Symantec™ Security Gateways Reference Guide - Sawmill

Log messagesNotice messages (200-299)175290 - Intrusion Event detectedDescription: An intrusion event is detected and all suspicious packets from the rogue host are dropped. The log messageprovides information on the type of intrusion event and includes parameters that elaborate on the event.One of these parameters is a hyperlink that provides more information on the event. The parameters arelisted below:Policy TagVendorClassFamilyA string identifying the type of event.This is currently Symantec.Currently all trackable events are of one sensor class “sniffer.”The family to which the event belongs.The Legal Values are listed below:“integrity” Indicates a protocol anomaly event.“availability”“notice”Context dataContext descriptionFlow CookieIP ProtocolLevelReliabilityPayloadPayload offsetStart timeEnd timeSource IPSource PortDestination IPDestination PortPacketInterfaceSource MACDestination MACVLAN IDOutcomeIndicates a counter alert event.Indicates a trackable event.Context specific data about the connection event.Textual description of the data, a given state machine adds to the context data buffer.A string that pseudo uniquely identifies the network flow where the event occurs.This is a conglomerate of the protocol, IPs and ports on both ends of the connection.The transport layer protocol on which the event was detected.A number between 0 and 255, which represents how severe the event is.A number between 0 and 255, which represents how reliable the event is.The exact snippet of data that generated the event. This may be empty for somealerts.The number of bytes into the payload data when the alerting pattern starts. Thisvalue is zero-indexed and is left/right inclusive.The starting time of the event.The end time of the event.The source IP address of the attack. This is also used when blacklist notifications areconfigured.The level four network of the source of the attack traffic.The destination IP address of the attack.The level four network of the destination of the attack traffic.The whole or partial IP packet triggering the event.The string identifying the device, on which the packet was captured.The source Ethernet address of the offending packet.The destination Ethernet address of the offending packet.The virtual local area network (VLAN) ID from the Ethernet header of the offendingpacket.Currently set to unknown