{"type":"doc","content":[{"type":"paragraph","content":[{"text":"This page contains the ","type":"text"},{"text":"Hostname Field Extraction","type":"text","marks":[{"type":"strong"}]},{"text":" methods for a number of Log Sources, listed by log source. ","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"},"minLevel":{"value":"2"}},"macroMetadata":{"macroId":{"value":"8e2f8eb5-4b2a-4495-9854-6452b436a401"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"16658a55-c2ce-4193-b943-ed75ba027e85"}},{"type":"paragraph","content":[{"text":"The Armor Log Relay allows customers to forward security logs to Armor from a multitude of available Armor supported log sources. Many of these Log Relay log sources may be forwarding events from multiple event sources and it is important to be able to uniquely identify the originating event source. This facilitates easy searching with Kibana, tagging in Armor's Management Portal (AMP), and enhances the security outcomes provided by Armor.","type":"text"},{"type":"hardBreak"},{"type":"hardBreak"},{"text":"Armor extracts a hostname from each log event as the unique identifier of the event's source. In Kibana, that hostname is mapped to the logsource.hostname field and in the Armor Tags API, it is combined in the resourceId for each tag ID using the convention log-relay-core-instance-id::hostname. Each log source has a specific way of formatting their logs and below is a description of the methodology Armor uses to extract the hostname value from each device type.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"Check-Point"},"legacyAnchorId":{"value":"HostnameFieldExtraction-Check-Point"}},"macroMetadata":{"macroId":{"value":"ef027247a46dfc6b980ff81b0ddd52a4"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"9589c2db-a620-4ca8-a6b8-fd85139764ec"}},{"text":"Check Point","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Armor extracts the hostname by evaluating the following possible field matches, in order:","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extraction method 1:","type":"text"}]},{"type":"paragraph","content":[{"text":"The extraction is done by a key-value pair match on the origin field.","type":"text"}]},{"type":"paragraph","content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelIconId":"atlassian-info","panelIcon":":info:","panelColor":"#DEEBFF","panelType":"custom"},"content":[{"type":"paragraph","content":[{"text":"LEEF:2.0|Check Point|VPN-1 & FireWall-1|1.0|Accept|cat=VPN-1 & FireWall-1 devTime=1580842617 srcPort=64416 layer_name=Rulebase Network layer_name=App Control - URL Filter layer_uuid=0c0c8c0c-1b7f-49b5-9b74-0843569dec02 layer_uuid=51f33b96-a02f-4666-9ae7-644d2ca7e116 match_id=184 match_id=16777227 parent_rule=0 parent_rule=0 rule_action=Accept rule_action=Accept rule_name=LOCK-DOWN rule_name=Cleanup rule rule_uid=d8b4a241-c952-4379-b0d7-c96eec992b46 rule_uid=55c97db7-8303-47ed-bbec-a657de6ed15d action=Accept ifdir=inbound ifname=eth1.1111 logid=0 loguid={0x5e39be79,0x4,0xf13c400a,0xc0000003} ","type":"text"},{"text":"origin=127.0.0.1","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]},{"text":" originsicname=CN\\=EALEDIcp5800fwa,O\\=EALEDICPMGR..i7ngdz sequencenum=24 version=5 dst=8.8.8.8 inzone=Internal outzone=External proto=6 service=443 service_id=https src=192.168.1.1","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Hostname is the ","type":"text"},{"text":"origin","type":"text","marks":[{"type":"code"}]},{"text":" field, so in this sample, the hostname would be ","type":"text"},{"text":"127.0.0.1","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Base Case Extraction Method:","type":"text"}]},{"type":"paragraph","content":[{"text":"The expected extraction fields are not in the log, so the fallback option is ","type":"text"},{"text":"unknown-check-point-","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"LEEF:2.0|Check Point|VPN-1 & FireWall-1|1.0|Accept|cat=VPN-1 & FireWall-1 devTime=1580842617 srcPort=64416 layer_name=Rulebase Network layer_name=App Control - URL Filter layer_uuid=0c0c8c0c-1b7f-49b5-9b74-0843569dec02 layer_uuid=51f33b96-a02f-4666-9ae7-644d2ca7e116 match_id=184 match_id=16777227 parent_rule=0 parent_rule=0 rule_action=Accept rule_action=Accept rule_name=LOCK-DOWN rule_name=Cleanup rule rule_uid=d8b4a241-c952-4379-b0d7-c96eec992b46 rule_uid=55c97db7-8303-47ed-bbec-a657de6ed15d action=Accept ifdir=inbound ifname=eth1.1111 logid=0 loguid={0x5e39be79,0x4,0xf13c400a,0xc0000003} originsicname=CN\\=CN_FIELD,O\\=O_FIELD..i7ngdz sequencenum=24 version=5 dst=8.8.8.8 inzone=Internal outzone=External proto=6 service=443 service_id=https src=192.168.1.1","type":"text"}]}]},{"type":"paragraph","content":[{"text":"If the log originated from ","type":"text"},{"text":"127.0.0.1","type":"text","marks":[{"type":"code"}]},{"text":", then the hostname would be ","type":"text"},{"text":"unknown-check-point-127.0.0.1","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"Cisco-ASA"},"legacyAnchorId":{"value":"HostnameFieldExtraction-Cisco-ASA"}},"macroMetadata":{"macroId":{"value":"c933baa9c317ce4a2df7b0860ba8dfc0"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"2e9326d2-6b5a-431c-8d06-80f3d68d3584"}},{"text":"Cisco ASA","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Armor extracts the hostname by evaluating the following possible field matches, in order:","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extraction Method 1:","type":"text"}]},{"type":"paragraph","content":[{"text":"The extraction is performed by a grok match on the log as follows: ","type":"text"},{"text":"match => {\"message\" => \"<%{NUMBER}>%{CISCOTIMESTAMP} %{WORD:syslog_hostname}\"}","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<179>Feb 3 06:54:54 ","type":"text"},{"text":"cisco-asa-device","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]},{"text":" mysql_log 2020-02-03T14:54:54.250208Z 0 [Warning] InnoDB: Table mysql/innodb_table_stats has length mismatch in the column name table_name. Please run mysql_upgrade","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The hostname is the syslog hostname from the log, so the hostname here would be ","type":"text"},{"text":"cisco-asa-device","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extraction Method 2: ","type":"text"}]},{"type":"paragraph","content":[{"text":"The extraction is performed by a grok match on the log as follows: ","type":"text"},{"text":"match => {\"message\" => \"<%{NUMBER}>%{DATA:syslog_hostname} %%{CISCOTAG}:\"}","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<132>","type":"text"},{"text":"cisco-asa-device","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]},{"text":" %ASA-4-106023: Deny tcp src outside:8.8.8.8/44761 dst eqf:192.168.1.1/28967 by access-group \"outside_access_in\" [0x0, 0x0]","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The hostname is the Cisco header hostname field from the log, so the hostname here would be ","type":"text"},{"text":"cisco-asa-device","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Base Case Extraction Method:","type":"text"}]},{"type":"paragraph","content":[{"text":"The expected fields are not in the log, so the fallback option is ","type":"text"},{"text":"unknown-cisco-asa-","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<132>%ASA-4-106023: Deny tcp src outside:8.8.8.8/44761 dst eqf:192.168.1.1/28967 by access-group \"outside_access_in\" [0x0, 0x0]","type":"text"}]}]},{"type":"paragraph","content":[{"text":"If the log originated from the host ","type":"text"},{"text":"127.0.0.1","type":"text","marks":[{"type":"code"}]},{"text":", then the hostname would be ","type":"text"},{"text":"unknown-cisco-asa-127.0.0.1","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"Cisco-ISR"},"legacyAnchorId":{"value":"HostnameFieldExtraction-Cisco-ISR"}},"macroMetadata":{"macroId":{"value":"c8669b3691b7a425bc15647c08158ec0"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"4dfcc1ad-9d7e-4279-8162-acdd5ecbcd42"}},{"text":"Cisco ISR","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Armor extracts the hostname by evaluating the following possible field matches, in order:","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extraction Method 1:","type":"text"}]},{"type":"paragraph","content":[{"text":"The extraction is performed by a grok match on the log as follows: ","type":"text"},{"text":"match => {\"message\" => \"<%{NUMBER}>%{CISCOTIMESTAMP} %{WORD:syslog_hostname}\"}","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<179>Feb 3 06:54:54 ","type":"text"},{"text":"cisco-isr-device","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]},{"text":" mysql_log 2020-02-03T14:54:54.250208Z 0 [Warning] InnoDB: Table mysql/innodb_table_stats has length mismatch in the column name table_name. Please run mysql_upgrade","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The hostname is the syslog hostname from the log, so the hostname here would be ","type":"text"},{"text":"cisco-isr-device","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extraction Method 2: ","type":"text"}]},{"type":"paragraph","content":[{"text":"The extraction is performed by a grok match on the log as follows: ","type":"text"},{"text":"match => {\"message\" => \"<%{NUMBER}>%{DATA:syslog_hostname} %%{CISCOTAG}:\"}","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<132>","type":"text"},{"text":"cisco-isr-device","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]},{"text":" %ASA-4-106023: Deny tcp src outside:8.8.8.8/44761 dst eqf:192.168.1.1/28967 by access-group \"outside_access_in\" [0x0, 0x0]","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The hostname is the Cisco header hostname field from the log, so the hostname here would be ","type":"text"},{"text":"cisco-isr-device","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Base Case","type":"text","marks":[{"type":"strong"}]},{"text":" Extraction Method:","type":"text"}]},{"type":"paragraph","content":[{"text":"The expected fields are not