AWS Network Firewall Sample Event Messages

Use these sample event messages to verify a successful integration with JSA.

Note:

Due to formatting issues, paste the message format into a text editor and then remove any carriage return or line feed characters.

Amazon AWS Network Firewall sample messages when you use the Amazon AWS REST API protocol

Sample 1 - alert logs: The following sample event message shows that a connection is allowed by the firewall.

Table 1: Highlighted Fields

JSA field name	Highlighted payload field name
Logsource Time	timestamp
Event ID	event_type + action
Source IP	src_ip
Source Port	src_port
Destination IP	dest_ip
Destination Port	dest_port
Protocol	proto

Sample 2 - flow logs: The following sample event message shows netflow traffic.

Table 2: Highlighted Fields

JSA field name	Highlighted payload field name
Logsource Time	timestamp
Event ID	event_type
Source IP	src_ip
Source Port	src_port
Destination IP	dest_ip
Destination Port	dest_port
Protocol	proto