--- title: "Security log attributes for SIEM integration" canonical: "https://docs.aryaka.com/space/KNOW/237961265/Security%20log%20attributes%20for%20SIEM%20integration" format: markdown --- The MyAryaka SIEM Configuration page allows you send Security logs to third-party security information and event management (SIEM) tools in real time. Many organizations use SIEM as the centralized, real-time, security tracking component for their response team at their security operations center (SOC). When exporting security logs in real-time, the MyAryaka SIEM solution uses the  Open Cybersecurity Schema Framework  (OCSF) format to standardize the exchange of data between MyAryaka and other security tools. The OCSF framework comprises multiple schemas that are designed to process different log content. Among those, the schema for Network Activity Class and Category has been selected to export security logs. Attributes associated with this schema are described later in the document. Study the log attributes to write custom parsers to extract key information relevant to your network security program, or—if the tool supports OCSF—leverage built-in dashboards designed for OCSF Network Activity logs to get started quickly. Network Activity OCSF schema The following JSON schema contains the list of attributes that is included in our security log SIEM record. This SIEM record includes the OCSF definition for each schema attribute (reference:  Open Cybersecurity Schema Framework ). network_activity { //OCSF Def - Network Activity events report network connection and traffic activity. activity_name: //NA activity_id: //NA app_name: //App name to which the connection belongs. category_name: //OCSF recommended value. "Network Activity" category_uid: //OCSF recommended value. "4" class_name: //OCSF recommended value. "Network Activity" class_uid: //OCSF recommended value. "4001" duration: //Duration of the connection from connection setup to connection close. start_time: //Connection setup time. end_time: //Connection close time. time: //log generation time on the event source. ANAP or POP. timezone_offset: //Offset from UTC. Will be "0" since the logging time zone is UTC. message: //"Aryaka Pre-SSL Flow Logs" or "Aryaka Post-SSL Flow Logs" type_uid: //OCSF recommended value - OCSF recommended value."400102" for connection close. type_name: //OCSF recommended value. "Network Activity: Close" connection_info { //Network connection information. boundary: //Possible Values: Internal, External, Lateral, Cloud Security Connector. boundry_id: //OCSF Def - The normalized identifier of the boundary of the connection. uid: //OCSF Def - The unique identifier of the connection. direction: //OCSF Def - The direction of the initiated connection, traffic, or email, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source. direction_id: //OCSF Def - 1 Inbound - Inbound network connection. The connection was originated from the Internet or outside network, destined for services on the inside network. 2 - Outbound Outbound network connection. The connection was originated from inside the network, destined for services on the Internet or outside network. protocol_ver: //OCSF Def - The Internet Protocol version. protocol_ver_id: //OCSF Def - The Internet Protocol version identifier. 0 Unknown, 4 Internet Protocol version 4 (IPv4), 6 Internet Protocol version 6 (IPv6), 99 Other protocol_name: //OCSF Def - The TCP/IP protocol name in lowercase, as defined by the Internet Assigned Numbers Authority (IANA). See Protocol Numbers. For example: tcp or udp. src_endpoint { //OCSF Def - The initiator (client) of the network connection. ip: //OCSF Def - The IP address of the endpoint, in either IPv4 or IPv6 format. zone: //OCSF Def - The network zone or LAN segment. port: //OCSF Def - The port used for communication within the network connection. dst_endpoint { //OCSF Def - The responder (server) in a network connection. ip: //OCSF Def - The IP address of the endpoint, in either IPv4 or IPv6 format. zone: //OCSF Def - The network zone or LAN segment. port: //OCSF Def - The port used for communication within the network connection. traffic { //OCSF Def - The network traffic refers to the amount of data moving across a network at a given point of time. Intended to be used alongside Network Connection. bytes_in: //OCSF Def - The number of bytes sent