776311 | CTS Policy: Previously unresolved security-group name {sg_name} is now resolved to security-group tag {sgt} | sg_name is set to about.labels.key/value, sgt is set to about.labels.key/value |
| 776312 | CTS Policy: Previously resolved security-group name {sg_name} is now unresolved, policies based on this name will be deactivated | sg_name is set to about.labels.key/value |
| 776313 | CTS Policy: Failure to update policies for security-group {sg_name}-{sgt} | sg_name is set to about.labels.key/value, sgt is set to about.labels.key/value |
| 778001 | VXLAN: Invalid VXLAN segment-id {segment_id} for {protocol} from {src_interface_name}:({src_ip}/{src_port}) to {dst_interface_name}:({dst_ip}/{dst_port}) | segment_id is set to about.labels.key/value, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 778002 | VXLAN: There is no VNI interface for segment-id {segment_id} | segment_id is set to about.labels.key/value |
| 778003 | VXLAN: Invalid VXLAN segment-id {segment_id} for {protocol} from {src_interface_name}:({src_ip}//{src_port}) to {dst_interface_name}:({dst_ip}//{dst_port}) in FP | segment_id is set to about.labels.key/value, protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 778004 | VXLAN: Invalid VXLAN header for {protocol} from {src_interface_name}:({src_ip}/{src_port}) to {dst_interface_name}:({dst_ip}/{dst_port}) in FP | protocol is set to network.ip_protocol, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 778005 | VXLAN: Packet with VXLAN segment-id {segment_id} from {interface_name} is denied by FP L2 check | segment_id is set to about.labels.key/value, interface_name is set to about.labels.key/value |
| 778006 | VXLAN: Invalid VXLAN UDP checksum from {src_interface_name}:({src_ip}/{src_port}) to {dst_interface_name}:({dst_ip}/{dst_port}) in FP | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 778007 | VXLAN: Packet from {interface_name} :{src_ip}(/{src_port})? to {dst_ip}/{dst_port} was discarded due to invalid NVE peer | interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 779001 | STS: Out-tag lookup failed for in-tag {segment_id} of {protocol} from {interface_name} :{src_ip}(/{src_port})? to {dst_ip}(/{dst_port})? | segment_id is set to about.labels.key/value, protocol is set to network.ip_protocol, interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 779002 | STS: STS and NAT locate different egress interface for segment-id {segment_id}, {protocol} from {interface_name} :{src_ip}(/{src_port})? to {dst_ip}(/{dst_port})? | segment_id is set to about.labels.key/value, protocol is set to network.ip_protocol, interface_name is set to about.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 779003, 779004 | STS: Failed to <message_text> tag-switching table - {summary} | summary is set to security_result.summary |
| 779005 | STS: Failed to parse tag-switching request from http - {summary} | summary is set to security_result.summary |
| 779006 | STS: Failed to save tag-switching table to flash - {summary} | summary is set to security_result.summary |
| 779007 | STS: Failed to replicate tag-switching table to peer - {summary} | summary is set to security_result.summary |
| 780001, 780002, 780003, 780004 | RULE ENGINE: <message_text> compilation for <message_text> transaction - {summary} | summary is set to security_result.summary |
| 785001 | Clustering: Ownership for existing flow from (<|){src_interface_name}(>|):(<|){src_ip}(>|)/(<|){src_port}(>|) to (<|){dst_interface_name}(>|):(<|){dst_ip}(>|)/(<|){dst_port}(>|) moved from unit (<|){old_owner_unit_id}(>|) at site (<|){old_site_id}(>|) to (<|){new_owner_unit_id}(>|) at site <message_text> due to {summary} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, old_owner_unit_id is set to about.labels.key/value, old_site_id is set to about.labels.key/value, new_owner_unit_id is set to about.labels.key/value, summary is set to security_result.summary |
| 802005 | IP {src_ip} Received MDM request {summary} | src_ip is set to principal.ip, summary is set to security_result.summary |
| 802006 | IP {src_ip} MDM request details has been rejected: {summary} | src_ip is set to principal.ip, summary is set to security_result.summary |
| 805001 | Flow offloaded: connection {session_id} {src_interface_name}:{src_ip}/{src_port} (<message_text>) {dst_interface_name}:{dst_ip}/{dst_port} <message_text> | session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 805,002,805,003 | Flow is no longer offloaded: connection {session_id} {src_interface_name}:{src_ip}/{src_port} (<message_text>) {dst_interface_name}:{dst_ip}/{dst_port} <message_text> | session_id is set to network.session_id, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 840001 | Failed to create the backup for an IKEv2 session (<|){src_ip}(>|), (<|){dst_ip}(>|) | src_ip is set to principal.ip, dst_ip is set to target.ip |
| 850001 | SNORT ID ({instance_or_process_id}) Automatic-Application-Bypass due to delay of (<|){timeout_delay}(>|)ms (threshold (<|){threshold}(>|)ms) with {info} | instance_or_process_id is set to about.labels.key/value, timeout_delay is set to about.labels.key/value, threshold is set to about.labels.key/value, info is set to about.labels.key/value |
| 850002 | SNORT ID ({instance_or_process_id}) Automatic-Application-Bypass due to SNORT not responding to traffics for (<|){delay}(>|)ms(threshold (<|){threshold}(>|)ms) | instance_or_process_id is set to about.labels.key/value, delay is set to about.labels.key/value, threshold is set to about.labels.key/value |
| 8300001 | VPN session redistribution {action_details} | action_details is set to security_result.action_details |
| 8300002 | Moved (<|){active_sessions}(>|) sessions to {member_name} | active_sessions is set to about.labels.key/value, member_name is set to about.labels.key/value |
| 8300003 | Failed to send session redistribution message to {member_name} | member_name is set to about.labels.key/value |
| 8300004 | (<|){action_details}(>|) request to move (<|){active_sessions}(>|) sessions from (<|){member_name}(>|) to {member_name_2} | action_details is set to security_result.action_details, active_sessions is set to about.labels.key/value, member_name is set to about.labels.key/value, member_name_2 is set to about.labels.key/value |
