Type to search.

Sophos fields

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

sophos Module

sophos.xg

Stack Beta

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Beta

    This functionality is in beta and is not ready for production usage. For beta features, the design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. Specific Support terms apply.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Module for parsing sophosxg syslog.

sophos.xg.action

Event Action

type: keyword

sophos.xg.activityname

Web policy activity that matched and caused the policy result.

type: keyword

sophos.xg.ap

Access Point Serial ID or LocalWifi0 or LocalWifi1.

type: keyword

sophos.xg.app_category

Name of the category under which application falls

type: keyword

sophos.xg.app_filter_policy_id

Application filter policy ID applied on the traffic

type: keyword

sophos.xg.app_is_cloud

Application is Cloud

type: keyword

sophos.xg.app_name

Application name

type: keyword

sophos.xg.app_resolved_by

Application is resolved by signature or synchronized application

type: keyword

sophos.xg.app_risk

Risk level assigned to the application

type: keyword

sophos.xg.app_technology

Technology of the application

type: keyword

sophos.xg.appfilter_policy_id

Application Filter policy applied on the traffic

type: integer

sophos.xg.application

Application name

type: keyword

sophos.xg.application_category

Application is resolved by signature or synchronized application

type: keyword

sophos.xg.application_filter_policy

Application Filter policy applied on the traffic

type: integer

sophos.xg.application_name

Application name

type: keyword

sophos.xg.application_risk

Risk level assigned to the application

type: keyword

sophos.xg.application_technology

Technology of the application

type: keyword

sophos.xg.appresolvedby

Technology of the application

type: keyword

sophos.xg.auth_client

Auth Client

type: keyword

sophos.xg.auth_mechanism

Auth mechanism

type: keyword

sophos.xg.av_policy_name

Malware scanning policy name which is applied on the traffic

type: keyword

sophos.xg.backup_mode

Backup mode

type: keyword

sophos.xg.branch_name

Branch Name

type: keyword

sophos.xg.category

IPS signature category.

type: keyword

sophos.xg.category_type

Type of category under which website falls

type: keyword

sophos.xg.classification

Signature classification

type: keyword

sophos.xg.client_host_name

Client host name

type: keyword

sophos.xg.client_physical_address

Client physical address

type: keyword

sophos.xg.clients_conn_ssid

Number of client connected to the SSID.

type: long

sophos.xg.collisions

collisions

type: long

sophos.xg.con_event

Event Start/Stop

type: keyword

sophos.xg.con_id

Unique identifier of connection

type: integer

sophos.xg.configuration

Configuration

type: float

sophos.xg.conn_id

Unique identifier of connection

type: integer

sophos.xg.connectionname

Connectionname

type: keyword

sophos.xg.connectiontype

Connectiontype

type: keyword

sophos.xg.connevent

Event on which this log is generated

type: keyword

sophos.xg.connid

Connection ID

type: keyword

sophos.xg.content_type

Type of the content

type: keyword

sophos.xg.contenttype

Type of the content

type: keyword

sophos.xg.context_match

Context Match

type: keyword

sophos.xg.context_prefix

Content Prefix

type: keyword

sophos.xg.context_suffix

Context Suffix

type: keyword

sophos.xg.cookie

cookie

type: keyword

sophos.xg.date

Date (yyyy-mm-dd) when the event occurred

type: date

sophos.xg.destinationip

Original destination IP address of traffic

type: ip

sophos.xg.device

device

type: keyword

sophos.xg.device_id

Serial number of the device

type: keyword

sophos.xg.device_model

Model number of the device

type: keyword

sophos.xg.device_name

Model number of the device

type: keyword

sophos.xg.dictionary_name

Dictionary Name

type: keyword

sophos.xg.dir_disp

TPacket direction. Possible values:“org”, “reply”, “”

type: keyword

sophos.xg.direction

Direction

type: keyword

sophos.xg.domainname

Domain from which virus was downloaded

type: keyword

sophos.xg.download_file_name

Download file name

type: keyword

sophos.xg.download_file_type

Download file type

type: keyword

sophos.xg.dst_country_code

Code of the country to which the destination IP belongs

type: keyword

sophos.xg.dst_domainname

Receiver domain name

type: keyword

sophos.xg.dst_ip

Original destination IP address of traffic

type: ip

sophos.xg.dst_port

Original destination port of TCP and UDP traffic

type: integer

sophos.xg.dst_zone_type

Type of destination zone

type: keyword

sophos.xg.dstdomain

Destination Domain

type: keyword

sophos.xg.duration

Durability of traffic (seconds)

type: long

sophos.xg.email_subject

Email Subject

type: keyword

sophos.xg.ep_uuid

Endpoint UUID

type: keyword

sophos.xg.ether_type

ethernet frame type

type: keyword

sophos.xg.eventid

ATP Evenet ID

type: keyword

sophos.xg.eventtime

Event time

type: date

sophos.xg.eventtype

ATP event type

type: keyword

sophos.xg.exceptions

List of the checks excluded by web exceptions.

