Network

Network Firewall (Vendor-Agnostic)

Vendor-agnostic firewall — ECS-normalized traffic flow decisions, session lifecycle, NAT translations, and IDS/IPS threat detections. Plug into any SIEM pipeline without vendor lock-in.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/network-firewall/generator.yml \
  --id fw \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
traffic-allowed	Permitted connection through firewall	~53%	network
traffic-denied	Connection rejected with RST/unreachable	~13%	network
session-start	Stateful session establishment	~11%	network
session-end	Session teardown with counters	~10%	network
traffic-dropped	Silently dropped (default deny)	~9%	network
nat-translation	Source/destination NAT event	~3%	network
threat-detected	IDS/IPS signature match	~1%	intrusion_detection
system-event	Device operational events	rare	configuration

Realism Features

Correlated sessions — session-start events consumed by session-end with matching 5-tuple
NAT tracking — outbound sessions carry source NAT details through session lifecycle
Zone-aware routing — trust/untrust/dmz zones with correct interface mappings per direction
Direction-specific behavior — denied/dropped traffic predominantly inbound; allowed mostly outbound
15 IDS/IPS signatures across SQL injection, brute force, C2, exploits
Session end reasons — tcp-fin (50%), aged-out (20%), tcp-rst (25%), policy-deny (5%)

Sample Output

{
  "@timestamp": "2026-02-21T12:00:01.234567+00:00",
  "event": {
    "action": "allow",
    "category": [
      "network"
    ],
    "dataset": "firewall.traffic",
    "outcome": "success",
    "type": [
      "connection",
      "allowed"
    ]
  },
  "source": {
    "ip": "10.1.1.30",
    "port": 52341
  },
  "destination": {
    "ip": "142.250.80.46",
    "port": 443
  },
  "network": {
    "application": "ssl",
    "direction": "outbound",
    "transport": "tcp"
  },
  "observer": {
    "hostname": "fw-01",
    "type": "firewall",
    "vendor": "Generic"
  },
  "rule": {
    "name": "Allow-HTTPS-Out"
  }
}

Parameters

Parameter	Default	Description
hostname	fw-01	Firewall hostname
domain	example.com	Domain for FQDN
serial_number	FW00A1B2C3D4	Firewall serial number
nat_ip	198.51.100.1	Public NAT IP
agent_id	e4f8c1a2-...	Filebeat agent ID
agent_version	8.17.0	Filebeat version

Related Generators

Network

Cisco ASA Firewall

Cisco ASA adaptive security appliance syslog — TCP/UDP/ICMP connection lifecycle, ACL permit/deny decisions, NAT translations, VPN tunnel events, and failover status messages.

Network

Check Point Security Gateway

Check Point Security Gateway SmartLog — 8 software blades including Firewall, IPS, Application Control, URL Filtering, Anti-Bot, Anti-Virus, Threat Emulation, and Identity Awareness.

Network

Network Traffic (Continent-Level Geo)

Network traffic events enriched with continent-level geographic information. Models cross-continent and same-continent flows for both inbound and outbound directions, with realistic allow/deny outcomes based on geographic policy.