| 8300005 | Failed to receive session move response from {member_name} | member_name is set to about.labels.key/value |
| 108006 | Detected ESMTP size violation from {src_interface_name}:{src_ip}(|{src_port})? to {dst_interface_name}:{dst_ip}(|{dst_port})?;{summary} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, summary is set to security_result.summary |
| 111009 | User {user_name} executed cmd:{command} | user_name is set to target.user.userid, command is set to target.process.command_line |
| 113028 | Extraction of username from VPN client certificate has {status}. Request {request_id}] | status is set to about.labels.key/value, request_id is set to about.labels.key/value |
| 304005 | URL Server {dst_ip} <message_text> <message_text> URL {url} | dst_ip is set to target.ip, url is set to about.labels.key/value |
| 333004, 333005, 333006, 333007, 333008 | {protocol}-SQ response .* - context:{session_id} | protocol is set to network.ip_protocol, session_id is set to network.session_id |
| 335007 | NAC Default ACL not configured - {dst_ip} | dst_ip is set to target.ip |
| 419003 | Cleared {protocol} urgent flag from {dst_interface_name}:{src_ip}/{src_port} to {src_interface_name}:{dst_ip}/{dst_port} | protocol is set to network.ip_protocol, dst_interface_name is set to target.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, src_interface_name is set to principal.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 421004 | Failed to inject {protocol} packet from {src_ip}/{src_port} to {dst_ip}/{dst_port} | protocol is set to network.ip_protocol, src_ip is set to principal.ip, src_port is set to principal.port, dst_ip is set to target.ip, dst_port is set to target.port |
| 609001, 609002 | (?P<action>Built|Teardown) local-host {src_interface_name}:{src_ip}( duration {duration})? | action is set to security_result.action, src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, duration is set to network.session_duration |
| 702307 | (?P<category>IPSEC): An (?P<direction>inbound|outbound|INBOUND|OUTBOUND|Inbound|Outbound) {tunnel_type} SA (SPI={spi}) between {src_ip} and {dst_ip} ({src_fwuser}) is rekeying due to data rollover | category is set to security_result.category_details, direction is set to network.direction, tunnel_type is set to about.labels.key/value, spi is set to about.labels.key/value, src_ip is set to principal.ip, dst_ip is set to target.ip, src_fwuser is set to principal.user.userid/principal.labels.key/value |
| 703001 | H.225 message received from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} is using an unsupported {version_number} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, version_number is set to about.labels.key/value |
| 703002 | Received H.225 Release Complete with newConnectionNeeded for {src_interface_name}:{src_ip} to {dst_interface_name}:{dst_ip}/{dst_port} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 703008 | Allowing early-message:<message_text>from {src_interface_name}:{src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | src_interface_name is set to principal.labels.key/value, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 709001 | FO replication failed: cmd={command} returned={return_code} | command is set to target.process.command_line, return_code is set to security_result.description |
| 709002 | FO unreplicable: cmd={command} | command is set to target.process.command_line |
| 710001 | (?P<protocol>TCP) access requested from {src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | protocol is set to network.ip_protocol, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 710002 | (?P<protocol>TCP|UDP) access permitted from {src_ip}/{src_port} to {dst_interface_name}:{dst_ip}(/{dst_port})? | protocol is set to network.ip_protocol, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 710004 | (?P<protocol>TCP) connection limit exceeded from {src_ip}/{src_port} to {input_interface}:{dst_ip}/{dst_port} (current connections/connection limit = {current_connections}/{connection_limit}) | protocol is set to network.ip_protocol, src_ip is set to principal.ip, src_port is set to principal.port, input_interface is set to about.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port, current_connections is set to about.labels.key/value, connection_limit is set to about.labels.key/value |
| 710005 | (?P<protocol>TCP|UDP|SCTP) request discarded from {src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | protocol is set to network.ip_protocol, src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 710006 | {protocol} request discarded from {src_ip} to {dst_interface_name}:{dst_ip} | protocol is set to network.ip_protocol, src_ip is set to principal.ip, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip |
| 710007 | NAT-T keepalive received from {src_ip}/{src_port} to {dst_interface_name}:{dst_ip}/{dst_port} | src_ip is set to principal.ip, src_port is set to principal.port, dst_interface_name is set to target.labels.key/value, dst_ip is set to target.ip, dst_port is set to target.port |
| 711003 | Unknown/Invalid interface identifier({vpifnum}) detected | vpifnum is set to about.labels.key/value |
| 711006 | CPU profiling has started for {number_of_sample} samples. Reason: {summary} | number_of_sample is set to about.labels.key/value, summary is set to security_result.summary |
| 713024 | Group {group_name}, IP {src_ip}, Received local Proxy Host data in ID Payload: Address {dst_ip}, Protocol {protocol}, Port {dst_port} | group_name is set to target.user.group_identifiers, src_ip is set to principal.ip, dst_ip is set to target.ip, protocol is set to network.ip_protocol, dst_port is set to target.port |
| 713025 | Received remote Proxy Host data in ID Payload: Address {dst_ip}, Protocol {protocol}, Port {dst_port} | dst_ip is set to target.ip, protocol is set to network.ip_protocol, dst_port is set to target.port |
| 713028 | Received local Proxy Range data in ID Payload: Addresses {dst_ip}- {dst_ip1}, Protocol {protocol}, Port {dst_port} | dst_ip is set to target.ip, dst_ip1 is set to target.ip, protocol is set to network.ip_protocol, dst_port is set to target.port |
