Перечень событий безопасности, регистрируемых на оркестраторе и устройствах CPE
Ниже представлен список событий безопасности, которые регистрируются в журнале аудита оркестратора.
Перечень событий безопасности, подлежащих регистрации
Код / Code | Cобытие / | Действие | Уровень Severity в логе / Severity | Уровень Severity события KUMA | Момент активации | Пример отображаемого события в журнале / Message |
Журнал аудита (Audit logging) | ||||||
SYS-AUD | Started | Включение подсистемы аудита | info | low | При нажатии: Save | Message: Code Event: Username:$username($tenant), UserIp:$userIp, Standard: [$code ...], Extended: [$code ...], OrcVersion:$orcversion SYS-AUD Started: Username:admin(tenant-1), UserIp:127.0.0.1, Standard: [SDW-CPE, SDW-CPET, SDW-FWT, SDW-FWZ, SDW-FMW, SCH-FMWU, USR-USR, USR-PERM, SYS-API], Extended: [], OrcVersion:3.0.0.release.1.cis.amd64 SYS-AUD Started: Username:admin(tenant-1), UserIp:127.0.0.1, Standard: [], Extended: [SDW-CPE, SDW-CPET, SDW-FWT, SDW-FWZ], OrcVersion:3.0.0.release.1.cis.amd64 SYS-AUD Started: Username:admin(tenant-1), UserIp:127.0.0.1, Standard: [SDW-FMW, SCH-FMWU, USR-USR, SYS-API], Extended: [SDW-CPE, SDW-CPET, SDW-FWT, SDW-FWZ], OrcVersion:3.0.0.release.1.cis.amd64 |
SYS-AUD | Stopped | Отключение подсистемы аудита | warn | medium | При нажатии: Save | Message: Code Event: Username:$username($tenant), UserIp:$userIp, Standard: [$code ...], Extended: [$code ...], OrcVersion:$orcversion SYS-AUD Stopped: Username:admin(tenant-1), UserIp:127.0.0.1, Standard: [SDW-CPE, SDW-CPET, SDW-FWT, SDW-FWZ, SDW-FMW, SCH-FMWU, USR-USR, USR-PERM, SYS-API], Extended: [], OrcVersion:3.0.0.release.1.cis.amd64 SYS-AUD Stopped: Username:admin(tenant-1), UserIp:127.0.0.1, Standard: [], Extended: [SDW-CPE, SDW-CPET, SDW-FWT, SDW-FWZ], OrcVersion:3.0.0.release.1.cis.amd64 SYS-AUD Stopped: Username:admin(tenant-1), UserIp:127.0.0.1, Standard: [SDW-FMW, SCH-FMWU, USR-USR, USR-PERM, SYS-API], Extended: [SDW-CPE, SDW-CPET, SDW-FWT, SDW-FWZ], OrcVersion:3.0.0.release.1.cis.amd64 |
SYS-AUD | Error | Невозможно запустить подсистему аудита | warn | medium | Сразу при возникновении | Message: Code Event: Standard: [$code ...], Extended: [$code ...], OrcVersion:$orcversion, $ErrorMessage SYS-AUD Error: Standard: [SDW-CPE, SDW-CPET, SDW-FWT, SDW-FWZ, SDW-FMW, SCH-FMWU, USR-USR, USR-PERM, SYS-API], Extended: [], OrcVersion:3.0.0.release.1.cis.amd64, $ErrorMessage SYS-AUD Error: Standard: [], Extended: [SDW-CPE, SDW-CPET, SDW-FWT, SDW-FWZ], OrcVersion:3.0.0.release.1.cis.amd64, $ErrorMessage SYS-AUD Error: Standard: [SDW-FMW, SCH-FMWU, USR-USR, USR-PERM, SYS-API], Extended: [SDW-CPE, SDW-CPET, SDW-FWT, SDW-FWZ], OrcVersion:3.0.0.release.1.cis.amd64, $ErrorMessage |
Управление конфигурацией CPE (CPE configuration management) | ||||||
SDW-CPE | Any | Любое изменение в любых разделах CPE, которое не попадает под специализируемые разделы описанных ниже. | info | low | При нажатии: Save | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name, OrcVersion:$orcversion, [Changed] SDW-CPE Any: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Changed] |
SDW-CPE | AnyError | Любое изменение в любых разделах CPE, которое не попадает под специализируемые разделы описанных ниже c ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: CPE:$name, Template:$name, CTenant:$name, $ErrorMessage SDW-CPE AnyError: CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, $ErrorMessage |
SDW-CPE | Create | Создание CPE | info | low | При нажатии: Save | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name. SDW-CPE Create: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1. |
SDW-CPE | CreateError | Создание CPE с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: CPE:$name, Template:$name, CTenant:$name, $ErrorMessage SDW-CPE CreateError: CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, $ErrorMessage |
SDW-CPE | Registration | Регистрация CPE | info | low | Когда CPE перешла в статус: Activate | Standard/Extended: Code Event: CPE:$name, Template:$name, CTenant:$name SDW-CPE Registration: CPE:vCPE1, Template:vCPE1, CTenant:tenant-1 |
SDW-CPE | RegistrationError | Регистрация CPE с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: CPE:$name, Template:$name, CTenant:$name, $ErrorMessage SDW-CPE RegistrationError: CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, $ErrorMessage |
SDW-CPE | Delete | Удаление CPE | info | low | При нажатии: Save | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name SDW-CPE Delete: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, TTenant:tenant-1, CTenant:tenant-1 |
SDW-CPE | DeleteError | Удаление CPE с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: CPE:$name, Template:$name, CTenant:$name, $ErrorMessage SDW-CPE DeleteError: CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, $ErrorMessage |
SDW-CPE | Disable | Отключение CPE | info | low | При нажатии: Save | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name SDW-CPE Disable: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, TTenant:tenant-1, CTenant:tenant-1 |
SDW-CPE | DisableError | Отключение CPE c ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: CPE:$name, Template:$name, CTenant:$name, $ErrorMessage SDW-CPE DisableError: CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, $ErrorMessage |
