Network threats
This option is visible only if Gateway is enabled. When this option is turned on, the events that are detected by Gateway are sent to your organization’s syslog server.
Field | Value | Description |
|---|---|---|
Eco Id | [varies] | The user's EcoID, if available. |
Event Name | Blocked Connection Allowed Connection | This is the defined event name for network alerts:
|
Event Type | NetworkThreat | This is the defined event type for network alerts. |
GhostUserEmail | [varies] | The email address of the support user. |
Message | [varies] | The message contains information related to the event, in JSON string format. |
Source | big.blackberry.com | The BlackBerry product generating the event. |
Tenant | [tenantId] | The UES tenant ID. |
Timestamp | [varies] | The date and time the event occurred. |
Message descriptions
Field | Value | Description | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
action | string | The action performed against this traffic. Unique to the associated event. | ||||||||||
alertType | string | The alert type associated with the event. The supported types are:
| ||||||||||
signature | string | The Packet Inspection Rule details of the identified network threat, if applicable. | ||||||||||
category | string | The Packet Inspection Rule category of the identified network threat, if applicable. | ||||||||||
policyName | string | The name of the user's policy that triggered the event, if applicable. | ||||||||||
appName | string | The name of the application or network service associated with the blocked event, if applicable. | ||||||||||
mitre | string | The MITRE information related to the event. Additional details are provided below.
| ||||||||||
endpointId | string | The Gateway installation ID of the endpoint as it is registered in UES. | ||||||||||
venueEndpointId | string | The ID of the BlackBerry Protect Desktop service if it is installed on the same device. | ||||||||||
dOsVers | string | The OS version of the device. | ||||||||||
dId | string | The UES ID of the device. | ||||||||||
dPlat | string | The platform of the device. | ||||||||||
dManuf | string | The manufacturer of the device. | ||||||||||
dModel | string | The model of the device. | ||||||||||
flowId | string | The ID of the Gateway access control engine flow that this event is associated with. | ||||||||||
correlationId | string | The correlation ID assigned to the event. | ||||||||||
sourceIp | string | The packet source IP address. | ||||||||||
sourcePort | string | The packet source port. | ||||||||||
dstAddress | string | The destination IP address of the IP packet that triggered the event. Can be IPv4 or IPv6. | ||||||||||
destPort | string | The packet destination port. | ||||||||||
protocol | string | The protocol used to transit the packet. | ||||||||||
endpointIp | string | The public source IP associated with the endpoint. This IP is assigned by the network itself. |
Example syslog message - Access control policy (blocked)
Event Type: NetworkThreat, Event Name: blocked connection, Eco Id: Am6XZ102m1PgFzI/N8mjANP4=, User: John Smith (jsmith@example.com), User Name: jsmith, Message: {"endpointId":"6c726244-ad1d-4ff4-922b-cbaf8ab3c6c2", "flowId":3190005035111956, "endpintIp":"99.250.195.118:39867", "dstAddress":"10.10.10.129", "action":"blocked", "dManuf":"Google", "category":"Access Control Blocked", "key":"", "correlationId":"4ddb23a8-defa-4a17-b549-4c36ed193954", "sourcePort": 31637, "destPort":53, "alertType":"accessControl", "policyName":"E2E Auto Block Saas Apps", "dId":"821f57dc-d7d6-4907-90ba-c6d7b0bca943", "venueEndpointId":"", "dOsVers":"11", "appName":"Slack", "protocol":"UDP", "signature":"Access Control Blocked - DNS", "dPlat":"Android", "sourceIp":"10.10.10.137", "dModel":"Pixel 4", "mitreData":""}
