Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document.
Note: Even the most advanced machine translation cannot match the quality of professional translators.
Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
IPS/4/BOTNET
Message
IPS/4/BOTNET(l): A botnet was detected. (SyslogId=[syslog-id], VSys=[vsys-name], Policy=[policy-name], SrcIp=[source-ip], DstIp=[destination-ip], SrcPort=[source-port], DstPort=[destination-port], SrcZone=[source-zone], DstZone=[destination-zone], User=[user-name], Protocol=[protocol], Application=[application-name], Profile=[profile-name], SignName=[signature-name], SignId=[signature-id], EventNum=[event-number], Target=[target], Severity=[severity], Os=[operating-system], Category=[category], Role=[role], SrcLocation=[source-location], DstLocation=[destination-location], Action=[action])
Parameters
| Parameter Name | Parameter Meaning |
|---|---|
| syslog-id | Log ID |
| vsys-name | Name of the virtual system |
| policy-name | Name of the security policy |
| source-ip | Source IP address of packets |
| destination-ip | Destination IP address of packets |
| source-port | Source port of packets (the field is 0 for ICMP packets) |
| destination-port | Destination port of packets (the field is 0 for ICMP packets) |
| source-zone | Source security zone of packets |
| destination-zone | Destination security zone of packets |
| user-name | User name |
| protocol | Protocol of the packets matching the signature |
| application-name | Application of the packets matching the signature |
| profile-name | Profile name |
| signature-name | Signature name |
| signature-id | Signature ID |
| event-number | Field for log merging: Logs are merged on the basis of the log generating frequency and the condition for log merging. The value is 1 if logs are not merged. |
| target | Attack target of the packets matching the signature
|
| severity | |
| operating-system | |
| category | Category of the attack matching the signature |
| role | Role of communication parties on the botnet
|
| source-location | Location of the source IP address (dynamically identified) |
| destination-location | Location of the destination IP address (dynamically identified) |
| action | Action for the signature
|