SonicWall NGFW content pack (контент багц)

Bitdefender-ийн албан ёсны баримтаас орчуулавАнгли эх (EN) · Орчуулсан: 2026.11.12

SonicWall NGFW content pack (контент багц)

SonicWall Next-Gen Firewalls (NGFW) нь аппликейшний шалгалт, IDS/IPS, VPN болон уламжлалт галт ханын функцийг хангадаг бүтээгдэхүүний цуврал (NSsp, NSa, NSv болон TZ сүлжээний аюулгүй байдлын төхөөрөмжүүд)-ыг хамарна. Энэ технологийн багц SonicWall NGFW-ийн үйл явдлын лог мессежийг боловсруулж, сонирхолтой түгээмэл үйл явдлуудыг нормчилж, баяжуулж, ангилна.

Шаардлага

SonicOS 6.5, 7.0 буюу түүнээс хойших хувилбар ажиллуулж буй SonicWall NGFW төхөөрөмж
Логийг syslog-оор Security Data Lake руу илгээхээр тохируулсан SonicWall төхөөрөмж
Enhanced syslog format илгээхээр тохируулсан SonicWall төхөөрөмж

Stream-ийн тохиргоо

Энэ технологийн багц нэг stream агуулна:

"Illuminate:SonicWall Device Messages"

Тэмдэглэл

Хэрэв энэ stream багц идэвхжихээс өмнө байхгүй бол үүсгэгдэж, мессежүүдийг энэ stream болон холбогдох index set рүү чиглүүлэхээр тохируулагдана. Энэ stream-д ямар ч stream rule тохируулсан байх ёсгүй.

Index set-ийн тохиргоо

Энэ технологийн багц нэг index set тодорхойлолт агуулна:

"SonicWall Device Event Log Messages"

Тэмдэглэл

Хэрэв энэ index set өмнө нь тодорхойлогдсон бол юу ч өөрчлөгдөхгүй. Байхгүй бол таны лицензийн эрхийн дагуу үүсгэгдэнэ.

Лог форматын жишээ

id=SDF2lk3rj sn=SD2342LJFS time="2022-04-22 11:02:41" fw=10.1.2.3 pri=4 c=1024 m=537 msg="Connection Closed" app=2 n=23593520 src=192.168.10.20:53323:IF0 dst=10.0.130.15:53:IF1 srcMac=00:15:5d:a1:a2:08 dstMac=f8:0f:6f:a8:a2:21 proto=udp/dns sent=85 rcvd=117 spkt=1 rpkt=1 cdur=30633 rule="3 (LAN->WAN)" fw_action="NA"

Юу багтсан бэ

Үйл явдлын лог мессежийг нормчилж, баяжуулах дүрмүүд
Spotlight контент багц

Лог мессежийн боловсруулалт

Illuminate нь SonicWall NGFW-ийн үйл явдлын лог мессежийг таньж, event_source_product талбарыг sonicwall_ngfw утгатай нэмнэ.

Illuminate-ийн SonicWall NGFW лог мессежийн боловсруулалт дараахыг хангана:

SonicWall лог мессежийн талбар гаргаж авах, нормчлох, мессеж баяжуулах
Security Data Lake Schema-д нийцүүлэх
Дараах мессежүүдийг GIM ангилах:

