check point security gateway

Expression

product = "check point security gateway"

Fields

Field	Core	Detection	Informational
src_ip		✓
src_translated_ip		✓
src_country_code		✓
dest_ip		✓
action		✓
event_name		✓
src_host		✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
vpn-authentication	auth_method	Default			✓
	os	Default			✓
vpn-login	user_ou	Default			✓
	src_port	Default			✓
	auth_type	Default			✓
	os	Default			✓
	src_translated_ipnum	Default			✓
	realm	Default			✓
	operation	Default			✓
	dest_port	Default			✓
	direction	Default			✓
vpn-logout	user_ou			✓
	dest_host	Legacy			✓
	session_duration	Legacy		✓