| 713029 | Received remote Proxy Range data in ID Payload: Addresses {dst_ip}-{dst_ip}, Protocol {protocol}, Port {dst_port} | dst_ip is set to target.ip, dst_ip is set to target.ip, protocol is set to network.ip_protocol, dst_port is set to target.port |
| 713034 | Received local IP Proxy Subnet data in ID Payload: Address {dst_ip}, Mask {netmask}, Protocol {protocol}, Port {dst_port} | dst_ip is set to target.ip, netmask is set to about.labels.key/value, protocol is set to network.ip_protocol, dst_port is set to target.port |
| 713035 | Group {group_name} IP {dst_ip} Received remote IP Proxy Subnet data in ID Payload: Address {dst_ip1}, Mask {netmask}, Protocol {protocol}, Port {dst_port} | group_name is set to target.user.group_identifiers, dst_ip is set to target.ip, dst_ip1 is set to target.ip, netmask is set to about.labels.key/value, protocol is set to network.ip_protocol, dst_port is set to target.port |
| 713039 | Send failure: Bytes ({sent_bytes}), Peer: {dst_ip} | sent_bytes is set to network.sent_bytes, dst_ip is set to target.ip |
| 713040 | Could not find connection entry and can not encrypt: msgid {message_id} | message_id is set to about.labels.key/value |
| 713052 | User ({user_name}) authenticated. | user_name is set to target.user.userid |
| 713066 | IKE Remote Peer configured for SA: {sa_name} | sa_name is set to about.labels.key/value |
| 713099 | Tunnel Rejected: Received NONCE length {nonce_length} is out of range! | nonce_length is set to about.labels.key/value |
| 713104 | Attempt to get Phase 1 ID data failed while {hash_computation} | hash_computation is set to about.labels.key/value |
| 713113 | Deleting IKE SA with associated (IPsec|IPSec) connection entries. IKE peer: {dst_ip}, SA address: {internal_sa_address}, tunnel count: {tunnel_count} | dst_ip is set to target.ip, internal_sa_address is set to about.labels.key/value, tunnel_count is set to about.labels.key/value |
| 713114 | Connection entry ({src_ip}) points to IKE SA ({src_ip1}) for peer {dst_ip}, but cookies don't match | src_ip is set to principal.ip, src_ip1 is set to principal.ip, dst_ip is set to target.ip |
| 713117 | Received Invalid SPI notify (SPI {spi_value})! | spi_value is set to about.labels.key/value |
| 713121 | Keep-alive type for this connection: {keepalive_type} | keepalive_type is set to about.labels.key/value |
| 713143 | Processing firewall record. Vendor: {vendor_id}, Product: {product_id}, Caps: {capability_value}, Version Number: {version_number}, Version String: {version_text} | vendor_id is set to about.labels.key/value, product_id is set to about.labels.key/value, capability_value is set to about.labels.key/value, version_number is set to about.labels.key/value, version_text is set to about.labels.key/value |
| 713160 | Remote user (session Id -{session_id}) has been granted access by the Firewall Server | session_id is set to network.session_id |
| 713169 | IKE Received delete for rekeyed SA IKE peer: {dst_ip}, SA address: {internal_sa_address}, tunnelCnt: {tunnel_count} | dst_ip is set to target.ip, internal_sa_address is set to about.labels.key/value, tunnel_count is set to about.labels.key/value |
| 713170 | Group {group_name} IP {dst_ip} IKE Received delete for rekeyed centry IKE peer: {dst_ip1}, centry address: {internal_address}, msgid: {message_id} | group_name is set to target.user.group_identifiers, dst_ip is set to target.ip, dst_ip1 is set to target.ip, internal_address is set to about.labels.key/value, message_id is set to about.labels.key/value |
| 713187 | Tunnel Rejected: IKE peer does not match remote peer as defined in L2L policy IKE peer address: {dst_ip}, Remote peer address: {dst_ip1} | dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 713190 | Got bad refCnt ({ref_count_value}) assigning {dst_ip1} ({dst_ip}) | ref_count_value is set to about.labels.key/value, dst_ip1 is set to target.ip, dst_ip is set to target.ip |
| 713204 | Adding static route for client address: {dst_ip} | dst_ip is set to target.ip |
| 713221 | Static Crypto Map check, checking map = {crypto_map_tag}, seq = {seq_number}.* | crypto_map_, seq_number is set to about.labels.key/value |
| 713222 | Group( =)? {group_name}(,)?( Username( =)? {user_name}(,)?)? IP( =)? {dst_ip1}(,)? Static Crypto Map check, map = {crypto_map_tag}, seq = {seq_number}, ACL does not match proxy IDs src:{src_ip} dst:{dst_ip} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip1 is set to target.ip, crypto_map_, seq_number is set to about.labels.key/value, src_ip is set to principal.ip, dst_ip is set to target.ip |
| 713223 | Static Crypto Map check, map = {crypto_map_tag}, seq = {seq_number}, no ACL configured | crypto_map_, seq_number is set to about.labels.key/value |
| 713225 | (Group = {group_name}, IP = {dst_ip}, )?(IKEv1], )?Static Crypto Map check, map {crypto_map_tag}, seq = {seq_number} is a successful match | group_name is set to target.user.group_identifiers, dst_ip is set to target.ip, crypto_map_, seq_number is set to about.labels.key/value |
| 713233 | (VPN-<message_text>) Remote network ({dst_ip}) validated for network extension mode | dst_ip is set to target.ip |
| 713234 | (VPN-<message_text>) Remote network ({dst_ip}) from network extension mode client mismatches AAA configuration ({aaa_ip}) | dst_ip is set to target.ip, aaa_ip is set to about.labels.key/value |
| 713263 | Received local IP Proxy Subnet data in ID Payload: Address {dst_ip}, Mask/{netmask}, Protocol {protocol}, Port {port} | dst_ip is set to target.ip, netmask is set to about.labels.key/value, protocol is set to network.ip_protocol, port is set to about.labels.key/value |
| 713264 | Received (local IP|remote IP) Proxy Subnet data in ID Payload: Address {dst_ip}, Mask/{netmask}, Protocol {protocol}, Port {port} | dst_ip is set to target.ip, netmask is set to about.labels.key/value, protocol is set to network.ip_protocol, port is set to about.labels.key/value |
| 713273 | (Deleting|Could not delete) static route for client address: {dst_ip} {dst_ip1} address of client whose route is being removed | dst_ip is set to target.ip, dst_ip1 is set to target.ip |
| 714002 | IKE Initiator starting QM: msg id = {message_id} | message_id is set to about.labels.key/value |
