Audit
client_ip_host
Vendor Documentation
Classification
Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|
Audit | Base Rule | General Audit Message | Other Audit |
Audit : Secret Changed | Sub Rule | Password Modified | Account Modified |
Audit : Policy Published | Sub Rule | Policy Created : Firewall/ACL | Policy |
Audit : Rule Modified | Sub Rule | Object Modified | Access Success |
Audit : Object Modified | Sub Rule | Object Modified | Access Success |
Audit : Policy Installed | Sub Rule | Policy Created : Firewall/ACL | Policy |
Audit : File Retrieved | Sub Rule | Object Accessed | Access Success |
Audit : Rule Deleted | Sub Rule | Object Deleted/Removed | Access Success |
Audit : Object Deleted | Sub Rule | Object Deleted/Removed | Access Success |
Audit : Section Created | Sub Rule | Object Modified | Access Success |
Audit : Rule Created | Sub Rule | Object Created | Access Success |
Audit : Create Object | Sub Rule | Object Created | Access Success |
Audit : Log Out | Sub Rule | User Logoff | Authentication Success |
Audit : Log In | Sub Rule | User Logon | Authentication Success |
Audit : Application Control & URL Filtering Update | Sub Rule | Signatures Updated | Configuration |
Audit : Initialize SIC Certificate | Sub Rule | Certificate Authorization Registered | Other Audit Success |
Audit : Revoke SIC Certificate | Sub Rule | Trust Relationship Revoked | Access Revoked |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type |
---|---|---|
Product | <version> | Number/Text |
origin | <sender> | Number/Text |
operation | <action> | Number/Text |
operation | <tag1> | Number/Text |
subject | <vendorinfo> | Number/Text |
status | <status> | Text/String |
administrator | <login> | Number/Text |
client | <dip> | Number |
client | <dname> | Number/Text |
generalinformation | <vendorinfo> | Number/Text |
objecttype | <objecttype> | Number/Text |