Dell SonicWall Firewall

[faen]

It’s in the pipeline and rules exchange - it was linked to in one of my previous posts, but here it is again:

Sonicwall Pipeline Rules

Sonicwall: TZ470 running SonicOS 7.01 Input type: Sylog/UDP Rule summary: Stage 0: Primary rule uses the “key_value” function to parse the delimited message using the default delimiter of space. Stage 1: Four rules to split the port from the IP address, as Sonicwall sends as XXX.XXX.XXX.XXX:YYYY and sometimes as XXX.XXX.XXX.XXX:YYYY:INTERFACENAME State 2: GeoIP Lookups on Source and Destination, as well as removing some of the redundant fields caused by Stage 1 rules. Stage 3: Whois Lookup…