SDW-CPE | Enable | Включение CPE | info | low | При нажатии: Save | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name SDW-CPE Enable: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1 |
SDW-CPE | EnableError | Включение CPE с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: CPE:$name, Template:$name, CTenant:$name, $ErrorMessage SDW-CPE EnableError: CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, $ErrorMessage |
SDW-CPE-GEN | FirewallTemplate | Изменение шаблонов экземпляра CPE | info | low | При нажатии: Save | Standard: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name, OrcVersion:$orcversion, [Changed] SDW-CPE-GEN FirewallTemplate: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Changed] Extended: Code Event: Username:$username(tenant-1), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name, OrcVersion:$orcversion, [$Detailed_change] SDW-CPE-GEN FirewallTemplate: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Changed:Default firewall template>Default firewall template(tenant-1)] |
SDW-CPE-GEN | FirewallTemplateError | Изменение шаблонов экземпляра CPE с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: CPE:$name, Template:$name, CTenant:$name, $ErrorMessage SDW-CPE-GEN FirewallTemplateError: CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, $ErrorMessage |
SDW-CPE-ENC | Encryption | Изменение шифрования канала на экземпляре CPE | info | low | При нажатии: Save | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name, OrcVersion:$orcversion, [Changed:$state], SDW-CPE-ENC Encryption: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Changed:enabled || disabled] |
SDW-CPE-ENC | EncryptionError | Изменение шифрования канала на экземпляре CPE с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: CPE:$name, Template:$name, CTenant:$name, $ErrorMessage SDW-CPE-ENC EncryptionError: CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, $ErrorMessage |
SDW-CPE-SCR | Scripts | Запуск скриптов на экземпляре CPE | info | low | При нажатии: Run | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name, OrcVersion:$orcversion, [Run: $SriptName] SDW-CPE-SCR Scripts: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Run:custom_config] |
SDW-CPE-SCR | ScriptsError | Запуск скриптов на экземпляре CPE с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: CPE:$name, Template:$name, CTenant:$name, $ErrorMessage SDW-CPE-SCR ScriptsError: CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, $ErrorMessage |
SDW-CPE-NET | Interface | Добавление/Удаление/Изменение зоны/IP адреса/ MAC адреса/QoS интерфейса на экземпляре CPE | info | low | При нажатии: Save | Standard: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name, OrcVersion:$orcversion, Alias:$alias, [Changed] SDW-CPE-NET Interface: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, Alias:lan, [Changed]
Extended: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name, OrcVersion:$orcversion, Alias: $alias, [Added || Deleted || Changed: GEN || QOS: $Detailed_change] SDW-CPE-NET Interface: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, Alias: lan, [Added: GEN: Zone:lan, Bridge:false, Enable automatically:true, IPv4 input type:Manually, IPv4 address:10.1.1.1, IPv4 netmask:255.0.0.0, IPv4 gateway:10.1.1.254, IPv4 broadcast:10.1.1.255, Override MAC:01:01:01:01:01:01, Generate MAC:true, Added: QOS: Enable QoS:false, MaxRate:1000, BE(MinR):10, BE(MaxR):100] SDW-CPE-NET Interface: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, Alias: lan, [Deleted: GEN: Zone:lan, Bridge:false, Enable automatically:true, IPv4 input type:Manually, IPv4 address:10.1.1.1, IPv4 netmask:255.0.0.0, IPv4 gateway:10.1.1.254, IPv4 broadcast:10.1.1.255, Override MAC:01:01:01:01:01:01, Generate MAC:true, Deleted: QOS: Enable QoS:false, MaxRate:1000, BE(MinR):10, BE(MaxR):100] SDW-CPE-NET Interface: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, Alias: lan, [Changed: GEN: Zone: lan>lan(tenant-1), Bridge:false>true, Enable automatically:true>false, IPv4 input type: Manually>From IP pool, IPv4 address: 10.1.1.1>10.2.2.2, IPv4 netmask: 255.0.0.0>255.255.0.0, IPv4 gateway: 10.1.1.254>10.2.2.254, IPv4 broadcast: 10.1.1.255>10.2.2.255, Override MAC: 01:01:01:01:01:01>02:02:02:02:02:02, Generate MAC: true>false, Changed: QOS: Enable QoS:true, MaxRate:100, BE(MinR):20, BE(MaxR):90]
Показываем изменение с/на при Change в GEN Не отображается изменение с/на при Change в QOS, указываются сразу новые параметры. |
SDW-CPE-NET | InterfaceError | Добавление/Удаление/Изменение зоны/QoS интерфейса на экземпляре CPE с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: CPE:$name, Template:$name, CTenant:$name, Alias: $alias, [GEN || QoS], $ErrorMessage SDW-CPE-NET InterfaceError: CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, Alias: lan, [GEN], $ErrorMessage SDW-CPE-NET InterfaceError: CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, Alias: lan, [QoS], $ErrorMessage |
SDW-CPE-FW | Firewall | Изменение настроек МЭ на экземпляре CPE | info | low | При нажатии: Save | Standard: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name, OrcVersion:$orcversion, [Changed] SDW-CPE-FW Firewall: Username:admin(tenant-1), UserIp:127.0.0.1,CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64,[Changed]
