The firewall log format varies according to the vendor; however, there are some core fields that will be there regardless of the platform. When reviewing the firewall logs, you must a focus on primarily answering the following questions:
- Who started the communication (source IP)?
- Where is the destination of that communication (destination IP)?
- What type of application is trying to reach the destination (transport protocol and port)?
- Was the connection allowed or denied by the firewall?
The following code is an example of the Check Point firewall log; in this case, we are hiding the destination IP for privacy purposes:
"Date","Time","Action","FW.Name","Direction","Source","Destination","Bytes","Rules","Protocol" "datetime=26Nov2017","...
