---
title: "firewall.all.traffic"
canonical: "https://docs.devo.com/space/latest/95126157/firewall.all.traffic"
format: markdown
---
> Macro (toc)

## Scope

This union table collects information from multiple tables containing firewall traffic events from a range of firewall manufacturers. Working with this table will allow you to monitor activity and control incoming and outgoing network traffic.

## Send data to Devo

Among the 49 compatible data sources, the most popular and security-critical are listed below. In most cases, you will need to [define a relay rule](https://docs.devo.com/space/latest/96469377) that correctly identifies the event type and applies the corresponding tag.

- [Fortinet](https://docs.devo.com/space/latest/94663604/firewall.fortinet)
- [Palo Alto](https://docs.devo.com/space/latest/94663642/firewall.paloalto)
- [Cisco](https://docs.devo.com/space/latest/94663174/firewall.cisco)
- [Sonicwall](https://docs.devo.com/space/latest/94663463/firewall.sonicwall)

## Source tables

The information displayed is extracted from the following tables: 

<details>
<summary>Check source tables</summary>

- `adn.f5.bigip.afm`
- `adn.f5.bigip.asm`
- `box.iptables`
- `cef0.checkPoint.vpn1Firewall1`
- `cef0.cisco.asa`
- `cef0.cisco.firepower`
- `cef0.forcepoint.firewall`
- `cef0.fortinet.fortigateAll`
- `cef0.paloAltoNetworks.lf`
- `cef0.paloAltoNetworks.panOs`
- `cef0.stonesoft.firewall`
- `cef0.stonesoft.stonegate`
- `cef0.zscaler.nssfwlog`
- `cloud.azure.firewall.application_rule`
- `cloud.azure.firewall.network_rule`
- `cloud.cloudflare.logpush.http`
- `edr.crowdstrike.falconstreaming.firewall_match`
- `firewall.checkpoint.fw`
- `firewall.checkpoint.gaia`
- `firewall.checkpoint.lea`
- `firewall.checkpoint.log_exporter`
- `firewall.cisco.asa`
- `firewall.cisco.fmc`
- `firewall.cisco.fmc_estreamer`
- `firewall.cisco.ftd`
- `firewall.cisco.fwsm`
- `firewall.cisco.pix`
- `firewall.fortinet.traffic`
- `firewall.juniper.isg.traffic`
- `firewall.juniper.nsm.traffic`
- `firewall.juniper.srx.traffic`
- `firewall.juniper.ssg.traffic`
- `firewall.meraki.flows`
- `firewall.paloalto.traffic`
- `firewall.pfsense.filterlog`
- `firewall.pfsense.firewall`
- `firewall.sangfor.app_control.event`
- `firewall.sonicwall.genv58`
- `firewall.sophos.securenet.packetfilter`
- `firewall.sophos.xgfirewall.firewall`
- `firewall.stonegate.leef`
- `firewall.stonegate.xml`
- `firewall.velocloud.traffic`
- `firewall.vyatta.traffic`
- `firewall.watchguard.traffic`
- `network.meraki.firewall`
- `network.meraki.l7_firewall`
- `proxy.zscaler.nss_firewall`
- `proxy.zscaler.zia.firewall`
</details>

## Secure it

Use the [firewall](https://devodocs.atlassian.net/wiki/spaces/latest/pages/2206367761/Query+and+alert+library#NETWORK%2FFIREWALL) queries from the library.

## Field transformations

Even though all source tables have several features in common, they have some particularities that make it necessary to undergo a set of transformations to harmonize them for the union table. The most common transformations comprise changes in the data type or the application of rules when several columns in the source table feed a single column in the union table. You can find below the detailed list of transformations in each source table.