SonicWall event code	gim_event_category	gim_event_subcategory	gim_event_type
10	endpoint	endpoint.service	service error
22	alert	alert.network alert	network alert
23	alert	alert.network alert	network alert
24	authentication	authentication.logoff	session disconnect
25	alert	alert.network alert	network alert
27	alert	alert.network alert	network alert
28	alert	alert.network alert	network alert
31	authentication	authentication.logon,authentication.credential validation	logon
32	authentication	authentication.logon,authentication.credential validation	logon
33	authentication	authentication.logon,authentication.credential validation	logon
34	authentication	authentication.credential validation	error
81	alert	alert.network alert	network alert
82	alert	alert.network alert	network alert
83	alert	alert.network alert	network alert
139	authentication	authentication.logon,authentication.credential validation	logon
140	authentication	authentication.logon,authentication.credential validation	logon
141	authentication	authentication.access notice	error
150	endpoint	endpoint.process	process stopped
151	endpoint	endpoint.process	process stopped
177	alert	alert.network alert	network alert
178	alert	alert.network alert	network alert
179	alert	alert.network alert	network alert
229	alert	alert.network alert	network alert
237	authentication	authentication.logon,authentication.credential validation	logon
238	authentication	authentication.logon,authentication.credential validation	logon
243	authentication	authentication.logon,authentication.credential validation	logon
244	authentication	authentication.logon,authentication.credential validation	logon
245	authentication	authentication.logon,authentication.credential validation	logon
246	authentication	authentication.logon,authentication.credential validation	logon
248	alert	alert.network alert	network alert
267	alert	alert.network alert	network alert
328	iam	iam.object modify	account renamed
437	alert	alert.network alert	network alert
440	endpoint	endpoint.service	configuration change
441	endpoint	endpoint.service	configuration change
442	endpoint	endpoint.service	configuration change
446	alert	alert.network alert	network alert
486	authentication	authentication.logon,authentication.credential validation	logon
506	endpoint	endpoint.service	service stopped
508	endpoint	endpoint.service	service stopped
527	endpoint	endpoint.ports	port closed
528	endpoint	endpoint.ports	port closed
538	endpoint	endpoint.ports	port closed
546	alert	alert.network alert	network alert
548	alert	alert.network alert	network alert
549	authentication	authentication.access policy	device policy violation
560	iam	iam.object disable	account disabled
561	iam	iam.object enable	account enabled
564	authentication	authentication.logoff	session disconnect
580	alert	alert.network alert	network alert
583	alert	alert.network alert	network alert
606	alert	alert.network alert	network alert
608	alert	alert.network alert	network alert
609	alert	alert.network alert	network alert
656	authentication	authentication.credential validation	error
669	endpoint	endpoint.service	service error
676	endpoint	endpoint.default	endpoint message
677	endpoint	endpoint.default	endpoint message
682	endpoint	endpoint.default	endpoint message
701	endpoint	endpoint.default	endpoint message
728	endpoint	endpoint.service	service stopped
734	endpoint	endpoint.default	endpoint message
735	endpoint	endpoint.default	endpoint message
737	authentication	authentication.credential validation	error
744	authentication	authentication.access notice	error
745	authentication	authentication.access notice	error
746	authentication	authentication.access notice	error
747	authentication	authentication.access notice	error
748	authentication	authentication.access notice	error
749	authentication	authentication.access notice	error
750	authentication	authentication.access notice	error
751	authentication	authentication.access notice	error
752	authentication	authentication.access notice	error
753	authentication	authentication.access notice	error
754	authentication	authentication.access notice	error
755	authentication	authentication.access notice	error
756	authentication	authentication.access notice	error
757	authentication	authentication.access notice	error
758	authentication	authentication.access notice	error
759	authentication	authentication.access notice	error
789	alert	alert.network alert	network alert
790	alert	alert.network alert	network alert
793	alert	alert.network alert	network alert
794	alert	alert.network alert	network alert
795	alert	alert.network alert	network alert
809	alert	alert.network alert	network alert
864	alert	alert.network alert	network alert
866	alert	alert.network alert	network alert
868	alert	alert.network alert	network alert
879	alert	alert.default	alert message
881	endpoint	endpoint.configuration	system time changed
882	http,network	http.communication,network.network connection	network http communication
883	endpoint	endpoint.default	endpoint message
884	endpoint	endpoint.default	endpoint message
885	endpoint	endpoint.default	endpoint message
886	endpoint	endpoint.default	endpoint message
897	alert	alert.network alert	network alert
898	alert	alert.network alert	network alert
904	alert	alert.default	alert message
905	alert	alert.default	alert message
913	authentication	authentication.credential validation	error
987	authentication	authentication.credential validation	error
988	authentication	authentication.access notice	error
989	authentication	authentication.access notice	error
990	authentication	authentication.access notice	error
991	authentication	authentication.access notice	error
992	authentication	authentication.default	authentication message
993	authentication	authentication.default	authentication message
994	endpoint	endpoint.service	configuration change
995	endpoint	endpoint.service	configuration change
996	authentication	authentication.default	authentication message
997	authentication	authentication.default	authentication message
998	authentication	authentication.default	authentication message
999	endpoint	endpoint.default	endpoint message
1000	endpoint	endpoint.default	endpoint message
