Breadcrumbs

Curl Messages

Vendor Documentation

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field

LogRhythm Default

LogRhythm Default v2.0

N/A

N/A

<vendorinfo>

N/A

N/A

<process>

N/A

N/A

<severity>

N/A

<process>

N/A

N/A

<tag1>

N/A

N/A

<sip>

N/A

N/A

N/A

<sip>

N/A

N/A

<sname>

N/A

N/A

<protname>

N/A

N/A

<dname>

N/A

N/A

<dip>

N/A

N/A

<sport>

N/A

N/A

<smac>

N/A

N/A

<dport>

N/A

N/A

<url>

N/A

N/A

<dmac>

N/A

N/A

<subject>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID

Rule Name

Rule Type

Common Event

Classification

1003328

Curl Messages

Base Rule

General Process Information

Information

SSL Connection Closed

Sub Rule

Connection Closed

Network Traffic

SSL Connection Closed Messages

Sub Rule

Connection Closed

Network Traffic

SSL Connection Messages

Sub Rule

SSL Connection Created

Information

HTTP Status 000

Sub Rule

HTTP 0 : Success - Operation Completed OK

Information

File Download Failed

Sub Rule

Error Copying File

Error

Curl Failed

Sub Rule

Error Copying File

Error

File Copied Successfully

Sub Rule

File Copied

Information

LogRhythm Default v2.0

Regex ID

Rule Name

Rule Type

Common Event

Classification

1012551

V 2.0 : FireEye MPS Events

Base Rule

FireEye Notification

Operations : Other Operations