EVID 1102 : Privileged Object Access (Part 1) (Deutsch - Security)

Event Details

Event Type	Other Events
Event Description	1102(S) : The audit log was cleared.
Event ID	1102

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Provider	N/A	N/A
EventID	<vmid>	<vmid>
Version	N/A	N/A
Level	<severity>	<severity>
Task	<vendorinfo>	<vendorinfo>
Opcode	N/A	N/A
Keywords	<tag1>	<result>, <tag1>
TimeCreated	N/A	N/A
EventRecordID	N/A	N/A
Correlation	N/A	N/A
Execution	N/A	N/A
Channel	N/A	N/A
Computer	<dname>	<dname>
Error Code	N/A	<responsecode>
Publisher Id	N/A	<subject>
Backup Path	N/A	<object>
TargetUserName	N/A	N/A
DomainPolicyChanged	N/A	N/A
SubjectUserSid	N/A	N/A
SubjectUserName	<account>	<subject>
SubjectDomainName	<domainorigin>	N/A
SubjectLogonId	<session>	N/A
TargetUserName	N/A	N/A
TargetDomainName	N/A	N/A
NewProcessName	N/A	N/A
ServiceName	<process>	N/A
LogonId	N/A	N/A
Objecttype	N/A	N/A
Objectname	<objectname>	N/A
Filename	N/A	N/A
ProcessId	<processid>	N/A
GroupName	N/A	N/A
TaskName	N/A	N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1004651	EVID 1102, 4673, 4674 : Privileged Object Access	Base Rule	Object Accessed	Audit :Access Success
	EVID 1102 : Audit Log Cleared	Sub Rule	Log Cleared	Access Success
	EVID 4673 : Fail Priv Svc Call	Sub Rule	Access Object Failure	Access Failure
	EVID 4673 : Priv Svc Call	Sub Rule	Object Accessed	Access Success
	EVID 4674 : Fail Priv Object Operation	Sub Rule	Access Object Failure	Access Failure
	EVID 4674 : Privileged Object Operation	Sub Rule	Object Accessed	Access Success

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1011090	V 2.0 : Event Logging Service Messages	Base Rule	General Logging Information	Information
	V 2.0 : EVID 1100 : Event Logging Service Shutdown	Sub Rule	Process/Service Stopped	Startup and Shutdown
	V 2.0 : EVID 1102 : Audit Log Cleared	Sub Rule	Log Cleared	Access Success
	V 2.0 : EVID 1104 : Security Log Full	Sub Rule	Log Full	Error
	V 2.0 : EVID 1105 : EventLog AutomaticallyBackedUp	Sub Rule	Backup Completed	Information
	V 2.0 : EVID 1108 : Error Encountered Proces Event	Sub Rule	General Event Log Error	Error