Extended: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name, OrcVersion:$orcversion, [Added || Deleted || Changed: GEN || RUL || ADVR || NAT || ZF || IPSET || DPI || ZONE: $Detailed_change] SDW-CPE-FW Firewall: Username:admin(tenant-1), CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Changed: GEN: Syn-flood protection:Disable, Default INPUT action:REJECT] SDW-CPE-FW Firewall: Username:admin(tenant-1), CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Added: RUL: (Name:Test, Action:ACCEPT, IPset:null, IPv:IPv4, SrcZ:wan, DstZ: lan, SrcIP:1.1.1.1:2.2.2.2, DstIP:3.3.3.3:4.4.4.4, Proto:icmp, + new rule), Deleted: RUL: (Name:Test2, Action:DROP, IPset:null, IPv:IPv4, SrcZ:wan, DstZ: lan, SrcIP:11.11.11.11, DstIP:12.12.12.12, Proto:icmp, + new rule), Changed: RUL: (Name:Allow-Ping, Action:DROP, IPset:null, IPv:IPv4, SrcZ:wan, DstZ:null, SrcIP:null, DstIP:null, Proto:icmp, + new rule)] SDW-CPE-FW Firewall: Username:admin(tenant-1), CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Added: ADVR: (Status:On, Name:Test, Ptags:null, Table:FILTER, Chain:INPUT, Proto:TCP, DPI:off, Placement:Pre-rules,Start of table, DstIP:1.1.1.1, MakeAnEx:false, SrcInt:null, DstInt:null, Target:ACCEPT, Frag:false, MarkVal:null, MarkMask:null, TosVal:null, TosMask:null, StrSrchPatt:null, StrAlg:BM, StrRange:1-65535, StrHEX:false, StrIgnore:false, RecentName:null, RecentProto:SET, RecentSec:null, RecentHit:null, MobileCode:Java applet,WebAsm, ..., + new rule), Deleted: ADVR: (Status:On, Name:Test ..., + new rule), Changed: ADVR: (Status:Off, Name:ICMP ..., + new rule)] SDW-CPE-FW Firewall: Username:admin(tenant-1), CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Added: NAT:DNAT: (Name:Test, Proto:IP, SP-DestIP:1.1.1.1, SP-SrcZone:lan(tenant-1), SP-SrcIP:11.1.1.1,TP-DstIP:192.1.1.1, TP-DestZone:wan(tenant-1), + new rule), Deleted: NAT:SNAT: (Name:Test, Proto:IP, SP-DestIP:1.1.1.1, SP-SrcZone:lan(tenant-1), SP-SrcIP:11.1.1.1,TP-DstIP:192.1.1.1, TP-DestZone:wan(tenant-1), + new rule), Changed: NAT:DNAT: (Name:Test, Proto:IP, SP-DestIP:1.1.1.1, SP-SrcZone:lan(tenant-1), SP-SrcIP:11.1.1.1,TP-DstIP:192.1.1.1, TP-DestZone:wan(tenant-1), + new rule)] SDW-CPE-FW Firewall: Username:admin(tenant-1), UserIp:127.0.0.1, Name:Default firewall template, Owner: admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Added: ZF: (From:Any zone, To:mgmt,+ new rule), Deleted: ZF: (From:Any zone, To:mgmt,+ new rule), Changed: ZF: (From:wan, To:lan,+ new rule)] SDW-CPE-FW Firewall: Username:admin(tenant-1), CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Added: IPSET: (Name:test, Direction:Match source, Type:Set of subnets, EntryList:10.1.1.[1-254]/24,20.2.2.[1-5], + new rule), Deleted: IPSET: (Name:test, Direction:Match source, Type:Set of subnets, EntryList:10.1.1.[1-254]/24,20.2.2.[1-5], + new rule), Changed: IPSET: (Name:test, Direction:Match source, Type:Set of subnets, EntryList:10.1.1.[1-254]/24,20.2.2.[1-5], + new rule)] SDW-CPE-FW Firewall: Username:admin(tenant-1), CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Changed: DPI: PKTmark:1,2,3,4] SDW-CPE-FW Firewall: Username:admin(tenant-1), CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Added: ZONE: (Name:RULE1, Input:ACCEPT, Output:ACCEPT, Forwarding:ACCEPT, Masquerading:false, MSS clamp to PMTU:false, Drop logging:false, Networks:11.1.1.1/32, 22.2.2.2/32, + new rule), Deleted: ZONE: (Name:RULE2, Input:ACCEPT, Output:ACCEPT, Forwarding:ACCEPT, Masquerading:false, MSS clamp to PMTU:false, Drop logging:false, Networks:11.1.1.1/32, 22.2.2.2/32, + new rule), Changed: ZONE: (Name:RULE3, Input:ACCEPT, Output:ACCEPT, Forwarding:REJECT, Masquerading:true, MSS clamp to PMTU:true, Drop logging:false, Networks:11.1.1.1/32, 33.3.3.3/32, + new rule)]
PKTmark: отображаются только включенные, иначе null. Не отображается изменение с/на при Change, указываются сразу новые параметры. |
SDW-CPE-FW | FirewallError | Изменение настроек МЭ на экземпляре CPE с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: CPE:$name, Template:$name, CTenant:$name, [GEN || RUL || ADVR || NAT, ZF || IPSET || DPI || ZONE], $ErrorMessage SDW-CPE-FW FirewallError: CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, [GEN || RUL || ADVR || NAT, ZF || IPSET || DPI || ZONE], $ErrorMessage |
SDW-CPE-STR | StaticRoute | Добавление/Удаление/Изменение настроек статических маршрутов | info | low | При нажатии: Save | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name, OrcVersion:$orcversion, [Added || Deleted || Changed: VRF:$vrf, Destination:$destination/$ipv4netmask Gateway:$gateway, Interface:$interface, Metric:$metric, MTU:$mtu, AD:$ad, Type:$type] SDW-CPET-STR StaticRoute: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Added: VRF:main/254, Destination:10.1.1.1/255.0.0.0, Gateway:10.1.1.254, Interface:lan, Metric:20, MTU:1500, AD:20, Type:unicast] SDW-CPET-STR StaticRoute: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Deleted: VRF:main/254, Destination:10.1.1.1/255.0.0.0, Gateway:10.1.1.254, Interface:lan, Metric:20, MTU:1500, AD:20, Type:unicast] SDW-CPET-STR StaticRoute: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Changed: VRF:yellow/100, Destination:10.2.2.2/255.255.0.0 Gateway:10.2.2.254, Interface:overlay, Metric:10, MTU:1300, AD:10, Type:blackhole] Не отображается изменение с/на при Change, указываются сразу новые параметры. |
SDW-CPE-STR | StaticRouteError | Добавление/Удаление/Изменение настроек статических маршрутов с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: CPE:$name, Template:$name, CTenant:$name, $ErrorMessage SDW-CPE-STR StaticRoute: CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, $ErrorMessage |
