Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Announcement: Try the Ask AI chatbot for answers to your technical questions about Juniper products and solutions.

close
header-navigation
keyboard_arrow_up
close
keyboard_arrow_left
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
keyboard_arrow_right

AWS Network Firewall Sample Event Messages

date_range 01-May-22

Use these sample event messages to verify a successful integration with JSA.

Note:

Due to formatting issues, paste the message format into a text editor and then remove any carriage return or line feed characters.

Amazon AWS Network Firewall sample messages when you use the Amazon AWS REST API protocol

Sample 1 - alert logs: The following sample event message shows that a connection is allowed by the firewall.

content_copy zoom_out_map
{"firewall_name":"firewall","availability_zone":"zone","event_timestamp":"1601074865","event":
{"timestamp":"2020-09-25T23:01:05.598481+0000","flow_id":1111111111111111,"event_type":"alert","
src_ip":"10.16.197.56","src_port":49157,"dest_ip":"10.16.197.55","dest_port":8883,"proto":"TCP",
"alert":
{"action":"allowed","signature_id":2,"rev":0,"signature":"","category":"","severity":3}}}
Table 1: Highlighted Fields

JSA field name

Highlighted payload field name

Logsource Time

timestamp

Event ID

event_type + action

Source IP

src_ip

Source Port

src_port

Destination IP

dest_ip

Destination Port

dest_port

Protocol

proto

Sample 2 - flow logs: The following sample event message shows netflow traffic.

content_copy zoom_out_map
{"firewall_name":"firewall","availability_zone":"useast-
1b","event_timestamp":"1601587565","event":
{"timestamp":"2020-10-01T21:26:05.007515+0000","flow_id":1770453319291727,"event_type":"netflow"
,"src_ip":"45.129.33.153","src_port":47047,"dest_ip":"172.31.16.139","dest_port":16463,"proto":"
TCP","netflow":
{"pkts":1,"bytes":60,"start":"2020-10-01T21:25:04.070479+0000","end":"2020-10-01T21:25:04.070479
+0000","age":0,"min_ttl":241,"max_ttl":241},"tcp":{"tcp_flags":"02","syn":true}}}
Table 2: Highlighted Fields

JSA field name

Highlighted payload field name

Logsource Time

timestamp

Event ID

event_type

Source IP

src_ip

Source Port

src_port

Destination IP

dest_ip

Destination Port

dest_port

Protocol

proto

footer-navigation