Access Logs (Key Value Pair)

Vendor Documentation

Classification

Rule Name

Rule Type

Classification

Common Event

Access Logs (Key Value Pair)

Base Rule

Information

General Information

HTTP - 100 - Transitional - Continue

Sub Rule

Information

HTTP 100 : Transition Status - Continue

HTTP - 101 - Transitional - Protocol Switch

Sub Rule

Information

HTTP 101 : Transition Status - Protocol Switch

HTTP - 200 - Success - OK

Sub Rule

Information

HTTP 200 : Success Reply - OK

HTTP - 201 - Success - Created

Sub Rule

Information

HTTP 201 : Success Reply - Created

HTTP - 202 - Success - Accepted

Sub Rule

Information

HTTP 202 : Success Reply - Accepted

HTTP - 203 - Success - Nonauthoritative Info

Sub Rule

Information

HTTP 203 : Success Reply - Nonauthoritative Info

HTTP - 204 - Success - No Content

Sub Rule

Information

HTTP 204 : Success Reply - No Content

HTTP - 205 - Success - Reset Content

Sub Rule

Information

HTTP 205 : Success Reply - Reset Content

HTTP - 206 - Success - Partial Content

Sub Rule

Information

HTTP 206 : Success Reply - Partial Content

HTTP - 300 - Redirect - Multiple Choices

Sub Rule

Information

HTTP 300 : Redirect - Multiple Choices

HTTP - 301 - Redirect - Moved Permanently

Sub Rule

Information

HTTP 301 : Redirect - Moved Permanently

HTTP - 302 - Redirect - Moved Temporarily

Sub Rule

Information

HTTP 302 : Redirect - Moved Temporarily

HTTP - 303 - Redirect - See Other

Sub Rule

Information

HTTP 303 : Redirect - See Other

HTTP - 304 - Redirect - Not Modified

Sub Rule

Information

HTTP 304 : Redirect - Not Modified

HTTP - 306 - Redirect - Unused

Sub Rule

Information

HTTP 306 : Redirect - Unused

HTTP - 307 - Redirect - Temporary Redirect

Sub Rule

Information

HTTP 307 : Redirect - Temporary Redirect

HTTP - 400 - Req Error - Bad Request

Sub Rule

Error

HTTP 400 : Request Error - Bad Request

HTTP - 401.7 - Req Error - Access Deny (URL Auth)

Sub Rule

Error

HTTP 401 : Request Error - Unauthorized

HTTP - 401.5 - Req Error - Auth Failed (ISAPI/CGI)

Sub Rule

Error

HTTP 401 : Request Error - Unauthorized

HTTP - 401.4 - Req Error - Auth Failed (Filter)

Sub Rule

Error

HTTP 401 : Request Error - Unauthorized

HTTP - 401.3 - Req Error - Unauth (ACL)

Sub Rule

Error

HTTP 401 : Request Error - Unauthorized

HTTP - 401.2 - Req Error - Logon Fail (Svr Config)

Sub Rule

Error

HTTP 401 : Request Error - Unauthorized

HTTP - 401.1 - Req Error - Logon Failed

Sub Rule

Error

HTTP 401 : Request Error - Unauthorized

HTTP - 401 - Req Error - Unauthorized

Sub Rule

Error

HTTP 401 : Request Error - Unauthorized

HTTP - 402 - Req Error - Payment Required

Sub Rule

Error

HTTP 402 : Request Error - Payment Required

HTTP - 403.20 - Req Error - Passport Logon Failed

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.19 - Req Error - Cannot Exec CGI

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.18 - Req Error - Cannot Exec URL

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.17 - Req Error - Cert Expired/Not Valid

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.16 - Req Error - Cert Untrusted/Invalid

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.15 - Req Error - CALs Exceeded

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.2 - Req Error - No Read Access

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.1 - Req Error - No Execute Access

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403 - Req Error - Forbidden

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.8 - Req Error - Site Access Denied

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.7 - Req Error - Client Cert Required

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.6 - Req Error - IP Rejected

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.5 - Req Error - SSL 128 Required

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.4 - Req Error - SSL Required

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.3 - Req Error - No Write Access

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.14 - Req Error - Dir List Denied

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.13 - Req Error - Client Cert Revoked

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.12 - Req Error - Mapper Denied Access

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.11 - Req Error - Password Change

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.10 - Req Error - Invalid Config

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 403.9 - Req Error - Too Many Users

Sub Rule

Error

HTTP 403 : Request Error - Forbidden

HTTP - 404.15 - Req Error - Req Query Too Long

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404.14 - Req Error - Req URL Too Long

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404.13 - Req Error - Req Content Too Large

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404.12 - Req Error - Req High Bit Chars

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404.11 - Req Error - Req URL Doubled Esc

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404.10 - Req Error - Req Header Too Long

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404.3 - Req Error - Denied By MIME Policy

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404.2 - Req Error - Denied By Svc Policy

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404.1 - Req Error - Site Not At Req Port

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404 - Req Error - Not Found

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404.9 - Req Error - Denied (Hidden File)