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> - [adn.f5.bigip.afm](#)
> - [adn.f5.bigip.asm](#)
> - [box.iptables](#)
> - [cef0.checkPoint.vpn1Firewall1](#)
> - [cef0.cisco.asa](#cef0.cisco.asa)
> - [cef0.cisco.firepower](#)
> 
> ### > Macro (anchor)
> 
> adn.f5.bigip.afm
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "adn.f5.bigip.afm"
> ``` | `str` |  |
> | *hostname* | *hostName* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> decode(action, 'Accept', 'accept', 'Drop', 'deny', 'Reject', 'deny', action)
> ``` | `str` |  |
> | *reason* | *dropReason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *aclRuleName* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> adn.f5.bigip.asm
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "adn.f5.bigip.asm"
> ``` | `str` |  |
> | *hostname* | *hostName* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *requestStatus* | ```
> decode(requestStatus, 'passed', 'accept', 'blocked', 'deny', 'alerted', 'alerted', requestStatus)
> ``` | `str` |  |
> | *reason* | *violations* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *policyName* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *x_fwd_hdr_val*<br>*xForwardedForHeaderValue* | ```
> isnotnull(xForwardedForHeaderValue) ? str(xForwardedForHeaderValue) : isnotnull(x_fwd_hdr_val) ? str(x_fwd_hdr_val) : null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> box.iptables
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "iptables"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *logprefix* | ```
> (logprefix -&gt; 'ACCEPT') ? 'accept' : (logprefix -&gt; 'DENY') ? 'deny' : (logprefix -&gt; 'REJECT') ? 'reject' : null('')
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.checkPoint.vpn1Firewall1
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "checkpoint"
> ``` | `str` |  |
> | *hostname* | *hostchain* | ```
> split(hostchain, "=", 0)
> ``` | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *act* | ```
> (lower(act) = 'reject') ? 'deny' : (lower(act) = 'drop') ? 'drop' : lower(act)
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *cs1*<br>*cs2*<br>*cs2Label* | ```
> cs2Label = "Rule Name" ? cs2 : cs1
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` | **✓** |
> | *hostchain* | *hostchain* |  | `str` |  |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.cisco.asa
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "cef0.cisco.asa"
> ``` | `str` |  |
> | *hostname* | *hostchain* | ```
> split(hostchain, "=", 0)
> ``` | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *act* | ```
> (act in {'permitted', 'Built', 'est-allowed', 'executed', 'Pre-allocate SIP SIGNALLING UDP secondary channel', 'Pre-allocate SIP Via UDP secondary channel', 'Retrieved', 'granted', 'built', 'Teardown', 'teardown', 'assigned a session'}) ? 'accept' : (act in {'Deny', 'denied', 'Denied', 'Inbound TCP connection denied', 'No matching connection for ICMP', 'discarded', 'Duplicate TCP SYN'}) ? 'deny' : (act in {'AAA user authentication Successful', 'User authentication failed', 'Login permitted', 'User authentication succeeded', 'User logged out', 'User priv level changed', 'WebVPN session started', 'User', 'Username', 'authentication', 'Authorization', 'logout', 'WebVPN session terminated', 'Stored'}) ? 'user' : null('')
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *cs1* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *destinationTranslatedAddress* | ```
> str(destinationTranslatedAddress)
> ``` | `str` |  |
> | *firewall_ip* | *dvc* | ```
> str(dvc)
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` | **✓** |
> | *hostchain* | *hostchain* |  | `str` |  |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.cisco.firepower
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "cef0.cisco.firepower"
> ``` | `str` |  |
> | *hostname* | *hostname* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *act* | ```
> (act = 'Allow') ? 'accept' : 'deny'
> ``` | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *cs2* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` | **✓** |
> | *hostchain* | *hostchain* |  | `str` |  |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [cef0.forcepoint.firewall](#)
> - [cef0.fortinet.fortigateAll](#)
> - [cef0.paloAltoNetworks.lf](#)
> - [cef0.paloAltoNetworks.panOs](#)
> 
> ### > Macro (anchor)
> 
> cef0.forcepoint.firewall
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "forcepoint"
> ``` | `str` |  |
> | *hostname* | *hostchain* | ```
> split(hostchain, "=", 0)
> ``` | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *act* | ```
> (act = 'Allow') ? 'accept' : 'deny'
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *cs1* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *dvc* | ```