in the log, so the fallback option is ","type":"text"},{"text":"unknown-cisco-isr-","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<132>%ASA-4-106023: Deny tcp src outside:8.8.8.8/44761 dst eqf:192.168.1.1/28967 by access-group \"outside_access_in\" [0x0, 0x0]","type":"text"}]}]},{"type":"paragraph","content":[{"text":"If the log originated from the host ","type":"text"},{"text":"127.0.0.1","type":"text","marks":[{"type":"code"}]},{"text":", then the hostname would be ","type":"text"},{"text":"unknown-cisco-isr-127.0.0.1","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"Fortinet-Fortigate"},"legacyAnchorId":{"value":"HostnameFieldExtraction-Fortinet-Fortigate"}},"macroMetadata":{"macroId":{"value":"191ef905e4cef48e6abb4a5fb1914d05"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"884bbfa7-a2ca-411c-9645-407a9e646c8d"}},{"text":"Fortinet Fortigate","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Armor extracts the hostname by evaluating the following possible field matches, in order:","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extraction Method 1:","type":"text"}]},{"type":"paragraph","content":[{"text":"The extraction is done by a key-value pair match on the ","type":"text"},{"text":"devname","type":"text","marks":[{"type":"code"}]},{"text":" field.","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<189>date=2020-01-30 time=01:34:53 devname=\"","type":"text"},{"text":"FORT-SAMPLE","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]},{"text":"\" devid=\"ABC1DE2345678901\" logid=\"0000000013\" type=\"traffic\" subtype=\"forward\" level=\"notice\" vd=\"root\" eventtime=1580319293 srcip=192.168.1.1 srcport=32471 srcintf=\"port9\" srcintfrole=\"wan\" dstip=8.8.8.8 dstport=443 dstintf=\"port11\" dstintfrole=\"lan\" poluuid=\"15459248-2e75-51e9-82d7-4fe3d456124a\" sessionid=714923758 proto=6 action=\"server-rst\" policyid=121 policytype=\"policy\" service=\"HTTPS\" dstcountry=\"Canada\" srccountry=\"United States\" trandisp=\"noop\" duration=11 sentbyte=6530 rcvdbyte=45758 sentpkt=76 rcvdpkt=46 appcat=\"unscanned\" wanin=43382 wanout=2570 lanin=2570 lanout=2570","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Hostname is the ","type":"text"},{"text":"devname","type":"text","marks":[{"type":"code"}]},{"text":" field, so in this sample, the hostname would be ","type":"text"},{"text":"FORT-SAMPLE","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extraction Method 2: ","type":"text"}]},{"type":"paragraph","content":[{"text":"The extraction is done by a key-value pair match on the ","type":"text"},{"text":"devid","type":"text","marks":[{"type":"code"}]},{"text":" field.","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<189>date=2020-01-30 time=01:34:53 devid=\"","type":"text"},{"text":"ABC1DE2345678901","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]},{"text":"\" logid=\"0000000013\" type=\"traffic\" subtype=\"forward\" level=\"notice\" vd=\"root\" eventtime=1580319293 srcip=192.168.1.1 srcport=32471 srcintf=\"port9\" srcintfrole=\"wan\" dstip=8.8.8.8 dstport=443 dstintf=\"port11\" dstintfrole=\"lan\" poluuid=\"15459248-2e75-51e9-82d7-4fe3d456124a\" sessionid=714923758 proto=6 action=\"server-rst\" policyid=121 policytype=\"policy\" service=\"HTTPS\" dstcountry=\"Canada\" srccountry=\"United States\" trandisp=\"noop\" duration=11 sentbyte=6530 rcvdbyte=45758 sentpkt=76 rcvdpkt=46 appcat=\"unscanned\" wanin=43382 wanout=2570 lanin=2570 lanout=2570","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Hostname is the ","type":"text"},{"text":"devid","type":"text","marks":[{"type":"code"}]},{"text":" field, so in this sample, the hostname would be ","type":"text"},{"text":"ABC1DE2345678901","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Base case","type":"text","marks":[{"type":"strong"}]},{"text":" extraction method:","type":"text"}]},{"type":"paragraph","content":[{"text":"The expected fields are not in the log, so the fallback option is ","type":"text"},{"text":"unknown-fortigate-security-gateway-","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<189>date=2020-01-30 time=01:34:53 logid=\"0000000013\" type=\"traffic\" subtype=\"forward\" level=\"notice\" vd=\"root\" eventtime=1580319293 srcip=8.8.8.8 srcport=32471 srcintf=\"port9\" srcintfrole=\"wan\" dstip=8.8.8.8 dstport=443 dstintf=\"port11\" dstintfrole=\"lan\" poluuid=\"15459248-2e75-51e9-82d7-4fe3d456124a\" sessionid=714923758 proto=6 action=\"server-rst\" policyid=121 policytype=\"policy\" service=\"HTTPS\" dstcountry=\"Canada\" srccountry=\"United States\" trandisp=\"noop\" duration=11 sentbyte=6530 rcvdbyte=45758 sentpkt=76 rcvdpkt=46 appcat=\"unscanned\" wanin=43382 wanout=2570 lanin=2570 lanout=2570","type":"text"}]}]},{"type":"paragraph","content":[{"text":"If the log originated from the host ","type":"text"},{"text":"127.0.0.1","type":"text","marks":[{"type":"code"}]},{"text":", then the hostname would be ","type":"text"},{"text":"unknown-fortigate-security-gateway-127.0.0.1","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"Juniper-SRX"},"legacyAnchorId":{"value":"HostnameFieldExtraction-Juniper-SRX"}},"macroMetadata":{"macroId":{"value":"b6cb7a8e00eaba775e90992d219f443f"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"1ca25024-f6c6-44c7-bdaa-d3a1277cd7a5"}},{"text":"Juniper SRX","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Armor extracts the hostname by evaluating the following possible field matches, in order:","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extraction Method 1:","type":"text"}]},{"type":"paragraph","content":[{"text":"The extraction is performed by a grok match on the log as follows: ","type":"text"},{"text":"match => {\"message\" => \"%{SYSLOGTIMESTAMP} %{HOSTNAME:syslog_hostname} %{DATA:syslog_program}(?:[%{POSINT:syslog_pid}])?:\"}","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Feb 22 20:35:07 ","type":"text"},{"text":"router1","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]},{"text":" snmpd[359]: SNMPD_THROTTLE_QUEUE_DRAINED: trap_throttle_timer_handler: cleared all throttled traps","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The hostname is the syslog hostname from the log, so the hostname here would be ","type":"text"},{"text":"router1","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Base case","type":"text","marks":[{"type":"strong"}]},{"text":" extraction method:","type":"text"}]},{"type":"paragraph","content":[{"text":"The expected fields are not in the log, so the fallback option is ","type":"text"},{"text":"unknown-juniper-srx-","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"VSRX chassisd 5738 CHASSISD_IFDEV_CREATE_FAILURE [junos@2636.1.1.1.2.129 function-name='create_pics' interface-name='lsq-0/0/0' error-message='Invalid argument'] create_pics: unable to create interface device for lsq-0/0/0 (Invalid argument)","type":"text"}]}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"If the log originated from the host ","type":"text"},{"text":"127.0.0.1","type":"text","marks":[{"type":"code"}]},{"text":", then the hostname would be ","type":"text"},{"text":"unknown-juniper-srx-127.0.0.1","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"Palo-Alto-PanOS"},"legacyAnchorId":{"value":"HostnameFieldExtraction-Palo-Alto-PanOS"}},"macroMetadata":{"macroId":{"value":"519c06ab54ab21dbe72e4867784530b9"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"d7fd2c9b-57b6-467d-b0ab-9c5e3403e6c5"}},{"text":"Palo Alto PanOS","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Armor extracts the hostname by evaluating the following possible field matches, in order:","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extraction Method 1:","type":"text"}]},{"type":"paragraph","content":[{"text":"The extraction is done by a key-value pair match on the ","type":"text"},{"text":"DeviceName","type":"text","marks":[{"type":"code"}]},{"text":" field.","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<14>Dec 12 11:43:52 palodevice LEEF:1.0|Palo Alto Networks|PAN-OS Syslog Integration|8.1.9-h4|allow|cat=TRAFFIC|ReceiveTime=2019/12/12 11:43:52|SerialNumber=123456789123|Type=TRAFFIC|Subtype=start|devTime=Dec 12 2019 16:43:52 GMT|src=192.168.1.3|dst=10.0.2.21|srcPostNAT=8.8.8.8|dstPostNAT=8.8.8.8|RuleName=Inside to Outside|usrName=|SourceUser=|DestinationUser=|Application=paloalto-wildfire-cloud|VirtualSystem=vsys1|SourceZone=inside-zone|DestinationZone=outside-zone|IngressInterface=ethernet1/3|EgressInterface=ethernet1/1|LogForwardingProfile=default|SessionID=57998|RepeatCount=1|srcPort=39936|dstPort=443|srcPostNATPort=34068|dstPostNATPort=443|Flags=0x400000|proto=tcp|action=allow|totalBytes=553|dstBytes=74|srcBytes=479|totalPackets=4|StartTime=2019/12/12 11:43:34|ElapsedTime=0|URLCategory=computer-and-internet-info|sequence=40307562|ActionFlags=0x8000000000000000|SourceLocation=192.168.0.0-192.168.255.255|DestinationLocation=United States|dstPackets=1|srcPackets=3|SessionEndReason=n/a|DeviceGroupHierarchyL1=64|DeviceGroupHierarchyL2=121|DeviceGroupHierarchyL3=144|DeviceGroupHierarchyL4=0|vSrcName=|DeviceName=","type":"text"},{"text":"PANOS-01","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]},{"text":"|ActionSource=from-policy|SrcUUID=|DstUUID=|TunnelID=0|MonitorTag=|ParentSessionID=0|ParentStartTime=|TunnelType=N/A","type":"text"}]}]},{"type":"paragraph","content":[{"text":"In this sample log, ","type":"text"},{"text":"DeviceName=PANOS-01","type":"text","marks":[{"type":"code"}]},{"text":", so ","type":"text"},{"text":"hostname","type":"text","marks":[{"type":"code"}]},{"text":" for this log event would be ","type":"text"},{"text":"PANOS-01","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extraction method 2:","type":"text"}]},{"type":"paragraph","content":[{"text":"The extraction is done by a key-value pair match on the ","type":"text"},{"text":"SerialNumber","type":"text","marks":[{"type":"code"}]},{"text":" field.","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<14>Dec 12 11:43:52 palodevice