Firewall Rule
firewall_rule
The Firewall Rule object represents a specific rule within a firewall policy or event. It contains information about a rule's configuration, properties, and associated actions that define how network traffic is handled by the firewall.
Attributes
| Caption | Name | Type | Description |
|---|---|---|---|
| Category | category | String | The rule category. |
| Condition | condition | String | The rule trigger condition for the rule. For example: SQL_INJECTION. |
| Description | desc | String | The description of the rule that generated the event. |
| Duration Milliseconds | duration | Long | The rule response time duration, usually used for challenge completion time. |
| Match Details | match_details | String[] | The data in a request that rule matched. For example: '["10","and","1"]'. |
| Match Location | match_location | String | The location of the matched data in the source which resulted in the triggered firewall rule. For example: HEADER. |
| Name | name | String | The name of the rule that generated the event. |
| Rate Limit | rate_limit | Integer | The rate limit for a rate-based rule. |
| Raw Data | raw_data | JSON | Group:contextThe event data as received from the event source. |
| Record ID | record_id | String | Group:primaryUnique identifier for the object |
| Sensitivity | sensitivity | String | The sensitivity of the firewall rule in the matched event. For example: HIGH. |
| Type | type | String | The rule type. |
| Unique ID | uid | String | The unique identifier of the rule that generated the event. |
| Unmapped | unmapped | Unmapped[] | Data from the source that was not mapped into the schema. |
| Version | version | String | The rule version. For example: 1.1. |
Relationships
Inbound Relationships
These objects and events reference Firewall Rule in their attributes:
- User Session Query
- SMB Activity
- Remediation Activity
- Base Event
- Datastore Activity
- Kernel Object Query
- Account Change
- Network Activity
- Software Inventory Info
- Networks Query
- Email File Activity
- Module Query
- Vulnerability Finding
- Live Evidence Info
- Tunnel Activity
- Startup Item Query
- File Remediation Activity
- Admin Group Query
- Job Query
- DHCP Activity
- Module Activity
- Process Query
- Memory Activity
- Entity Management
- Process Activity
- Process Remediation Activity
- Registry Key Activity
- Registry Value Query
- Device Inventory Info
- Application Lifecycle
- Event Log Activity
- Registry Value Activity
- Kernel Activity
- OSINT Inventory Info
- File Query
- NTP Activity
- HTTP Activity
- User Query
- Authorize Session
- Prefetch Query
- File System Activity
- User Access Management
- Application Error
- Device Config State Change
- Data Security Finding
- Security Finding
- FTP Activity
- Registry Key Query
- User Inventory Info
- Application Security Posture Finding
- API Activity
- SSH Activity
- Detection Finding
- Peripheral Device Query
- Windows Service Activity
- Web Resources Activity
- Authentication
- Network File Activity
- Group Management
- Network Connection Query
- IAM Analysis Finding
- Email URL Activity
- Incident Finding
- Drone Flights Activity
- Network Remediation Activity
- Operating System Patch State
- Scan Activity
- Kernel Extension Activity
- Device Config State
- Cloud Resources Inventory Info
- Folder Query
- Airborne Broadcast Activity
- DNS Activity
- Windows Resource Activity
- Email Activity
- File Hosting Activity
- Scheduled Job Activity
- RDP Activity
- Compliance Finding
- Web Resource Access Activity
- Script Activity
- Service Query
Outbound Relationships
Firewall Rule references the following objects and events in its attributes:
This page describes qdm-1.5.1+ocsf-1.6.0