> str(dvc)
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` | **✓** |
> | *hostchain* | *hostchain* |  | `str` |  |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.fortinet.fortigateAll
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "fortinet"
> ``` | `str` |  |
> | *hostname* | *hostchain* | ```
> split(hostchain, "=", 0)
> ``` | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *act* |  | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` | **✓** |
> | *hostchain* | *hostchain* |  | `str` |  |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.paloAltoNetworks.lf
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "paloalto"
> ``` | `str` |  |
> | *hostname* | *hostname* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *act* | ```
> (act = 'Allow') ? 'accept' : act
> ``` | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *cs1* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` | **✓** |
> | *hostchain* | *hostchain* |  | `str` |  |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.paloAltoNetworks.panOs
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "paloalto"
> ``` | `str` |  |
> | *hostname* | *hostchain* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *signatureID* | ```
> (signatureID = 'start') ? 'accept' : 'deny'
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *cs1* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *dvchost* | ```
> str(dvchost)
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` | **✓** |
> | *hostchain* | *hostchain* |  | `str` |  |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [cef0.stonesoft.firewall](#)
> - [cef0.stonesoft.stonegate](#)
> - [cef0.zscaler.nssfwlog](#)
> - [cloud.azure.firewall.application_rule](#)
> 
> ### > Macro (anchor)
> 
> cef0.stonesoft.firewall
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "stonegate"
> ``` | `str` |  |
> | *hostname* | *hostchain* | ```
> split(hostchain, "=", 0)
> ``` | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *act* | ```
> (act = 'Allow') ? 'accept' : 'deny'
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *cs1* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *dvc* | ```
> str(dvc)
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` | **✓** |
> | *hostchain* | *hostchain* |  | `str` |  |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.stonesoft.stonegate
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "stonegate"
> ``` | `str` |  |
> | *hostname* | *hostchain* | ```
> split(hostchain, "=", 0)
> ``` | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *act* | ```
> (act = 'Allow') ? 'accept' : 'deny'
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *cs1* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *dvc* | ```
> str(dvc)
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` | **✓** |
> | *hostchain* | *hostchain* |  | `str` |  |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> cef0.zscaler.nssfwlo
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "cef0 zscaler nssfwlog"
> ``` | `str` |  |
> | *hostname* | *hostchain* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *act* | ```
> (act -&gt; 'Allow') ? 'accept' : (act -&gt; 'Drop') ? 'drop' : (act -&gt; 'Reset') ? 'drop' : null('')
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` | **✓** |
> | *hostchain* | *hostchain* |  | `str` |  |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> cloud.azure.firewall.application_rule
> 
> | ***Field in union table*** | ***Field in source table*** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "azure"
> ``` | `str` |  |
> | *hostname* | *hostname* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action -&gt; 'Allow') ? 'accept' : (action -&gt; 'Deny') ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [cloud.azure.firewall.network_rule](#)
> - [cloud.cloudflare.logpush.http](#)
> - [edr.crowdstrike.falconstreaming.firewall_match](#edr.crowdstrike.falconstreaming.firewall_match)
> - [firewall.checkpoint.fw](#)
> - [firewall.checkpoint.gaia](#)
> 
> ### > Macro (anchor)
> 
> cloud.azure.firewall.network_rule
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "azure"
> ``` | `str` |  |
> | *hostname* | *hostname* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action -&gt; 'Allow') ? 'accept' : (action -&gt; 'Deny') ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> cloud.cloudflare.logpush.http
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "cloud.cloudflare.logpush.http"
> ``` | `str` |  |
> | *hostname* | *hostname* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *WAFAction* | ```
> decode(WAFAction, 'challenge allow', 'allow', 'drop', 'deny', WAFAction)
> ``` | `str` |  |
