Vendor Documentation
Classification
|
Rule Name |
Rule Type |
Common Event |
Classification
|
|---|---|---|---|
|
Alert Messages |
Base Rule |
General Alert Message |
Information |
|
EVID 76509 : File_Malware-Detected |
Sub Rule |
Detected Malware Activity |
Malware |
|
EVID 70471 : DNS_Server-Class-Unknown |
Sub Rule |
Non Compliant DNS |
Activity |
|
EVID 70590 : TCP_Checksum-Mismatch |
Sub Rule |
Vuln Low Severity : TCP/IP |
Vulnerability |
|
EVID 70422 : DNS_Client-UDP-Extra-Data |
Sub Rule |
Non Compliant DNS |
Activity |
|
EVID 70428 : DNS_Client-Type-Unknown |
Sub Rule |
Non Compliant DNS |
Activity |
|
EVID 70407 : DNS_Client-Name-Bad-Label-Type |
Sub Rule |
Non Compliant DNS |
Activity |
|
EVID 79891 : HTTP_Headerline_LF |
Sub Rule |
Non Compliant DNS |
Activity |
|
EVID 501487 : Binary_Confl-Content-Type-Text-Plain |
Sub Rule |
Vuln Low Severity : Protocol Violation |
Vulnerability |
|
EVID 501485 : Binary_Conflicting-Content-Type-Text |
Sub Rule |
Vuln Low Severity : Protocol Violation |
Vulnerability |
|
EVID 76457 : HTTP_Server-Nested-Multipart-Message |
Sub Rule |
Vuln Low Severity : Web Server |
Vulnerability |
|
EVID 70425 : DNS_Client-Class-Unknown |
Sub Rule |
Non Compliant DNS |
Activity |
|
EVID 278069 : MHTML-Info-Dsclosure-CVE-2011-0096-3 |
Sub Rule |
Vuln High Severity : Web Server |
Vulnerability |
|
EVID 275505 : HTTP_SLS-Unauthorized-Status-Code |
Sub Rule |
User Logon Failure |
Authentication Failure |
|
EVID 316105 : Authentication-Null-Session-DOS |
Sub Rule |
Vuln Low Severity : Denial Of Service |
Vulnerability |
|
EVID 264210 : HTTPS_CS-OpenSSL-SSLv3-Get-Shared-Ci |
Sub Rule |
Cipher Information |
Information |
|
EVID 276065 : HTTP_CSU-Excessively-Long-Url |
Sub Rule |
Url Too Long |
Warning |
|
EVID 70613 : TCP_Segment-Invalid |
Sub Rule |
General TCP/IP Warning |
Warning |
|
EVID 70802 : System_Engine-LOGIN_Failed |
Sub Rule |
Computer Logon Failure |
Authentication Failure |
|
EVID 71423 : HTTP_Client-Obsolete-Header-Line-Fold |
Sub Rule |
HTTP Header Error |
Error |
Mapping with LogRhythm Schema
|
Device Key in Log Message |
LogRhythm Schema |
Data Type |
|
Version |
<version> |
Number |
|
vmid |
<vmid> |
Number |
|
objectname |
<objectname> |
Text/String |
|
cve |
<cve> |
Text/String/Number |
|
severity |
<severity> |
Text/String/Number |
|
spt |
<sport> |
Number |
|
dst |
<dip> |
IP Address |
|
cat |
<subject> |
Text/String/Number |
|
requestURL |
<url> |
Text/String |
|
app |
<session> |
Text/String/Number |
|
act |
<command> |
Text/String |
|
deviceoutboundinterface |
<sinterface> |
Text/String/Number |
|
deviceinboundinterface |
<dinterface> |
Text/String/Number |
|
proto |
<protnum> |
Number |
|
dpt |
<dport> |
Number |
|
src |
<sip> |
IP Address |