1001	endpoint	endpoint.default	endpoint message
1002	endpoint	endpoint.default	endpoint message
1003	endpoint	endpoint.default	endpoint message
1004	endpoint	endpoint.default	endpoint message
1005	endpoint	endpoint.default	endpoint message
1006	endpoint	endpoint.default	endpoint message
1011	iam	iam.object modify	password change
1033	authentication	authentication.access notice	error
1035	authentication	authentication.logon,authentication.credential validation	logon
1048	iam	iam.object modify	password change
1049	endpoint	endpoint.filesystem	file modified
1058	endpoint	endpoint.process	process altered
1059	endpoint	endpoint.process	process altered
1073	authentication	authentication.access notice	error
1075	authentication	authentication.kerberos request	error
1076	authentication	authentication.default	authentication message
1080	authentication	authentication.logon,authentication.credential validation	logon
1085	endpoint	endpoint.service	service stopped
1088	endpoint	endpoint.service	service error
1089	endpoint	endpoint.service	service error
1091	alert	alert.network alert	network alert
1092	alert	alert.network alert	network alert
1093	alert	alert.network alert	network alert
1117	authentication	authentication.default	authentication message
1118	authentication	authentication.default	authentication message
1119	authentication	authentication.default	authentication message
1120	authentication	authentication.default	authentication message
1121	authentication	authentication.default	authentication message
1122	authentication	authentication.default	authentication message
1123	authentication	authentication.default	authentication message
1157	iam	iam.object disable	account disabled
1158	iam	iam.object disable	account disabled
1180	alert	alert.default	alert message
1181	alert	alert.default	alert message
1190	iam	iam.object modify	group member added
1191	iam	iam.object modify	group member removed
1192	iam	iam.object modify	group member added
1193	iam	iam.object modify	group member removed
1198	alert	alert.default	alert message
1199	alert	alert.default	alert message
1200	alert	alert.default	alert message
1201	alert	alert.default	alert message
1202	authentication	authentication.default	authentication message
1203	authentication	authentication.default	authentication message
1204	authentication	authentication.default	authentication message
1209	alert	alert.default	alert message
1210	alert	alert.default	alert message
1211	alert	alert.default	alert message
1212	alert	alert.default	alert message
1213	alert	alert.default	alert message
1214	alert	alert.default	alert message
1226	http,network	http.communication,network.network connection	network http communication
1227	authentication	authentication.access policy	account policy violation
1229	network	network.default	network message
1231	endpoint	endpoint.configuration	system time changed
1243	authentication	authentication.credential validation	error
1316	alert	alert.default	alert message
1336	endpoint	endpoint.service	configuration change
1337	iam	iam.object modify	password change
1338	iam	iam.object modify	password change
1341	authentication	authentication.default	authentication message
1342	authentication	authentication.default	authentication message
1363	alert	alert.default	alert message
1366	alert	alert.default	alert message
1367	alert	alert.default	alert message
1369	alert	alert.network alert	network alert
1373	alert	alert.network alert	network alert
1374	alert	alert.network alert	network alert
1375	alert	alert.network alert	network alert
1376	alert	alert.network alert	network alert
1378	alert	alert.default	alert message
1382	endpoint	endpoint.audit	audit policy changed
1383	endpoint	endpoint.audit	audit error
1387	alert	alert.network alert	network alert
1393	endpoint	endpoint.service	service stopped
1432	endpoint	endpoint.service	configuration change
1438	endpoint	endpoint.configuration	system configuration modified
1439	endpoint	endpoint.configuration	system configuration modified
1440	endpoint	endpoint.configuration	system configuration modified
1441	endpoint	endpoint.configuration	system configuration modified
1450	alert	alert.default	alert message
1471	alert	alert.default	alert message
1490	http,network	http.communication,network.network connection	network http communication
1491	http,network	http.communication,network.network connection	network http communication
1517	authentication	authentication.credential validation	error
1518	alert	alert.default	alert message
1519	alert	alert.default	alert message
1522	endpoint	endpoint.default	endpoint message
1524	endpoint	endpoint.default	endpoint message
1525	endpoint	endpoint.default	endpoint message
1526	endpoint	endpoint.default	endpoint message
1552	authentication	authentication.credential validation	error
1553	authentication	authentication.credential validation	error
1554	authentication	authentication.credential validation	error
1555	authentication	authentication.credential validation	error
1556	authentication	authentication.credential validation	error
1557	authentication	authentication.credential validation	error
1572	authentication	authentication.logon,authentication.credential validation	logon
1585	authentication	authentication.logon,authentication.credential validation	logon
1590	endpoint	endpoint.configuration	system configuration modified
1595	endpoint	endpoint.default	endpoint message
1596	endpoint	endpoint.default	endpoint message
1599	endpoint	endpoint.configuration	system configuration modified
1600	endpoint	endpoint.configuration	system configuration modified
1601	endpoint	endpoint.configuration	system configuration modified
1627	iam	iam.object disable	account disabled
1632	endpoint	endpoint.service	service stopped
1634	endpoint	endpoint.service	service removed
1635	endpoint	endpoint.service	service error
1636	endpoint	endpoint.default	endpoint message
1637	endpoint	endpoint.default	endpoint message
1640	endpoint	endpoint.service	configuration change
1642	endpoint	endpoint.ports	port closed
1655	authentication	authentication.access policy	account policy violation
1674	endpoint	endpoint.audit	audit policy changed

Built-in administrator бүртгэлтэй холбоотой үйл явдлууд

SonicWall NGFW төхөөрөмжүүд нь суулгагдсан Administrator бүртгэлтэй тохируулагдсан байдаг. Энэ бүртгэлийн үндсэн нэр нь Admin боловч хэрэглэгч нэрийг нь өөрчилж болно. SonicWall төхөөрөмжүүд энэ бүртгэлтэй холбоотой зарим үйл явдлыг бүртгэдэг бөгөөд тэдгээр нь бодит хэрэглэгчийн нэрийг агуулдаггүй, зөвхөн Administrator гэж дурддаг. Illuminate эдгээр үйл явдалд user_name утгыг Administrator гэж оноодог.

Ноцтой байдлын (severity) харгалзуулалт

SonicWall төхөөрөмжүүд ноцтой байдлын түвшний өөр өөр оноолттой бөгөөд тэдгээрийг event_severity болон event_severity_level талбаруудад Security Data Lake схемийн ноцтой байдлын түвшинд харгалзуулдаг.

vendor_event_severity_severity	vendor_event_severity	event_severity_level	event_severity
0	Emergency	5	critical
1	Alert	5	critical
2	Critical	5	critical
3	Error	4	high
4	Warning	3	medium
5	Notice	2	low
6	Info	1	informational
7	Debug	1	informational

Spotlight content pack

Spotlight контент багц дараахыг агуулна:

Dashboard: SonicWall NGFW Overview
- Overview tab: SonicWall төхөөрөмжийн үйл ажиллагааны хураангуй.
- Alerts tab: SonicWall-ийн GIM-ээр ангилсан alert-уудын хураангуй
- Network tab: Сүлжээний траффикийн хураангуй
- VPN tab: VPN үйл ажиллагааны хураангуй
Saved search: SonicWall NGFW alert log viewer
- SonicWall NGFW-ийн GIM-ээр ангилсан аюулгүй байдлын alert-уудыг харах
Saved search: SonicWall NGFW log viewer - filtered
- SonicWall NGFW логийг үйлдвэрлэгчийн ноцтой байдлаар хамгийн эгзэгтэй түвшнээс (0 - Emergency) хамгийн бага түвшин (7 - debug) хүртэл шүүх
Saved search: SonicWall NGFW log viewer
- SonicWall NGFW үйл явдлын лог мессежийг харах saved search
Saved search: SonicWall NGFW VPN log viewer
- SonicWall NGFW VPN, SSL VPN, L2TP болон portal мессежүүдийг харах saved search

Энэ хуудсанд гарсан нэр томъёо

Endpoint: Хамгаалж буй компьютер, сервер, виртуал машин
Policy: Хамгаалалтын тохиргооны багц; төхөөрөмж эсвэл бүлэгт оноодог
Network: Таны байгууллагын бүх төхөөрөмжийн жагсаалт (Inventory)

Асуулт байна уу?AI туслах GravityZone-ийн монгол баримтаас хайна. Нарийн асуудлыг таны гэрээт борлуулагч, Bitdefender Mongolia-ийн инженер шийднэ.