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404.8 - Req Error - Denied Hidden Namespace

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404.7 - Req Error - Req File Ext Denied

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404.6 - Req Error - Req Verb Denied

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404.5 - Req Error - Req URL Seq Denied

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 404.4 - Req Error - No Handler

Sub Rule

Error

HTTP 404 : Request Error - Not Found

HTTP - 405 - Req Error - Method Not Allowed

Sub Rule

Error

HTTP 405 : Request Error - Method Not Allowed

HTTP - 406 - Req Error - Not Acceptable

Sub Rule

Error

HTTP 406 : Request Error - Not Acceptable

HTTP - 407 - Req Error - Proxy Auth Req

Sub Rule

Error

HTTP 407 : Request Error - Proxy Auth Required

HTTP - 408 - Req Error - Request Time-Out

Sub Rule

Error

HTTP 408 : Request Error - Request Time-Out

HTTP - 409 - Req Error - Conflict

Sub Rule

Error

HTTP 409 : Request Error - Conflict

HTTP - 410 - Req Error - Gone

Sub Rule

Error

HTTP 410 : Request Error - Gone

HTTP - 411 - Req Error - Length Required

Sub Rule

Error

HTTP 411 : Request Error - Length Required

HTTP - 412 - Req Error - Precondition Failed

Sub Rule

Error

HTTP 412 : Request Error - Precondition Failed

HTTP - 413 - Req Error - Request Item Too Big

Sub Rule

Error

HTTP 413 : Request Error - Request Item Too Big

HTTP - 414 - Req Error - Request-URL Too Large

Sub Rule

Error

HTTP 414 : Request Error - Request-URL Too Large

HTTP - 415 - Req Error - Unsupported Type

Sub Rule

Error

HTTP 415 : Request Error - Unsupported Type

HTTP - 416 - Req Error - Req Rng Unfillable

Sub Rule

Error

HTTP 416 : Request Error - Range Unfillable

HTTP - 417 - Req Error - Expectation Failed

Sub Rule

Error

HTTP 417 : Request Error - Expectation Failed

HTTP - 500.100 - Svr Error - Internal ASP Error

Sub Rule

Error

HTTP 500 : Server Error - Internal Server Error

HTTP - 500.18 - Svr Error - URL Auth Store Fail

Sub Rule

Error

HTTP 500 : Server Error - Internal Server Error

HTTP - 500.16 - Svr Error - Bad UNC Auth Cred

Sub Rule

Error

HTTP 500 : Server Error - Internal Server Error

HTTP - 500.15 - Svr Error - Global.asa Disallowed

Sub Rule

Error

HTTP 500 : Server Error - Internal Server Error

HTTP - 500.13 - Svr Error - Web Server Too Busy

Sub Rule

Error

HTTP 500 : Server Error - Internal Server Error

HTTP - 500.12 - Svr Error - App Busy Restarting

Sub Rule

Error

HTTP 500 : Server Error - Internal Server Error

HTTP - 500 - Svr Error - Internal Server Error

Sub Rule

Error

HTTP 500 : Server Error - Internal Server Error

HTTP - 501 - Svr Error - Not Implemented

Sub Rule

Error

HTTP 501 : Server Error - Not Implemented

HTTP - 502 - Svr Error - Bad Gateway

Sub Rule

Error

HTTP 502 : Server Error - Bad Gateway

HTTP - 503 - Svr Error - Service Unavailable

Sub Rule

Error

HTTP 503 : Server Error - Service Unavailable

HTTP - 504 - Svr Error - Gateway Time-Out

Sub Rule

Error

HTTP 504 : Server Error - Gateway Time-Out

HTTP - 505 - Svr Error - HTTP Ver Unsupported

Sub Rule

Error

HTTP 505 : Server Error - HTTP Ver Unsupported

HTTP - 207 - Success - Multistatus Response

Sub Rule

Information

HTTP 207 : Success - Multistatus Response

HTTP - 305 - Redirect - Use Proxy

Sub Rule

Misuse

Unauthorized Proxy Activity

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

N/A

<vmid>

Text/String

N/A

<severity>

Text/String

N/A

<sip>

Ip Address

N/A

<dip>

Ip Address

N/A

<dname>

Text/String/Number

N/A

<dport>

Number

N/A

<protname>

Text/String/Number

N/A

<login>

Text/String/Number

N/A

<domainorigin>

Text/String/Number

N/A

<object>

Text/String/Number

N/A

<objectname>

Text/String/Number

N/A

<objecttype>

Text/String/Number

N/A

<subject>

Text/String/Number

N/A

<useragent>

Text/String/Number

N/A

<url>

Text/String/Number

N/A

<group>

Text/String/Number

N/A

<command>

Text/String/Number

N/A

<action>

Text/String/Number

N/A

<result>

Text/String/Number

N/A

<responsecode>

Number

N/A

<bytesin>

Number

N/A

<bytesout>

Number

N/A

<duration>

Number

N/A

<tag2>

Text/String/Number