sonicwall

Expression

product = "sonicwall"

Fields

Field	Core	Detection	Informational
src_interface			✓
protocol			✓
bytes_out			✓
dest_interface			✓
bytes_in			✓
bytes			✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
endpoint-login	src_ip	Default		✓
	src_port	Default			✓
	login_type_text	Default			✓
	dest_ip	Default		✓
	realm	Default			✓
	src_host	Default		✓
	session_duration	Default			✓
	dest_port	Default			✓
	user_agent	Default			✓
http-session	src_mac	Default			✓
	category_id	Default			✓
	additional_info	Default			✓
	dest_mac	Default			✓
	firewall	Default			✓
	rule	Default			✓
	message_id	Default			✓
vpn-login	src_port	Default			✓
	src_translated_ip	Default			✓
	dest_ip	Default		✓
	dest_host	Default		✓
	realm	Default			✓
	src_host	Default		✓
	dest_port	Default			✓
	user_agent	Default			✓
	session_duration	Default			✓
vpn-logout	src_translated_ip
	src_port
	dest_ip
	dest_host	Legacy			✓
	realm	Legacy			✓
	src_host
	session_duration	Legacy		✓
	dest_port
	user_agent