There is already a reporting mode on native devices that integrates with the XDR platform, so why do we still need separate data‑reporting practices?

The reason is that the reporting mode on native devices provides relatively coarse‑grained data. While the data is more comprehensive and should be the preferred choice when the XDR platform has sufficient performance capacity, real customer environments often experience mismatches between the customer’s data model and the model used by Sangfor’s internal sizing tools. This mismatch may cause the customer’s actual data volume to exceed the resource specifications purchased at the time of ordering.

In such cases, finer‑grained data filtering is required to reduce the amount of data being uploaded, ensuring that customers can still achieve the best possible security outcomes even when they are temporarily unable to scale up their resources.

EDR Data Reporting

Log Type	Core outcome	Priority	Remark
IOA Threat Detection Logs	IOA‑based behavioral threat detection security logs	High
IOC Threat Detection Logs	DNS‑based threat intelligence detection security logs	High
Malware Detection Logs	Antivirus threat detection and security logs	High
Endpoint Asset Logs	Asset information	High
Endpoint Behavior Logs – Process Category	–	Low	if performance requirements are met, full data reporting is recommended.
Endpoint Behavior Logs – File Category	–	Low
Endpoint Behavior Logs – Network Category	1. IOA detection 2. Threat source tracing	Low
Endpoint Behavior Logs – Registry Category	–	Low
Endpoint Behavior Logs – DNS Category	–	Low
Endpoint Behavior Logs – Scheduled Task Category	–	Low

STA Data Reporting

STA has differences in detection coverage when integrated with Athena NDR versus XDR.
Compared with XDR, integration with SIP provides additional detection capabilities, including file‑based malware detection and IoT device threat detection.

When integrating with the XDR platform, all high‑priority logs must be reported to ensure full detection effectiveness. If the reporting load exceeds system capacity, resource expansion is required.

It is strongly recommended to upgrade to Probe version 3.0.99, which optimizes TCP/SSL/DNS protocol processing and reduces reporting traffic by over 40% without compromising detection quality.

Log Category	Log Sub-type	Core Outcome	Priority	Remarks
Security Detection Logs	Website Attack Detection Logs	WAF Protection Security Logs	High
	Vulnerability Exploit Detection Logs	IPS Security Logs	High
	Botnet Detection Logs	UTM Network Security Logs	High
	Business Brute‑force Detection Logs	PVS Attack Success	High
	HTTP Protocol Audit Logs	Web Attack Detection: 1. Injection Attacks 2. WebShell Detection 3. Directory Traversal 4. C2 Communications 5. File Tampering 6. Others	High
	HTTPS Protocol Audit Logs	Requires certificate decryption; effective only when HTTP audit logs are enabled	Low
	DNS Protocol Audit Logs	1. Suspicious Domain Detection 2. External Threat Detection	High
	SMB Protocol Audit Logs	1. Internal Lateral Movement Detection 2. File Tampering	Medium
	Full Traffic Metadata Audit (TCP)	1. Brute‑force Detection 2. UEBA Detection	Medium
	SSL Protocol Audit Logs	Tunneling Detection	Low
	DCE_RPC Protocol Audit Logs	1. Vulnerability Exploitation 2. Remote Command Execution	Medium
	Database Protocol Audit Logs (db_mysql, db_sqlserver, db_db2, db_oracle, db_sybase, db_redis, db_mongo, db_pgsql)	1. Brute‑force 2. Weak Passwords	Medium
Audit Logs	Web Login Audit Logs	1. Brute‑force 2. Weak Passwords	Medium
	FTP Protocol Audit Logs	1. Weak Passwords 2. Brute‑force 3. File Tampering	Medium
	Telnet Protocol Audit Logs	1. Weak Passwords 2. Brute‑force	Medium
	RDP Protocol Audit Logs	Brute‑force	Medium
	ICMP Protocol Audit Logs	Evasion‑type Attack Detection	Low
	NTLM Protocol Audit Logs	Brute‑force	Medium
	SNMP Protocol Audit Logs	Brute‑force	Low
	LDAP Protocol Audit Logs	1. Brute‑force 2. Unauthorized Access	Medium
	SSH Protocol Audit Logs	Brute‑force	Medium
	netbios_nbns Protocol Audit Logs	Evasion‑type Attack Detection	Low
	Email Protocol Audit Logs (IMAP, SMTP, POP3)	1. Weak Passwords 2. Brute‑force 3. File Tampering 4. Phishing Detection	Medium
	NFS Protocol Audit Logs	Suspicious Mounting	Medium
	SOCKS Protocol Audit Logs	Scanning	Low
	kerberos Protocol Audit Logs	1. Scanning 2. Brute‑force	Medium
	AD Domain Protocol Audit Logs	–	–
	DHCP Protocol Audit Logs	–	–
	SIP Protocol Audit Logs	–	–
	ONVIF Protocol Audit Logs	–	–
	websocket Protocol Audit Logs	–	–
	WEBMAIL Protocol Audit Logs	No Effective Outcome	Low
	IoMT Protocol Audit Logs	–	–
	t3 Protocol Audit Logs	–	–
	radius Protocol Audit Logs	–	–
	ARP Protocol Audit Logs	–	–
	ACL Protocol Audit Logs	–	–

Athena NDR Data Reporting

Athena NDR forwards the traffic metadata collected by STA. To ensure effective detection, all high‑priority STA logs must be ingested by the Athena NDR appliance, including (but not limited to) Security Logs, HTTP Audit Logs, DNS Audit Logs, and TCP Audit Logs. For detailed log priority definitions, refer to the STA section.

Log Type	Core Outcomr	Priority	Remarks
Audit Logs	Refer to STA section for all audit log types	High	NDR security alerts and security events are not reported to XDR; XDR does notuse this portion of the data
Security Logs	Security Detection Logs	High
Vulnerabilities	Vulnerability Information	High
Assets	Asset Data	High

NGFW Data Reporting(new structure)

Log Type	Core Outcome	Priority	Remarks
Security Logs (WAF, UTM, IPS)	Security Detection Logs	High
Audit Logs – HTTP Logs	Web Core Detection Capabilities: 1. Injection Detection 2. WebShell Detection 3. Directory Traversal Detection 4. C2 Detection	High
Audit Logs – DNS Logs	1. DNS Anomaly Reporting 2. DNS Tunneling Detection	High

{{ $t('index.defaultHeader.logo') }}

Athena XDR (Extended Detection and Response)

Best Practices for Data Ingestion for Native devices