| 714003 | IKE Responder starting QM: msg id = {message_id} | message_id is set to about.labels.key/value |
| 714006 | IKE Initiator sending <message_text> QM pkt: msg id = {message_id} | message_id is set to about.labels.key/value |
| 714005 | IKE Responder sending 2nd QM pkt: msg id = {message_id} | message_id is set to about.labels.key/value |
| 715004 | subroutine {subroutine_name} Send failure: RetCode ({return_code}) | subroutine_name is set to about.labels.key/value, return_code is set to security_result.description |
| 715005 | subroutine {subroutine_name} Bad message code: Code ({return_code}) | subroutine_name is set to about.labels.key/value, return_code is set to security_result.description |
| 715006 | IKE got SPI from key engine: SPI ={spi_value} | spi_value is set to about.labels.key/value |
| 715007 | IKE got a KEY_ADD msg for SA: SPI ={spi_value} | spi_value is set to about.labels.key/value |
| 715008 | Could not delete SA {internal_sa_address}, refCnt = {ref_cnt}, caller = {calling_subroutine_address} | internal_sa_address is set to about.labels.key/value, ref_cnt is set to about.labels.key/value, calling_subroutine_address is set to about.labels.key/value |
| 715009 | IKE Deleting SA: Remote Proxy {src_ip}, Local Proxy {src_ip1} | src_ip is set to principal.ip, src_ip1 is set to principal.ip |
| 715013 | Tunnel negotiation in progress for destination {dst_ip}, discarding data | dst_ip is set to target.ip |
| 715018 | IP Range type id was loaded: Direction {ipsec_direction}, From: {from}, Through: {through} | ipsec_direction is set to about.labels.key/value, from is set to about.labels.key/value, through is set to about.labels.key/value |
| 715019 | Group {group_name} Username {user_name} IP {dst_ip} IKEGetUserAttributes: Attribute name ={attribute_name} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, attribute_name is set to about.labels.key/value |
| 715020 | construct_cfg_set: Attribute name ={attribute_name} | attribute_name is set to about.labels.key/value |
| 715027, 715028 | (IP = {dst_ip},)?<message_text>SA Proposal {chosen_proposal}, Transform {chosen_transform} acceptableMatches global <message_text> entry {crypto_map_index} | dst_ip is set to target.ip, chosen_proposal is set to about.labels.key/value, chosen_transform is set to about.labels.key/value, crypto_map_index is set to about.labels.key/value |
| 715031 | Obtained IP addr ({src_ip}) prior to initiating Mode Cfg (XAuth {x_auth}) | src_ip is set to principal.ip, x_auth is set to about.labels.key/value |
| 715032 | Sending subnet mask ({subnet_mask}) to remote client | subnet_mask is set to about.labels.key/value |
| 715033 | Processing CONNECTED notify (MsgId {message_id}) | message_id is set to about.labels.key/value |
| 715035 | Starting IOS keepalive monitor: seconds {seconds} | seconds is set to about.labels.key/value |
| 715036 | Sending keep-alive of type {notify_type} (seq number {seq_number}) | notify_type is set to about.labels.key/value, seq_number is set to about.labels.key/value |
| 715037 | Unknown IOS Vendor ID version: {cisco_ios_version} | cisco_ios_version is set to about.labels.key/value |
| 715038 | {spoof_action} {spoofing_info} Vendor ID payload (version: {cisco_ios_version}, capabilities: {capabilities}) | spoof_action is set to about.labels.key/value, spoofing_info is set to about.labels.key/value, cisco_ios_version is set to about.labels.key/value, capabilities is set to about.labels.key/value |
| 715040 | Deleting active auth handle during SA deletion: handle = {internal_authentication_handle} | internal_authentication_handle is set to about.labels.key/value |
| 715041 | Received keep-alive of type {keepalive_type}, not the negotiated type | keepalive_type is set to about.labels.key/value |
| 715042 | IKE received response of type {failure_type} to a request from the {dst_ip} utility | failure_type is set to about.labels.key/value, dst_ip is set to target.ip |
| 715046 | (Group = {group_name},)?(Username = {user_name},)?IP = {dst_ip}, constructing {payload_description} payload | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, payload_description is set to about.labels.key/value |
| 715047 | processing {payload_description} payload | payload_description is set to about.labels.key/value |
| 715051 | Received unexpected TLV type {tlv_type} while processing FWTYPE ModeCfg Reply | tlv_type is set to about.labels.key/value |
| 715053 | MODE_CFG: Received request for {info} | info is set to about.labels.key/value |
| 715054 | MODE_CFG: Received {attribute_name} reply: {summary} | attribute_name is set to about.labels.key/value, summary is set to security_result.summary |
| 715060 | Dropped received IKE fragment. Reason: {summary} | summary is set to security_result.summary |
| 715064 | IKE Peer included IKE fragmentation capability flags: Main Mode: {main_mode} Aggressive Mode: {aggressive_mode} | main_mode is set to about.labels.key/value, aggressive_mode is set to about.labels.key/value |
| 715065 | IKE {state_machine} {subtype} FSM error history (struct {data_structure_address}) {state_name}, | state_machine is set to about.labels.key/value, subtype is set to about.labels.key/value, data_structure_address is set to about.labels.key/value, state_name is set to about.labels.key/value |
| 715068 | QM IsRekeyed: duplicate sa found by {address}, deleting old sa | address is set to about.labels.key/value |
| 715069 | Invalid ESP SPI size of {spi_size} | spi_size is set to about.labels.key/value |
| 715070 | Invalid IPComp SPI size of {spi_size} | spi_size is set to about.labels.key/value |
| 715072 | Received proposal with unknown protocol ID {version_protocol} | version_protocol is set to network.tls.version_protocol |
| 715074 | Could not retrieve authentication attributes for peer {dst_ip} | dst_ip is set to target.ip |
| 715075 | Group = {group_name}, IP = {dst_ip}(,)? Received keep-alive of type {message_type}(seq number {seq_number}) | group_name is set to target.user.group_identifiers, dst_ip is set to target.ip, message_type is set to about.labels.key/value, seq_number is set to about.labels.key/value |
| 715078 | Received {attribute} LAM attribute | attribute is set to about.labels.key/value |
