EVID : 1 EPO - Booting Disabled

https://kcm.trellix.com/corporate/index?page=content&id=KB54677

EVID : 1 EPO - Booting Disabled

Base Rule

Information

General Performance Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

MachineName

N/A

N/A

Name of the system hosting the detecting product.

AgentGUID

N/A

N/A

Unique identifier of the agent that forwarded the event.

IPAddress

<dip>

IP Address

IP address of the system hosting the detecting product (if given in the event).

OSName

N/A

N/A

N/A

UserName

<domainimpacted>
<account>

Text/String

N/A

TimeZoneBias

N/A

N/A

N/A

RawMACAddress

<dmac>

Text/String/Number

MAC address of the system hosting the detecting product.

ProductName

<vendorinfo>

Text/String

Name of the detecting managed product.

ProductVersion

<version>

Text/String/Number

Version number of the detecting product.

ProductFamily

N/A

N/A

N/A

TaskName

<object>

Text/String

N/A

ProductFamily

N/A

N/A

N/A

ProductName

N/A

N/A

Name of the detecting managed product.

ProductVersion

N/A

N/A

Version number of the detecting product.

EventID

<vmid>

Number

Unique identifier of the event class.

Severity

<severity>

Text/String/Number

N/A

GMTTime

N/A

N/A

N/A

UTCTime

N/A

N/A

N/A

DetectedUTC

N/A

N/A

N/A

ScanServer

<dname>

Text/String

N/A

Plugin

N/A

N/A

N/A

MaxScanThreadsUsed

N/A

N/A

N/A

MaxScanThreadsAllowed

N/A

N/A

N/A

RequestDenied

N/A

N/A

N/A

RequestAccepted

N/A

N/A

N/A

ScanTimeExceeded

N/A

N/A

N/A

FileAccessFailed

N/A

N/A

N/A

ProductCode

N/A

N/A

N/A