Catch All : Level 3 3

Vendor Documentation

https://docs.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms525807(v=vs.90)

Classification

Rule Name	Rule Type	Common Event	Classification
Catch All : Level 3	Base Rule	General Information	Information
HTTP - 100 - Transitional - Continue	Sub Rule	HTTP 100 : Transition Status - Continue	Information
HTTP - 101 - Transitional - Protocol Switch	Sub Rule	HTTP 101 : Transition Status - Protocol Switch	Information
HTTP - 200 - Success - OK	Sub Rule	HTTP 200 : Success Reply - OK	Information
HTTP - 201 - Success - Created	Sub Rule	HTTP 201 : Success Reply - Created	Information
HTTP - 202 - Success - Accepted	Sub Rule	HTTP 202 : Success Reply - Accepted	Information
HTTP - 203 - Success - Nonauthoritative Info	Sub Rule	HTTP 203 : Success Reply - Nonauthoritative Info	Information
HTTP - 204 - Success - No Content	Sub Rule	HTTP 204 : Success Reply - No Content	Information
HTTP - 205 - Success - Reset Content	Sub Rule	HTTP 205 : Success Reply - Reset Content	Information
HTTP - 206 - Success - Partial Content	Sub Rule	HTTP 206 : Success Reply - Partial Content	Information
HTTP - 207 - Success - Multistatus Response	Sub Rule	HTTP 207 : Success - Multistatus Response	Information
HTTP - 300 - Redirect - Multiple Choices	Sub Rule	HTTP 300 : Redirect - Multiple Choices	Information
HTTP - 301 - Redirect - Moved Permanently	Sub Rule	HTTP 301 : Redirect - Moved Permanently	Information
HTTP - 302 - Redirect - Moved Temporarily	Sub Rule	HTTP 302 : Redirect - Moved Temporarily	Information
HTTP - 303 - Redirect - See Other	Sub Rule	HTTP 303 : Redirect - See Other	Information
HTTP - 304 - Redirect - Not Modified	Sub Rule	HTTP 304 : Redirect - Not Modified	Information
HTTP - 305 - Redirect - Use Proxy	Sub Rule	Unauthorized Proxy Activity	Misuse
HTTP - 306 - Redirect - Unused	Sub Rule	HTTP 306 : Redirect - Unused	Information
HTTP - 307 - Redirect - Temporary Redirect	Sub Rule	HTTP 307 : Redirect - Temporary Redirect	Information
HTTP - 400 - Req Error - Bad Request	Sub Rule	HTTP 400 : Request Error - Bad Request	Error
HTTP - 401 - Req Error - Unauthorized	Sub Rule	Authentication Failure Activity	Authentication Failure
HTTP - 401.1 - Req Error - Logon Failed	Sub Rule	User Logon Failure	Authentication Failure
HTTP - 401.2 - Req Error - Logon Fail (Svr Config)	Sub Rule	Computer Logon Failure	Authentication Failure
HTTP - 401.3 - Req Error - Unauth (ACL)	Sub Rule	Service Logon Failure	Authentication Failure
HTTP - 401.4 - Req Error - Auth Failed (Filter)	Sub Rule	Authentication Failure Activity	Authentication Failure
HTTP - 401.5 - Req Error - Auth Failed (ISAPI/CGI)	Sub Rule	Service Logon Failure	Authentication Failure
HTTP - 401.7 - Req Error - Access Deny (URL Auth)	Sub Rule	Authentication Failure Activity	Authentication Failure
HTTP - 402 - Req Error - Payment Required	Sub Rule	HTTP 402 : Request Error - Payment Required	Error
HTTP - 403 - Req Error - Forbidden	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.1 - Req Error - No Execute Access	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.10 - Req Error - Invalid Config	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.11 - Req Error - Password Change	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.12 - Req Error - Mapper Denied Access	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.13 - Req Error - Client Cert Revoked	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.14 - Req Error - Dir List Denied	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.15 - Req Error - CALs Exceeded	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.16 - Req Error - Cert Untrusted/Invalid	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.17 - Req Error - Cert Expired/Not Valid	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.18 - Req Error - Cannot Exec URL	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.19 - Req Error - Cannot Exec CGI	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.2 - Req Error - No Read Access	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.20 - Req Error - Passport Logon Failed	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.3 - Req Error - No Write Access	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.4 - Req Error - SSL Required	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.5 - Req Error - SSL 128 Required	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.6 - Req Error - IP Rejected	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.7 - Req Error - Client Cert Required	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.8 - Req Error - Site Access Denied	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 