MELTr
Home Vendors Search Download
Login
Vendors / Check Point Software Technologies / Check Point Security Gateway / Firewall Traffic Logs
Check Point Software Technologies logo

Event type

Firewall Traffic Logs

Network traffic and policy enforcement events

Check Point Security Gateway firewall traffic logs capturing network connections, policy enforcement decisions, and traffic flow details including source/destination IPs, ports, protocols, and rule matching information.

PLAIN TEXT 31 fields High Generator

firewall network traffic security policy checkpoint
Preview Sample View Schema
CLI Install
meltr templates install checkpoint

Overview

What this event covers

Records all network traffic processed by Check Point Security Gateway, including accepted, dropped, and rejected connections with detailed policy matching and rule information.

When generated

  • ›When network packets traverse the firewall
  • ›When firewall policy rules are evaluated and matched
  • ›When traffic is accepted, dropped, or rejected based on policy
  • ›During ICMP, TCP, and UDP connection attempts
  • ›When traffic crosses security zones (Internal, External, DMZ)

Security relevance

High

Compliance

PCI-DSS (Requirement 1.2 - Network Security Controls) NIST 800-53 (SC-7 - Boundary Protection) ISO 27001 (A.13.1 - Network Security Management) HIPAA (164.312(e)(1) - Transmission Security) SOC 2 (CC6.6 - Logical and Physical Access Controls)

Frequency notes

Very high frequency during business hours (1500+ events/hour). Network traffic logs are among the most voluminous firewall log types, scaling with network activity and connection volumes.

Resources

Docs and tools

Check Point Log Exporter API Reference official Check Point Security Gateway Administration Guide official Check Point Log Format Reference official SmartConsole Logging and Monitoring official Check Point SmartConsole Unified security management console for viewing and analyzing firewall logs Check Point Log Exporter Tool for exporting Check Point logs to SIEM and log management platforms cpview Command-line monitoring tool for Check Point appliances

Generation

Configuration

Base frequency
500 events/hour
Time patterns
business_hours night_hours weekend
Business hours
3.0x
Night hours
0.4x
Weekend
0.6x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

time
Integer Required

Unix timestamp when the event occurred

Source: current_timestamp() | unix_timestamp

Format Unix epoch timestamp (seconds)
Example 1766266517
hostname
String Required

Hostname of the Check Point management server or security gateway

Source: registry.get_random_device().hostname

Example orgmgmt
product
String Required

Check Point product type generating the log

Source: Static value 'Firewall'

Example Firewall
layer_name
String Required

Name of the security policy layer that processed the traffic

Source: random_choice(['Internal-Policy Network', 'External-Policy Network', 'Standard Network', 'Security-Policy Network'])

Example Internal-Policy Network
Values
  • Internal-Policy Network Policy layer for internal network traffic
  • External-Policy Network Policy layer for external-facing traffic
  • Standard Network Default security policy layer
  • Security-Policy Network Enhanced security policy layer
layer_uuid
String Required

Unique identifier for the policy layer

Source: random_guid()

Format UUID (RFC 4122)
Example 1cfc5be4-cef8-4340-8217-3828ef6e9aa2
match_id
Integer Required

Rule number within the policy layer that matched the traffic

Source: random_int(1, 50)

Example 7
parent_rule
Integer Required

Parent rule identifier (0 indicates top-level rule)

Source: Static value 0

Example 0
rule_action
String Required

Action specified in the matched firewall rule

Source: random_weighted(['Accept', 'Drop', 'Reject'], [0.85, 0.10, 0.05])

Example Accept
Values
  • Accept Traffic is allowed through the firewall (85% probability)
  • Drop Traffic is silently discarded (10% probability)
  • Reject Traffic is rejected with notification (5% probability)
rule_name
String Required

Descriptive name of the firewall rule that matched

Source: random_choice(['Cleanup', 'Enterprise-Inbound', 'Allow-SCCP_SNMP', 'Rapid7 Scanning', 'VPN Access', 'Internet Access', 'DMZ Access', 'Internal Access', 'Stealth Rule'])

Example Rapid7 Scanning
rule_uid
String Required

Unique identifier for the firewall rule

Source: random_guid()