LEEF:1.0|Palo Alto Networks|PAN-OS Syslog Integration|8.1.9-h4|allow|cat=TRAFFIC|ReceiveTime=2019/12/12 11:43:52|SerialNumber=","type":"text"},{"text":"123456789123","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]},{"text":"|Type=TRAFFIC|Subtype=start|devTime=Dec 12 2019 16:43:52 GMT|src=192.168.1.3|dst=10.0.2.21|srcPostNAT=8.8.8.8|dstPostNAT=8.8.8.8|RuleName=Inside to Outside|usrName=|SourceUser=|DestinationUser=|Application=paloalto-wildfire-cloud|VirtualSystem=vsys1|SourceZone=inside-zone|DestinationZone=outside-zone|IngressInterface=ethernet1/3|EgressInterface=ethernet1/1|LogForwardingProfile=default|SessionID=57998|RepeatCount=1|srcPort=39936|dstPort=443|srcPostNATPort=34068|dstPostNATPort=443|Flags=0x400000|proto=tcp|action=allow|totalBytes=553|dstBytes=74|srcBytes=479|totalPackets=4|StartTime=2019/12/12 11:43:34|ElapsedTime=0|URLCategory=computer-and-internet-info|sequence=40307562|ActionFlags=0x8000000000000000|SourceLocation=192.168.0.0-192.168.255.255|DestinationLocation=United States|dstPackets=1|srcPackets=3|SessionEndReason=n/a|DeviceGroupHierarchyL1=64|DeviceGroupHierarchyL2=121|DeviceGroupHierarchyL3=144|DeviceGroupHierarchyL4=0|vSrcName=|ActionSource=from-policy|SrcUUID=|DstUUID=|TunnelID=0|MonitorTag=|ParentSessionID=0|ParentStartTime=|TunnelType=N/A","type":"text"}]}]},{"type":"paragraph","content":[{"text":"In this sample log, `SerialNumber=123456789123`, so ","type":"text"},{"text":"hostname","type":"text","marks":[{"type":"code"}]},{"text":" for this log event would be ","type":"text"},{"text":"123456789123","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extraction Method 3:","type":"text"}]},{"type":"paragraph","content":[{"text":"The extraction is performed by a grok match on the log as follows: ","type":"text"},{"text":"match => {\"message\" => \"%{SYSLOGTIMESTAMP} %{SYSLOGHOST:hostname}\"}","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<14>Dec 12 11:43:52 ","type":"text"},{"text":"palodevice","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]},{"text":" LEEF:1.0|Palo Alto Networks|PAN-OS Syslog Integration|8.1.9-h4|allow|cat=TRAFFIC|ReceiveTime=2019/12/12 11:43:52|Type=TRAFFIC|Subtype=start|devTime=Dec 12 2019 16:43:52 GMT|src=192.168.1.3|dst=10.0.2.21|srcPostNAT=8.8.8.8|dstPostNAT=8.8.8.8|RuleName=Inside to Outside|usrName=|SourceUser=|DestinationUser=|Application=paloalto-wildfire-cloud|VirtualSystem=vsys1|SourceZone=inside-zone|DestinationZone=outside-zone|IngressInterface=ethernet1/3|EgressInterface=ethernet1/1|LogForwardingProfile=default|SessionID=57998|RepeatCount=1|srcPort=39936|dstPort=443|srcPostNATPort=34068|dstPostNATPort=443|Flags=0x400000|proto=tcp|action=allow|totalBytes=553|dstBytes=74|srcBytes=479|totalPackets=4|StartTime=2019/12/12 11:43:34|ElapsedTime=0|URLCategory=computer-and-internet-info|sequence=40307562|ActionFlags=0x8000000000000000|SourceLocation=192.168.0.0-192.168.255.255|DestinationLocation=United States|dstPackets=1|srcPackets=3|SessionEndReason=n/a|DeviceGroupHierarchyL1=64|DeviceGroupHierarchyL2=121|DeviceGroupHierarchyL3=144|DeviceGroupHierarchyL4=0|vSrcName=|ActionSource=from-policy|SrcUUID=|DstUUID=|TunnelID=0|MonitorTag=|ParentSessionID=0|ParentStartTime=|TunnelType=N/A","type":"text"}]}]},{"type":"paragraph","content":[{"text":"In this sample log, ","type":"text"},{"text":"palodevice","type":"text","marks":[{"type":"code"}]},{"text":" is the syslog hostname, so ","type":"text"},{"text":"hostname","type":"text","marks":[{"type":"code"}]},{"text":" for this log event would be ","type":"text"},{"text":"palodevice","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text","marks":[{"type":"strong"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Base Case Extraction Method:","type":"text"}]},{"type":"paragraph","content":[{"text":"The expected extraction fields are not in the log, so the fallback option is ","type":"text"},{"text":"unknown-palo-alto-firewall-","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<14>Dec 12 11:43:52 LEEF:1.0|Palo Alto Networks|PAN-OS Syslog Integration|8.1.9-h4|allow|cat=TRAFFIC|ReceiveTime=2019/12/12 11:43:52|Type=TRAFFIC|Subtype=start|devTime=Dec 12 2019 16:43:52 GMT|src=192.168.1.3|dst=10.0.2.21|srcPostNAT=8.8.8.8|dstPostNAT=8.8.8.8|RuleName=Inside to Outside|usrName=|SourceUser=|DestinationUser=|Application=paloalto-wildfire-cloud|VirtualSystem=vsys1|SourceZone=inside-zone|DestinationZone=outside-zone|IngressInterface=ethernet1/3|EgressInterface=ethernet1/1|LogForwardingProfile=default|SessionID=57998|RepeatCount=1|srcPort=39936|dstPort=443|srcPostNATPort=34068|dstPostNATPort=443|Flags=0x400000|proto=tcp|action=allow|totalBytes=553|dstBytes=74|srcBytes=479|totalPackets=4|StartTime=2019/12/12 11:43:34|ElapsedTime=0|URLCategory=computer-and-internet-info|sequence=40307562|ActionFlags=0x8000000000000000|SourceLocation=192.168.0.0-192.168.255.255|DestinationLocation=United