type: keyword

sophos.xg.execution_path

ATP execution path

type: keyword

sophos.xg.extra

extra

type: keyword

sophos.xg.file_name

Filename

type: keyword

sophos.xg.file_path

File path

type: keyword

sophos.xg.file_size

File Size

type: integer

sophos.xg.filename

File name associated with the event

type: keyword

sophos.xg.filepath

Path of the file containing virus

type: keyword

sophos.xg.filesize

Size of the file that contained virus

type: integer

sophos.xg.free

free

type: integer

sophos.xg.from_email_address

Sender email address

type: keyword

sophos.xg.ftp_direction

Direction of FTP transfer: Upload or Download

type: keyword

sophos.xg.ftp_url

FTP URL from which virus was downloaded

type: keyword

sophos.xg.ftpcommand

FTP command used when virus was found

type: keyword

sophos.xg.fw_rule_id

Firewall Rule ID which is applied on the traffic

type: integer

sophos.xg.fw_rule_type

Firewall rule type which is applied on the traffic

type: keyword

sophos.xg.hb_health

Heartbeat status

type: keyword

sophos.xg.hb_status

Heartbeat status

type: keyword

sophos.xg.host

Host

type: keyword

sophos.xg.http_category

HTTP Category

type: keyword

sophos.xg.http_category_type

HTTP Category Type

type: keyword

sophos.xg.httpresponsecode

code of HTTP response

type: long

sophos.xg.iap

Internet Access policy ID applied on the traffic

type: keyword

sophos.xg.icmp_code

ICMP code of ICMP traffic

type: keyword

sophos.xg.icmp_type

ICMP type of ICMP traffic

type: keyword

sophos.xg.idle_cpu

idle ##

type: float

sophos.xg.idp_policy_id

IPS policy ID which is applied on the traffic

type: integer

sophos.xg.idp_policy_name

IPS policy name i.e. IPS policy name which is applied on the traffic

type: keyword

sophos.xg.in_interface

Interface for incoming traffic, e.g., Port A

type: keyword

sophos.xg.interface

interface

type: keyword

sophos.xg.ipaddress

Ipaddress

type: keyword

sophos.xg.ips_policy_id

IPS policy ID applied on the traffic

type: integer

sophos.xg.lease_time

Lease Time

type: keyword

sophos.xg.localgateway

Localgateway

type: keyword

sophos.xg.localnetwork

Localnetwork

type: keyword

sophos.xg.log_component

Component responsible for logging e.g. Firewall rule

type: keyword

sophos.xg.log_id

Unique 12 characters code (0101011)

type: keyword

sophos.xg.log_subtype

Sub type of event

type: keyword

sophos.xg.log_type

Type of event e.g. firewall event

type: keyword

sophos.xg.log_version

Log Version

type: keyword

sophos.xg.login_user

ATP login user

type: keyword

sophos.xg.mailid

mailid

type: keyword

sophos.xg.mailsize

mailsize

type: integer

sophos.xg.message

Message

type: keyword

sophos.xg.mode

Mode

type: keyword

sophos.xg.nat_rule_id

NAT Rule ID

type: keyword

sophos.xg.newversion

Newversion

type: keyword

sophos.xg.oldversion

Oldversion

type: keyword

sophos.xg.out_interface

Interface for outgoing traffic, e.g., Port B

type: keyword

sophos.xg.override_authorizer

Override authorizer

type: keyword

sophos.xg.override_name

Override name

type: keyword

sophos.xg.override_token

Override token

type: keyword

sophos.xg.phpsessid

PHP session ID

type: keyword

sophos.xg.platform

Platform of the traffic.

