Recommendations on sending firewall logs to Security Data Lake for MDR
GravityZone Security Data Lake extends Bitdefender MDR by ingesting and normalizing additional telemetry sources. This provides analysts with expanded visibility and enriched datasets for investigation and detection workflows, enabling the MDR team to:
Use third-party telemetry data to perform deeper investigations and hunt threats more effectively.
Improve investigation speed through enriched log context, risk scoring, and historical context.
Reduce false positives by applying asset-based risk prioritization and filtering out noise.
Enhance response effectiveness by providing analysts with greater context and supporting evidence.
GravityZone Security Data Lake for MDR currently supports ingestion of firewall telemetry to extend the data available to the SOC, with additional telemetry categories planned for the future. The following firewalls are currently supported:
Optimal logging scope for firewalls
Firewall integrations should provide detailed network connection telemetry, including action taken, connection outcome, and associated threat context. This data supports the MDR team's detection of lateral movement, data exfiltration, command-and-control activity, and potential account compromise.
To ensure consistent normalization and effective alerting, you must collect and forward the following log categories:
Traffic / connection logs (Allow and Deny)
Session start and end events
Policy action (accept, deny, drop, reset)
Source and destination IP addresses
Source and destination ports
Protocol
Rule or policy name / ID
Interface or zone
Bytes and packets transferred
These logs provide the baseline dataset required for connection-level detection, anomaly identification, and data exfiltration analysis.
Threat / security logs
IPS / IDS alerts
Malware / antivirus detections
Vulnerability signatures
URL filtering events
Botnet / C2 detections
Application control blocks
Each event should include severity, signature or threat ID, threat name, category, and disposition (blocked or allowed).
System / administrative / configuration logs
Admin login success and failure
Privilege changes
Configuration or policy changes
Commit events
High availability failover events
Time changes
Logging subsystem errors
These logs enable administrative activity monitoring and configuration integrity alerts.
Note
While sending all the log categories listed above ensures optimal detection and alerting, it can also generate a high volume of traffic and related infrastructure costs. For example, Allow traffic/connection logs are useful in detecting data exfiltration attempts but also record high volumes of benign traffic, so omitting these logs may help reduce costs. We recommend that you choose a mix of logs that balances detection coverage with ingestion, storage, and processing costs.
It is also strongly recommended to collect and forward the following log categories if they are available:
VPN logs (tunnel up / down, authentication, assigned IPs, user attribution)
NAT translation logs (original and translated IP / port mappings)
DHCP logs (if provided by the firewall)
DNS logs (if the firewall acts as DNS resolver)
Field-level requirements for proper normalization
For accurate mapping onto the Security Data Lake Information Model, logs must consistently include the following fields:
Connection context
Timestamp (synchronized with NTP and aligned in UTC)
Device identifier (hostname or serial number)
Log subtype (traffic, threat, system)
Source IP
Destination IP
Source port
Destination port
Protocol
Decision and policy context
Action (allow, deny, drop, reset)
Rule or policy name / ID
Zone or interface
Direction (inbound / outbound), if available
Volume metrics
Bytes transferred
Packets transferred
Session duration
Threat context (for security logs)
Signature or threat ID
Threat name
Severity
Category
Outcome (blocked or allowed)
Identity context (if available)
Username
Application
URL or domain
NAT - original and translated fields
Vendor-specific notes
Palo Alto: Ensure traffic, threat, and system logs are forwarded. These log categories map directly to the Palo Alto Illuminate content pack.
FortiGate: Send logs in Syslog or raw / plaintext format. Do not use CEF. Include both traffic and security event logs.
pfSense / OPNsense: Forward firewall filter logs, authentication logs (GUI / SSH), and optionally DNS and DHCP logs.
Other supported vendors (for example, Checkpoint, Cisco ASA, Juniper SRX, SonicWall): Forward traffic, threat, and administrative log categories via supported input types.