from the destination to the source. bytes_out: //OCSF Def - The number of bytes sent from the source to the destination. total_bytes: //OCSF Def - The total number of bytes (in and out). url { hostname: //OCSF Def - The URL host as extracted from the URL. For example - www.example.com from www.example.com/download/trouble. path: //OCSF Def - The URL path as extracted from the URL. For example - /download/trouble from www.example.com/download/trouble. scheme: //OCSF Def - The scheme portion of the URL. For example - http, https, ftp, or sftp. subdomain: //OCSF Def - The subdomain portion of the URL. For example - sub in https://sub.example.com or sub2.sub1 in https://sub2.sub1.example.com. URL String: //OCSF Def - The URL string. See RFC 1738. For example - http://www.example.com/download/trouble.exe. Note - The URL path should not populate the URL string. Website Categorization: The Website categorization names, as defined by category_ids enum values. Website Categorization IDs: observables { //OCSF Def - The observables associated with the event or a finding. observable { //OCSF Def - Observable object to represent the logged in user. name: User Identity //OCSF Def - Custom name given to represent that this observable provides the logged on username associated with the connection. type: Email Address //OCSF Def - Name of the corresponding integer value from type_id. OCSF defined. type_id: 5 //OCSF Def - From the enlisted observable values by OCSF. OCSF defined. value: //OCSF Def - If the name refers to a scalar attribute, then the value is the value of the attribute. observable { //OCSF Def - Observable object to represent the reputation score of the domain name. Present only for RSE log based SIEM record. name: Domain Reputation Score //OCSF Def - Custom name given to represent that this observable provides the domain name associated with the connection. type: Hostname //OCSF Def - Name of the corresponding integer value from type_id. OCSF defined. type_id: 1 //OCSF Def - From the enlisted observable values by OCSF. OCSF defined. value: //OCSF Def - If the name refers to a scalar attribute, then the value is the value of the attribute. reputation { //OCSF Def - Contains the original and normalized reputation scores. This sub-class exists only for observable "Domain/URL Reputation Score" provider: Webroot //OCSF Def - The provider of the reputation information. base_score: //OCSF Def - The reputation score as reported by the event source. In our case, Webroot. score: //OCSF Def - The reputation score, normalized to the caption of the score_id value. In the case of 'Other', it is defined by the event source. score_id: //OCSF Def - Score mapping as provided in the schema mapping confluence doc. observable { //OCSF Def - Observable object to represent the reputation score of the URL. Present only for SECNI log based SIEM record. name: URL Reputation Score //OCSF Def - Custom name given to represent that this observable provides the URL associated with the connection. type: URL String //OCSF Def - Name of the corresponding integer value from type_id. OCSF defined. type_id: 6 //OCSF Def - From the enlisted observable values by OCSF. OCSF defined. value: //OCSF Def - If the name refers to a scalar attribute, then the value is the value of the attribute. reputation { //OCSF Def - Contains the original and normalized reputation scores. This sub-class exists only for observable "Domain/URL Reputation Score" provider: Webroot //OCSF Def - The provider of the reputation information. base_score: //OCSF Def - The reputation score as reported by the event source. In our case, Webroot. score: //OCSF Def - The reputation score, normalized to the caption of the score_id value. In the case of 'Other', it is defined by the event source. score_id: //OCSF Def - Score mapping as provided in the schema mapping confluence doc. observable { //OCSF Def - Observable object to represent the reputation score of the file. Present only for SECNI log based SIEM record. name: File Reputation Score //OCSF Def - Custom name given to represent that this observable provides the file name associated with the connection. type: File //OCSF Def - Name of the corresponding integer value from type_id. OCSF defined. type_id: 7 /From the enlisted observable values by OCSF. OCSF defined. value: //OCSF Def - If the name refers to a scalar attribute, then