# NGFW (Firewalls)

Version 1.1

Please check back often as new fields are often added to align with changes in vendor logs.

| **Column Names**                  | **Data Type** |
| --------------------------------- | ------------- |
| agent.type                        | text          |
| destination.as.organization.name  | text          |
| destination.bytes                 | int           |
| destination.domain                | text          |
| destination.geo.city\_name        | text          |
| destination.geo.continent\_code   | text          |
| destination.geo.country\_code     | text          |
| destination.geo.country\_name     | text          |
| destination.geo.location.lat      | geopoint      |
| destination.geo.location.lon      | geopoint      |
| destination.geo.region\_name      | text          |
| destination.ip                    | ip            |
| destination.locality              | text          |
| destination.mac                   | text          |
| destination.nat.ip                | ip            |
| destination.nat.port              | int           |
| destination.packets               | int           |
| destination.port                  | int           |
| destination.service.name          | text          |
| destination.user.email            | text          |
| destination.user.id               | text          |
| destination.user.name             | text          |
| dns.id                            | int           |
| dns.question.name                 | text          |
| dns.question.type                 | text          |
| dns.type                          | text          |
| email.bcc.address                 | text          |
| email.cc.address                  | text          |
| email.delivery\_timestamp         | date/time     |
| email.from.address                | text          |
| email.local\_id                   | text          |
| email.message\_id                 | text          |
| email.subject                     | text          |
| email.to.address                  | text          |
| error.message                     | text          |
| event.action                      | text          |
| event.category                    | array         |
| event.created                     | date          |
| event.dataset                     | text          |
| event.id                          | text          |
| event.kind                        | text          |
| event.module                      | text          |
| event.original                    | text          |
| event.outcome                     | text          |
| event.reason                      | text          |
| event.severity                    | text          |
| event.type                        | array         |
| file.hash.md5                     | text          |
| file.hash.sha1                    | text          |
| file.hash.sha256                  | text          |
| file.inode                        | int           |
| file.name                         | text          |
| file.size                         | int           |
| file.type                         | text          |
| group.name                        | text          |
| host.hostname                     | text          |
| host.id                           | text          |
| host.ip                           | ip            |
| host.type                         | text          |
| http.request.method               | text          |
| http.request.referrer             | text          |
| log.source.address                | ip            |
| log.source.hostname               | text          |
| log.type                          | text          |
| message                           | text          |
| network.application               | text          |
| network.bytes                     | int           |
| network.community\_id             | text          |
| network.direction                 | text          |
| network.iana\_number              | text          |
| network.inner.vlan.name           | text          |
| network.name                      | text          |
| network.packets                   | int           |
| network.protocol                  | text          |
| network.transport                 | text          |
| network.type                      | text          |
| network.vlan.name                 | text          |
| observer.egress.interface.name    | text          |
| observer.egress.zone              | text          |
| observer.ingress.interface.name   | text          |
| observer.ingress.zone             | text          |
| observer.ip                       | text          |
| observer.mac                      | text          |
| observer.name                     | text          |
| observer.product                  | text          |
| observer.type                     | text          |
| observer.vendor                   | text          |
| observer.version                  | text          |
| organisation.id                   | text          |
| process.hash.md5                  | text          |
| process.name                      | text          |
| process.parent.hash.md5           | text          |
| process.parent.name               | text          |
| related.hash                      | array         |
| related.hosts                     | array         |
| related.ip                        | array         |
| related.user                      | array         |
| rule.category                     | text          |
| rule.description                  | text          |
| rule.id                           | text          |
| rule.name                         | text          |
| rule.ruleset                      | text          |
| rule.uuid                         | text          |
| sensor.id                         | text          |
| source.as.number                  | text          |
| source.as.organization.name       | text          |
| source.bytes                      | int           |
| source.domain                     | text          |
| source.geo.city\_name             | text          |
| source.geo.continent\_code        | text          |
| source.geo.country\_code          | text          |
| source.geo.country\_name          | text          |
| source.geo.location.lat           | geopoint      |
| source.geo.location.lon           | geopoint      |
| source.geo.region\_name           | text          |
| source.ip                         | ip            |
| source.locality                   | text          |
| source.mac                        | text          |
| source.nat.ip                     | ip            |
| source.nat.port                   | int           |
| source.packets                    | int           |
| source.port                       | int           |
| source.user.email                 | text          |
| source.user.group.name            | text          |
| source.user.id                    | text          |
| source.user.name                  | text          |
| threat.indicator.file.hash.sha256 | text          |
| threat.indicator.file.name        | text          |
| threat.indicator.reference        | text          |
| threatintel.days                  | int           |
| threatintel.entity                | text          |
| threatintel.event\_data           | text          |
| threatintel.lookup                | text          |
| threatintel.malware.malware       | text          |
| threatintel.malware.timestamp     | date/time     |
| threatintel.severity              | text          |
| threatintel.tags                  | text          |
| threatintel.white\_list           | text          |
| url.domain                        | text          |
| url.original                      | text          |
| url.original.text                 | text          |
| user\_agent.name                  | text          |
| user\_agent.original              | text          |
| user.name                         | text          |
| uuid                              | text          |
| vulnerability.id                  | text          |

\\


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.blusapphire.io/taxonomy/ngfw-firewalls.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.