Attack Log Messages
Vendor Documentation
Classification
Rule Name | Rule Type | Common Event | Classification |
Attack Log Messages | Base Rule | General Attack Activity | Attack |
Signature Policy | Sub Rule | Signature Information | Information |
Known Bots Detection | Sub Rule | Security Violation | Other Security |
HTTP Method Violation | Sub Rule | Security Violation | Other Security |
HTTP Host Violation | Sub Rule | Security Violation | Other Security |
Page Access Rule Violation | Sub Rule | Security Violation | Other Security |
Start Page Violation | Sub Rule | Security Violation | Other Security |
Parameter Name | Sub Rule | General Attack Activity | Attack |
Block List IP Blocked | Sub Rule | Access Blocked | Information |
URL Access Rule Violation | Sub Rule | Rule Violation | Warning |
Custom Signature Rule Violation | Sub Rule | Rule Violation | Warning |
Brute Force Login Violation | Sub Rule | Brute Force Activity | Attack |
Hidden Field Manipulation | Sub Rule | Security Violation | Other Security |
User Defined In Site Locked Out | Sub Rule | Security Violation | Other Security |
HTTP Parsing Error | Sub Rule | General Error Log Message | Error |
DoS Protection Violation | Sub Rule | Security Violation | Other Security |
SYN Flood Protection | Sub Rule | Security Violation | Other Security |
HTTPS Connection Failure | Sub Rule | HTTPS Connection Error | Error |
File Upload Restrictions Violation | Sub Rule | Security Violation | Other Security |
Unauthorized Geo IP | Sub Rule | Unauthorized Activity | Misuse |
Custom Access Rule Violation | Sub Rule | Security Violation | Other Security |
IP Reputation Violation | Sub Rule | Security Violation | Other Security |
Padding Oracle Attack | Sub Rule | General Attack Activity | Attack |
CSRF Detection | Sub Rule | Security Violation | Other Security |
Quarantined IPs | Sub Rule | Security Violation | Other Security |
HTTP Protocol Constraints Violation | Sub Rule | Security Violation | Other Security |
Credential Stuffing Defense Violation | Sub Rule | Security Violation | Other Security |
User Tracking Rules Violation | Sub Rule | Security Violation | Other Security |
XML Validation Violation | Sub Rule | Security Violation | Other Security |
Cookie Security Violation | Sub Rule | Security Violation | Other Security |
FTP Command Restriction | Sub Rule | FTP Command Denied | Failed Activity |
Session Was Timed Out | Sub Rule | Session Closed | Information |
FTP File Security Violation | Sub Rule | Security Violation | Other Security |
FTPS Connection Failure | Sub Rule | Security Violation | Other Security |
Machine Learning Anomaly Detection Violation | Sub Rule | Security Violation | Other Security |
OpenAPI Validation Violation | Sub Rule | Security Violation | Other Security |
WebSocket Security Violation | Sub Rule | Security Violation | Other Security |
MiTB AJAX Security Violation | Sub Rule | Security Violation | Other Security |
Machine Learning Bot Detection Violation | Sub Rule | Security Violation | Other Security |
CORS Check Security Violation | Sub Rule | Security Violation | Other Security |
JSON Validation Security Violation | Sub Rule | Security Violation | Other Security |
Mobile API Protection Rule Violation | Sub Rule | Security Violation | Other Security |
BOT Deception Violation | Sub Rule | Possible Botnet Activity | Malware |
BOT Biometrics Based Detection Violation | Sub Rule | Security Violation | Other Security |
BOT Threshold Based Detection Violation | Sub Rule | Security Violation | Other Security |
URL Encryption Violation | Sub Rule | Security Violation | Other Security |
Client Management Violation | Sub Rule | Security Violation | Other Security |
IP Not In Allow Only List Was Blocked | Sub Rule | Access Blocked | Information |
Web Shell Detection Violation | Sub Rule | Security Violation | Other Security |
Zero Trust Access Violation | Sub Rule | Security Violation | Other Security |
GRPC Security Violation | Sub Rule | Security Violation | Other Security |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
N/A | N/A | N/A | Common Event Format identifier: Default or unspecified severity level (can be replaced with specific severity levels such as 1-10). |
N/A | N/A | N/A | Vendor or organization name. |
N/A | N/A | N/A | Product or service name generating the event. |
N/A | <version> | Numbers | Version number. |
N/A | <vmid> | Numbers | log_id |
N/A | <vendorinfo> | Text/String | Description |
N/A | <severity> | Text/String | Severity level of the event. |
cat | <objecttype> | Text/String | N/A |
act | <action> | Text/String | N/A |
deviceExternalId | N/A | N/A | N/A |
deviceProcessName | <process> | Text/String | N/A |
sourceServiceName | N/A | N/A | N/A |
proto | <protname> | Text/String | N/A |
app | <object> | Text/String | N/A |
src | <sip> | IP Address | N/A |
spt | <sport> | Numbers | N/A |
dst | <dip> | IP Address | N/A |
dpt | <dport> | Numbers | N/A |
requestMethod | <command> | Text/String | N/A |
request | N/A | N/A | N/A |
requestClientApplication | <useragent> | Text/String | N/A |
dhost | <dname> | Text/String | N/A |
msg | <subject> | Text/String | N/A |
cn1 | N/A | N/A | N/A |
cn1Label | N/A | N/A | N/A |
cs1 | N/A | N/A | N/A |
cs1Label | N/A | N/A | N/A |
cs2 | N/A | N/A | N/A |
cs2Label | N/A | N/A | N/A |
cs3 | N/A | N/A | N/A |
cs3Label | N/A | N/A | N/A |
cs4 | N/A | N/A | N/A |
cs4Label | N/A | N/A | N/A |
cs5 | N/A | N/A | N/A |
cs5Label | N/A | N/A | N/A |
cs6 | N/A | N/A | N/A |
cs6Label | N/A | N/A | N/A |