Views:

Contains information pertaining to the event that caused a POLICY to trigger.
  • When an ACTIONSET is applied to a POLICY and it has a Management Console notification selected, it is put in the ALERTS table.
  • The primary key, a unique key, is a four column index, DEVICE_ID, ALERT_TYPE_ID, SEQUENCE_NUM, and END_TIME.
  • The table is expected to have a continuous growth pattern and contain millions of records.

Definition

dbAccess/tptDBServlet?method=GetData&table=ALERTS

Parameters

Column Description
SEQUENCE_NUM Reference to a particular logs row entry counter.
  • The ALERT_TYPE column defines the log being referenced.
  • This sequence number is not reliable as far as counting on it behaving as an ever increasing sequential number. It can be reset on the device and repeated for new events.
DEVICE_ID Identifier for the DEVICE entry that sent the notification.
  • Second part of the ALERTS table unique index.
  • A foreign key to the DEVICE table was left off for the purpose of performance and due to the possibility that a DEVICE entry may not have been yet stored in the DEVICE table for this external database.
ALERT_TYPE_ID The TYPE column is the third and final primary key constraint on the ALERTS table.
  • This field can be joined to the ALERT_TYPE table for a descriptive name for this column.
POLICY_ID Identifier used to map this alert to a POLICY table entry.
SIGNATURE_ID Identifier used to map this alert to a SIGNATURE table entry.
BEGIN_TIME Time at which the event was first started or previously logged.
  • Value is in milliseconds elapsed since Jan. 1, 1970 00:00:00 GMT
  • When using notification aggregation, this value and the END_TIME typically are off by the number of minutes specified in the aggregation setting.
  • The difference between BEGIN_TIME and END_TIME may be larger if a lot of time passes between attack events.
  • When aggregation is turned off, the BEGIN_TIME usually is the same as the END_TIME.
END_TIME Time at which the notification was logged and sent to the Management Console.
  • Value is in milliseconds elapsed since Jan. 1, 1970 00:00:00 GMT
  • Subtract BEGIN_TIME from END_TIME to determine the length of an attack, if aggregation is being used.
  • Difference between BEGIN_TIME and END_TIME might be unexpectedly large if a lot of time passes between attack events.
HIT_COUNT Counter displaying the number of times the event triggered before the notification was sent to the Management Console.
SRC_IP_ADDR Source IP of the packet causing the notification. Numeric value of an IPv4 address, or the low-order 64 bits for an IPv6 address if SRC_IP_ADDR_HIGH is not NULL.
SRC_IP_ADDR_HIGH Source IP of the packet causing the notification. Numeric value of high-order 64 bits for an IPv6 address.
SRC_PORT Source port of the packet causing the notification.
DST_IP_ADDR Destination IP of the packet causing the notification. Numeric value of an IPv4 address, or the low-order 64 bits for an IPv6 address if DST_IP_ADDR_HIGH is not NULL.
DST_IP_ADDR_HIGH Destination IP of the packet causing the notification. Numeric value of high-order 64 bits for an IPv6 address.
DST_PORT Destination port of the packet causing the notification.
VIRTUAL_SEGMENT_INDEX Identifier for which device segment this alert was seen on.
PHYSICAL_PORT_IN Device port on which the event was detected.
VLAN_TAG VLAN identifier contained in the event.
SEVERITY SEVERITY of the event. Usually corresponds to the SIGNATURE.SEVERITY column, joined by the SIGNATURE_ID column. A foreign key constraint to the SEVERITY table has been applied here.
PACKET_TRACE Indicates if a packet trace is available on the device.
DEVICE_TRACE_BUCKET Part of the device packet trace identifier.
DEVICE_TRACE_BEGIN_SEQ Part of the device packet trace identifier.
DEVICE_TRACE_END_SEQ Part of the device packet trace identifier.
MESSAGE_PARMS Variable list of message parameters.
  • Value can be tokenized and combined with the SIGNATURE.MESSAGE data to display a dynamic ALERT message.
  • Join SIGNATURE_ID with SIGNATURE.ID to retrieve the SIGNATURE.MESSAGE data. The MESSAGE_PARMS string is a delimited string, the delimiter is the “|” character.
  • The SIGNATURE.MESSAGE string contains place holders for these strings, the place holders are %1, %2, ..., %n.
  • The tokenized MESSAGE_PARMS replaces the %n values based on their location in the string.
Example
MESSAGE_PARMS=Austin|Texas SIGNATURE.MESSAGE=%1 is in %2.
The preceding parameters and message generates the following message:
Austin is in Texas.
QUARANTINE_ACTION Quarantine action taken, either Added or Removed; used only in quarantine logs.
FLOW_CONTROL Action taken by the action set: Permit, Rate Limit, or Trust.
ACTION_SET_UUID Action set UUID; used only in rate limit logs.
ACTION_SET_NAME Rate limit action; used only in rate limit logs.
RATE_LIMIT_RATE Rate for rate limit logs; a numerical value followed by a unit. The unit can be Kbps or Mbps.
CLIENT_IP_ADDR Long value of the Client IP address (Capture Additional Event Information must be enabled).
CLIENT_IP_ADDR_HIGH Long value of the Client IP address (Capture Additional Event Information must be enabled). For IPV6 only.
XFF_IP_ADDR Long value of the X-Forwarded-For IP address (Capture Additional Event Information must be enabled).
XFF_IP_ADDR_HIGH Long value of the X-Forwarded-For IP address (Capture Additional Event Information must be enabled). For IPV6 only.
TCIP_IP_ADDR Long value of the True-Client-IP address (Capture Additional Event Information must be enabled).
TCIP_IP_ADDR_HIGH Long value of the True-Client-IP address (Capture Additional Event Information must be enabled). For IPV6 only.
URI_METHOD Method of the URI.
URI_HOST Host of the URI.
URI_STRING URI string.
SRC_USER_NAME User name on the source machine.
  • User ID IP Correlation must be configured on the SMS to retrieve this information.
  • User ID IP Correlation is a feature that enables the SMS to collect user authentication data directly and continuously from an Identity Agent device.
SRC_DOMAIN Name of the source domain.
SRC_MACHINE Name of the source machine.
DST_USER_NAME User name on the destination machine.
DST_DOMAIN Name of the destination domain
DST_MACHINE Name of the destination machine.