Ahnlab Trusguard

Feature Improvements

• Added blocking integration functionality
• Added support for AhnLab TrusGuard API access profiles
• Added the trusguard-blacklist-rules command to query blacklist rules
• Added the trusguard-add-blacklist-rule command to add blacklist rules
• Added the trusguard-update-blacklist-rule command to modify blacklist rules
• Added trusguard-remove-blacklist-rule command to delete blacklist rules
• Added trusguard-blacklist-files command to list blacklisted files
• Added trusguard-remove-blacklist-file command to delete blacklisted files
• Added trusguard-ipv4-addresses command to list IPv4 address objects
• Added trusguard-add-ipv4-address command to add an IPv4 address object
• Added trusguard-update-ipv4-address command to update an IPv4 address object
• Added trusguard-remove-ipv4-address command to delete an IPv4 address object
• Added trusguard-ipv4-address-groups command to query IPv4 address groups
• Added trusguard-add-ipv4-address-group command to add IPv4 address groups
• Added trusguard-update-ipv4-address-group command to update IPv4 address groups
• Added trusguard-remove-ipv4-address-group command to delete an IPv4 address group
• Added trusguard-policies command to list policies
• Added trusguard-commit command to commit configuration changes

Changelog

• Fixed parse failure for App Control log type

Support TrusGuard 3.1.0 version.

• (NEW) module_flag 1018: tg-iface-traffic
• Parsing by module_flag regardless of type value for version 3 logs.

Support TrusGuard 3.0.0 version.

Added 25 Log Schemas

• module_flag 1010: tg-audit
• module_flag 1011: tg-device-perf
• module_flag 1012: tg-line-failure
• module_flag 1013: tg-line-status
• module_flag 1017: tg-iface-traffic
• module_flag 1030: tg-antivirus
• module_flag 1040: tg-anti-spam
• module_flag 1050: tg-webfilter
• module_flag 1070: tg-content-filter
• module_flag 1080: tg-ipsec-vpn
• module_flag 1090: tg-ssl-vpn
• module_flag 1101: tg-app-control
• module_flag 1102: tg-app-detect
• module_flag 1110: tg-dns-filter
• module_flag 1121: tg-iac
• module_flag 1130: tg-siteguard
• module_flag 1140: tg-qos
• module_flag 1141: tg-lbqos
• module_flag 1150: tg-proxy-auth
• module_flag 1151: tg-proxy-mail
• module_flag 1170: tg-c2-detect
• module_flag 1180: tg-file-scan
• module_flag 1230: tg-dlp

Normalize the action value of the web filter log type (module_flag 1050) as follows:

• 3001: BLOCK
• 3003: DETECT

First release. Support up to v2.7.5.

• Dedicated log parser
• Logger model
• Traffic and Detection dashboards