| 716010 | Group {group_name} User {user_name} Browse network | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid |
| 716011 | Group {group_name} User {user_name} Browse domain {domain_name} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, domain_name is set to about.labels.key/value |
| 716012, 716019, 716020 | Group {group_name} User {user_name} (Create|Remove|Browse) directory {directory} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, directory is set to about.labels.key/value |
| 716013, 716014 | Group {group_name} User {user_name} (Close|View|Remove) file {target_file_full_path} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, target_file_full_path is set to target.file.full_path |
| 716016 | Group {group_name} User {user_name} Rename file {old_filename} to {new_filename} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, old_filename is set to about.labels.key/value, new_filename is set to about.labels.key/value |
| 716017, 716018 | Group {group_name} User {user_name} (Create|Modify) file {target_file_full_path} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, target_file_full_path is set to target.file.full_path |
| 716021 | File access (?P<action>DENIED), {target_file_full_path} | action is set to security_result.action, target_file_full_path is set to target.file.full_path |
| 716024 | Group {group_name} User {user_name} Unable to browse the network.Error:{summary} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, summary is set to security_result.summary |
| 716025 | Group {group_name} User {user_name} Unable to browse domain {domain_name}. Error:{summary} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, domain_name is set to about.labels.key/value, summary is set to security_result.summary |
| 716026 | Group {group_name} User {user_name} Unable to browse directory {directory}. Error:{summary} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, directory is set to about.labels.key/value, summary is set to security_result.summary |
| 716027, 716028, 716029, 716030 | Group {group_name} User {user_name} Unable to (?P<action_details>view|remove|rename|modify|create) file {target_file_full_path}. Error:{summary} | action_details is set to security_result.action_details, group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, target_file_full_path is set to target.file.full_path, summary is set to security_result.summary |
| 716031 | Group {group_name} User {user_name} Unable to (?P<action_details>view|remove|rename|modify|create) file {target_file_full_path}. Error:{summary} | action_details is set to security_result.action_details, group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, target_file_full_path is set to target.file.full_path, summary is set to security_result.summary |
| 716032 | Group {group_name} User {user_name} Unable to (create|remove) folder {folder}. Error:{summary} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, folder is set to about.labels.key/value, summary is set to security_result.summary |
| 716033 | Group {group_name} User {user_name} Unable to (create|remove) folder {folder}. Error:{summary} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, folder is set to about.labels.key/value, summary is set to security_result.summary |
| 716034 | Group {group_name} User {user_name} Unable to (write to|read) file {target_file_full_path} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, target_file_full_path is set to target.file.full_path |
| 716035 | Group {group_name} User {user_name} Unable to (write to|read) file {target_file_full_path} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, target_file_full_path is set to target.file.full_path |
| 716036 | Group {group_name} User <message_text> File Access: User {user_name} logged into the {dst_ip} server | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 716037 | Group {group_name} User <message_text> File Access: User {user_name} failed to login into the {dst_ip} server | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip |
| 716603 | Received {received_kb} KB Hostscan data from IP (<)?{src_ip}(>)? | received_kb is set to about.labels.key/value, src_ip is set to principal.ip |
| 722029 | Group {group_name} User {user_name} IP {dst_ip} SVC Session Termination: Conns: {number_of_connections}, DPD Conns: {dpd_conns}, Comp resets: {compression_resets}, Dcmp resets: {decompression_resets} | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, number_of_connections is set to about.labels.key/value, dpd_conns is set to about.labels.key/value, compression_resets is set to about.labels.key/value, decompression_resets is set to about.labels.key/value |
| 722030, 722031 | Group {group_name} User {user_name} IP {dst_ip} SVC Session Termination: <message_text>: {received_bytes}(+{ctrl_bytes}) bytes, {data_pkts}(+{ctrl_pkts}) packets, {drop_pkts} drops | group_name is set to target.user.group_identifiers, user_name is set to target.user.userid, dst_ip is set to target.ip, received_bytes is set to network.received_bytes, ctrl_bytesis set to about.labels.key/value, data_pkts is set to about.labels.key/value, drop_pkts is set to about.labels.key/value |
| 317078 | (Deleted|Added) {protocol} route {dst_ip} {subnet_mask} via {gateway_address} <message_text> on <message_text> | protocol is set to network.ip_protocol, dst_ip is set to target.ip, gateway_address is set to about.labels.key/value, subnet_mask is set to about.labels.key/value |
Referenz zur Feldzuordnung: Nachrichten-IDs zum UDM-Ereignistyp
In der folgenden Tabelle sind die Cisco-Nachrichten-IDs und die entsprechenden UDM-Ereignistypen aufgeführt:
| Message IDs | UDM event type |
|---|---|
