Network

UserGate NGFW

UserGate next-generation firewall and UTM appliance logs — traffic accept/deny decisions, web content filtering, DNS queries, IDS/IPS alerts, user authentication, VPN sessions, and system operational events.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/network-usergate/generator.yml \
  --id usergate \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
traffic-accept	Traffic Accept (allowed connections)	~49%	network
traffic-deny	Traffic Deny (blocked connections)	~16%	network
web-filter	Web Content Filter	~7%	network
dns	DNS Query Logging	~5%	network
system-event	System Operational Events	~5%	host
idps-alert	IDS/IPS Alert Detection	~4%	intrusion_detection
auth	User Authentication	~4%	authentication
vpn	VPN Session Events	~3%	network

Realism Features

Weighted event distributions matching production UserGate log volumes (traffic ~65%, UTM ~16%, system/auth/vpn ~12%)
UserGate-specific fields — rule_id, zone pairs (Trusted/Untrusted/DMZ), content filtering categories
Zone-aware routing with UserGate interface naming conventions
IDS/IPS alerts with signature IDs and severity levels matching real threat classifications
Web content filter categories aligned with UserGate URL filtering engine
VPN session lifecycle — tunnel establishment and teardown with user identity correlation

Sample Output

{
  "@timestamp": "2026-03-07T11:24:18.000000+00:00",
  "event": {
    "action": "accept",
    "category": [
      "network"
    ],
    "dataset": "usergate.log",
    "outcome": "success",
    "type": [
      "connection",
      "allowed"
    ]
  },
  "source": {
    "ip": "10.1.1.25",
    "port": 51843
  },
  "destination": {
    "ip": "93.184.216.34",
    "port": 443
  },
  "network": {
    "direction": "outbound",
    "transport": "tcp"
  },
  "observer": {
    "hostname": "ug-fw-01",
    "product": "NGFW",
    "type": "firewall",
    "vendor": "UserGate"
  },
  "rule": {
    "id": "12",
    "name": "Allow-Internet"
  },
  "usergate": {
    "zone_src": "Trusted",
    "zone_dst": "Untrusted"
  }
}

Parameters

Parameter	Default	Description
hostname	ug-fw-01	UserGate device hostname
domain	example.com	Domain name
nat_ip	198.51.100.1	Public NAT IP for outbound connections
agent_id	b5c8d3e2-...	Elastic Agent ID
agent_version	8.17.0	Elastic Agent version

Related Generators

Network

Cisco ASA Firewall

Cisco ASA adaptive security appliance syslog — TCP/UDP/ICMP connection lifecycle, ACL permit/deny decisions, NAT translations, VPN tunnel events, and failover status messages.

Network

Check Point Security Gateway

Check Point Security Gateway SmartLog — 8 software blades including Firewall, IPS, Application Control, URL Filtering, Anti-Bot, Anti-Virus, Threat Emulation, and Identity Awareness.

Network

Network Traffic (Continent-Level Geo)

Network traffic events enriched with continent-level geographic information. Models cross-continent and same-continent flows for both inbound and outbound directions, with realistic allow/deny outcomes based on geographic policy.