Threat logs let you audit, verify, and analyze the threats detected in your network.
When Cloud Next Generation Firewall detects a threat on the traffic being
monitored for Layer 7 inspection, it generates a log entry
in the originating project with the details of the threat. To view and examine
the threat logs, in the Logs Explorer,
search for the log networksecurity.googleapis.com/firewall_threat.
You can also view these threat logs on the Threats page.
This page explains the format and structure of the threat logs that are generated when a threat is detected.
Threat log format
Cloud NGFW creates a log record entry in Cloud Logging for each threat detected on the monitored traffic to or from a virtual machine (VM) instance in a specific zone. Log records are included in the JSON payload field of a LogEntry.
Some log fields are in a multiple-field format, with more than one piece of data
in a given field. For example, the connection field is of the Connection
format, which contains the server IP address and port, the client IP address
and port, and the protocol number in a single field.
The following table describes the format of the threat log fields.
| Field | Type | Description |
|---|---|---|
connection
|
Connection
|
A 5-tuple that describes the connection parameters associated with the traffic where the threat is detected. |
action
|
string
|
The action performed on the packet where the threat is detected. This action can either be the default action or the override action specified in the security profile. |
threatDetails
|
ThreatDetails
|
The details of the threat detected. |
securityProfileGroupDetails
|
SecurityProfileGroupDetails
|
The details of the security profile group applied to the intercepted traffic. |
interceptVpc
|
VpcDetails
|
The details of the Virtual Private Cloud (VPC) network associated with the VM instance or the load balancer where the threat is detected.
For both VM instances and load balancer forwarding rules, the project that owns the VPC network serves as the logging project. |
interceptInstance
|
InterceptInstance
|
The details of the VM instance where the threat is detected. |
interceptLoadBalancer
|
LoadBalancingDetails |
The details of the load balancer where the threat is detected and the firewall rule is applied. |
Connection field format
The following table describes the format of the Connection field.
| Field | Type | Description |
|---|---|---|
clientIp
|
string
|
The client IP address. If the client is a Compute Engine VM, clientIp is either the primary internal IP address or an address in an alias IP range of the VM's network interface. The external IP address is not shown. The logs show the IP address of the VM instance as observed on the packet header, similar to the TCP dump on the VM instance.
|
clientPort
|