---
title: "firewall.watchguard"
canonical: "https://docs.devo.com/space/latest/245006348/firewall.watchguard"
format: markdown
---
> Macro (toc)

## Introduction

Tags beginning with `firewall.watchguard` identify events generated by [WatchGuard](https://www.watchguard.com/).

## Valid tags and data tables

The full tag must have 3 levels. The first two are fixed as** **`firewall.watchguard`. The third level identifies the type of events sent, while the fourth indicates the product versioning.

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| WatchGuard Firewall | - `firewall.watchguard.traffic`
- `firewall.watchguard.traffic.v2` | `firewall.watchguard.traffic` |
|  | `firewall.watchguard.event` | `firewall.watchguard.event` |

## How is the data send to Devo?

Before sending WatchGuard events, make sure that the aliases don’t contain space characters (`" "`), as they are used to distinguish between different fields.

The procedure to check and modify the aliases is detailed [in this article](https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/policies/alias_create_c.html).

Example relay rules:

```
         Source message: 
            Source data: 
             Source tag: 
             Target tag: firewall.watchguard.traffic
Sent without syslog tag: true
        Stop processing: true
```

## Table structure

### firewall.watchguard.traffic

| **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- | --- |
| *eventdate* | `timestamp` |  | * * |  |
| *srcIP* | `ip4` |  | * * |  |
| *dstIP* | `ip4` |  | * * |  |
| *protocol* | `str` |  | * * |  |
| *srcPORT* | `int4` |  | * * |  |
| *dstPORT* | `int4` |  | * * |  |
| *proxy_act* | `str` |  | * * |  |
| *cats* | `str` |  | * * |  |
| *dstname* | `str` |  | * * |  |
| *sni* | `str` |  | * * |  |
| *cn* | `str` |  | * * |  |
| *cert_issuer* | `str` |  | * * |  |
| *cert_subject* | `str` |  | * * |  |
| *action* | `str` | ```
ifthenelse(isnotnull(action_), action_, ifthenelse(eq(disposition, "Allow"), "allow", ifthenelse(eq(disposition, "Deny"), "deny", null)))
``` | *action_*<br>*disposition* |  |
| *app_id* | `str` |  | * * |  |
| *app_name* | `str` |  | * * |  |
| *app_cat_id* | `str` |  | * * |  |
| *app_beh_name* | `str` |  | * * |  |
| *app_ctl_disp* | `str` |  | * * |  |
| *cat_name* | `str` |  | * * |  |
| *duration* | `str` |  | * * |  |
| *sent_bytes* | `str` |  | * * |  |
| *rcvd_bytes* | `str` |  | * * |  |
| *geo_src* | `str` |  | * * |  |
| *geo_dst* | `str` |  | * * |  |
| *serial_number* | `str` |  | * * |  |
| *fecha* | `timestamp` | ```
timestamp(fechad, +".000")
``` | *fechad* |  |
| *disposition* | `str` |  | * * |  |
| *interface* | `str` |  | * * |  |
| *external* | `str` |  | * * |  |
| *request* | `str` |  | * * |  |
| *area00* | `str` |  | * * |  |
| *area01* | `str` |  | * * |  |
| *proc_id* | `str` |  | * * |  |
| *rc* | `str` |  | * * |  |
| *service* | `str` |  | * * |  |
| *log_type* | `str` |  | * * |  |
| *msg_id* | `str` | ```
ifthenelse(isnull(msg_id_dstar), msg_id_aux, +msg_id_end, msg_id_dstar)
``` | *msg_id_dstar*<br>*msg_id_aux*<br>*msg_id_end* |  |
| *fqdn_dst_match* | `str` |  | * * |  |
| *srcInterface* | `str` |  | * * |  |
| *dstInterface* | `str` |  | * * |  |
| *num1* | `int4` |  | * * |  |
| *num2* | `int4` |  | * * |  |
| *num3* | `int4` |  | * * |  |
| *winVersion* | `str` | ```
ifthenelse(isnotnull(win1), (win1 + " " + win2 + " " + win3 + " " + win4 + " " + win5 + " " + __win6), null)
``` | *win4*<br>*__win6*<br>*win2*<br>*win3*<br>*win5*<br>*win1* |  |
| *msg* | `str` |  | * * |  |
| *line* | `str` |  | * * |  |
| *rule_name* | `str` |  | * * |  |
| *query_opcode* | `str` |  | * * |  |
| *header* | `str` |  | * * |  |
| *content_type* | `str` |  | * * |  |
| *method* | `str` |  | * * |  |
| *scheme* | `str` |  | * * |  |
| *op* | `str` |  | * * |  |
| *arg* | `str` |  | * * |  |
| *path* | `str` |  | * * |  |
| *elapsed_time* | `str` |  | * * |  |
| *reputation* | `str` |  | * * |  |
| *signature_name* | `str` |  | * * |  |
| *signature_cat* | `str` |  | * * |  |
| *signature_id* | `str` |  | * * |  |
| *sig_vers* | `str` |  | * * |  |
| *src_user* | `str` |  | * * |  |
| *id* | `str` |  | * * |  |
| *ip_packet_length* | `str` | ```
ifthenelse(isnotnull(_ip_packet_length), _ip_packet_length, str(num1))
``` | *_ip_packet_length*<br>*num1* |  |
| *ip_header_length* | `str` | ```
ifthenelse(isnotnull(_ip_header_length), _ip_header_length, str(num2))
``` | *_ip_header_length*<br>*num2* |  |
| *ttl* | `str` | ```
ifthenelse(isnotnull(_ttl), _ttl, str(num3))
``` | *_ttl*<br>*num3* |  |
| *new_action* | `str` |  | * * |  |
| *tls_profile* | `str` |  | * * |  |
| *tls_version* | `str` |  | * * |  |
| *seq* | `str` |  | * * |  |
| *severity* | `str` |  | * * |  |
| *type* | `str` |  | * * |  |
| *hostchain* | `str` |  | * * | **✓** |
| *tag* | `str` |  | * * | **✓** |
| *rawMessage* | `str` |  | *rawSource* | **✓** |