Управление конфигурацией шаблона (CPE template configuration management) | ||||||
SDW-CPET | Any | Любое изменение в любых разделах CPE Template, которое не попадает под специализируемые разделы описанные ниже. | info | low | При нажатии: Save | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, Template:$name, Owner:$owner, OrcVersion:$orcversion, [Changed] SDW-CPET Any: Username:admin(tenant-1), UserIp:127.0.0.1, Template:vCPE1, Owner:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Changed] |
SDW-CPET | AnyError | Любое изменение в любых разделах CPE Template, которое не попадает под специализируемые разделы описанные ниже c ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: Template:$name, Owner:$owner, $ErrorMessage SDW-CPET AnyError: Template:vCPE1, Owner:tenant-1, $ErrorMessage
|
SDW-CPET-ENC | Encryption | Изменение шифрования канала в шаблоне CPE | info | low | При нажатии: Save | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, Template:$name, Owner:$owner, OrcVersion:$orcversion, [Changed:$state], SDW-CPET-ENC Encryption: Username:admin(tenant-1), UserIp:127.0.0.1, Template:vCPE1, Owner:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Changed: enabled || disabled] |
SDW-CPET-ENC | EncryptionError | Изменение шифрования канала в шаблоне CPE с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: Template:$name, Owner:$owner, $ErrorMessage SDW-CPET-ENC EncryptionError: Template:vCPE1, Owner:tenant-1, $ErrorMessage |
SDW-CPET-SCR | Scripts | Изменение скриптов в шаблоне CPE | info | low | При нажатии: Save, Run | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, Template:$name, Owner:$owner, OrcVersion:$orcversion, [Run || Added || Deleted || Changed: $SriptName] SDW-CPET-SCR Scripts: Username:admin(tenant-1), UserIp:127.0.0.1, Template:vCPE1, Owner:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Run || Added || Deleted || Changed: custom_config] |
SDW-CPET-SCR | ScriptsError | Изменение скриптов в шаблоне CPE с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: CPE:$name, Template:$name, Owner:$owner, $ErrorMessage SDW-CPET-SCR ScriptsError: Template:vCPE1, Owner:tenant-1, $ErrorMessage |
SDW-CPET-NET | Interface | Добавление/Удаление/Изменение зоны/IP адреса/ MAC адреса/QoS интерфейса в шаблоне CPE | info | low | При нажатии: Save | Standard: Code Event: Username:$username($tenant), UserIp:$userIp, Template:$name, Owner:$owner, OrcVersion:$orcversion, Alias:$alias, [Added || Deleted || Changed] SDW-CPET-NET Interface: Username:admin(tenant-1), UserIp:127.0.0.1, Template:vCPE1, Owner:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, Alias:lan, [Added] SDW-CPET-NET Interface: Username:admin(tenant-1), UserIp:127.0.0.1, Template:vCPE1, Owner:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, Alias:lan, [Deleted] SDW-CPET-NET Interface: Username:admin(tenant-1), UserIp:127.0.0.1, Template:vCPE1, Owner:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, Alias:lan, [Changed]
Extended: Code Event: Username:$username($tenant), UserIp:$userIp, Template:$name, Owner:$owner, OrcVersion:$orcversion, Alias: $alias, [Added || Deleted || Changed: GEN || QOS: $Detailed_change] SDW-CPET-NET Interface: Username:admin(tenant-1), UserIp:127.0.0.1, Template:vCPE1, Owner:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, Alias: lan, [Added: GEN: Zone:lan, Bridge:false, Enable automatically:true, IPv4 input type:Manually, IPv4 address:10.1.1.1, IPv4 netmask:255.0.0.0, IPv4 gateway:10.1.1.254, IPv4 broadcast:10.1.1.255, Override MAC:01:01:01:01:01:01, Generate MAC:true, Added: QOS: Enable QoS:false, MaxRate:1000, BE(MinR):10, BE(MaxR):100] SDW-CPET-NET Interface: Username:admin(tenant-1), UserIp:127.0.0.1, Template:vCPE1, Owner:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, Alias: lan, [Deleted: GEN: Zone:lan, Bridge:false, Enable automatically:true, IPv4 input type:Manually, IPv4 address:10.1.1.1, IPv4 netmask:255.0.0.0, IPv4 gateway:10.1.1.254, IPv4 broadcast:10.1.1.255, Override MAC:01:01:01:01:01:01, Generate MAC:true, Deleted: QOS: Enable QoS:false, MaxRate:1000, BE(MinR):10, BE(MaxR):100] SDW-CPET-NET Interface: Username:admin(tenant-1), UserIp:127.0.0.1, Template:vCPE1, Owner:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, Alias: lan, [Changed: GEN: Zone: lan>lan(tenant-1), Bridge:false>true, Enable automatically:true>false, IPv4 input type: Manually>From IP pool, IPv4 address: 10.1.1.1>10.2.2.2, IPv4 netmask: 255.0.0.0>255.255.0.0, IPv4 gateway: 10.1.1.254>10.2.2.254, IPv4 broadcast: 10.1.1.255>10.2.2.255, Override MAC: 01:01:01:01:01:01>02:02:02:02:02:02, Generate MAC: true>false, Changed: QOS: Enable QoS:true, MaxRate:100, BE(MinR):20, BE(MaxR):90]
Показываем изменение с/на при Change в GEN Не отображается изменение с/на при Change в QOS, указываются сразу новые параметры. |
SDW-CPET-NET | InterfaceError | Добавление/Удаление/Изменение зоны/IP адреса/ MAC адреса/QoS интерфейса в шаблоне CPE с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: Template:$name, Owner:$owner, Alias: $alias, [GEN || QoS], $ErrorMessage SDW-CPE-NET InterfaceError: Template:vCPE1, Owner:tenant-1, Alias: lan, [GEN], $ErrorMessage SDW-CPE-NET InterfaceError: Template:vCPE1, Owner:tenant-1, Alias: lan, [QoS], $ErrorMessage |
