Cloud Firewall:Flow log fields

Parameter

Description

Example

__time__

The time when the log is written to the Logstore.

1703483369

__topic__

The topic of the log. The value is always cloudfirewall_access_log, which indicates a traffic log from Cloud Firewall.

cloudfirewall_access_log

acl_rule_id

The ID of the matching access control policy.

A value of 00000000-0000-0000-0000-000000000000 indicates that no access control policy was matched.

073a1475-6e11-43e2-8b28-98cee9c6****

action_user

The action taken by the matching rule. Valid values:

• 0 (pass): The rule is disabled.

• 1 (alert): An alert is generated.

• 2 (drop): The traffic is dropped.

1

aliuid

The ID of the Alibaba Cloud account.

1233333333****

app_dpi_state

The status of application identification. Valid values:

• success: The application was successfully identified.

• policy_discard: The traffic was dropped by a policy.

• tcp_not_establish: The TCP connection failed to establish.

• analysing: The application is being analyzed.

• no_payload: No payload has been received.

• unknown_loose: The application could not be identified in loose mode.

• unknown_strict: The application failed to be identified in strict mode.

• none: The traffic is stateless.

success

app_name

The application type of the traffic. Valid values include HTTPS, NTP, SIP, SMB, NFS, DNS, and Unknown (unknown protocol type).

HTTPS

appid_ctrl_appid

The application ID.

10010470000

attack_type

The attack type. Valid values:

• 1: Abnormal connection

• 2: Command execution

• 3: Brute-force attack

• 4: Scan

• 5: Other

• 6: Information leak

• 7: DoS attack

• 8: Buffer overflow attack

• 9: Web attack

• 10: Trojan or backdoor

• 11: Virus or worm

• 12: Mining behavior

• 13: Reverse shell

11

attack_type_name

The Chinese name of the attack type detected in the traffic.

Mining behavior

attack_type_name_en

The English name of the attack type detected in the traffic.

Mining behavior

country_id

The country or region, represented by a two-letter code based on the ISO 3166-1 standard.

• If direction is in, this field indicates the source country or region of the traffic.

• If direction is out, this field indicates the destination country or region of the traffic.

CN

city_id

The unique identifier for a city. This field uses the six-digit administrative division codes for cities in China at or above the county level. You can look up the corresponding city based on its code. For example, the code for Beijing is 110000.

110000

cloud_instance_id

The ID of the protected asset instance.

ngw-bp1d5bx2orlw1p2wn****

direction

The direction of the traffic. Valid values:

• in: Inbound traffic to your assets from resources on the internet or other ECS instances in your private network.

• out: Outbound traffic from your assets to other resources on the internet or other ECS instances in your private network.

in

domain

The destination domain name of the traffic.

www.aliyundoc.com

dst_ip

The destination IP address of the traffic.

39.108.XX.XX

dst_network_instance_id

The destination network instance of the traffic.

vpc-bp18ina819injc9zs****

dst_port

The destination port of the traffic.

443

dst_region

The destination region of the traffic.

cn-beijing

end_time

The time when the session ended, in UNIX timestamp format. Unit: seconds.

1702367350

firewall_id

The ID of the VPC Firewall instance.

cen-m9y9u2hgc0t9im****

in_bps

The rate of inbound traffic. Unit: bit/s.

42

in_packet_bytes

The size of inbound traffic. Unit: bytes.

58

in_packet_count

The number of inbound traffic packets.

1

in_pps

The average transmission rate of inbound traffic packets. Unit: packets per second (pps).

1

ip_protocol

The IP protocol type. Valid values:

• tcp

• udp

• icmp

tcp

ips_ai_rule_id

The ID of the matching intelligent recommended access control policy.

A value of 00000000-0000-0000-0000-000000000000 indicates that no intelligent recommended access control policy was matched.

00000000-0000-0000-0000-000000000000

ips_rule_id

The ID of the matching intrusion prevention rule.

A value of 00000000-0000-0000-0000-000000000000 indicates that no intrusion prevention rule was matched.

00000000-0000-0000-0000-000000000000

ips_rule_name

The Chinese name of the matching intrusion prevention rule.

Mining behavior on the host

ips_rule_name_en

The English name of the matching intrusion prevention rule.

Mining behavior on the host

log_type

The log type. Valid values:

• internet_log: Traffic log for Internet Firewall

• vpc_firewall_log: Traffic log for VPC Firewall

• nat_firewall_log: Traffic log for NAT Firewall

• dns_firewall_log: Log for DNS Firewall

• ipv6_firewall_log: Traffic protection log for IPv6 assets

• internet_ips_log: IPS event log for Internet Firewall

• vpc_ips_log: IPS event log for VPC Firewall

• appid_ctrl: Application control log for Internet Firewall

• web_filter: Web filtering log for Internet Firewall

• tls: TLS inspection log for Internet Firewall

internet_log

loose_allow_acl_id

The ID of the pre-match access control policy. This policy allows traffic to pass when the traffic cannot be fully identified. Valid values:

• 00000000-0000-0000-0000-000000000000: No unidentified traffic was allowed to pass.

