CROND Operations 1
Classification
Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|
CROND Operations | Base Rule | CROND Information Message | Information |
Crond : Cannot Set Security Context | Sub Rule | Authentication Failure Activity | Authentication Failure |
Crond : Failed To Open PAM Security Session | Sub Rule | Failed To Create Session | Error |
Crond : Password Expired | Sub Rule | LOGIN_PASSWORD_EXPIRED | Information |
Crond : Failed To Authorize User | Sub Rule | PAM Authentication Error | Error |
Crond : Command Executed | Sub Rule | Cron Command Information | Information |
Crond : Command Executed As Root | Sub Rule | Crond Executed Command As Root | Information |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type |
---|---|---|
N/A | <severity> | Text/String |
N/A | <dname> | Number/Text |
N/A | <process> | Text/String |
N/A | <processid> | Number |
N/A | <tag1> | Text/String |
N/A | <subject> | Text/String |
N/A | <tag2> | Text/String |
N/A | <login> | Text/String |
N/A | <command> | Number/Text |