Views:
Contains information pertaining to logs where traffic has been permitted by firewall rules that have logging enabled, including packets that were permitted by the content filtering configuration.

Definition

dbAccess/tptDBServlet?method=GetData&table=FIREWALL_BLOCK_ALERTS

Parameters

Column Description
SEQUENCE_NUM Reference to a particular logs row entry counter.
DEVICE_ID Identifier for the DEVICE entry that sent the notification.
BEGIN_TIME Time in which the event was first started.
  • When using notification aggregation, this value and the TIME_END typically are off by the number of minutes specified in the aggregation setting.
  • When aggregation is turned off, the BEGIN_TIME usually is the same as the TIME_END. This value is in milliseconds since Jan. 1, 1970 00:00:00 GMT.
END_TIME Time in which the notification was sent to the Management Console.
  • Subtracting BEGIN_TIME from TIME_END can determine the length of an attack if aggregation is being used.
  • This value is in milliseconds since Jan. 1, 1970 00:00:00 GMT
HIT_COUNT Number of times the firewall rule was applied.
SRC_IP_ADDR Source IP of the packet causing the notification.
SRC_PORT Source port of the packet causing the notification.
DST_IP_ADDR Destination IP of the packet causing the notification.
DST_PORT Destination port of the packet causing the notification.
RULE_ID Unique identifier for rule to monitor traffic between security zones.
PROTOCOL_NAME Packet type.
PROTOCOL_NUMBER Number associated with the protocol in the filter.
PROTOCOL_TYPE Protocol that was used to respond to the event.
IN_ZONE_UUID Security zone from which the attack originated.
OUT_ZONE_UUID Security zone from which the attack was targeted.
PHYSICAL_PORT_IN Device port on which the attack was detected.
VLAN Local VLAN that was targeted.
CATEGORY Type of traffic filter that was activated.
URL URL associated with the attack.
URL_INFO Additional information relevant to the URL.
SEVERITY_ID Severity of the attack.