Network Session ASIM parser for Force Point Firewall
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimNetworkSessionForcePointFirewall |
| Built-in Parser | _ASim_NetworkSession_ForcePointFirewall |
| Schema | NetworkSession |
| Schema Version | 0.2.6 |
| Parser Type | 🔌 Source (product-specific) |
| Product | ForcePointFirewall |
| Parser Version | 0.1 (version history) |
| Last Updated | March 17, 2022 |
| Unifying Parser | ASimNetworkSession |
| Source File | Parsers\ASimNetworkSession\Parsers\ASimNetworkSessionForcePointFirewall.yaml |
Description
This ASIM parser supports normalizing Force Point Firewall logs coming from CEF Data Connector to the ASIM Network Session normalized schema.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
CommonSecurityLog |
ApplicationProtocol startswith "TCP"ApplicationProtocol startswith "UDP"DestinationServiceName in "Application-Unknown,Generic-Web-HTTP,Unknown-Encrypted-Application"DeviceEventClassID in "70734,76508,76509"DeviceEventClassID != "0"DeviceEventClassID !in "70383,70393,70734,71009,71040"DeviceProduct == "Firewall"DeviceVendor == "FORCEPOINT"RequestMethod != "UNKNOWN" |
✓ | ✓ | ✓ |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
Solutions: Common Event Format, VirtualMetric DataStream
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