pfSense Log Filtering Guide for Wazuh Discover

📊 pfSense Log Filtering Guide for Wazuh Discover

If you want to analyze pfSense firewall logs on Wazuh, below are some key filter fields you can use in the Discover interface. These fields help make threat detection, traffic analysis, and incident tracking much more efficient.

🔍 Essential Filter Fields

• data.action – Action taken: block / pass
• data.protocol – Protocol information: tcp, udp, etc.
• data.srcip – Source IP address
• data.dstip – Destination IP address
• data.srcport – Source port
• data.dsport – Destination port
• GeoLocation.country_name – IP geolocation (country)
• predecoder.timestamp – Real-time timestamp of the event
• timestamp – Log processing time
• location – Log file source (e.g., /var/log/pfsense.log)

🧠 MITRE ATT&CK Information

If the event matches a rule, Wazuh may enrich the logs with MITRE ATT&CK information:

• rule.mitre.technique – Technique used (e.g., Brute Force)
• rule.mitre.tactic – Adversary’s goal (e.g., Credential Access)

📝 Event Descriptions and Rules

• rule.description – Short description of the event (e.g., Multiple pfSense firewall blocks events from same source.)
• rule.id – Matched rule ID (if available)
• rule.level – Severity level of the event

📌 Sample Discover Queries

data.action: "block" AND data.protocol: "tcp"
# Shows blocked traffic over TCP protocol

data.srcip: "104.28.154.248"
# Lists all events originating from a specific IP address

GeoLocation.country_name: "United States" AND data.dport: 1514
# Connections from the US targeting port 1514

rule.mitre.technique: "Brute Force"
# All events identified as Brute Force attacks
            

🧰 Additional Tips

• Mind the field types: Some fields are keyword while others are text. Add the .keyword suffix if necessary.
• From filtering to visualization: You can turn tested Discover filters into visualizations for dashboards.
• Wazuh Field Reference: Use Wazuh’s documentation to explore log fields in more detail.

✅ Quick Reference Table