States|dstPackets=1|srcPackets=3|SessionEndReason=n/a|DeviceGroupHierarchyL1=64|DeviceGroupHierarchyL2=121|DeviceGroupHierarchyL3=144|DeviceGroupHierarchyL4=0|vSrcName=|ActionSource=from-policy|SrcUUID=|DstUUID=|TunnelID=0|MonitorTag=|ParentSessionID=0|ParentStartTime=|TunnelType=N/A","type":"text"}]}]},{"type":"paragraph","content":[{"text":"If the log originated from ","type":"text"},{"text":"192.168.1.3","type":"text","marks":[{"type":"code"}]},{"text":", then the hostname would be ","type":"text"},{"text":"unknown-palo-alto-firewall-192.168.1.3","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"Sonicwall"},"legacyAnchorId":{"value":"HostnameFieldExtraction-Sonicwall"}},"macroMetadata":{"macroId":{"value":"472ac5e0-cf2b-461f-8c8c-fb70961a1a7a"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"d5e38f09-bb3a-442a-9475-ab44074078b8"}},{"text":"Sonicwall","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Armor extracts the hostname by evaluating the following possible field matches, in order:","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extraction method 1:","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"The extraction is done by a key-value pair match on the ","type":"text"},{"text":"sn","type":"text","marks":[{"type":"code"}]},{"text":" field.","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<134> id=firewall sn=","type":"text"},{"text":"1234567891A1","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]},{"text":" time=\"2019-11-06 15:22:44\" fw=4.4.4.4 pri=6 c=512 m=602 msg=\"DNS packet allowed\" app=2 n=110037 src=8.8.8.8:53:X1 dst=8.8.8.8:36780:X1 srcMac=02:c2:ea:7f:6f:07 dstMac=02:80:85:81:68:12 proto=udp/dns fw_action=\"forward\"","type":"text"}]}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"The event's ","type":"text"},{"text":"hostname","type":"text","marks":[{"type":"code"}]},{"text":" is extracted from the ","type":"text"},{"text":"sn","type":"text","marks":[{"type":"code"}]},{"text":" field in the log event. In this sample log, ","type":"text"},{"text":"sn=1234567891A1","type":"text","marks":[{"type":"code"}]},{"text":", so ","type":"text"},{"text":"hostname","type":"text","marks":[{"type":"code"}]},{"text":" for this log event would be ","type":"text"},{"text":"1234567891A1","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text","marks":[{"type":"strong"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extraction method 2:","type":"text"}]},{"type":"paragraph","content":[{"text":"The extraction is done by a key-value pair match on the ","type":"text"},{"text":"fw","type":"text","marks":[{"type":"code"}]},{"text":" field.","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":" ","type":"text"},{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<134> id=firewall time=\"2019-11-06 15:22:44\" fw=","type":"text"},{"text":"4.4.4.4","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]},{"text":" pri=6 c=512 m=602 msg=\"DNS packet allowed\" app=2 n=110037 src=8.8.8.8:53:X1 dst=8.8.8.8:36780:X1 srcMac=02:c2:ea:7f:6f:07 dstMac=02:80:85:81:68:12 proto=udp/dns fw_action=\"forward\"","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The event's ","type":"text"},{"text":"hostname","type":"text","marks":[{"type":"code"}]},{"text":" is extracted from the ","type":"text"},{"text":"fw","type":"text","marks":[{"type":"code"}]},{"text":" field in the log event. In this sample log, ","type":"text"},{"text":"fw=4.4.4.4","type":"text","marks":[{"type":"code"}]},{"text":", so ","type":"text"},{"text":"hostname","type":"text","marks":[{"type":"code"}]},{"text":" for this log event would be ","type":"text"},{"text":"4.4.4.4","type":"text","marks":[{"type":"code"}]},{"text":". ","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Base Case Extraction Method:","type":"text"}]},{"type":"paragraph","content":[{"text":"The expected extraction fields are not in the log, so the fallback option is ","type":"text"},{"text":"unknown-sonicwall-","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"<134> id=firewall time=\"2019-11-06 15:22:44\" pri=6 c=512 m=602 msg=\"DNS packet allowed\" app=2 n=110037 src=4.4.4.4:53:X1 dst=8.8.8.8:36780:X1 srcMac=02:c2:ea:7f:6f:07 dstMac=02:80:85:81:68:12 proto=udp/dns fw_action=\"forward\"","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The expected extraction fields are not in the log, so the fallback option is ","type":"text"},{"text":"unknown-sonicwall-","type":"text","marks":[{"type":"code"}]},{"text":". If the log originated from 4.4.4.4, then the ","type":"text"},{"text":"hostname","type":"text","marks":[{"type":"code"}]},{"text":" would be ","type":"text"},{"text":"4.4.4.4","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"AWS-WAF"},"legacyAnchorId":{"value":"HostnameFieldExtraction-AWS-WAF"}},"macroMetadata":{"macroId":{"value":"bbab7209525c9a37ef48060110737107"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"ca5bb48d-01c0-424a-b26d-3d5ad08542f0"}},{"text":"AWS WAF","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Armor extracts the hostname by evaluating the following possible field matches, in order:","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Extraction Method 1:","type":"text"}]},{"type":"paragraph","content":[{"text":"The extraction is performed by a grok match on the log as follows: ","type":"text"},{"text":"match => {\"webaclId\" => \".