Example syslog message - Signature detection (blocked)
Event Type: NetworkThreat, Event Name: blocked connection, Eco Id: Am6XZ102mlPgFzI/N8mjANP4=, User: John Smith (jsmith@example.com), User Name: jsmith, Message: {"endpointId":"7c726244-ad1d-4ff4-922b-cbaf8ab3c6c1", "flowId":1975772272249751, "endpointIp":"99.250.195.118:49713", "dstAddress":"10.10.10.1", "action":"blocked", "dManuf":"Google", "category":"A Network Trojan was detected", "key":"", "correlationId":"6df43c40-5bad-40d1-b081-7882cb28d330", "sourcePort":28945, "destPort":53, "alertType":"signature", "policyName":"E2E Auto Block Saas Apps", "dId":"812f57dc-d7d6-4907-90ba-c6d7b0bca943", "venueEndpointId":"", "dOsVers":"11", "appName":"", "protocol":"UDP", "signature":"ET MOBILE_MALWARE Android/TrojanDropper.Agent.BKY DNS Lookup 1 (tp/emerging-threats/emerging-mobile_malware/2025014)", "dPlat":"Android", "sourceIp":"10.10.10.9", "dModel":"Pixel 4", "mitreData":""}
Example syslog message - Signature detection (allowed)
Event Type: NetworkThreat, Event Name: allowed connection, Eco Id: Am6XZ102mlPgFzI/N8mjANP4=, User: John Smith (jsmith@example.com), User Name: jsmith, Message: {"policyName":"E2E Auto FQDN Block", "flowId":788929250499854, "sourceIp":"10.10.10.22", "dId":"5e2ae619-8116-4f0e-b233-91eeec15c9c4", "sourcePort":41236, "destPort":80, "endpointId":"f9963a84-9311-42c7-b251-c4dd97ed2bd6", "dOsVers":"0", "mitreData":"", "appName":"", "endpointIp":"", "correlationId":"883d6505-2cd5-4872-98b0-570cf2bdf24b", "dManuf":"generic", "venueEndpointId":"", "dModel":"Generic Device", "action":"allowed", "alertType":"signature", "dstAddress":"69.16.231.150", "signature":"ET POLICY curl User-Agent Outbound (tp/emerging-threats/emerging-policy/2013028)", "key":"", "category":"Attempted Information Leak", "dPlat":"Windows", "protocol":"TCP"}
Example syslog message - IP reputation (blocked)
Event Type: NetworkThreat, Event Name: blocked connection, Eco Id: Am6XZ102mlPgFzI/N8mjANP4=, User: John Smith (jsmith@example.com), User Name: jsmith, Message: {"sourceIp":"10.10.10.18", "protocol":"TCP", "dModel":"Nexus 6", "policyName":"IP Reputation Policy", "appName":"", "mitreData":"", "key":"", "dstAddress":"195.110.46.232", "alertType":"ipReputation", "dPlat":"Android", "venueEndpointId":"", "destPort":80, "category":"Access Control Blocked", "endpointId":"e017bd79-69e5-4a4f-af26-f295b0d28e78", "signature":"Access Control Blocked", "flowId":801786180096101, "sourcePort":39240, "action":"blocked", "dId":"fe9fd95d-76c4-410f-997f-7c76e8741b0f", "dManuf":"motorola", "correlationId":"d773b803-9333-4851-85ed-ae5165e83f93", "dOsVers":"7.1.1", "endpointIp":"173.33.81.137:41890"}
Example syslog message - IP reputation (allowed)
Event Type: NetworkThreat, Event Name: allowed connection, Eco Id: Am6XZ102mlPgFzI/N8mjANP4=, User: John Smith (jsmith@example.com), User Name: jsmith, Message: {"dPlat":"Windows", "destPort":443, "dId":"a58a0ce5-d94f-472e-ab57-574fc807119e", "policyName":"allow_all", "flowId":1139639166113122, "dstAddress":"odc.officeapps.live.com", "endpointIp":"172.29.139.30:35068", "dOsVers":"Windows 10 Enterprise 2009", "category":"Access Control Allowed", "mitreData":"", "protocol":"TCP", "dManuf":"VMware, Inc.", "dModel":"VMware Virtual Platform", "appName":"", "endpointId":"96551433-b13d-423b-8157-d8854f82a8cb", "key":"", "signature":"Access Control Allowed - TLS", "venueEndpointId":"c303f4e7-8377-4a6d-9849-19b8cf811e9f", "correlationId":"210cc54b-8624-4d18-9ca8-3af1335500bd", "action":"allowed", "alertType":"ipReputation", "sourceIp":"10.10.10.133", "sourcePort":58111}