| "722053", "725001", "725002", "725003", "725004", "725005", "725007", "725016", "726001", "750001", "750002", "750003", "750004", "750005", "750006", "750007", "750008", "750009", "750010", "750014", "750015", "751001", "751002", "751004", "751005", "751006", "751007", "751008", "751009", "751010", "751011", "751012", "751013", "751014", "751015", "751016", "751017", "751020", "751021", "751022", "751023", "751024", "751025", "751026", "751027", "751028", "753001", "775001", "775002", "775003", "106001", "106002", "106006", "106007", "106010", "106011", "106012", "106013", "106014", "106015", "106016", "106017", "106018", "106020", "106021", "106022", "106023", "106025", "106026", "106027", "106100", "106102", "108002", "108004", "108007", "109001", "109002", "109003", "109005", "109007", "109008", "109010", "109023", "109024", "109025", "109028", "109034", "109039", "110002", "110003", "110004", "113042", "201003", "201010", "201011", "201012", "202005", "202010", "210005", "210007", "210008", "210010", "212004", "212006", "302003", "302004", "302012", "302017", "302018", "302020", "302021", "302022", "302024", "302026", "302027", "302033", "302034", "302035", "302036", "302303", "302305", "302306", "302311", "313004", "304001", "304002", "305005", "305006", "305009", "305010", "305011", "305012", "305013", "305014", "305016", "305017", "305018", "313005", "313008", "313009", "314001", "314002", "322004", "324000", "324001", "324002", "324003", "324004", "324005", "324007", "331001", "331002", "332003", "334001", "334002", "334003", "334004", "334005", "334006", "334007", "334008", "334009", "335001", "335002", "335003", "335004", "335005", "335006", "335008", "335009", "335012", "337000", "337001", "337005", "338001", "338002", "338003", "338004", "338005", "338006", "338007", "338008", "338101", "338102", "338103", "338104", "338201", "338202", "338203", "338204", "338301", "340001", "340002", "400000", "400001", "400002", "400003", "400004", "400005", "400006", "400007", "400008", "400009", "400010", "400011", "400012", "400013", "400014", "400015", "400016", "400017", "400018", "400019", "400020", "400021", "400022", "400023", "400024", "400025", "400026", "400027", "400028", "400029", "400030", "400031", "400032", "400033", "400034", "400035", "400036", "400037", "400038", "400039", "400040", "400041", "400042", "400043", "400044", "400045", "400046", "400047", "400048", "400049", "400050", "401004", "402114", "402115", "402116", "402117", "402118", "402119", "402120", "402121", "402122", "402130", "403109", "405001", "405101", "405102", "405103", "405104", "405105", "405201", "406002", "407001", "407002", "407003", "409005", "409007", "410001", "410002", "410003", "410004", "415001", "415002", "415003", "415004", "415005", "415006", "415007", "415008", "415009", "415010", "415011", "415012", "415013", "415014", "415015", "415016", "415017", "415018", "415019", "415020", "416001", "418001", "419001", "419002", "419003", "419004", "419006", "420001", "420002", "420003", "420006", "421001", "421002", "421007", "423001", "423002", "423003", "423004", "423005", "424001", "424002", "428002", "429001", "429002", "429003", "429005", "429006", "429007", "4302310", "431001", "431002", "434001", "434002", "434003", "434004", "434007", "446003", "447001", "448001", "450001", "507001", "507003", "508001", "508002", "509001", "602303", "602304", "602305", "602306", "607001", "607002", "607003", "607004", "608001", "608002", "608003", "608004", "608005", "613013", "616001", "617001", "617003", "617004", "618001", "620001", "620002", "710003", "713032", "713033", "302013", "302015", "778001", "778003", "778004", "778006", "778007", "779001", "779002", "805001", "805002", "805003" | NETWORK_CONNECTION |
| "722053", "725001", "725002", "725003", "725004", "725005", "725007", "725016", "726001", "750001", "750002", "750003", "750004", "750005", "750006", "750007", "750008", "750009", "750010", "750014", "750015", "751001", "751002", "751004", "751005", "751006", "751007", "751008", "751009", "751010", "751011", "751012", "751013", "751014", "751015", "751016", "751017", "751020", "751021", "751022", "751023", "751024", "751025", "751026", "751027", "751028", "753001", "775001", "775002", "775003", "106001", "106002", "106006", "106007", "106010", "106011", "106012", "106013", "106014", "106015", "106016", "106017", "106018", "106020", "106021", "106022", "106023", "106025", "106026", "106027", "106100", "106102", "108002", "108004", "108007", "109007", "109008", "109010", "109023", "109024", "109025", "109028", "109034", "109039", "110002", "110003", "110004", "113042", "201003", "201010", "201011", "201012", "202005", "202010", "210005", "210007", "210008", "210010", "212004", "212006", "302003", "302004", "302012", "302017", "302018", "302020", "302021", "302022", "302024", "302026", "302027", "302033", "302034", "302035", "302036", "302303", "302305", "302306", "302311", "313004", "304001", "304002", "305005", "305006", "305009", "305010", "305011", "305012", "305013", "305014", "305016", "305017", "305018", "313005", "313008", "313009", "314001", "314002", "322004", "324000", "324001", "324002", "324003", "324004", "324005", "324007", "331001", "331002", "332003", "334001", "334002", "334003", "334004", "334005", "334006", "334007", "334008", "334009", "335001", "335002", "335003", "335004", "335005", "335006", "335008", "335009", "335012", "337000", "337001", "337005", "338001", "338002", "338003", "338004", "338005", "338006", "338007", "338008", "338101", "338102", "338103", "338104", "338201", "338202", "338203", "338204", "338301", "340001", "340002", "400000", "400001", "400002", "400003", "400004", "400005", "400006", "400007", "400008", "400009", "400010", "400011", "400012", "400013", "400014", "400015", "400016", "400017", "400018", "400019", "400020", "400021", "400022", "400023", "400024", "400025", "400026", "400027", "400028", "400029", "400030", "400031", "400032", "400033", "400034", "400035", "400036", "400037", "400038", "400039", "400040", "400041", "400042", "400043", "400044", "400045", "400046", "400047", "400048", "400049", "400050", "401004", "402114", "402115", "402116", "402117", "402118", "402119", "402120", "402121", "402122", "402130", "403109", "405001", "405101", "405102", "405103", "405104", "405105", "405201", "406002", "407001", "407002", "407003", "409005", "409007", "410001", "410002", "410003", "410004", "415001", "415002", "415003", "415004", "415005", "415006", "415007", "415008", "415009", "415010", "415011", "415012", "415013", "415014", "415015", "415016", "415017", "415018", "415019", "415020", "416001", "418001", "419001", "419002", "419003", "419004", "419006", "420001", "420002", "420003", "420006", "421001", "421002", "421007", "423001", "423002", "423003", "423004", "423005", "424001", "424002", "428002", "429001", "429002", "429003", "429005", "429006", "429007", "4302310", "431001", "431002", "434001", "434002", "434003", "434004", "434007", "446003", "447001", "448001", "450001", "507001", "507003", "508001", "508002", "509001", "602303", "602304", "602305", "602306", "607001", "607002", "607003", "607004", "608001", "608002", "608003", "608004", "608005", "613013", "616001", "617001", "617003", "617004", "618001", "620001", "620002", "710003", "713032", "713033", "302013", "302015", "778001", "778003", "778004", "778006", "778007", "779001", "779002", "805001", "805002", "805003", "106103", "108003", "317078" | NETWORK_UNCATEGORIZED |