> | *reason* | *WAFRuleMessage* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *WAFRuleID* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> edr.crowdstrike.falconstreaming.firewall_match
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> 'edr.crowdstrike.falconstreaming.firewall_match'
> ``` | `str` |  |
> | *hostname* | *hostchain* | ```
> split(hostchain, "=", 0)
> ``` | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *ruleAction* | ```
> (ruleAction = '1') ? 'accept' : 'deny'
> ``` | `str` |  |
> | *reason* | *ruleDescription* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *ruleName* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.checkpoint.fw
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "checkpoint"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action = 'reject') ? 'deny' : (action = 'drop') ? 'drop' : action
> ``` | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *rule* | ```
> str(rule)
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *fwIp* | ```
> str(fwIp)
> ``` | `str` |  |
> | *firewall_ip* | *fwIp* | ```
> str(fwIp)
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.checkpoint.gaia
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "checkpoint"
> ``` | `str` |  |
> | *hostname* | *hostchain* | ```
> split(hostchain, "=", 0)
> ``` | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action = 'reject') ? 'deny' : (action = 'drop') ? 'drop' : action
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *rule* | ```
> str(rule)
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` | **✓** |
> | *hostchain* | *hostchain* |  | `str` |  |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [firewall.checkpoint.lea](#)
> - [firewall.checkpoint.log_exporter](#)
> - [firewall.cisco.asa](#)
> - [firewall.cisco.fmc](#)
> 
> ### > Macro (anchor)
> 
> firewall.checkpoint.lea
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "checkpoint"
> ``` | `str` |  |
> | *hostname* | *hostchain* | ```
> split(hostchain, "=", 0)
> ``` | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action = 'reject') ? 'deny' : (action = 'drop') ? 'drop' : action
> ``` | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *rule* | ```
> str(rule)
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` | **✓** |
> | *hostchain* | *hostchain* |  | `str` |  |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.checkpoint.log_exporter
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "checkpoint log_exporter"
> ``` | `str` |  |
> | *hostname* | *host_aux* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action in {'Accept', 'Allow', 'Bypass', 'Key Install', 'Decrypt', 'Encrypt'}) ? 'accept' : (action in {'Block', 'Detect', 'Reject', 'Redirect'}) ? 'deny' : (action = 'Drop') ? 'drop' : action
> ``` | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *rule_name* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.cisco.asa
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "cisco asa"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action in {'permitted', 'Built', 'est-allowed', 'executed', 'Pre-allocate SIP SIGNALLING UDP secondary channel', 'Pre-allocate SIP Via UDP secondary channel', 'Retrieved', 'granted', 'built', 'Teardown', 'teardown', 'assigned a session'}) ? 'accept' : (action in {'Deny', 'denied', 'Denied', 'Inbound TCP connection denied', 'No matching connection for ICMP', 'discarded', 'Duplicate TCP SYN'}) ? 'deny' : (action in {'AAA user authentication Successful', 'User authentication failed', 'Login permitted', 'User authentication succeeded', 'User logged out', 'User priv level changed', 'WebVPN session started', 'User', 'Username', 'authentication', 'Authorization', 'logout', 'WebVPN session terminated', 'Stored'}) ? 'user' : null('')
> ``` | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *aclId* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *dstXIp* | ```
> str(dstXIp)
> ``` | `str` |  |
> | *firewall_ip* | *machine* | ```
> str(machine)
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.cisco.fmc
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "cisco fmc"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *accessControlRuleAction* | ```
> (accessControlRuleAction = 'Allow') ? 'accept' : (accessControlRuleAction = 'Block') ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *accessControlRuleName* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [firewall.cisco.fmc_estreamer](#)
> - [firewall.cisco.ftd](#)
> - [firewall.cisco.fwsm](#)
> - [firewall.cisco.pix](#)
> 
> ### > Macro (anchor)
> 
> firewall.cisco.fmc_estreamer
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "cisco fmc_estreamer"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *at_computed__firewallRuleAction* | ```
