check point ngfw

Expression

product = "check point ngfw"

Fields

Field	Core	Detection	Informational
src_ip	✓	✓
dest_ip	✓	✓
local_user_name
fallback_user_name
src_host		✓
user		✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-login	additional_info	Default			✓
	user_agent	Default			✓
email-receive	interface_name	Default			✓
	rule	Default			✓
	product_name	Default			✓
	dest_translated_ip	Default			✓
	src_port	Default			✓
	src_translated_ip	Default			✓
	rule_id	Default			✓
	protocol	Default			✓
	app_protocol	Default			✓
	action	Default			✓
	dest_translated_port	Default			✓
	dest_host	Default		✓
	src_translated_port	Default			✓
	dest_port	Default			✓
	origin_ip	Default			✓
	origin_name	Default			✓
	direction	Default			✓
email-send	src_interface	Default			✓
	message_id	Default			✓
	direction	Default			✓
endpoint-authentication	user_ou	Default			✓
	os	Default			✓
	bytes_in	Default			✓
	rule	Default			✓
	product_name	Default			✓
	dest_translated_ip	Default			✓
	src_port	Default			✓
	src_translated_ip	Default			✓
	protocol	Default			✓
	bytes_out	Default			✓
	action	Default			✓
	dest_translated_port	Default			✓
	company	Default			✓
	src_translated_port	Default			✓
	department	Default			✓
	dest_port	Default			✓
	origin_ip	Default			✓
	origin_name	Default			✓
	direction	Default			✓
endpoint-login	user_ou	Default			✓
	os	Default			✓
	bytes_in	Default			✓
	rule	Default			✓
	product_name	Default			✓
	dest_translated_ip	Default			✓
	src_port	Default			✓
	src_translated_ip	Default			✓
	protocol	Default			✓
	bytes_out	Default			✓
	additional_info	Default			✓
	process_name	Default			✓
	action	Default			✓
	dest_translated_port	Default			✓
	company	Default			✓
	src_translated_port	Default			✓
	department	Default			✓
	dest_port	Default			✓
	origin_ip	Default			✓
	origin_name	Default			✓
	direction	Default			✓
http-session	os	Default			✓
	service_name	Default			✓
	interface_name	Default			✓
	rule	Default			✓
	product_name	Default			✓
	dest_translated_ip	Default			✓
	rule_id	Default			✓
	src_translated_ip	Default			✓
	protocol	Default			✓
	full_name	Default			✓
	additional_info	Default			✓
	dest_translated_port	Default			✓
	src_translated_port	Default			✓
	origin_ip	Default			✓
	origin_name	Default			✓
	direction	Default			✓
network-session	user_ou	Default			✓
	src_interface	Default			✓
	os	Default			✓
	bytes_in	Default			✓
	alert_severity	Default			✓
	interface_name	Default			✓
	rule	Default			✓
	product_name	Default			✓
	users	Default			✓
	dest_translated_ip	Default			✓
	rule_id	Default			✓
	src_translated_ip	Default			✓
	bytes_out	Default			✓
	app_protocol	Default			✓
	action	Default			✓
	dest_translated_port	Default			✓
	dest_host	Default		✓
	company	Default			✓
	src_translated_port	Default			✓
	department	Default			✓
	origin_ip	Default			✓
	origin_name	Default			✓
	policy	Default			✓
	direction	Default			✓
network-traffic	peer_gateway	Default			✓
	interface_name	Default			✓
	rule	Default			✓
	rule_uid	Default			✓
	dest_translated_ip	Default			✓
	result	Default			✓
	src_translated_ip	Default			✓
	service_id	Default			✓
	app_protocol	Default			✓
	action	Default			✓
	origin_name	Default			✓
	policy	Default			✓
	direction	Default			✓
	inzone	Default			✓
	outzone	Default			✓
	community	Default			✓
	product_name	Default			✓
	users	Default			✓
	rule_id	Default			✓
	additional_info	Default			✓
	log_uid	Default			✓
	dest_translated_port	Default			✓
	dest_host	Default		✓
	src_translated_port	Default			✓
	origin_ip	Default			✓
vpn-login	src_interface	Default			✓
	bytes_in	Default			✓
	alert_severity	Default			✓
	interface_name	Default			✓
	rule	Default			✓
	dest_translated_ip	Default			✓
	src_translated_ip	Default			✓
	protocol	Default			✓
	app_protocol	Default			✓
	action	Default			✓
	company	Default			✓
	department	Default			✓
	dest_port	Default			✓
	origin_name	Default			✓
	tunnel_protocol	Default			✓
	policy	Default			✓
	direction	Default			✓
	user_ou	Default			✓
	os	Default			✓
	product_name	Default			✓
	rule_id	Default			✓
	src_port	Default			✓
	auth_method	Default			✓
	bytes_out	Default			✓
	dest_translated_port	Default			✓
	dest_host	Default		✓
	src_translated_port	Default			✓
	origin_ip	Default			✓
vpn-logout	user_ou				✓
	os			✓
	bytes_in			✓
	rule			✓
	product_name				✓
	dest_translated_ip			✓
	src_port			✓
	src_translated_ip			✓
	protocol			✓
	bytes_out	Legacy		✓
	action			✓
	dest_translated_port			✓
	dest_host	Legacy			✓
	company			✓
	src_translated_port			✓
	department			✓
	dest_port			✓
	origin_ip			✓
	origin_name			✓
	direction			✓