DNS Messages - D Series

DNS Messages - D Series

Base Rule

DNS Notification

Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

logid

<vmid>

Number

The ID (logid) is a 10-digit field. It is a unique identifier for that specific log.

level

<severity>

Text\String

Each log entry contains a Level (level) field that indicates the estimated severity of the event that caused the log entry.

srcip

<sip>

IP Address

IP address of the traffic’s origin.

dstip

<dip>

IP Address

Destination IP address for the web.

qname

<dname>

Text\String

N/A

srcport

<sport>

Number

Port number of the traffic's origin

dstport

<dport>

Number

Port number of the traffic's destination.

srcintf

<sinterface>

Text\String

Interface name of the traffic's origin.

dstintf

<dinterface>

Text\String

Interface of the traffic's destination.

user

<login>

Text\String

Name of the user

vd

<domainorigin>

Text\String

Name of the virtual domain in which the log message was recorded.

sessionid

<session>

Number

ID for the session.

subtype

<subject>

Text\String

Subcategory

type

<policy>

Text\String

Category