> (at_computed__firewallRuleAction = 'Allow' or at_computed__firewallRuleAction = 'Trust') ? 'accept' : (at_computed__firewallRuleAction = 'Block' or at_computed__firewallRuleAction = 'Block with reset') ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *at_computed__firewallRule* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.cisco.ftd
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "cisco ftd"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *accessControlRuleAction* | ```
> (accessControlRuleAction = 'Allow') ? 'accept' : (accessControlRuleAction = 'Block') ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *accessControlRuleName* | ```
> str(accessControlRuleName)
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.cisco.fwsm
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "cisco fwsm"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action in {'permitted', 'Built', 'est-allowed', 'executed', 'Pre-allocate SIP SIGNALLING UDP secondary channel', 'Pre-allocate SIP Via UDP secondary channel', 'Retrieved', 'granted', 'built', 'Teardown', 'teardown', 'assigned a session'}) ? 'accept' : (action in {'Deny', 'denied', 'Denied', 'Inbound TCP connection denied', 'No matching connection for ICMP', 'discarded', 'Duplicate TCP SYN'}) ? 'deny' : (action in {'AAA user authentication Successful', 'User authentication failed', 'Login permitted', 'User authentication succeeded', 'User logged out', 'User priv level changed', 'WebVPN session started', 'User', 'Username', 'authentication', 'Authorization', 'logout', 'WebVPN session terminated', 'Stored'}) ? 'user' : null('')
> ``` | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *aclId* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *dstXIp* | ```
> str(dstXIp)
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.cisco.pix
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "cisco pix"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action in {'permitted', 'Built', 'est-allowed', 'executed', 'Pre-allocate SIP SIGNALLING UDP secondary channel', 'Pre-allocate SIP Via UDP secondary channel', 'Retrieved', 'granted', 'built', 'Teardown', 'teardown', 'assigned a session'}) ? 'accept' : (action in {'Deny', 'denied', 'Denied', 'Inbound TCP connection denied', 'No matching connection for ICMP', 'discarded', 'Duplicate TCP SYN'}) ? 'deny' : (action in {'AAA user authentication Successful', 'User authentication failed', 'Login permitted', 'User authentication succeeded', 'User logged out', 'User priv level changed', 'WebVPN session started', 'User', 'Username', 'authentication', 'Authorization', 'logout', 'WebVPN session terminated', 'Stored'}) ? 'user' : null('')
> ``` | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *aclId* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *dstXIp* | ```
> str(dstXIp)
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [firewall.fortinet.traffic](#)
> - [firewall.juniper.isg.traffic](#)
> - [firewall.juniper.nsm.traffic](#)
> - [firewall.juniper.srx.traffic](#)
> 
> ###   > Macro (anchor)
> 
> firewall.fortinet.traffic
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "fortinet"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *status*<br>*action* | ```
> status ?: action
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *rule*<br>*policyID* | ```
> isnotnull(rule) ? str(rule) : str(policyID)
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.juniper.isg.traffic
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "juniper"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action -&gt; 'Permit') ? 'accept' : (action -&gt; 'Deny') ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *policyId* | ```
> str(policyId)
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *dstXIp* | ```
> str(dstXIp)
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.juniper.nsm.traffic
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "juniper"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action -&gt; 'accepted') ? 'accept' : (action -&gt; 'conn dropped') ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *details* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *policyName* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *dstXIp* | ```
> str(dstXIp)
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> str('deviceIp')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.juniper.srx.traffic
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "juniper"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action -&gt; 'CREATE') ? 'accept' : (action -&gt; 'DENY') ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *policy* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *dstXIp* | ```
> str(dstXIp)
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [firewall.juniper.ssg.traffic](#)