403.9 - Req Error - Too Many Users	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 404 - Req Error - Not Found	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.1 - Req Error - Site Not At Req Port	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.10 - Req Error - Req Header Too Long	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.11 - Req Error - Req URL Doubled Esc	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.12 - Req Error - Req High Bit Chars	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.13 - Req Error - Req Content Too Large	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.14 - Req Error - Req URL Too Long	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.15 - Req Error - Req Query Too Long	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.2 - Req Error - Denied By Svc Policy	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.3 - Req Error - Denied By MIME Policy	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.4 - Req Error - No Handler	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.5 - Req Error - Req URL Seq Denied	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.6 - Req Error - Req Verb Denied	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.7 - Req Error - Req File Ext Denied	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.8 - Req Error - Denied Hidden Namespace	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 404.9 - Req Error - Denied (Hidden File)	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 405 - Req Error - Method Not Allowed	Sub Rule	HTTP 405 : Request Error - Method Not Allowed	Error
HTTP - 406 - Req Error - Not Acceptable	Sub Rule	HTTP 406 : Request Error - Not Acceptable	Error
HTTP - 407 - Req Error - Proxy Auth Requested	Sub Rule	HTTP 407 : Request Error - Proxy Auth Required	Error
HTTP - 408 - Req Error - Request Time-Out	Sub Rule	HTTP 408 : Request Error - Request Time-Out	Error
HTTP - 409 - Req Error - Conflict	Sub Rule	HTTP 409 : Request Error - Conflict	Error
HTTP - 410 - Req Error - Gone	Sub Rule	HTTP 410 : Request Error - Gone	Error
HTTP - 411 - Req Error - Length Required	Sub Rule	HTTP 411 : Request Error - Length Required	Error
HTTP - 412 - Req Error - Precondition Failed	Sub Rule	HTTP 412 : Request Error - Precondition Failed	Error
HTTP - 413 - Req Error - Request Item Too Big	Sub Rule	HTTP 413 : Request Error - Request Item Too Big	Error
HTTP - 414 - Req Error - Request-URL Too Large	Sub Rule	HTTP 414 : Request Error - Request-URL Too Large	Error
HTTP - 415 - Req Error - Unsupported Type	Sub Rule	HTTP 415 : Request Error - Unsupported Type	Error
HTTP - 416 - Req Error - Requested Rng Unfillable	Sub Rule	HTTP 416 : Request Error - Range Unfillable	Error
HTTP - 417 - Req Error - Expectation Failed	Sub Rule	HTTP 417 : Request Error - Expectation Failed	Error
HTTP - 440 - Client Error - Login Timeout	Sub Rule	Timeout Error	Error
HTTP - 500 - Svr Error - Internal Server Error	Sub Rule	HTTP 500 : Server Error - Internal Server Error	Error
HTTP - 500.100 - Svr Error - Internal ASP Error	Sub Rule	HTTP 500 : Server Error - Internal Server Error	Error
HTTP - 500.12 - Svr Error - App Busy Restarting	Sub Rule	HTTP 500 : Server Error - Internal Server Error	Error
HTTP - 500.13 - Svr Error - Web Server Too Busy	Sub Rule	HTTP 500 : Server Error - Internal Server Error	Error
HTTP - 500.15 - Svr Error - Global.asa Disallowed	Sub Rule	HTTP 500 : Server Error - Internal Server Error	Error
HTTP - 500.16 - Svr Error - Bad UNC Auth Cred	Sub Rule	HTTP 500 : Server Error - Internal Server Error	Error
HTTP - 500.18 - Svr Error - URL Auth Store Fail	Sub Rule	HTTP 500 : Server Error - Internal Server Error	Error
HTTP - 501 - Svr Error - Not Implemented	Sub Rule	HTTP 501 : Server Error - Not Implemented	Error
HTTP - 502 - Svr Error - Bad Gateway	Sub Rule	HTTP 502 : Server Error - Bad Gateway	Error
HTTP - 503 - Svr Error - Service Unavailable	Sub Rule	HTTP 503 : Server Error - Service Unavailable	Error
HTTP - 504 - Svr Error - Gateway Time-Out	Sub Rule	HTTP 504 : Server Error - Gateway Time-Out	Error
HTTP - 505 - Svr Error - HTTP Ver Unsupported	Sub Rule	HTTP 505 : Server Error - HTTP Ver Unsupported	Error

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type
N/A	<dip>	Number
N/A	<command>	Text/String
N/A	<url>	Text/String
N/A	<subject>	Number/Text
N/A	<dport>	Number
N/A	<domain>	Text/String
N/A	<login>	Text/String
N/A	<sip>	Number
N/A	<version>	Number
N/A	<useragent>	Number/Text
N/A	<object>	Number/Text
N/A	<vmid>	Number
N/A	<responsecode>	Number
N/A	<tag2>	Number
N/A	<tag1>	Number
N/A	<bytesout>	Number
N/A	<bytesin>	Number
N/A	<milliseconds>	Number