• Other values: The ID of the policy that allowed unidentified traffic to pass.

00000000-0000-0000-0000-000000000000

new_conn

Indicates whether a new connection was established. Valid values:

• 1: Yes

• 0: No

1

out_bps

The rate of outbound traffic. Unit: bit/s.

0

out_packet_bytes

The size of outbound traffic. Unit: bytes.

0

out_packet_count

The number of outbound traffic packets.

0

out_pps

The average transmission rate of outbound traffic packets. Unit: packets per second (pps).

0

payload

The payload from the packet that matched an intrusion prevention rule, in hexadecimal format. This field is populated only when log_type is internet_ips_log or vpc_ips_log.

302602010104067075626c6963a1190204dc63c29a0201000xxxxx

region_id

The region ID. For more information about region IDs, see Supported regions.

• If direction is in, this field indicates the region ID of the destination asset.

• If direction is out, this field indicates the region ID of the source asset.

cn-beijing

rule_result

The action taken on the traffic that matched an access control policy. Valid values:

• pass: The traffic is allowed.

• alert: The traffic is monitored.

• drop: The traffic is dropped.

The action taken on the traffic that triggered an intrusion prevention event. Valid values:

• alert: An alert is generated.

• drop: The traffic is dropped.

alert

rule_source

The source of the matching policy. Valid values:

• basic_acl: Access control

• dns_acl_rule: Access control policy for DNS Firewall

• intelligence: Threat intelligence

• ips_basic_rule: Basic protection

• virtual_patch: Virtual patching

• unknown: Unknown

basic_acl

session_id

The session ID.

16000208880536122104

ssl_protocol

The TLS protocol version. Valid values:

• TLSv1

• TLSv1.1

• TLSv1.2

• TLSv1.3

TLSv1.3

ssl_cipher

The cipher suite type.

TLS_AES_128_GCM_SHA256

ssl_handshake_res

Indicates if TLS offloading was successful. Valid values:

• success

• failed

success

ssl_error_index

The error category. Valid values:

• Null: No error occurred.

• Certificate: Certificate error (missing or invalid).

• Protocol: Unsupported protocol version.

• Syscall: The underlying system call failed.

• Error: Generic SSL error.

Certificate

ssl_error_msg

The error details.

certificate verify failed

sni

The Server Name Indication (SNI).

example.com

src_ip

The source IP address of the traffic.

167.94.XX.XX

src_network_instance_id

The source network instance of the traffic.

vpc-bp18ina819injc9zs****

src_port

The source port of the traffic.

47915

src_region

The source region of the traffic.

cn-beijing

src_vpc_id

The ID of the source VPC.

vpc-bp18ina819injc9zs****

start_time

The time when the session started, in UNIX timestamp format. Unit: seconds.

1701759171

start_time_min

The start time of the session, truncated to the minute, in UNIX timestamp format. Unit: seconds.

1701759120

tcp_seq

The TCP sequence number.

388367****

total_bps

The total transmission rate of inbound and outbound traffic. Unit: bit/s.

42

total_packet_bytes

The total size of inbound and outbound traffic. Unit: bytes.

58

total_packet_count

The total number of inbound and outbound traffic packets.

1

total_pps

The average transmission rate of all inbound and outbound traffic packets. Unit: packets per second (pps).

0

url

The URL accessed by the server.

http://aliyundoc.com/index.html

user_ips_mode

The IPS protection mode. Valid values:

• 0: Disabled

• 1: Drop - Loose

• 2: Drop - Medium

• 3: Drop - Strict

1

vul_level

The risk level of the vulnerability exploited by the malicious traffic. Valid values:

• 0: No vulnerability exploit was detected.

• 1: Low-risk vulnerability exploit.

• 2: Medium-risk vulnerability exploit.

• 3: High-risk vulnerability exploit.

1

ndr_log_type

The protocol log type for Network Detection and Response (NDR), which identifies the protocol of the log.

HTTP

net_type

The location where NDR traffic was detected. Valid values:

• 0: Public network.

• 1: Private network.

0

request_uri

• The complete request URI, which includes the path and query parameters (for example, /api/data?id=123). This is used for route matching, locating resources, and auditing the full request path.

• Difference from request_path: request_uri includes query parameters, whereas request_path contains only the path portion.

/api?key=value

request_path

The path component of the URI, without query parameters.

/api

host

The destination hostname and port number from the request's Host header.

aliyun.com:8080

request_method

The HTTP request method, such as GET, POST, PUT, or DELETE.

POST

http_user_agent

The client identifier from the User-Agent header of the request.

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.95 Safari/537.36

status

The three-digit HTTP response status code.

200