File format definition for full traffic logging

Documentation | Support

Go to the table of contents

Go to the previous page

Go to the next page

View or print as PDF

Configuring Full Traffic Logging : File format definition for full traffic logging

File format definition for full traffic logging

Forcepoint Web Security Cloud | Configuring Full Traffic Logging

The log files downloaded from the cloud service are in JavaScript Object Notation (JSON) format. For more information about JSON, see http://www.json.org/.

Each log file contains multiple lines, with one request per line. Each line is enclosed in square brackets.

The following table describes the fields that comprise each request.

The time that a request occurred on the proxy, in seconds in UNIX time.

The Forcepoint Web Security Cloud internal identifier for your account.

The web user's ID, usually their email address.

The client's external Internet IP address, shown in integer format.

See Converting integer IP addresses to dot-decimal IPv4 format.

The number of requests for a particular site. This will default to 1 per log entry.

Size of the request in bytes.

Size of the response in bytes.

The disposition code of the request. For an explanation of the codes, see Disposition codes.

A comma-separated list of category IDs. To see how the ID numbers relate to category names, go to https://sync-web.mailcontrol.com/hosted/categories?version=2. (Note that this URL is for logs generated with 2015 Release 1 and later. To see ID numbers and category names for logs generated prior to that release, go to https://sync-web.mailcontrol.com/hosted/categories.)

The protocol used in the request (for example HTTP, HTTPS, or FTP)

The port number used for the request.

The IP of the requested address, shown in integer format.

See Converting integer IP addresses to dot-decimal IPv4 format.

The full URL of the page requested by the user.

Defines the analytic applied to the request. Can be one of the following:

1, 2 - Real-Time Security Scanning (RTSS)

4, 5, 6 - Advanced Detection (AD)

10 - Antivirus (AE)

11 - Real-Time Classification (RTC)

13 - Malicious iFrame Detection (MIDE)

14 - Malicious PDF Detection (SPIE)

15 - Advanced Secure Hash (ASH)

18 - Meta-analytic Detection (ICE)

The reason code assigned to the request. For an explanation of the codes, see Reason codes.

ContentStripping

This field is blank in this version of the log file.

This is an internal signature ID string.

One of the following groups: 'unknown', 'text', 'executable', 'image', 'multimedia', 'document', 'suspicious', 'archive', 'ria', 'mime'.

Name of the policy used to filter the request.

Content-Type of the response. The default value is an empty string.

The host name of the origin server.

HTTP method used in the request.

The total delay, in milliseconds, due to filtering the transaction through the proxy.

The time taken, in milliseconds, to receive the request from the origin server.

The total response time for the transaction, in milliseconds.

Converting integer IP addresses to dot-decimal IPv4 format

Note: IP addresses in the ClientIP field are exported in integer format. To convert integer IP addresses to the dot-decimal IPv4 address format, you can use the Excel formula shown in the table below. This example assumes an integer IP address is in cell A1 of your Excel spreadsheet.


Example integer IP	Formula to convert integer IP in cell A1	Dot-decimal IPv4 address
1433608197	=HEX2DEC(MID(DEC2HEX(A1,8),1,2))&"."&HEX2DEC(MID(DEC2HEX(A1,8),3,2))&"."&HEX2DEC(MID(DEC2HEX(A1,8),5,2))&"."&HEX2DEC(MID(DEC2HEX(A1,8),7,2))	85.115.32.5

Disposition codes

The following table explains the meaning of the disposition codes used in the log files.


Code	Description
2	Page blocked
3	Page filtered and permitted
4	Request filtering refused to service the request
6	Could not connect to requested site
9	Blocked, and user access to service disabled
12	Continue/confirm request
13	Quota request
14	Request permitted without filtering

The following table explains the meaning of the reason codes used in the log files.


ID	Analytic	Name
1		Generic
1	Real-time security scanning	Generic
2	Real-time security scanning	Suspicious
3	Real-time security scanning	Exploit
4	Real-time security scanning	Redirection
5	Real-time security scanning	Obfuscation
6	Real-time security scanning	Evasion
7	Real-time security scanning	Counterfeit
8	Real-time security scanning	Spam
9	Real-time security scanning	Hijacked
10	Real-time security scanning	Defaced
11	Real-time security scanning	Tools
12	Real-time security scanning	Infostealer
13	Real-time security scanning	Backchannel traffic
14	Real-time security scanning	Remote control
15	Real-time security scanning	Installer
16	Advanced Detection	Malicious Packed
17	Advanced Detection	Generic Malicious
18	Advanced Detection	Trojan
19	Advanced Detection	Virus
20	Advanced Detection	Worm
21	Advanced Detection	Infected
22	Advanced Detection	Adware
50	Advanced Detection	Zipbomb
300	Malicious PDF Detection	Suspicious document
301	Malicious PDF Detection	Suspicious uncategorized document
302	Malicious PDF Detection	Document with active content
400	Malicious iFrame Detection	Malicious iFrame detection
700	Advanced Secure Hash	Generic
800	Meta-Analytic Detection	Generic
900	AppID	Generic
10001	Antivirus	Virus
10002	Antivirus	Adware
10003	Antivirus	Application
10004	Antivirus	Backdoor
10005	Antivirus	Bomb
10006	Antivirus	BootVirus
10007	Antivirus	Denial
10008	Antivirus	Dialer
10009	Antivirus	Downloader
10010	Antivirus	Exploit
10011	Antivirus	Intended
10012	Antivirus	Joke
10013	Antivirus	Macro
10014	Antivirus	MassMailer
10015	Antivirus	MisDisinfection
10016	Antivirus	NetWorm
10017	Antivirus	P2Worm
10018	Antivirus	Proxy
10019	Antivirus	PasswordStealer
10020	Antivirus	Remote
10021	Antivirus	Risk
10022	Antivirus	Spyware
10023	Antivirus	Tool
10024	Antivirus	Trojan
10025	Antivirus	HiddenProcess
10026	Antivirus	Injected Code

Go to the table of contents

Go to the previous page

Go to the next page

View or print as PDF

Configuring Full Traffic Logging : File format definition for full traffic logging

Copyright 2022 Forcepoint All rights reserved.