SDW-CPEТ-STR | StaticRoute | Добавление/Удаление/Изменение настроек статических маршрутов в шаблоне CPE | info | low | При нажатии: Save | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, Template:$name, Owner:$owner, OrcVersion:$orcversion, [Added || Deleted || Changed: VRF:$vrf, Destination:$destination/$ipv4netmask Gateway:$gateway, Interface:$interface, Metric:$metric, MTU:$mtu, AD:$ad, Type:$type] SDW-CPET-STR StaticRoute: Username:admin(tenant-1), UserIp:127.0.0.1, Template:vCPE1, Owner:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Added: VRF:main/254, Destination:10.1.1.1/255.0.0.0, Gateway:10.1.1.254, Interface:lan, Metric:20, MTU:1500, AD:20, Type:unicast] SDW-CPET-STR StaticRoute: Username:admin(tenant-1), UserIp:127.0.0.1, Template:vCPE1, Owner:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Deleted: VRF:main/254, Destination:10.1.1.1/255.0.0.0, Gateway:10.1.1.254, Interface:lan, Metric:20, MTU:1500, AD:20, Type:unicast] SDW-CPET-STR StaticRoute: Username:admin(tenant-1), UserIp:127.0.0.1, Template:vCPE1, Owner:tenant-1, OrcVersion:3.0.0.release.1.cis.amd64, [Changed: VRF:yellow/100, Destination:10.2.2.2/255.255.0.0 Gateway:10.2.2.254, Interface:overlay, Metric:10, MTU:1300, AD:10, Type:blackhole] Не отображается изменение с/на при Change, указываются сразу новые параметры. |
SDW-CPET-STR | StaticRouteError | Изменение настроек статических маршрутов в шаблоне CPE с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: Template:$name, Owner:$owner, $ErrorMessage SDW-CPE-STR StaticRoute: Template:vCPE1, Owner:tenant-1, $ErrorMessage |
Управление конфигурацией шаблона межсетевого экрана (Firewall template configuration management) | ||||||
SDW-FWT | Firewall | Создание/Удаление/Изменение правил шаблона МЭ | info | low | При нажатии: Save | При создании/удалении шаблона: Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, Name:$name, Owner:$owner, OrcVersion:$orcversion, [Added || Deleted] SDW-FWT Firewall: Username:admin(tenant-1), UserIp:127.0.0.1, Name:Default firewall template, Owner:admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Added] SDW-FWT Firewall: Username:admin(tenant-1), UserIp:127.0.0.1, Name:Default firewall template, Owner:admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Deleted]
При изменении: Standard: Code Event: Username:$username($tenant), UserIp:$userIp, Name:$name, Owner:$owner, OrcVersion:$orcversion, [Changed] SDW-FWT Firewall: Username:admin(tenant-1), UserIp:127.0.0.1, Name:Default firewall template, Owner:admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Changed]
Extended: Code Event: Username:$username($tenant), UserIp:$userIp, Name:$name, Owner:$owner, OrcVersion:$orcversion, [Added || Deleted || Changed: GEN || RUL || ADVR || NAT || ZF || IPSET || DPI: $Detailed_change] SDW-FWT Firewall: Username:admin(tenant-1), UserIp:127.0.0.1, Name:Default firewall template, Owner:admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Changed: GEN: Syn-flood protection:Disable, Default INPUT action:REJECT] SDW-FWT Firewall: Username:admin(tenant-1), UserIp:127.0.0.1, Name:Default firewall template, Owner:admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Added: RUL: (Name:Test, Action:ACCEPT, IPset:null, IPv:IPv4, SrcZ:wan, DstZ: lan, SrcIP:1.1.1.1:2.2.2.2, DstIP:3.3.3.3:4.4.4.4, Proto:icmp, + new rule), Deleted: RUL: (Name:Test2, Action:DROP, IPset:null, IPv:IPv4, SrcZ:wan, DstZ: lan, SrcIP:11.11.11.11, DstIP:12.12.12.12, Proto:icmp, + new rule), Changed: RUL: (Name:Allow-Ping, Action:DROP, IPset:null, IPv:IPv4, SrcZ:wan, DstZ:null, SrcIP:null, DstIP:null, Proto:icmp, + new rule)] SDW-FWT Firewall: Username:admin(tenant-1), UserIp:127.0.0.1, Name:Default firewall template, Owner:admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Added: ADVR: (Status:On, Name:Test, Ptags:null, Table:FILTER, Chain:INPUT, Proto:TCP, DPI:off, Placement:Pre-rules,Start of table, DstIP:1.1.1.1, MakeAnEx:false, SrcInt:null, DstInt:null, Target:ACCEPT, Frag:false, MarkVal:null, MarkMask:null, TosVal:null, TosMask:null, StrSrchPatt:null, StrAlg:BM, StrRange:1-65535, StrHEX:false, StrIgnore:false, RecentName:null, RecentProto:SET, RecentSec:null, RecentHit:null, MobileCode:Java applet,WebAsm, ..., + new rule), Deleted: ADVR: (Status:On, Name:Test ..., + new rule), Changed: ADVR: (Status:Off, Name:ICMP ..., + new rule)] SDW-FWT Firewall: Username:admin(tenant-1), UserIp:127.0.0.1, Name:Default firewall template, Owner: admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Added: NAT:DNAT: (Name:Test, Proto:IP, SP-DestIP:1.1.1.1, SP-SrcZone:lan(tenant-1), SP-SrcIP:11.1.1.1,TP-DstIP:192.1.1.1, TP-DestZone:wan(tenant-1), + new rule), Deleted: NAT:SNAT: (Name:Test, Proto:IP, SP-DestIP:1.1.1.1, SP-SrcZone:lan(tenant-1), SP-SrcIP:11.1.1.1,TP-DstIP:192.1.1.1, TP-DestZone:wan(tenant-1), + new rule), Changed: NAT:DNAT: (Name:Test, Proto:IP, SP-DestIP:1.1.1.1, SP-SrcZone:lan(tenant-1), SP-SrcIP:11.1.1.1,TP-DstIP:192.1.1.1, TP-DestZone:wan(tenant-1), + new rule)] SDW-FWT Firewall: Username:admin(tenant-1), UserIp:127.0.0.1, Name:Default firewall template, Owner: admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Added: ZF: (From:Any zone, To:mgmt,+ new rule), Deleted: ZF: (From:Any zone, To:mgmt,+ new rule), Changed: ZF: (From:wan, To:lan,+ new rule)] SDW-FWT Firewall: Username:admin(tenant-1), UserIp:127.0.0.1, Name:Default firewall template, Owner: admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Added: IPSET: (Name:test, Direction:Match source, Type:Set of subnets, EntryList:10.1.1.[1-254]/24,20.2.2.[1-5], + new rule), Deleted: IPSET: (Name:test, Direction:Match source, Type:Set of subnets, EntryList:10.1.1.[1-254]/24,20.2.2.[1-5], + new rule), Changed: IPSET: (Name:test, Direction:Match source, Type:Set of subnets, EntryList:10.1.1.[1-254]/24,20.2.2.[1-5], + new rule)] SDW-FWT Firewall: Username:admin(tenant-1), UserIp:127.0.0.1, Name:Default firewall template, Owner:admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Changed: DPI: PKTmark:1,2,3,4]
