Authentication Messages
Classification
Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|
Authentication Messages | Base Rule | General Authentication Event | Other Audit |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type |
N/A | <severity> | Text/String |
N/A | <sname> | Number/Text |
N/A | <process> | Text/String |
CN | <session> | Number/Text |
VMCACheckAccessKrb | <object> | Text/String |
N/A | <vendorinfo> | Text/String |
by | <account> | Number/Text |
CN | <command> | Number/Text |
dc | <login> | Number/Text |
USN | <protnum> | Number/Text |
from | <dip> | Number |