Format UUID (RFC 4122)
Example 29e5bb8c-7249-4682-936d-e4fcff0a5bea
action
String Required

Final action taken on the traffic (typically matches rule_action)

Source: random_weighted(['Accept', 'Drop', 'Reject'], [0.85, 0.10, 0.05])

Example Accept
ifdir
String Required

Direction of traffic relative to the firewall interface

Source: random_choice(['inbound', 'outbound'])

Example inbound
Values
  • inbound Traffic entering the firewall interface
  • outbound Traffic leaving the firewall interface
ifname
String Required

Network interface name where traffic was observed

Source: eth{random_int(0,3)}-{random_int(20,25)}

Format ethX-Y format
Example eth2-23
logid
Integer Required

Log message identifier (0 for standard traffic logs)

Source: Static value 0

Example 0
loguid
String Required

Unique log entry identifier in Check Point format

Source: Generated with random_hex() for each component

Format Four hexadecimal values in braces
Example {0x3cab6cc,0x90e12910,0x7a93992b,0x8f110a1b}
origin
String Required

IP address of the Security Gateway that generated the log

Source: random_private_ip()

Format IPv4 address
Example 10.40.55.33
originsicname
String Required

SIC (Secure Internal Communication) name of the originating gateway

Source: Constructed from device hostname and organization info

Format Distinguished Name format with escaped characters
Example CN=dst_Int-GW,O=ORGMGMT..ohuccs
sequencenum
Integer Required

Sequential log entry number

Source: random_int(100, 999)

Example 345
version
Integer Required

Log format version

Source: Static value 5

Example 5
src
String Required

Source IP address of the network connection

Source: random_private_ip()

Format IPv4 address
Example 10.40.5.162
dst
String Required

Destination IP address of the network connection

Source: random_weighted([random_private_ip(), random_public_ip()], [0.6, 0.4])

Format IPv4 address
Example 54.144.111.231
s_port
Integer Optional

Source port number (present for TCP/UDP traffic)

Source: random_port(1024, 65535)

Format 1024-65535 (ephemeral port range)
Example 59786
service
Integer Optional

Destination port number or service identifier

Source: random_choice([80, 443, 22, 23, 25, 53, 161, 162, 445, 3389, 8080, 8443, 9443])

Example 443
service_id
String Optional

Named service identifier for the destination port

Source: random_choice(['http', 'https', 'ssh', 'telnet', 'smtp', 'dns', 'snmp', 'snmp-trap', 'microsoft-ds', 'rdp', 'http-alt', 'https-alt', 'tcp-high-ports', 'echo-request', 'nbname', 'SCCP'])

Example https
proto
Integer Required

IP protocol number

Source: random_weighted([6, 17, 1], [0.7, 0.25, 0.05])

Format IANA protocol number
Example 6
Values
  • 6 TCP (Transmission Control Protocol) - 70% of traffic
  • 17 UDP (User Datagram Protocol) - 25% of traffic
  • 1 ICMP (Internet Control Message Protocol) - 5% of traffic
icmp
String Optional

ICMP message type description (present only for ICMP traffic)

Source: random_choice(['Echo Request', 'Echo Reply', 'Destination Unreachable', 'Time Exceeded'])

Example Echo Request
icmp_code
Integer Optional

ICMP message code (present only for ICMP traffic)

Source: random_int(0, 15)

Format 0-15
Example 0
icmp_type
Integer Optional

ICMP message type number (present only for ICMP traffic)

Source: random_int(0, 18)

Format 0-18
Example 8
inzone
String Required

Security zone of the incoming interface

Source: random_choice(['Internal', 'External', 'DMZ', 'Trusted'])

Example Internal
Values
  • Internal Internal corporate network zone
  • External External/Internet-facing zone
  • DMZ Demilitarized zone for public-facing services
  • Trusted Highly trusted network segment
outzone
String Required

Security zone of the outgoing interface

Source: random_choice(['Internal', 'External', 'DMZ', 'Trusted'])

Example Internal
member_id
String Required

Cluster member identifier for high-availability deployments

Source: random_choice(['1_2', '1_3', '2_1', '2_2'])

Format X_Y where X is cluster ID and Y is member number
Example 1_2