Understanding Event Fields

Action that is relevant to the event type, for example:

Duration in milliseconds between the start and end of a transaction or operation. For example, in DNS or HTTP events, this reflects the time between the request and the corresponding response.

For DNS event sub-types

Name of the PoP the traffic egresses from, as defined in a Network Rule using a NAT or Route via configuration

The field is shown only when traffic egresses from a PoP other than the one the site is connected to

Cato's description of the event

For BGP route ignore action:

Name of the relevant file

Note: If the PoP can't capture the actual file name at the time of detection, then it uses the last part of the URL for the file name, such as download

File content type (such as Archive or Microsoft Office)

For File Control rules, form_data is a generic representation of data submitted through a web form, commonly used in HTTP requests (e.g., multipart form submissions). It doesn't indicate a distinct file type.

HTTP status code returned (ie. for DNS request, DNS-over-HTTPS (DoH) server when DoH is used)

For DNS and App Security event sub-types

The ISP used for this event

When the IP address isn't provided by the ISP, then the event message is IP Addresses are assigned statically

Note: For sites with multiple active WAN interfaces that use different ISPs, the ISP Name value might not be accurate because the interfaces can change over the lifetime of the traffic flow

For relevant IPS events, shows data based on the comprehensive Mitre Att&ck knowledge base of cyber adversaries

Name of the Network Rule matched by the traffic in this event

A value of 0 indicates that the flow experienced packet corruption issues, or was a system flow such as accessing the Socket WebUI

The public IP address assigned by the PoP that traffic egressed from. For sites that are using Internet Traffic Backauling as the routing method, this field shows the Local IP address of the Native Range for the site.

The field is not shown for traffic that doesn't egress from the PoP to the Internet, such as internal DNS requests and FTP traffic.

Type of query (ie. DNS query: A, AAAA, MX, or PTR)

For DNS and App Security event sub-types

A list of applications identified in the traffic flow for this event, as part of the application identification process.

This process analyzes the traffic at different stages of the flow, gathering information on all the protocols, services, and applications to make an accurate final determination of the application. This field provides context for the app identification by showing the apps identified throughout the stages of the process.

Request packet size in bytes (ie. DNS request packet)

For DNS and App Security event sub-types

Response packet size in bytes (ie. DNS response packet)

For DNS and App Security event sub-types

IPS event indicating the overall impact of a threat for the host or network:

Risk level low – minimal risk for network, such as adware

Risk level medium – medium risk for the network, such as network scans

Risk level high – significant risk for the network, such as spyware or worms

Shows if traffic in the event was TCP accelerated. Values are 1 (accelerated) and 0 (not accelerated)

The field appears only for TCP-based traffic flows

For anti-malware events, malware name

For IPS events, explains the reason why the traffic was blocked

Result of the anti-malware scan

Explanation of the TLS error in this event, values are:

close notify, unexpected message, bad record mac, decompression failure, handshake failure, no certificate, bad certificate, unsupported certificate, certificate revoked, certificate expired, certificate unknown, illegal parameter, decryption failed, record overflow, unknown CA, access denied, decode error, decrypt error, export restriction, protocol version, insufficient security, internal error, user canceled, no renegotiation, unknown PSK identity, unknown

For explanations of these errors, see this document

The type of TLS error for this event, values are:

Shows if traffic in the event was TLS. Values are 1 (inspected) and 0 (not inspected)

The field appears only for TLS traffic flows

Total transaction size in bytes, including both the request and response

For DNS and App Security event sub-types

The user agent used in the sign-in as it appears in the User Agent field in the HTTP header for the traffic. This field is only populated when the pop extracts its value from HTTP requests, which currently occurs in the following cases:

These are examples of user agent values:

A true/false value that indicates if this event is: