Authentication Status Messages

Vendor Documentation

Rule Name	Rule Type	Common Event	Classification
Authentication Status Messages	Base Rule	General Authentication Event	Other Audit
Authentication Timed Out	Sub Rule	Server Authentication Timed Out	Warning
User Logon	Sub Rule	User Logon	Authentication Success
User Logged Off	Sub Rule	User Logoff	Authentication Success
Authentication Status - User Logged Out	Sub Rule	User Logoff	Authentication Success
Authentication Timed Out - Notification	Sub Rule	Authentication Timeout	Other Audit

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
logid	<vmid>	Number	The ID (logid) is a 10-digit field. It is a unique identifier for that specific log.
level	<severity>	Text/String	Each log entry contains a Level (level) field that indicates the estimated severity of the event that caused the log entry.
srcip	<sip>	IP Address	IP address of the traffic’s origin.
user	<login>	Text/String	N/A
server	<domainorigin>	Text/String	N/A
msg	<object>	Text/String	N/A
logdesc	<subject>	Text/String	N/A
action	<command>	Text/String	N/A