D

detail

Additional information on the vulnerable software version.

String of characters in UTF-8 format.

Example: detail="PHP_5.2.3".

Affected logs: l_pvm.

Details

discovery

Date on which the security watch team published the vulnerability (only if the level of severity is higher than “0”)

String in “YYYY-MM-DD” format.

Example: discovery="2023-10-12".

Affected logs: l_pvm.

Discovered on

Format: depends on the language of the operating system on which the administration suite was installed. Example: “DD/MM/YYYY” and “HH:MM:SS” for French; “YYYY/MM/DD” and “HH:MM:SS” for English.
domain

Authentication method used or LDAP directory of the user authenticated by the firewall.

String of characters in UTF-8 format.

Example: domain="documentation.stormshield.eu"

Available from: SNS v3.0.0.

Affected logs: l_alarm, l_auth, l_connection, l_plugin, l_server, l_ssl, l_web and l_xvpn.
Method or directory
downrate

Indicates the percentage of time the gateway could not be reached over the last 15 minutes.

String of characters in UTF-8 format.

Example: downrate=0.

Available from: SNS v4.3.0.

Affected logs: l_routerstat.
dst

IP address of the destination host
Decimal format.
Example: "192.168.0.2"
Available from: v1.0.0 SNS

Affected logs: l_alarm, l_connection, l_filter, l_ftp, l_plugin, l_pop3, l_sandboxing, l_smtp, l_ssl, l_vpn and l_web, l_dmrouting.
Destination
dstcontinent

Continent to which the destination IP address of the connection belongs.
Value: continent's ISO code
Example: dstcontinent="eu"
Available from: SNS v3.0.0.

Affected logs: l_alarm, l_connection, l_filter, l_plugin, l_pop3, l_sandboxing, l_smtp, l_ssl and l_web.
Destination continent
dstcountry

Country to which the destination IP address of the connection belongs.
Format: country's ISO code
Example: dstcountry="fr"
Available from: v3.0.0 SNS

Affected logs: l_alarm, l_connection, l_filter, l_ftp, l_plugin, l_pop3, l_sandboxing, l_smtp, l_ssl, l_vpn and l_web.
Destination country
dsthostrep

Reputation of the connection's target hosts Available only if reputation management has been enabled for the relevant hosts.
Format: unrestricted integer.
Example: dsthostrep=41
Available from: v3.0.0 SNS

Affected logs: l_alarm, l_connection, l_filter, l_plugin, l_pop3, l_sandboxing, l_smtp, l_ssl and l_web.
Destination host reputation
dstif

Name of the destination interface.
String of characters in UTF-8 format.
Example: dstif=Ethernet 1.
Available from: SNS v1.0.0.

Affected logs: l_alarm, l_connection, l_filter and l_plugin, l_dmrouting.
Dest. interf. (ID)
dstifname

Name of the object representing the traffic’s destination interface.
String of characters in UTF-8 format.
Example: dstifname=dmz1.
Available from: SNS v1.0.0.

Affected logs: l_alarm, l_connection, l_filter and l_plugin, l_dmrouting.
Dest. interf.
dstiprep

Reputation of the destination IP address. Available only if this IP address is public and listed in the IP address reputation base.
Values: "anonymizer", "botnet", "malware", "phishing", "tor", "scanner" or "spam".
Example: dstiprep=spam.
Available from: SNS v3.0.0.

Affected logs: l_alarm, l_connection, l_filter, l_plugin, l_pop3, l_sandboxing, l_smtp, l_ssl and l_web.
Public reputation of the destination IP address
dstmac

MAC address of the destination host.
Format: Hexadecimal values separated by ":".
Example: dstmac=00:25:90:01:ce:e7
Available from: SNS v4.0.0.

Affected logs: l_alarm, l_connection and l_plugin.
Destination MAC address
dstname

Name of the object corresponding to the IP address of the destination host.
String of characters in UTF-8 format.
Example: dstname=intranet_server.
Available from: SNS v1.0.0.

Affected logs: l_alarm, l_connection, l_filter, l_ftp, l_plugin, l_pop3, l_sandboxing, l_smtp, l_ssl, l_vpn, l_web and l_xvpn, l_dmrouting.
Destination name
dstport

Destination TCP/UDP port number.
Example: dstport=22.
Available from: SNS v1.0.0.

Affected logs: l_alarm, l_connection, l_filter, l_ftp, l_plugin, l_pop3, l_sandboxing, l_smtp, l_ssl, l_web and l_xvpn.
Destination port
dstportname

Name of the object corresponding to the destination port.
String of characters in UTF-8 format.
Example: dstportname=ssh.
Available from: SNS v1.0.0.

Affected logs: l_alarm, l_connection, l_filter, l_ftp, l_plugin, l_pop3, l_sandboxing, l_smtp, l_ssl, l_web and l_xvpn.
Dest. port name

DtrackMem

Percentage of memory used for data tracking (TCP/UDP packets).

Value from “0” to “100”.

Affected logs: l_filterstat.
duration Duration of the connection in seconds.
Decimal format.
Example: "173.15"
Duration
Example: "2m 53s 15"

DynamicMem

Percentage of the ASQ’s dynamic memory in use.

Value from “0” to “100”.

Affected logs: l_filterstat.