Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 18: Monitoring
Viewing IPS attack and system event summaries
524
Figure 219: Audit
Record window
About the Audit
Record window
When you double-click an audit event in the table, the detailed audit
information for that attack appears in a pop-up window. The displayed fields
vary, depending on the audit type. In general, the data in an audit message is a
tag name followed by a colon and the tag’s value. The following table provides
examples and descriptions of fields that may appear in an audit record.
More information on audit fields is available using acat -c |more at a
command line interface and in the Sidewinder Export Format application note
at www.securecomputing.com/goto/appnotes.
Table 32: Audit data field examples
Tag Description
facility The event facility code for the event that audited the message,
such as the kernel or FTP
area The area in the facility that audited the message, such as
a_nil_area or a_proxylib
type The event type code, such as t_attack
category The event category code, such as c_policy_violation
priority The event priority, such as p_major
*id IDs that may appear include the process ID (pid), the real user
ID (ruid), the effective user ID (euid), the process family ID (fid)
and login ID (logid)
srcservice/
destservice
srcburb/
destburb
The source or destination service name (/etc/services)
The source or destination burb number
reason The reason the Sidewinder G2 generated an audit record