PKTmark: отображаются только включенные, иначе null. Не отображается изменение с/на при Change, указываются сразу новые параметры. |
SDW-FWT | FirewallError | Создание/Удаление/Изменение правил шаблона МЭ c ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: Name:$name, Owner:$owner, [GEN || RUL || ADVR || NAT, ZF || IPSET || DPI], $ErrorMessage SDW-FWT FirewallError: Name:Default firewall template, Owner:tenant-1, [GEN || RUL || ADVR || NAT, ZF || IPSET || DPI], $ErrorMessage |
Управление зонами межсетевого экрана (Firewall zones configuration management) | ||||||
SDW-FWZ | Zone | Создание/Удаление/Изменение правил зон шаблона МЭ | info | low | При нажатии: Save | Standard: Code Event: Username:$username($tenant), UserIp:$userIp, Name:$name, Owner:$owner, OrcVersion:$orcversion, [Added || Deleted || Changed] SDW-FWZ Zone: Username:admin(tenant-1), UserIp:127.0.0.1, Name:lan, Owner:admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Added || Deleted || Changed]
Extended: Code Event: Username:$username($tenant), UserIp:$userIp, Name:$name, Owner:$owner, OrcVersion:3.0.0.release.1.cis.amd64, [Added || Deleted || Changed: $Detailed_change] SDW-FWZ Zone: Username:admin(tenant-1), UserIp:127.0.0.1, Name:lan, Owner:admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Added: Input:ACCEPT, Output:ACCEPT, Forwarding:ACCEPT, Masquerading:false, MSS clamp to PMTU:false, Drop logging:false, Networks:11.1.1.1/32, 22.2.2.2/32] SDW-FWZ Zone: Username:admin(tenant-1), UserIp:127.0.0.1, Name:lan, Owner:admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Deleted: Input:ACCEPT, Output:ACCEPT, Forwarding:ACCEPT, Masquerading:false, MSS clamp to PMTU:false, Drop logging:false, Networks:11.1.1.1/32, 22.2.2.2/32] SDW-FWZ Zone: Username:admin(tenant-1), UserIp:127.0.0.1, Name:lan, Owner:admin(tenant-1), OrcVersion:3.0.0.release.1.cis.amd64, [Changed: Input:ACCEPT, Output:ACCEPT, Forwarding:REJECT, Masquerading:true, MSS clamp to PMTU:true, Drop logging:false, Networks:11.1.1.1/32, 33.3.3.3/32] Не отображается изменение с/на при Change, указываются сразу новые параметры. |
SDW-FWZ | ZoneError | Создание/Удаление/Изменение правил зон шаблона МЭ c ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: Name:$name, Owner:$owner, $ErrorMessage SDW-FWT ZoneError: Name:lan, Owner:tenant-1, $ErrorMessage |
Загрузка прошивки (Upload firmware) | ||||||
SDW-FMW | Firmware | Загружена прошивка, проверка целостности пакета. | info | info | При нажатии: | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, [Added || Deleted: $FwName] SDW-FMW Firmware: Username:admin(tenant-1), UserIp:127.0.0.1, [Added || Deleted: knaas-cpe_2.25.09.release.21.bios.amd64-vkesr-m1_en-US_ru-RU.tar] |
SDW-FMW | FirmwareError | Загружена прошивка, проверка целостности пакета с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: $ErrorMessage SDW-FWT FirmwareError: $ErrorMessage |
Запланированные события (Scheduled events) | ||||||
SCH-FMWU | FirmwareUpdate | Обновление прошивки на CPE | info | low | При получении подтверждения от CPE, что обновление успешно | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name, [Update: $OldFwName>$NewFwName] SDW-FMWU FirmwareUpdate: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, [Update: knaas-cpe_2.25.09.release.11.bios.amd64-vkesr-m1_en-US_ru-RU.tar>knaas-cpe_2.25.09.release.21.bios.amd64-vkesr-m1_en-US_ru-RU.tar] |
SCH-FMWU | FirmwareUpdateError | Обновление прошивки на CPE | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, CPE:$name, Template:$name, CTenant:$name, $ErrorMessage SDW-FMWU FirmwareUpdate: Username:admin(tenant-1), UserIp:127.0.0.1, CPE:vCPE1, Template:vCPE1, CTenant:tenant-1, $ErrorMessage |
SCH-UPDS | UpdateSettings | Запланированное изменение конфигурации CPE | info | low | В момент наступления времени выполнения | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, [Scheduled: CPE:$name, Time:$time] SCH-UPDS UpdateSettings: Username:admin(tenant-1), UserIp:127.0.0.1, [Scheduled: CPE:vCPE1, Time:$time]
|
SCH-UPDS | UpdateSettingsError | Запланированное изменение конфигурации CPE c ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: $ErrorMessage SCH-UPDS UpdateSettingsError: $ErrorMessage |
Идентификация и аутентификация пользователей (User identification and authentication) | ||||||
USR-USR | Authentication | Аутентификация на оркестратор успешное | info | low | В момент подключения пользователя | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, Role:$role, Account type:$type, Group:$group, Permissions:$permissions, PermissionsID:$id, Authentication by password || 2FA. USR-USR Authentication: Username:admin(tenant-1), UserIp:127.0.0.1, Role:Tenant, Account type:LDAP, Group:admin, Permissions:Full access PermissionsID:82bb50a0-d82e-4dfb-b7bc-414cca14abc5, Authentication by password |