> - [firewall.meraki.flows](#)
> - [firewall.paloalto.traffic](#)
> - [firewall.pfsense.filterlog](#)
> 
> ### > Macro (anchor)
> 
> firewall.juniper.ssg.traffic
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "juniper"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action -&gt; 'Permit') ? 'accept' : (action -&gt; 'Deny') ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *policyId* | ```
> str(policyId)
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *dstXIp* | ```
> str(dstXIp)
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.meraki.flows
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "meraki"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action = 'allow') ? 'accept' : 'deny'
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *fwip* | ```
> str(fwip)
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.paloalto.traffic
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "paloalto"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action = 'allow') ? 'accept' : action
> ``` | `str` |  |
> | *reason* | *session_end_reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *rule* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *xff_ip* |  | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.pfsense.filterlog
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "pfsense"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *actionTaken* | ```
> (actionTaken -&gt; 'pass') ? 'accept' : (actionTaken -&gt; 'block') ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *reasonLogEntry* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *ruleNumber* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [firewall.pfsense.firewall](#)
> - [firewall.sangfor.app_control.event](#firewall.sangfor.app_control.event)
> - [firewall.sonicwall.genv58](#)
> - [firewall.sophos.securenet.packetfilter](#)
> - [firewall.sophos.xgfirewall.firewall](#)
> 
> ### > Macro (anchor)
> 
> firewall.pfsense.firewall
> 
> | **Field in union table** | **Field in custom table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "pfsense"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action -&gt; 'pass') ? 'accept' : (action -&gt; 'block') ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *rule* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.sangfor.app_control.event
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "sangfor.app_control"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action in {'allow', 'Allow'}) ? 'accept' : (action in {'Block', 'block'}) ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *policy_name* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.sonicwall.genv58
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "sonicwall.genv58"
> ``` | `str` |  |
> | *hostname* | *hostchain* | ```
> split(hostchain, "=", 0)
> ``` | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *c* | ```
> (band(c, 1024) = 1024) ? 'accept' : 'deny'
> ``` | `str` |  |
> | *reason* | *msg* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *rule* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.sophos.securenet.packetfilter
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "sophos"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action = 'drop') ? 'deny' : action
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *fwrule* | ```
> str(fwrule)
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.sophos.xgfirewall.firewall
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "sophos"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *status*<br>*log_subtype* | ```
> (status -&gt; 'Allow') ? 'accept' : (status -&gt; 'Deny') ? 'deny' : (log_subtype -&gt; 'Denied') ? 'deny' : (log_subtype -&gt; 'Allowed') ? 'accept' : null('')
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *fw_rule_id* | ```
> str(fw_rule_id)
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [firewall.stonegate.leef](#)
> - [firewall.stonegate.xml](#)
> - [firewall.velocloud.traffic](#)
> - [firewall.vyatta.traffic](#)
> 
> ### > Macro (anchor)
> 
> firewall.stonegate.leef
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "stonegate"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *eventID* | ```
> (eventID = 'Connection_Allowed') ? 'accept' : (eventID = 'Connection_Discarded') ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` | **✓** |
> | *hostchain* | *hostchain* |  | `str` |  |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.stonegate.xml
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "stonegate"
> ``` | `str` |  |
> | *hostname* | *machine* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action = 'Allow') ? 'accept' : (action in {'Refuse', 'Discard'}) ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *infomsg* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *rule_id* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *nodeid* | ```
