field identifier | Field Type | Field Name | Field description | Reference Value | Subcategory | Remark |
src_ip | string | Source IP | - | 192.168.0.1 | CFWRuleAcl,CFWRuleVpcAcl | - |
dst_ip | string | Destination IP | - | 192.168.0.1 | CFWRuleAcl,CFWRuleVpcAcl | - |
src_port | uint16 | Source Port | - | 22 | CFWRuleAcl,CFWRuleVpcAcl | - |
dst_port | uint16 | Destination port | - | 22 | CFWRuleAcl,CFWRuleVpcAcl | - |
protocol | string | Protocol | - | tcp | CFWRuleAcl,CFWRuleVpcAcl | - |
info | string | URL information | HTTP hit log's URL | domain/testphp | CFWRuleAcl | - |
direction | int8 | Traffic direction | 0: Outbound 1: Inbound | 0 | CFWRuleAcl,CFWRuleVpcAcl | - |
detail | string | Rule alarm description (with rule description) | Alarm details | Overseas blocking | CFWRuleAcl,CFWRuleVpcAcl | - |
rule_info | string | Rule Alarm Details (for associated rules) | - | {"uuid":"cfwrule-xxxxx","sequence":1,"source":"1.2.3.4","dest":"10.0.0.1","port":"80","protocol":"TCP","action":1} | CFWRuleAcl | - |
strategy | string | Policy | Rule Execution Action Policy | Observation | CFWRuleAcl,CFWRuleVpcAcl | - |
time | int64 | Time | Time when a rule is hit (UTC+8) | 1742109846 | CFWRuleAcl,CFWRuleVpcAcl | - |
appid | string | appid | Account (appid) | 100011949846 | CFWRuleAcl | - |
instance_id | string | Victim-related asset ID. | Victim-related asset ID. | ins-gpnr3uaw | CFWRuleAcl,CFWRuleVpcAcl | - |
uuid | string | Raw Alarm Log Unique ID | Raw Alarm Log Unique ID | 1257172971_0.0.0.0/0_1763825073255377 | CFWRuleAcl | - |
uid | int64 | Rule Unique ID | Rule Unique ID (Internal Use) | 309352 | CFWRuleAcl | - |
insert_time | int64 | Log insertion time | Log generation time (UTC+8) | 1742109847 | CFWRuleAcl,CFWRuleVpcAcl | - |
mode | uint8 | Firewall Attribute | 0: Bypass 1: Serial | 0 | CFWRuleAcl | - |
type | uint8 | Protocol | - | 1 | CFWRuleAcl | - |
fw_type | string | Firewall Type | Rule's Firewall Type | NAT Border Firewall | CFWRuleAcl,CFWRuleVpcAcl | - |
timestamp | string | Timestamp. | Current time (UTC+8) | 2025-03-16 15:24:06 | CFWRuleAcl,CFWRuleVpcAcl | - |
fws_id | string | Engine Instance ID | | cfwnat-fd7f678e | CFWRuleVpcAcl | - |
nat_ins_name | string | NAT's instance name | - | [autotest] Automated Testing | CFWRuleVpcAcl | - |
log_type | uint8 | Log type (for internal use) | Current log type fixed value: 5 | 5 | CFWRuleVpcAcl | - |
dst_vpc | string | Victim's asset VPC ID | - | vpc-d0t6wgo2 | CFWRuleVpcAcl | When the current log field is empty, this field is hidden by default. |
fws_name | string | Engine Instance Name | - | Core Business VPC Firewalls | CFWRuleVpcAcl | - |
src_vpc | string | Attacker's asset VPC ID | - | vpc-msa9dvac | CFWRuleVpcAcl | When the current log field is empty, this field is hidden by default. |
region | string | Region. | - | ap-shanghai | CFWRuleVpcAcl | - |
dst_domain | string | External Domain | External Domain Information | internal.example.com | CFWRuleVpcAcl | - |
l7proto | string | Layer 7 Protocol Name | - | DNS,SMTP,HTTP | CFWRuleVpcAcl | - |
src_vpc_name | string | Access Source VPC Name | - | [autotest] Automated Testing | CFWRuleVpcAcl | When the current log field is empty, this field is hidden by default. |
dst_vpc_name | string | Access Destination VPC Name | - | [autotest] Automated Testing | CFWRuleVpcAcl | When the current log field is empty, this field is hidden by default. |
ew_ins_id | string | VPC Firewall Instance ID | - | cfwew-85fbe09c | CFWRuleVpcAcl | - |
ew_ins_name | string | VPC Firewall Instance Name | - | Inter-VPC Firewalls | CFWRuleVpcAcl | - |
src_ins_id | string | Access Source Asset ID | - | ins-qv3l7d1j | CFWRuleVpcAcl | When the current log field is empty, this field is hidden by default. |
dst_ins_id | string | Access Destination Asset ID | - | ins-pt34wvaf | CFWRuleVpcAcl | When the current log field is empty, this field is hidden by default. |
src_ins_name | string | Access Source Instance Name | - | UMOP-3D8F3014BE-cvm | CFWRuleVpcAcl | When the current log field is empty, this field is hidden by default. |
dst_ins_name | string | Access Destination Instance Name | - | MQMS-CVM-06 | CFWRuleVpcAcl | When the current log field is empty, this field is hidden by default. |
Was this page helpful?
You can also Contact sales or Submit a Ticket for help.
Help us improve! Rate your documentation experience in 5 mins.
Feedback