Skip to main content
Skip table of contents

Attack Anomaly

Vendor Documentation

Classification

Rule Name

Rule Type

Common Event

Classification

Attack AnomalyBase RuleGeneral Attack ActivityAttack
Attack Anomaly (TCP/UDP)Sub RuleGeneral Attack ActivityAttack
Attack Anomaly (ICMP)Sub RuleGeneral Attack ActivityAttack


Mapping with LogRhythm Schema  

Device Key in Log MessageLog ValueLogRhythm SchemaData TypeSchema Description
logidN/A

<vmid>

NumberEach log entry contains a Level (level) field that indicates the estimated severity of the event that caused the log entry,
severityN/A<severity>Text/StringEach log entry contains a Level (level) field that indicates the estimated severity of the event that caused the log entry,
srcipN/A<sip>IP AddressIP address of the traffic’s origin
dstipN/A<dip>IP AddressDestination IP address for the web
srcportN/A<sport>NumberPort number of the traffic's origin
dstportN/A<dport>NumberPort number of the traffic's destination.
srcintfN/A<sinterface>Text/StringInterface name of the traffic's origin.
protoN/A

<protnum>

NumberThe protocol used by web traffic (tcp by default)
vdN/A<domainorigin>Text\StringName of the virtual domain in which the log message was recorded.
sessionidN/A<session>NumberID for the session.
attackidN/A<processid>NumberN/A
attackN/A<object>Text\StringN/A
msgN/A<subject>Text\StringN/A
refN/A<url>Text\StringN/A
actionN/A<command>Text\StringN/A
countN/A<quantity>NumberN/A
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.