> str(nodeid)
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> firewall.velocloud.traffic
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "velocloud"
> ``` | `str` |  |
> | *hostname* | *hostchain* | ```
> split(hostchain, "=", 0)
> ``` | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* |  | `str` |  |
> | *reason* | *reason* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
>   firewall.vyatta.traffic
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "vyata.traffic"
> ``` | `str` |  |
> | *hostname* | *hostchain* | ```
> split(hostchain, "=", 0)
> ``` | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action = 'PASS') ? 'accept' : (action = 'DROP') ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *rule_name* | ```
> str(rule_name)
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [firewall.watchguard.traffic](#)
> - [network.meraki.firewall](#network.meraki.firewall)
> - [network.meraki.l7_firewall](#network.meraki.l7_firewall)
> - [proxy.zscaler.nss_firewall](#)
> - [proxy.zscaler.zia.firewall](#)
> 
> ### > Macro (anchor)
> 
> firewall.watchguard.traffic
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "watchguard"
> ``` | `str` |  |
> | *hostname* | *hostchain* | ```
> split(hostchain, "=", 0)
> ``` | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* | ```
> (action in {'Allow', 'allow'}) ? 'accept' : (action -&gt; 'Deny') ? 'deny' : action
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *rule_name* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> network.meraki.firewall
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "meraki_firewall"
> ``` | `str` |  |
> | *hostname* | *unknown2* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *-* | ```
> null('')
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawSource* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> network.meraki.l7_firewall
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "meraki_l7"
> ``` | `str` |  |
> | *hostname* | *hostname* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *decision* | ```
> (decision -&gt; 'allowed') ? 'accept' : (decision -&gt; 'blocked') ? 'deny' : null('')
> ``` | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> proxy.zscaler.nss_firewall
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "zscaler nss_firewall"
> ``` | `str` |  |
> | *hostname* | *hostname* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* |  | `str` |  |
> | *reason* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *-* | ```
> null('')
> ``` | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> proxy.zscaler.zia.firewall
> 
> | **Field in union table** | **Field in source table** | **Field transformation** | **Type** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | *eventdate* |  | `timestamp` |  |
> | *source* | *-* | ```
> "zscaler zia firewall"
> ``` | `str` |  |
> | *hostname* | *hostname* |  | `str` |  |
> | *firewall_name* | *firewall_name* |  | `str` |  |
> | *firewall_cluster* | *firewall_cluster* |  | `str` |  |
> | *action* | *action* |  | `str` |  |
> | *reason* | *rulelabel* |  | `str` |  |
> | *source_ipv4* | *source_ipv4* |  | `ip4` |  |
> | *source_ip* | *source_ip* |  | `str` |  |
> | *destination_ipv4* | *destination_ipv4* |  | `ip4` |  |
> | *destination_ip* | *destination_ip* |  | `str` |  |
> | *source_port* | *source_port* |  | `str` |  |
> | *destination_port* | *destination_port* |  | `str` |  |
> | *source_zone* | *source_zone* |  | `str` |  |
> | *destination_zone* | *destination_zone* |  | `str` |  |
> | *application* | *application* |  | `str` |  |
> | *protocol* | *protocol* |  | `str` |  |
> | *rule* | *rulelabel* |  | `str` |  |
> | *source_interface* | *source_interface* |  | `str` |  |
> | *destination_interface* | *destination_interface* |  | `str` |  |
> | *source_service* | *source_service* |  | `str` |  |
> | *destination_service* | *destination_service* |  | `str` |  |
> | *packets_total* | *packets_total* |  | `int8` |  |
> | *packets_sent* | *packets_sent* |  | `int8` |  |
> | *packets_received* | *packets_received* |  | `int8` |  |
> | *bytes_total* | *bytes_total* |  | `int8` |  |
> | *bytes_sent* | *bytes_sent* |  | `int8` |  |
> | *bytes_received* | *bytes_received* |  | `int8` |  |
> | *source_username* | *source_username* |  | `str` |  |
> | *x_forwarded_for_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *firewall_ip* | *-* | ```
> null('')
> ``` | `str` |  |
> | *rawSource* | *rawMessage* |  | `str` | **✓** |
> | *rawMessage* | *rawMessage* |  | `str` |  |
> | *hostchain* | *hostchain* |  | `str` | **✓** |
> | *tag* | *tag* |  | `str` | **✓** |