|
| 1 | +<?xml version="1.0"?> |
| 2 | +<device> |
| 3 | + <vendor>Juniper</vendor> |
| 4 | + <product>JunOS</product> |
| 5 | + <version id="16.2R1" /> |
| 6 | + <version id="17.1R1" /> |
| 7 | + <version id="17.2R1" /> |
| 8 | + <event code="" name="RT_FLOW_SESSION_CREATE" format="syslog"> |
| 9 | + <transport type="syslog" /> |
| 10 | + <source> |
| 11 | + <jira id="ADDON-25170"/> |
| 12 | + <comment>Got this event form Juniper document.</comment> |
| 13 | + </source> |
| 14 | + <raw> |
| 15 | + <![CDATA[<111> 2020-02-12T03:27:09+10:00 sample.dvc RT_FLOW: RT_FLOW_SESSION_CREATE: session created 1.1.1.1/34667->10.0.0.1/5048 0x0 junos-http 1.1.1.2/34667->10.0.0.2/5048 0x0 sample_src_rule_type sample_src_rule_name sample_dst_rule_type sample_dest_rule_n**ame 6 1660(global) SAMPLE-SERVER-ZONE DUMMY_ZONE 113256 user2(admin) gg-0/0/0.1 SNMP DUMMY_APP UNKNOWN]]> |
| 16 | + </raw> |
| 17 | + <cim> |
| 18 | + <models> |
| 19 | + <model>Network Traffic</model> |
| 20 | + </models> |
| 21 | + <cim_fields> |
| 22 | + <field name="action" value="allowed"/> |
| 23 | + <field name="dest" value="10.0.0.1"/> |
| 24 | + <field name="dest_ip" value="10.0.0.1"/> |
| 25 | + <field name="dest_port" value="5048"/> |
| 26 | + <field name="dest_zone" value="DUMMY_ZONE"/> |
| 27 | + <field name="dvc" value="sample.dvc"/> |
| 28 | + <field name="rule" value="sample_src_rule_name sample_dest_rule_n**ame 1660(global)"/> |
| 29 | + <field name="session_id" value="113256"/> |
| 30 | + <field name="src" value="1.1.1.1"/> |
| 31 | + <field name="src_ip" value="1.1.1.1"/> |
| 32 | + <field name="src_port" value="34667"/> |
| 33 | + <field name="src_zone" value="SAMPLE-SERVER-ZONE"/> |
| 34 | + <field name="src_interface" value="gg-0/0/0.1"/> |
| 35 | + <field name="user" value="user2"/> |
| 36 | + <field name="app" value="SNMP DUMMY_APP"/> |
| 37 | + <field name="transport" value="tcp"/> |
| 38 | + <field name="protocol" value="ip"/> |
| 39 | + <field name="vendor_product" value="Incorrect vendor product"/> |
| 40 | + </cim_fields> |
| 41 | + <missing_recommended_fields> |
| 42 | + <field>bytes</field> |
| 43 | + <field>bytes_in</field> |
| 44 | + <field>bytes_out</field> |
| 45 | + </missing_recommended_fields> |
| 46 | + <exceptions> |
| 47 | + <field name="vendor_product" value="Incorrect vendor product" reason="testing exceptions"/> |
| 48 | + </exceptions> |
| 49 | + </cim> |
| 50 | + <test></test> |
| 51 | + </event> |
| 52 | +</device> |
0 commit comments