| "101001", "101002", "101003", "101004", "101005", "103001", "103002", "103003", "103004", "103005", "103006", "103007", "103008", "104001", "104002", "104003", "104004", "104500", "104501", "104502", "105001", "105002", "105003", "105004", "105005", "105007", "105008", "105009", "105010", "105011", "105020", "105021", "105031", "105032", "105033", "105034", "105035", "105036", "105037", "105038", "105039", "105040", "105041", "105042", "105043", "105044", "105045", "105046", "105047", "105048", "105050", "105500", "105501", "105502", "105503", "105506", "105507", "105508", "105520", "105521", "105522", "105523", "105524", "105524", "105525", "105526", "105527", "105528", "105529", "105530", "105531", "105532", "105533", "105534", "105535", "105536", "105537", "109012", "109013", "109016", "109018", "109019", "109020", "109022", "109026", "109029", "109031", "109032", "109035", "109036", "109037", "109038", "109040", "111001", "111002", "111003", "111004", "111005", "111007", "111111", "112001", "113001", "114006", "114007", "114008", "114009", "114010", "114011", "114012", "114013", "114014", "114015", "114016", "114017", "114018", "114019", "114020", "114021", "114022", "114023", "115000", "115001", "115002", "120001", "120002", "120003", "120004", "120005", "120006", "120007", "120008", "120009", "120010", "120011", "120012", "121001", "121002", "121003", "199001", "199002", "199003", "199005", "199010", "199011", "199012", "199020", "199021", "199027", "210020", "210021", "211003", "211004", "212001", "212002", "212003", "212005", "212009", "212010", "212011", "213001", "213002", "213003", "213004", "213007", "214001", "215001", "216001", "216002", "216003", "216004", "216005", "218001", "218002", "218003", "218004", "218005", "219002", "216002", "216003", "216004", "216005", "218001", "218002", "218003", "218004", "218005", "219002", "722016", "722017", "722018", "722019", "722020", "722021", "722039", "722040", "722043", "722044", "722055", "730004", "730005", "730008", "730009", "732001", "732002", "732003", "733100", "733101", "733102", "733103", "735001", "735002", "735003", "735004", "735005", "735006", "735007", "735008", "735009", "735010", "735011", "735012", "735013", "735014", "735015", "735016", "735017", "735018", "735019", "735020", "735021", "735022", "735023", "735024", "735025", "735026", "735027", "735028", "735029", "736001", "737002", "737003", "737004", "737005", "737006", "737007", "737008", "737012", "737017", "737018", "737019", "737027", "737034", "741005", "741006", "742001", "742002", "742003", "742004", "742005", "742006", "742007", "742008", "742009", "742010", "746016", "747007", "747008", "747009", "747010", "747011", "747012", "747013", "747014", "747015", "747016", "747017", "747018", "747020", "747021", "747022", "747023", "747024", "747025", "747026", "747027", "747028", "747029", "747030", "747031", "747032", "747033", "747034", "747035", "747036", "747037", "747038", "747039", "747040", "747041", "747042", "748001", "748002", "748003", "748004", "748005", "748006", "748007", "748008", "748009", "748202", "748203", "750011", "750012", "751018", "751019", "768001", "768002", "768003", "768004", "770001", "770002", "770003", "772003", "772004", "775004", "775005", "775006", "775007", "776001", "776002", "776003", "776004", "776005", "776007", "776008", "776010", "105538", "105539", "105540", "105541", "105542", "105543", "105544", "105545", "105546", "105547", "105548", "105549", "105550", "105551", "109011", "113006", "113012", "113013", "113018", "113020", "113021", "113022", "113024", "113025", "113026", "113027", "113040", "114001", "114002", "114003", "113014", "113045", "302019", "302302", "304006", "304008", "315004", "318006", "318007", "318008", "318009", "318108", "318109", "318110", "318111", "318112", "318113", "318114", "318115", "318116", "318117", "318118", "318119", "318120", "318121", "318122", "318123", "318126", "320001", "321001", "321002", "321003", "321004", "321005", "321006", "321007", "322001", "323001", "323002", "323003", "323004", "323005", "323006", "323007", "324008", "324010", "324011", "324301", "325001", "325002", "325004", "325005", "325006", "326001", "326002", "326004", "326008", "326009", "326010", "326011", "326012", "326013", "326014", "326015", "326016", "326026", "326027", "326028", "328001", "328002", "329001", "333001", "333002", "333003", "333009", "333010", "335010", "335011", "335013", "335014", "336001", "336002", "336003", "336004", "336005", "336006", "336007", "336008", "336009", "336010", "336011", "336012", "336013", "336014", "336015", "336016", "336019", "338304", "338305", "338306", "338307", "338310", "339001", "339002", "339005", "341001", "341002", "341003", "341004", "341005", "341006", "341007", "341008", "341010", "341011", "342002", "342006", "342008", "401002", "401003", "401005", "402123", "402124", "402125", "402126", "402127", "402128", "402129", "402140", "402141", "402142", "402143", "402144", "402145", "402146", "402147", "402149", "402150", "403101", "403102", "403104", "403106", "403107", "403108", "403110", "403500", "403501", "403502", "403503", "403507", "405106", "406001", "408002", "408003", "408101", "408102", "409001", "409008", "409014", "409015", "409016", "409017", "409023", "409101", "409102", "409103", "409104", "409105", "409106", "409107", "409108", "409109", "409110", "409111", "409112", "409113", "409114", "409115", "409116", "409117", "409128", "411001", "411002", "411003", "411004", "411005", "412002", "413001", "413002", "413003", "413004", "413005", "413005", "413006", "413007", "413008", "414001", "414002", "414006", "414007", "414008", "417004", "417006", "418018", "420007", "421006", "422004", "422005", "425001", "425002", "425003", "425004", "425005", "425006", "426001", "426002", "426003", "426004", "426101", "426102", "426103", "426104", "429004", "429008", "444004", "444005", "444007", "444008", "444009", "444100", "444101", "444102", "444103", "444104", "444105", "444106", "444107", "444108", "444109", "444110", "444111", "444302", "444303", "444304", "444305", "444306", "446001", "500001", "500002", "502101", "502102", "502111", "502112", "503001", "503002", "503003", "503004", "503005", "503101", "504001", "504002", "505007", "505007", "505008", "505008", "505009", "505010", "505011", "505012", "505012", "505013", "505013", "505014", "505014", "505015", "505015", "505016", "505016", "506001", "507002", "603101", "603102", "603103", "604105", "606001", "606002", "606003", "606004", "610001", "610002", "610101", "611104", "611301", "611302", "611303", "611304", "611305", "611306", "611307", "611308", "611309", "611310", "611311", "611312", "611313", "611314", "611315", "611316", "611317", "611318", "611319", "611320", "611321", "611322", "611323", "612001", "612002", "612003", "613001", "613002", "613004", "613005", "613006", "613011", "613014", "613017", "613018", "613019", "613027", "613028", "613030", "613032", "613035", "613036", "613037", "613038", "613039", "613101", "613103", "615001", "615002", "617002", "622001", "622101", "622102", "709007", "709008", "711002", "711004", "711005", "713004", "713201", "713202", "713008", "713009", "713010", "713012", "713014", "713016", "713017", "713018", "713020", "713048", "713049", "713056", "713060", "713061", "713065", "713068", "713072", "713073", "713074", "713075", "713076", "713078", "713081", "713084", "713085", "713086", "713088", "713092", "713098", "713102", "713105", "713107", "713109", "713112", "713115", "713118", "713119", "713120", "713122", "713124", "713127", "713128", "713129", "713131", "713133", "713134", "713136", "713137", "713138", "713139", "713140", "713141", "713142", "713144", "713149", "713152", "713159", "713161", "713162", "713163", "713165", "713166", "713167", "713168", "713172", "713179", "713184", "713186", "713193", "713194", "713195", "713197", "713198", "713199", "713206", "713207", "713208", "713209", "713210", "713215", "713216", "713217", "713219", "713220", "713230", "713231", "713232", "713235", "713237", "713238", "713240", "713241", "713242", "713243", "713244", "713245", "713246", "713247", "713248", "713249", "713250", "713251", "713257", "713260", "713130", "713275", "713276", "713900", "713901", "713902", "713903", "713904", "713905", "716005", "716009", "716022", "716023", "716041", "716043", "716048", "716049", "716050", "716053", "716054", "716055", "716057", "716058", "716059", "716060", "716061", "716500", "716501", "716502", "716503", "716504", "716505", "716506", "716507", "716508", "716509", "716510", "716512", "716513", "716515", "716516", "716517", "716518", "716519", "716520", "716521", "716522", "716525", "716526", "716527", "716528", "716600", "716601", "716602", "717001", "717002", "717003", "717004", "717005", "717006", "717007", "717008", "717009", "717010", "717011", "717012", "717013", "717014", "717015", "717016", "717017", "717018", "717019", "717020", "717021", "717022", "717023", "717026", "717027", "717028", "717031", "717033", "717035", "717037", "717039", "717040", "717042", "717043", "717044", "717046", "717047", "717048", "717049", "717054", "717055", "717057", "717058", "717059", "717060", "717061", "717062", "717063", "717064", "720022", "720023", "720024", "720025", "720026", "720027", "720028", "720029", "720030", "720032", "720033", "720035", "720036", "720037", "720038", "720039", "720040", "720043", "720044", "720045", "720046", "720055", "720056", "720057", "720058", "720059", "720060", "720061", "720062", "720063", "720065", "720066", "720067", "720068", "720069", "720070", "720071", "720072", "720073", "721001", "721002", "721003", "721004", "721005", "721006", "721007", "721008", "721009", "721010", "721011", "721012", "721013", "721014", "721015", "718004", "718005", "718006", "718007", "718008", "718037", "718038", "718039", "718040", "718057", "718060", "718061", "718062", "718063", "718064", "718068", "718069", "718070", "718071", "718072", "718073", "718074", "718075", "718085", "718086", "718087", "719001", "719002", "719003", "719004", "719008", "719010", "719011", "719012", "719013", "719014", "719017", "719018", "719019", "719020", "719021", "719022", "719023", "719024", "719025", "719026", "720001", "720002", "720003", "720004", "720005", "720006", "720007", "720008", "720009", "720010", "720011", "720012", "720013", "720014", "720015", "720016", "720017", "720018", "720019", "720020", "720021", "722026", "722027", "722046", "722047", "722048", "722049", "722050", "747004", "748100", "748101", "748102", "748103", "748201", "769001", "769002", "769003", "769004", "769005", "769006", "402131", "403504", "420004", "420005", "502103", "776201", "776202", "776203", "776204", "776303", "776304", "776309", "776310", "776311", "776312", "776313", "802005", "802006", "850001", "850002", "8300002", "8300003", "8300004", "8300005" | STATUS_UPDATE |
| 111010 | SETTING_MODIFICATION |
| "113019", "315011", "611103", "716002", "722012", "722023", "722028" | USER_LOGOUT |
| "113023", "713121", "715036", "715075" | STATUS_HEARTBEAT |
| "113004", "113005", "113010", "113011", "113039", "605005", "605004", "611101", "611102", "716039", "722022", "716040" | USER_LOGIN |
| "111009", "111008", "113003", "113008", "113009", "713130", "725006", "746012", "746013", "746017", "746018", "746019" | USER_UNCATEGORIZED |
| "303002", "303004", "303005" | NETWORK_FTP |
| "746014", "746015" | NETWORK_DNS |
| "604201", "604202", "604203", "604204", "604205", "604206", "604207", "604208" | NETWORK_DHCP |
| The other Cisco message IDs that are not listed in this table are set to GENERIC_EVENT. Also, if a mandatory field is missing for a message ID, it is set to GENERIC_EVENT. | GENERIC_EVENT |