+webacl/(?[^/]+)\"}","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"{","type":"text"},{"text":"\"timestamp\"","type":"text","marks":[{"type":"em"}]},{"text":":1580760260344,","type":"text"},{"text":"\"formatVersion\"","type":"text","marks":[{"type":"em"}]},{"text":":1,","type":"text"},{"text":"\"webaclId\"","type":"text","marks":[{"type":"em"}]},{"text":":\"arn:aws:wafv2:us-west-2:123456789012:regional/webacl/","type":"text"},{"text":"sample-web-acl","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]},{"text":"/web-acl-id\",","type":"text"},{"text":"\"terminatingRuleId\"","type":"text","marks":[{"type":"em"}]},{"text":":\"Default_Action\",","type":"text"},{"text":"\"terminatingRuleType\"","type":"text","marks":[{"type":"em"}]},{"text":":\"REGULAR\",","type":"text"},{"text":"\"action\"","type":"text","marks":[{"type":"em"}]},{"text":":\"ALLOW\",","type":"text"},{"text":"\"terminatingRuleMatchDetails\"","type":"text","marks":[{"type":"em"}]},{"text":":[],","type":"text"},{"text":"\"httpSourceName\"","type":"text","marks":[{"type":"em"}]},{"text":":\"ALB\",","type":"text"},{"text":"\"httpSourceId\"","type":"text","marks":[{"type":"em"}]},{"text":":\"123456789012-app/sample-web-acl-alb/ab123cd4ef56789g\",","type":"text"},{"text":"\"ruleGroupList\"","type":"text","marks":[{"type":"em"}]},{"text":":[{","type":"text"},{"text":"\"ruleGroupId\"","type":"text","marks":[{"type":"em"}]},{"text":":\"AWS#AWSManagedRulesAmazonIpReputationList\",","type":"text"},{"text":"\"terminatingRule\"","type":"text","marks":[{"type":"em"}]},{"text":":null,","type":"text"},{"text":"\"nonTerminatingMatchingRules\"","type":"text","marks":[{"type":"em"}]},{"text":":[],","type":"text"},{"text":"\"excludedRules\"","type":"text","marks":[{"type":"em"}]},{"text":":null}],","type":"text"},{"text":"\"rateBasedRuleList\"","type":"text","marks":[{"type":"em"}]},{"text":":[],","type":"text"},{"text":"\"nonTerminatingMatchingRules\"","type":"text","marks":[{"type":"em"}]},{"text":":[],","type":"text"},{"text":"\"httpRequest\"","type":"text","marks":[{"type":"em"}]},{"text":":{","type":"text"},{"text":"\"clientIp\"","type":"text","marks":[{"type":"em"}]},{"text":":\"8.8.8.8\",","type":"text"},{"text":"\"country\"","type":"text","marks":[{"type":"em"}]},{"text":":\"US\",","type":"text"},{"text":"\"headers\"","type":"text","marks":[{"type":"em"}]},{"text":":[{","type":"text"},{"text":"\"name\"","type":"text","marks":[{"type":"em"}]},{"text":":\"Host\",","type":"text"},{"text":"\"value\"","type":"text","marks":[{"type":"em"}]},{"text":":\"","type":"text"},{"text":"sample-web-acl-alb-123456789012.us-west-2.elb.amazonaws.com","type":"text","marks":[{"type":"link","attrs":{"href":"http://sample-web-acl-alb-123456789012.us-west-2.elb.amazonaws.com/"}}]},{"text":"\"},{","type":"text"},{"text":"\"name\"","type":"text","marks":[{"type":"em"}]},{"text":":\"User-Agent\",","type":"text"},{"text":"\"value\"","type":"text","marks":[{"type":"em"}]},{"text":":\"curl/7.64.1\"},{","type":"text"},{"text":"\"name\"","type":"text","marks":[{"type":"em"}]},{"text":":\"Accept\",","type":"text"},{"text":"\"value\"","type":"text","marks":[{"type":"em"}]},{"text":":\"*/*\"}],","type":"text"},{"text":"\"uri\"","type":"text","marks":[{"type":"em"}]},{"text":":\"/\",","type":"text"},{"text":"\"args\"","type":"text","marks":[{"type":"em"}]},{"text":":\"=php.admin\",","type":"text"},{"text":"\"httpVersion\"","type":"text","marks":[{"type":"em"}]},{"text":":\"HTTP/1.1\",","type":"text"},{"text":"\"httpMethod\"","type":"text","marks":[{"type":"em"}]},{"text":":\"GET\",","type":"text"},{"text":"\"requestId\"","type":"text","marks":[{"type":"em"}]},{"text":":null}}","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The event's ","type":"text"},{"text":"hostname","type":"text","marks":[{"type":"code"}]},{"text":" is extracted and manipulated from the webaclId field with the following regular expression pattern: ","type":"text"},{"text":".+webacl\\/([^\\/]+)","type":"text","marks":[{"type":"code"}]},{"text":". In this sample log, ","type":"text"},{"text":"hostname","type":"text","marks":[{"type":"code"}]},{"text":" would be ","type":"text"},{"text":"sample-web-acl","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Base Case Extraction Method:","type":"text"}]},{"type":"paragraph","content":[{"text":"The expected fields are not in the log, so the fallback option is ","type":"text"},{"text":"unknown-aws-waf-","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Sample