Event-o-Pedia URL Blocked

	Event Details
	Operating System->Syslog->Juniper JUNOS->10.3->URL Blocked

URL Blocked

A web request is blocked.

Sample:

Jun 23 14:02:19  firewall utmd[1038]: WEBFILTER_URL_BLOCKED: WebFilter: ACTION="URL Blocked" 10.10.10.10(51916)->194.71.107.15(80) CATEGORY="Remote_Proxies" REASON="by predefined category" PROFILE="surf-control" URL=thepiratebay.com OBJ=/favicon.ico

Log Type:

Generic Syslog

Uniquely Identified By:

OS Type:

Any

Filtering RegExp:

^(?:<(\d{1,2}|1[0-8]\d||19[01])>)?(\d*)?\s*((?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (?: \d|[12]\d|3[01]) (?:[01]\d|2[0-3]):[0-5][0-9]:[0-5][0-9])?\s+(\w+)\s+(\w+)\s?\[?(\d+)\]?:? (WEBFILTER_URL_BLOCKED):? (?:\[junos@2636\.((?:\d+\.){4}\d+).*\] )?(WebFilter: ACTION="(URL Blocked)" ((?:\d{1,3}\.){3}\d{1,3})\((\d+)\)->((?:\d{1,3}\.){3}\d{1,3})\((\d+)\) CATEGORY="([^"]*)" REASON="([^"]*)" PROFILE="([^"]*)" URL=([^ ]+) OBJ=(.*))

Field Matching

Field	Description	Stored in	Sample Value
Severity	Specify the seriousness of the event.	Expression
Facility		Expression
Priority	Number that indicates the message's facility and severity.	RegExpGroup1
HostName	Name of the host that originally generated the message.	RegExpGroup4	firewall
Tag	System log message tag, which uniquely identifies the message.	RegExpGroup7	WEBFILTER_URL_BLOCKED
Message	Description of the event or error	RegExpGroup9	WebFilter: ACTION="URL Blocked" 10.10.10.10(51916)->194.71.107.15(80) CATEGORY="Remote_Proxies" REASON="by predefined category" PROFILE="surf-control" URL=thepiratebay.com OBJ=/favicon.ico
DateTime	Date/Time of event origination in GMT format.	DateTime
LogName	The name of the event log (e.g. Application, Security, System, etc.).	"syslog"	syslog
Computer	Name of server workstation where event was logged.	Computer
Process	Name of the Junos process that generated the message.	RegExpGroup5	utmd
ProcessID	UNIX process ID (PID) of the Junos process that generated the message.	RegExpGroup6	1038
MessageText	Description of the event or error	RegExpGroup9	WebFilter: ACTION="URL Blocked" 10.10.10.10(51916)->194.71.107.15(80) CATEGORY="Remote_Proxies" REASON="by predefined category" PROFILE="surf-control" URL=thepiratebay.com OBJ=/favicon.ico
Action		RegExpGroup10	URL Blocked
SourceAddress		RegExpGroup11	10.10.10.10
SourcePort		RegExpGroup12	51916
DestinationAddress		RegExpGroup13	194.71.107.15
DestinationPort		RegExpGroup14	80
Category		RegExpGroup15	Remote_Proxies
Reason		RegExpGroup16	by predefined category
Profile		RegExpGroup17	surf-control
URL		RegExpGroup18	thepiratebay.com
Obj		RegExpGroup19	/favicon.ico
PlatformType		RegExpGroup8