← Browse all tablesLoading table information…
AWSNetworkFirewallTls Schema
Table description
| TableSection |
TableType |
TableSectionName |
Description |
|
|
Other hunting tables |
The AWS Platform Firewall TLS logs, ingested from Sentinel’s connector, enabling real-time analysis and correlation with other security data sources. |
Schema
| Name |
Description |
Type |
| _BilledSize |
|
Double |
| _IsBillable |
|
String |
| Action |
The action taken by the firewall (e.g., allowed, dropped, inspected). |
String |
| AvailabilityZone |
The AWS Availability Zone where the firewall instance is located. |
String |
| DestIp |
The destination IP address of the packet. |
String |
| DestPort |
The destination port to which the packet was sent. |
String |
| ErrorMessage |
Any error message associated with the event, if applicable. |
String |
| EventTimestamp |
The epoch timestamp of when the event occurred. |
DateTime |
| FirewallName |
The name of the AWS Network Firewall instance generating the log. |
String |
| LeafCertificateFingerprint |
The SHA-256 fingerprint of the leaf certificate observed in the TLS handshake. |
String |
| Sni |
The Server Name Indication (SNI) from TLS traffic. |
String |
| SourceSystem |
|
String |
| SrcIp |
The source IP address of the packet that triggered the event. |
String |
| SrcPort |
The source port from which the packet originated. |
String |
| Status |
The status of the TLS inspection event (e.g., success, failure). |
String |
| TenantId |
Unique identifier of the tenant into which the data connector ingests data. |
String |
| TimeGenerated |
The timestamp when the log entry was created in AWS Network Firewall. |
DateTime |
| Type |
The name of the table |
String |
Schema changes
| Date |
Action |
| 2026-10-07 |
Table added to tracking |
| 2026-02-27 |
Table removed from tracking |
| 2026-01-02 |
Table added to tracking |