AWSNetworkFirewallTls

AWSNetworkFirewallTls Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel The AWS Platform Firewall TLS logs, ingested from Sentinel’s connector, enabling real-time analysis and correlation with other security data sources.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
Action The action taken by the firewall (e.g., allowed, dropped, inspected). String
AvailabilityZone The AWS Availability Zone where the firewall instance is located. String
DestIp The destination IP address of the packet. String
DestPort The destination port to which the packet was sent. String
ErrorMessage Any error message associated with the event, if applicable. String
EventTimestamp The epoch timestamp of when the event occurred. DateTime
FirewallName The name of the AWS Network Firewall instance generating the log. String
LeafCertificateFingerprint The SHA-256 fingerprint of the leaf certificate observed in the TLS handshake. String
Sni The Server Name Indication (SNI) from TLS traffic. String
SourceSystem String
SrcIp The source IP address of the packet that triggered the event. String
SrcPort The source port from which the packet originated. String
Status The status of the TLS inspection event (e.g., success, failure). String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TimeGenerated The timestamp when the log entry was created in AWS Network Firewall. DateTime
Type The name of the table String

Schema changes #

Date Action
2026-01-02 Table added to tracking