USR-USR | AuthenticationError | Аутентификация на оркестратор с ошибкой | warn | medium | Сразу при возникновении | Standard/Extended: Code Event: Username:$username($tenant), UserIp:$userIp, Role:$role, Account type:$type, Group:$group, Permissions:$permissions, PermissionsID:$id, Authentication by password || 2FA, $ErrorMessage USR-USR AuthenticationError: Username:admin(tenant-1), UserIp:127.0.0.1, Role:Tenant, Account type:LDAP, Group:admin, Permissions:Full access, PermissionsID:82bb50a0-d82e-4dfb-b7bc-414cca14abc5, Authentication by password, $ErrorMessage Если пользователя не существует то: Standard/Extended: Code Event: Username:$username, UserIp:$userIp, Authentication by password, $ErrorMessage USR-USR AuthenticationError: Username:admin1, UserIp:127.0.0.1, Authentication by password, $ErrorMessage |
USR-USR | UserChange | Создание/Удаление/Изменение ролей, разрешений, 2FA, пароля, пользователя. | info | low | При нажатии: Save | Standard: Code Event: Username:$username($tenant), UserIp:$userIp, [Added || Deleted || Changed || Blocked || Unblocked || Password changed || Reinitialized 2FA: $username] USR-USR UserChange: Username:admin(tenant-1), UserIp:127.0.0.1, [Added: UserTenant1] USR-USR UserChange: Username:admin(tenant-1), UserIp:127.0.0.1, [Deleted: UserTenant1] USR-USR UserChange: Username:admin(tenant-1), UserIp:127.0.0.1, [Changed: UserTenant1] USR-USR UserChange: Username:admin(tenant-1), UserIp:127.0.0.1, [Blocked: UserTenant1] USR-USR UserChange: Username:admin(tenant-1), UserIp:127.0.0.1, [Unblocked: UserTenant1] USR-USR UserChange: Username:admin(tenant-1), UserIp:127.0.0.1, [Password changed: UserTenant1] USR-USR UserChange: Username:admin(tenant-1), UserIp:127.0.0.1, [Reinitialized 2FA: UserTenant1]
Extended: Code Event: Username:$username($tenant), UserIp:$userIp, [Added || Deleted || Changed || Blocked || Unblocked || Password changed || Reinitialized 2FA: $username, $Detailed_change] USR-USR UserChange: Username:admin(tenant-1), UserIp:127.0.0.1, [Added: $name, Account type:Local, Login:UserTenant1, Role:Tenant, Permissions:Full access, 2FA:false, Request confirmation is required:false, Fname:Boris, Lname:Britva, Email:boris.britva@snatch.com] USR-USR UserChange: Username:admin(tenant-1), UserIp:127.0.0.1, [Deleted: $name, Account type:Local, Login:UserTenant1, Role:Tenant, Permissions:Full access, 2FA:false, Request confirmation is required:false, Fname:Boris, Lname:Britva, Email:boris.britva@snatch.com] USR-USR UserChange: Username:admin(tenant-1), UserIp:127.0.0.1, [Deleted: $name, Account type:Local, Login:UserTenant1, Role:Tenant, Permissions:Full access, 2FA:false, Request confirmation is required:false, Fname:Boris, Lname:Britva, Email:boris.britva@snatch.com] |
USR-PERM | UserPermissions | Создание/Удаление/Изменение прав доступа. | info | low | При нажатии: Save | Standard: Code Event: Username:$username($tenant), UserIp:$userIp, [Added || Deleted || Changed: $PermissionsName] USR-PERM UserPermissions: Username:admin(tenant-1), UserIp:127.0.0.1, [Added: Full access] USR-PERM UserPermissions: Username:admin(tenant-1), UserIp:127.0.0.1, [Deleted: Full access] USR-PERM UserPermissions: Username:admin(tenant-1), UserIp:127.0.0.1, [Changed: Full access]
Extended: Code Event: Username:$username($tenant), UserIp:$userIp, [Added || Deleted || Changed: $PermissionsName, $Detailed_change] USR-PERM UserPermissions: Username:admin(tenant-1), UserIp:127.0.0.1, [Added: $name, All:Editing || Viewing || No access, Infrastructure:Editing || Viewing || No access, Domain:Editing || Viewing || No access, Data center:Editing || Viewing || No access, VIM:Editing || Viewing || No access, Controller:Editing || Viewing || No access, etc...] USR-PERM UserPermissions: Username:admin(tenant-1), UserIp:127.0.0.1, [Deleted: $name, All:Editing || Viewing || No access, Infrastructure:Editing || Viewing || No access, Domain:Editing || Viewing || No access, Data center:Editing || Viewing || No access, VIM:Editing || Viewing || No access, Controller:Editing || Viewing || No access, etc...] USR-PERM UserPermissions: Username:admin(tenant-1), UserIp:127.0.0.1, [Changed: $name, All:Editing || Viewing || No access, Infrastructure:Editing || Viewing || No access, Domain:Editing || Viewing || No access, Data center:Editing || Viewing || No access, VIM:Editing || Viewing || No access, Controller:Editing || Viewing || No access, etc...] |
Взаимодействие с внешними СЗИ: IDS/AV/DLP (Interaction with external information security systems: IDS/AV/DLP) | ||||||
SYS-API | Call | Совершен вызов метода API | info | low | В момент исполнения | Standard/Extended: Code Event API-[$API_path]-[PUT || POST || GET || DELETE]: Username:$username($tenant), srcIp:$srcIp, Obj:[имя объекта к которому вызывается метод API] SYS-API Call: API-[/api/nfv/sdwan/cpe/inventory/{id}]-[GET]: Username:admin(tenant-1), UserIp:127.0.0.1, Obj:[ .. ] |
SYS-API | СallСomplete | Завершен вызов метода API | info | low | В момент исполнения | Standard/Extended: Code Event API-[$API_path]-[PUT || POST || GET || DELETE]: Username:$username($tenant), srcIp:$srcIp, Obj:[имя объекта к которому вызывается метод API], Ret: [код возврата] SYS-API CallComplete: API-[/api/nfv/sdwan/cpe/inventory/{id}]-[GET]: Username:admin(tenant-1), UserIp:127.0.0.1, Obj:[ .. ], Ret: [ ... ] |
Ниже представлен список событий безопасности, которые регистрируются в журнале аудита на устройствах CPE.