the value is the value of the attribute. reputation { //OCSF Def - Contains the original and normalized reputation scores. This sub-class exists only for observable "Domain/URL/File Reputation Score" provider: Webroot //OCSF Def - The provider of the reputation information. base_score: //OCSF Def - The reputation score as reported by the event source. In our case, Webroot. score: //OCSF Def - The reputation score, normalized to the caption of the score_id value. In the case of 'Other', it is defined by the event source. score_id: //OCSF Def - Score mapping as provided in the schema mapping confluence doc. enrichments { //OCSF Def - The additional information from an external data source, which is associated with the event or a finding. enrichment { Provider: //OCSF Def - The enrichment data provider name. Check mapping to see how this is used. Type: //OCSF Def - The enrichment type. For example - location. Check mapping to see how this is used. data: //OCSF Def - The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. Check mapping to see how this is used. name: //OCSF Def - The name of the attribute to which the enriched data pertains. Check mapping to see how this is used. Value: //OCSF Def - The value of the attribute to which the enriched data pertains. Check mapping to see how this is used. metadata { //OCSF Def - The metadata associated with the event or a finding. log_name: //OCSF Def - The event log name. For example, syslog file name or Windows logging subsystem - Security. In our case, we plan to write "Flow Logs" log_provider: //OCSF Def - The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing. In our case, we plan to write "ANAP" or "POP" depending on the nexus insertion model. product { //OCSF Def - The product that reported the event. vendor_name: //OCSF Def - The name of the vendor of the product. In our case, we plan to write "Aryaka Networks" logged_time: //OCSF Def - The time when the logging system collected and logged the event. This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different. original_time: //OCSF Def - The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs. version: //OCSF Def - The version of the OCSF schema, using Semantic Versioning Specification (SemVer). For example - 1.0.0. Event consumers use the version to determine the available event attributes. } } Pre-SSL and post-SSL security logs For every connection, two SIEM records are generated when the connection ends: one from the pre-SSL engine and another from the post-SSL engine. These security logs are then exported to your configured SIEM endpoint in OCSF format.  All SIEM records contain the following details for each flow: Five-tuple information Connection start and end time App ID, App Group ID, or DPI ID (If application classification data is available in the ngstat records) Zone details (VPN, DMZ, or direct internet) Flow direction (incoming or outgoing) Flow boundary (interzone traffic, local to internet traffic, internet to local traffic, and so on) Other mandatory attributes required to maintain compatibility with OCSF, such as OSCF schema version, category, class, and so on SIEM records generated from pre-SSL security logs also contain the following information: Domain name Domain category Domain reputation score User and user group names Pre-SSL security engine actions SIEM records generated from post-SSL security logs also contain the following information: URL category URL reputation score User and user group names Post-SSL security engine actions Sample pre-SSL and post-SSL security logs are included in the sections that follow. Sample pre-SSL security log record The following sample SIEM record is from the Aryaka Pre-SSL Flow Log (as noted in line 14). This log includes many attributes that are also included in the post-SSL log, but includes domain name, domain category, and domain reputation score attributes (lines 45 through 53). network_activity { activity_name: Close activity_id: 1 app_name: category_name: Network Activity category_uid: 4 class_name: Network Activity class_uid: 4001 duration: 2312 start_time: 2024/02/15_13:01:41.523 end_time: 2024/02/15_13:02:42.841 time: 2024/02/15_13:02:42.841 timezone_offset: 0 message: Aryaka Pre-SSL Flow Log type_uid: 400102 type_name: Network Activity: Close connection_info { boundry: Internet Gateway boundry_id: 11 uid: 21231 