type: keyword

sophos.xg.policy_type

Policy type applied to the traffic

type: keyword

sophos.xg.priority

Severity level of traffic

type: keyword

sophos.xg.protocol

Protocol number of traffic

type: keyword

sophos.xg.qualifier

Qualifier

type: keyword

sophos.xg.quarantine

Path and filename of the file quarantined

type: keyword

sophos.xg.quarantine_reason

Quarantine reason

type: keyword

sophos.xg.querystring

querystring

type: keyword

sophos.xg.raw_data

Raw data

type: keyword

sophos.xg.received_pkts

Total number of packets received

type: long

sophos.xg.receiveddrops

received drops

type: long

sophos.xg.receivederrors

received errors

type: keyword

sophos.xg.receivedkbits

received kbits

type: long

sophos.xg.recv_bytes

Total number of bytes received

type: long

sophos.xg.red_id

RED ID

type: keyword

sophos.xg.referer

Referer

type: keyword

sophos.xg.remote_ip

Remote IP

type: ip

sophos.xg.remotenetwork

remotenetwork

type: keyword

sophos.xg.reported_host

Reported Host

type: keyword

sophos.xg.reported_ip

Reported IP

type: keyword

sophos.xg.reports

Reports

type: float

sophos.xg.rule_priority

Priority of IPS policy

type: keyword

sophos.xg.sent_bytes

Total number of bytes sent

type: long

sophos.xg.sent_pkts

Total number of packets sent

type: long

sophos.xg.server

Server

type: keyword

sophos.xg.sessionid

Sessionid

type: keyword

sophos.xg.sha1sum

SHA1 checksum of the item being analyzed

type: keyword

sophos.xg.signature

Signature

type: float

sophos.xg.signature_id

Signature ID

type: keyword

sophos.xg.signature_msg

Signature message

type: keyword

sophos.xg.site_category

Site Category

type: keyword

sophos.xg.source

Source

type: keyword

sophos.xg.sourceip

Original source IP address of traffic

type: ip

sophos.xg.spamaction

Spam Action

type: keyword

sophos.xg.sqli

related SQLI caught by the WAF

type: keyword

sophos.xg.src_country_code

Code of the country to which the source IP belongs

type: keyword

sophos.xg.src_domainname

Sender domain name

type: keyword

sophos.xg.src_ip

Original source IP address of traffic

type: ip

sophos.xg.src_mac

Original source MAC address of traffic

type: keyword

sophos.xg.src_port

Original source port of TCP and UDP traffic

type: integer

sophos.xg.src_zone_type

Type of source zone

type: keyword

sophos.xg.ssid

Configured SSID name.

type: keyword

sophos.xg.start_time

Start time

type: date

sophos.xg.starttime

Starttime

type: date

sophos.xg.status

Ultimate status of traffic – Allowed or Denied

type: keyword

sophos.xg.status_code

Status code

type: keyword

sophos.xg.subject

Email subject

type: keyword

sophos.xg.syslog_server_name

Syslog server name.

type: keyword

sophos.xg.system_cpu

system

type: float

sophos.xg.target

Platform of the traffic.

type: keyword

sophos.xg.temp

Temp

type: float

sophos.xg.threatname

ATP threatname

type: keyword

sophos.xg.timestamp

timestamp

type: date

sophos.xg.timezone

Time (hh:mm:ss) when the event occurred

type: keyword

sophos.xg.to_email_address

Receipeint email address

type: keyword

sophos.xg.total_memory

Total Memory

type: integer

sophos.xg.trans_dst_ip

Translated destination IP address for outgoing traffic

type: ip

sophos.xg.trans_dst_port

Translated destination port for outgoing traffic

type: integer

sophos.xg.trans_src_ip

Translated source IP address for outgoing traffic

type: ip

sophos.xg.trans_src_port

Translated source port for outgoing traffic

type: integer

sophos.xg.transaction_id

Transaction ID

type: keyword

sophos.xg.transactionid

Transaction ID of the AV scan.

type: keyword

sophos.xg.transmitteddrops

transmitted drops

type: long

sophos.xg.transmittederrors

transmitted errors

type: keyword

sophos.xg.transmittedkbits

transmitted kbits

type: long

sophos.xg.unit

unit

type: keyword

sophos.xg.updatedip

updatedip

type: ip

sophos.xg.upload_file_name

Upload file name

type: keyword

sophos.xg.upload_file_type

Upload file type

type: keyword

sophos.xg.url

URL from which virus was downloaded

type: keyword

sophos.xg.used

used

type: integer

sophos.xg.used_quota

Used Quota

type: keyword

sophos.xg.user

User

type: keyword

sophos.xg.user_cpu

system

type: float

sophos.xg.user_gp

Group name to which the user belongs.

type: keyword

sophos.xg.user_group

Group name to which the user belongs

type: keyword

sophos.xg.user_name

user_name

type: keyword

sophos.xg.users

Number of users from System Health / Live User events.

type: long

sophos.xg.vconn_id

Connection ID of the master connection

type: integer

sophos.xg.virus

virus name

type: keyword

sophos.xg.web_policy_id

Web policy ID

type: keyword

sophos.xg.website

Website

type: keyword

sophos.xg.xss

related XSS caught by the WAF

type: keyword