Таблица 2. Перечень событий безопасности, регистрируемых на устройствах CPE
Уровень устройства . серьезности (Код) / Facility.Severity (Code) | Служба / | Имя события / | Действие | Уровень Severity события Kuma | Момент активации | Пример отображаемого события в журнале / Message |
Идентификация и аутентификация пользователей (User identification and authentication) | ||||||
authpriv.info (10.6) | dropbear | Child connection from | Аутентификация на устройство | low | В момент исполнения | Tue Oct 21 07:43:34 2025 authpriv.info dropbear[16054]: Child connection from 172.17.9.200:60634 |
authpriv.info (10.6) | dropbear | Max auth tries reached | Аутентификация на устройство | high | В момент исполнения | Tue Oct 21 07:46:54 2025 authpriv.info dropbear[18442]: Exit before auth from <172.17.9.200:57270>: (user 'root', 3 fails): Max auth tries reached - user 'root' |
authpriv.notice (10.5) | dropbear | Password auth succeeded | Аутентификация на устройство | low | В момент исполнения | Tue Oct 21 07:43:45 2025 authpriv.notice dropbear[16170]: Password auth succeeded for 'root' from 172.17.9.200:56364 |
authpriv.warn (10.4) | dropbear | Bad password attempt | Аутентификация на устройство | medium | В момент исполнения | Tue Oct 21 07:46:52 2025 authpriv.warn dropbear[18442]: Bad password attempt for 'root' from 172.17.9.200:57270 |
Управление конфигурацией МЭ/CPE (Firewall/CPE Configuration Management) | ||||||
user.info (1.6) | sdwan-oob | Recieved and execute task firewall | Изменение правил МЭ | low | В момент исполнения | Wed Nov 12 09:01:04 2025 user.info sdwan-oob: Recieved and execute task firewall id abb0629b-757e-423a-b71d-2e330ef11b8b executor oob_firewall |
user.crit (1.2) | firewall | Firewall stopped | Остановка сервиса МЭ | critical | В момент исполнения | Thu Oct 23 13:04:40 2025 user.crit firewall: Firewall stopped |
user.info (1.6) | firewall | Firewall started | Запуск сервиса МЭ | low | В момент исполнения | Thu Oct 23 13:04:44 2025 user.info firewall: Firewall started |
user.warn (1.4) | firewall | Firewall restarted | Перезапуск сервиса МЭ | medium | В момент исполнения | Thu Oct 23 13:04:55 2025 user.warn firewall: Firewall restarted |
user.warn (1.4) | firewall | Firewall reloaded | Перезагрузка сервиса МЭ | medium | В момент исполнения | Thu Oct 23 13:04:59 2025 user.warn firewall: Firewall reloaded |
Логирование фильтрации/передачи трафика на МЭ (Logging of traffic filtering/transmission on the firewall) | ||||||
kern.info (0.6) | kernel | FW-AUD | Аудит работы МЭ | low | В момент исполнения | Sat Nov 1 11:54:41 2025 kern.info kernel: [337220.695029] FW-AUD= OUT=eth0 SRC=172.17.9.221 DST=172.17.9.203 LEN=299 TOS=0x00 PREC=0xC0 TTL=64 ID=39548 DF PROTO=TCP SPT=54280 DPT=6653 WINDOW=3219 RES=0x00 ACK PSH URGP=0 MARK=0x1f4 |
Проверка целостности МЭ/CPE (Firewall/CPE Integrity Check) | ||||||
user.info (1.6) | sdwan | Integrity check successful | Контроль целостности не нарушен | low | В момент исполнения | Thu Apr 9 11:45:44 2026 user.info sdwan[31284]: Integrity check successful |
user.crit (1.2) | sdwan | Integrity check failed | Нарушение контроля целостности файлов | critical | В момент исполнения | Thu Apr 9 11:00:03 2026 user.crit sdwan[18383]: Integrity check failed |
user.crit (1.2) | sdwan | Verification mismatch with 'Gost2012' checker. Reason: File <$file> | Нарушение контроля целостности файлов | critical | В момент исполнения | Thu Apr 9 11:00:03 2026 user.crit sdwan[18383]: Verification mismatch with 'Gost2012' checker. Reason: File "/usr/sbin/sdwan" has unexpected hash Vmd5sJ2GwLK35woBdeivZ1NAtsXlZNDBga2W4LH522E= != expected ttDJAQ1XW+UmYx4RdVru2YFWR2Al1YzG9BO4Nvx2isE= |
user.crit (1.2) | sdwan | Integrity check failed. Traffic forwarding blocked | Блокировка трафика | critical | В момент исполнения | Thu Apr 9 11:00:03 2026 user.crit sdwan[18383]: Integrity check failed. Traffic forwarding blocked |
user.info (1.6) | sdwan | Firewall self-test successful | Успешная проверка МЭ | info | В момент исполнения | Thu Feb 26 12:15:48 2026 user.info sdwan[7241]: Successful firewall self test |
user.crit (1.2) | sdwan | Firewall self-test failed | Неуспешная проверка МЭ | critical | В момент исполнения | Thu Feb 26 13:27:06 2026 user.crit sdwan[30591]: Firewall self test failed |
Подключение USB устройств (Connecting USB devices) | ||||||
kern.info (0.6) | kernel | usb | Подключение USB устройства | medium | В момент исполнения | Tue Feb 10 08:08:34 2026 kern.info kernel: [ 136.326025] usb 2-2: new SuperSpeed Gen 1 USB device number 2 using xhci_hcd |
kern.info (0.6) | kernel | mounted | Монтирование USB устройства | high | В момент исполнения | Tue Feb 10 08:09:30 2026 kern.info kernel: [ 191.877209] EXT4-fs (sdb2): mounted filesystem with ordered data mode. Opts: (null) |
Изменение времени (Time change) | ||||||
daemon.warn (3.4) | chronyd | time jump detected | Изменение времени | medium | В момент исполнения | Tue Feb 10 08:04:13 2026 daemon.warn chronyd[4428]: Backward time jump detected!
Tue Feb 10 08:56:20 2026 daemon.warn chronyd[8350]: Forward time jump detected! |