Log","type":"text","marks":[{"type":"underline"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"{","type":"text"},{"text":"\"timestamp\"","type":"text","marks":[{"type":"em"}]},{"text":":1580760260344,","type":"text"},{"text":"\"formatVersion\"","type":"text","marks":[{"type":"em"}]},{"text":":1,","type":"text"},{"text":"\"terminatingRuleId\"","type":"text","marks":[{"type":"em"}]},{"text":":\"Default_Action\",","type":"text"},{"text":"\"terminatingRuleType\"","type":"text","marks":[{"type":"em"}]},{"text":":\"REGULAR\",","type":"text"},{"text":"\"action\"","type":"text","marks":[{"type":"em"}]},{"text":":\"ALLOW\",","type":"text"},{"text":"\"terminatingRuleMatchDetails\"","type":"text","marks":[{"type":"em"}]},{"text":":[],","type":"text"},{"text":"\"httpSourceName\"","type":"text","marks":[{"type":"em"}]},{"text":":\"ALB\",","type":"text"},{"text":"\"httpSourceId\"","type":"text","marks":[{"type":"em"}]},{"text":":\"123456789012-app/sample-web-acl-alb/ab123cd4ef56789g\",","type":"text"},{"text":"\"ruleGroupList\"","type":"text","marks":[{"type":"em"}]},{"text":":[{","type":"text"},{"text":"\"ruleGroupId\"","type":"text","marks":[{"type":"em"}]},{"text":":\"AWS#AWSManagedRulesAmazonIpReputationList\",","type":"text"},{"text":"\"terminatingRule\"","type":"text","marks":[{"type":"em"}]},{"text":":null,","type":"text"},{"text":"\"nonTerminatingMatchingRules\"","type":"text","marks":[{"type":"em"}]},{"text":":[],","type":"text"},{"text":"\"excludedRules\"","type":"text","marks":[{"type":"em"}]},{"text":":null}],","type":"text"},{"text":"\"rateBasedRuleList\"","type":"text","marks":[{"type":"em"}]},{"text":":[],","type":"text"},{"text":"\"nonTerminatingMatchingRules\"","type":"text","marks":[{"type":"em"}]},{"text":":[],","type":"text"},{"text":"\"httpRequest\"","type":"text","marks":[{"type":"em"}]},{"text":":{","type":"text"},{"text":"\"clientIp\"","type":"text","marks":[{"type":"em"}]},{"text":":\"8.8.8.8\",","type":"text"},{"text":"\"country\"","type":"text","marks":[{"type":"em"}]},{"text":":\"US\",","type":"text"},{"text":"\"headers\"","type":"text","marks":[{"type":"em"}]},{"text":":[{","type":"text"},{"text":"\"name\"","type":"text","marks":[{"type":"em"}]},{"text":":\"Host\",","type":"text"},{"text":"\"value\"","type":"text","marks":[{"type":"em"}]},{"text":":\"","type":"text"},{"text":"sample-web-acl-alb-123456789012.us-west-2.elb.amazonaws.com","type":"text","marks":[{"type":"link","attrs":{"href":"http://sample-web-acl-alb-123456789012.us-west-2.elb.amazonaws.com/"}}]},{"text":"\"},{","type":"text"},{"text":"\"name\"","type":"text","marks":[{"type":"em"}]},{"text":":\"User-Agent\",","type":"text"},{"text":"\"value\"","type":"text","marks":[{"type":"em"}]},{"text":":\"curl/7.64.1\"},{","type":"text"},{"text":"\"name\"","type":"text","marks":[{"type":"em"}]},{"text":":\"Accept\",","type":"text"},{"text":"\"value\"","type":"text","marks":[{"type":"em"}]},{"text":":\"*/*\"}],","type":"text"},{"text":"\"uri\"","type":"text","marks":[{"type":"em"}]},{"text":":\"/\",","type":"text"},{"text":"\"args\"","type":"text","marks":[{"type":"em"}]},{"text":":\"=php.admin\",","type":"text"},{"text":"\"httpVersion\"","type":"text","marks":[{"type":"em"}]},{"text":":\"HTTP/1.1\",","type":"text"},{"text":"\"httpMethod\"","type":"text","marks":[{"type":"em"}]},{"text":":\"GET\",","type":"text"},{"text":"\"requestId\"","type":"text","marks":[{"type":"em"}]},{"text":":null}}","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The expected extraction fields are not in the log, so the fallback option is ","type":"text"},{"text":"unknown-aws-waf-","type":"text","marks":[{"type":"code"}]},{"text":". If the log originated from 8.8.8.8, then the ","type":"text"},{"text":"hostname","type":"text","marks":[{"type":"code"}]},{"text":" would be ","type":"text"},{"text":"8.8.8.8","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"Imperva-Incapsula"},"legacyAnchorId":{"value":"HostnameFieldExtraction-Imperva-Incapsula"}},"macroMetadata":{"macroId":{"value":"67a56b5286729d94695a17978c6d4032"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"d261db39-ef12-4b86-adc1-8ca9701208ca"}},{"text":"Imperva Incapsula","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"The hostname for Imperva Incapsula log events is determined by ","type":"text"},{"text":"the name of the S3 bucket","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.armor.com/display/KBSS/Create+a+Remote+Log+Source+-+Imperva+Incapsula#CreateaRemoteLogSource-ImpervaIncapsula-ImportImpervaIncapsulaLogsfromS3"}}]},{"text":" defined as the environment variable ","type":"text"},{"text":"bucket_name","type":"text","marks":[{"type":"code"}]},{"text":" in the ","type":"text"},{"text":"/opt/armor/log-relay/conf.d/..env","type":"text","marks":[{"type":"code"}]},{"text":" file on the Log Relay server.","type":"text"}]},{"type":"paragraph","content":[{"text":"If bucket_name was ","type":"text"},{"text":"example-bucket-name","type":"text","marks":[{"type":"code"}]},{"text":", the hostname would be ","type":"text"},{"text":"example-bucket-name","type":"text","marks":[{"type":"code"}]},{"text":". Be sure that only one Imperva Incapsula device feeds into one S3 bucket, or multiple devices will report under the same hostname.","type":"text"}]}],"version":1}

Browser not supported