direction: Outbound direction_id: 2 protocol_ver: IPv4 protocol_ver_id: 4 protocol_name: TCP src_endpoint { ip: 172.17.21.148 zone: VPN0 port: 23365 dst_endpoint { ip: 23.211.217.111 zone: Public port: 443 url { hostname: go.microsoft.com Website Categorization: Technology/Internet Website Categorization IDs: 38 observables { observable { name: User Identity type: Email Address type_id: 5 value: john_doe@example.com observable { name: Domain Reputation Score type: Hostname type_id: 1 value: go.microsoft.com reputation { provider: Webroot base_score: 84 score: 99 score_id: Trustworthy enrichments { enrichment { Provider: Policy Engines (Pre-SSL) Type: Action data: {"basic_firewall_policy action":"permit","inter_zone_fw_policy_action":"permit","internet_routing_policy_action":"itc","ip_rep_action":"PERMIT","domain_rep_policy_action":"PERMIT","nac_policy_action":"PERMIT","lan_idps_policy_action":"PERMIT", "wan_idps_policy_action":"permit"} name: Resulting Action Value: Permit metadata { log_name: Pre-SSL Network Activity log_provider: product { vendor_name: logged_time: 2024/02/15_13:02:43.897 original_time: 2024/02/15_13:02:42.841 version: 1.1.0 Sample post-SSL security log record The following sample SIEM record is from the Aryaka Post-SSL Flow Log (as noted in line 14). This log includes many attributes that are also included in the pre-SSL log, but includes URL, URL category, and URL reputation score attributes (lines 44 through 51). network_activity { activity_name: Close activity_id: 1 app_name: category_name: Network Activity category_uid: 4 class_name: Network Activity class_uid: 4001 duration: 2312 start_time: 2024/02/15_13:01:41.589 end_time: 2024/02/15_13:02:42.892 time: 2024/02/15_13:02:42.898 timezone_offset: 0 message: Aryaka Post-SSL Flow Log type_uid: 400102 type_name: Network Activity: Close connection_info { boundry: Internet Gateway boundry_id: 11 uid: 21231 direction: Outbound direction_id: 2 protocol_ver: IPv4 protocol_ver_id: 4 protocol_name: TCP src_endpoint { ip: 172.17.21.148 zone: VPN0 port: 23365 dst_endpoint { ip: 23.211.217.111 zone: Public port: 80 url { Website Categorization: Technology/Internet Website Categorization IDs: 99dsdds observables { observable { name: User Identity type: Email Address type_id: 5 value: john_doe@example.com observable { name: URL Reputation Score type: URL type_id: 1 reputation { provider: Webroot base_score: 84 score: 99 score_id: Very Safe enrichments { enrichment { Provider: Policy Engines (Post-SSL) Type: Action data: {"url_rep_policy_name":,"url_rep_policy_action":"PERMIT","wac_policy_name":,"wac_policy_action":"PERMIT","malware_policy_name":,"malware_action":"PERMIT","adv_idps_policy_name":,"adv_idps_policy_action":"SKIP_ENGINE", "adv_idps_action":"PERMIT"} name: Resulting Action Value: Permit metadata { log_name: Post-SSL Network Activity log_provider: product { vendor_name: logged_time: 2024/02/15_13:02:43.897 original_time: 2024/02/15_13:02:42.841 version: 1.1.0 Security log format considerations Aryaka security logs are formatted using JSON. If you are using a syslog server that only accepts RFC formatted syslog messages and using RELP as the transport protocol, the server must be configured to use a JSON parser module and to use either the TCP or UDP protocol to successfully receive the JSON formatted logs. A standard syslog server (rsyslog or syslog-ng) typically uses the RELP protocol and the default format expected on incoming logs is syslog (RFC5424 or RFC5426). If this is the case, the server’s syslog.conf file must be edited to use the mmjsonparse module and to use standard TCP or UDP (imtcp or imudp) to listen instead of RELP. # Load the mmjsonparse module to enable JSON parsing $ModLoad mmjsonparse # Load the imtcp module to enable TCP input module(load="imtcp") # Define a TCP input on port 514 to receive log messages input(type="imtcp" port="514") ## JSON LOGGING CONFIGURATION ## # Check if the message contains both '{' and '}', indicating a JSON formatted log if $msg contains '{' and $msg contains '}' then { # Parse the JSON log message action(type="mmjsonparse" cookie="" ) # Write the parsed JSON log message to a file action(type="omfile" file="/var/log/jsonlogs/json.log") } Related topics SIEM Configure SIEM integration View security logs Monitor security Network_activity Attribute Reference Guide.pdf  (only opens in this tab)