AWS Network Firewall sample event messages
Use these sample event messages to verify a successful integration with IBM® QRadar®.
Important: Due to formatting issues, paste the message format into a text editor and
then remove any carriage return or line feed characters.
Amazon AWS Network Firewall sample messages when you use the Amazon AWS REST API protocol
Sample 1 - alert logs: The following sample event message shows that a connection is allowed by the firewall.
{"firewall_name":"firewall","availability_zone":"zone","event_timestamp":"1601074865","event":{"timestamp":"2020-09-25T23:01:05.598481+0000","flow_id":1111111111111111,"event_type":"alert","src_ip":"10.16.197.56","src_port":49157,"dest_ip":"10.16.197.55","dest_port":8883,"proto":"TCP","alert":{"action":"allowed","signature_id":2,"rev":0,"signature":"","category":"","severity":3}}}| QRadar field name | Highlighted payload field name |
|---|---|
| Logsource Time | timestamp |
| Event ID | event_type + action |
| Source IP | src_ip |
| Source Port | src_port |
| Destination IP | dest_ip |
| Destination Port | dest_port |
| Protocol | proto |
Sample 2 - flow logs: The following sample event message shows netflow traffic.
{"firewall_name":"firewall","availability_zone":"us-east-1b","event_timestamp":"1601587565","event":{"timestamp":"2020-10-01T21:26:05.007515+0000","flow_id":1770453319291727,"event_type":"netflow","src_ip":"45.129.33.153","src_port":47047,"dest_ip":"172.31.16.139","dest_port":16463,"proto":"TCP","netflow":{"pkts":1,"bytes":60,"start":"2020-10-01T21:25:04.070479+0000","end":"2020-10-01T21:25:04.070479+0000","age":0,"min_ttl":241,"max_ttl":241},"tcp":{"tcp_flags":"02","syn":true}}}| QRadar field name | Highlighted payload field name |
|---|---|
| Logsource Time | timestamp |
| Event ID | event_type |
| Source IP | src_ip |
| Source Port | src_port |
| Destination IP | dest_ip |
| Destination Port | dest_port |
| Protocol | proto |