#-----------------------------------------------------------------------------#
#    This file contains sample logging rules.                                 #
#                                                                             #
#    To activate the rules, simply move them to firerule.cnf and update the   #
#    attributes to match your setup.                                          #
#                                                                             #
#    DISCLAIMER: Not all samples have been tested by F/X Communications.      #
#-----------------------------------------------------------------------------#


Log-Host                Comment = "Log all packets coming from host 1.2.3.4",
                        Source = "1.2.3.4",
                        Log-Control = Enabled,
                        Rule-Action = Log,
                        Log-File = "firewall/logs/hacker.log",

Log-Blacklist           Comment = "Log packets causing blacklisting",
                        Packet-Feature = Blacklist-Trigger,
                        Rule-Action = Log,
                        Log-Control = Enabled,
                        Log-File = "firewall/logs/blacklst.log",
                        Log-Mask = "date time action_rule direction source dest s_port d_port",

Log-Connections         Comment = "Log all TCP connections",
                        Rule-Action = Log,
                        Log-Control = Enabled,
                        Log-Mask = "date time direction resolved_source resolved_dest s_port d_port message",
                        Log-File = "firewall/logs/connect.log",
                        Log-Message = "Connection opened",
                        Packet-Feature = Connection-Open,

Log-Denied-NetBIOS      Comment = "Deny and log all NetBIOS over TCP/IP",
                        Destination-Port = "137 138 139 140 445",
                        Rule-Action = Deny,
                        Log-Control = Enabled,
                        Log-File = "firewall/logs/netbios.log",

