Event Details
Log Fields and Parsing
This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.
|
Log Field |
LogRhythm Default |
LogRhythm Default v2.0 |
|
|---|---|---|---|
|
Provider |
N/A |
N/A |
|
|
EventID |
<vmid> |
<vmid> |
|
|
Version |
N/A |
N/A |
|
|
Level |
N/A |
<severity> |
|
|
Task |
N/A |
<vendorinfo> |
|
|
Opcode |
N/A |
N/A |
|
|
Keywords |
<tag1> |
<result>, <tag2> |
|
|
TimeCreated |
N/A |
N/A |
|
|
EventRecordID |
N/A |
N/A |
|
|
Correlation |
N/A |
N/A |
|
|
Execution |
N/A |
N/A |
|
|
Processid |
N/A |
N/A |
|
|
Channel |
N/A |
N/A |
|
|
Computer |
<dname> |
<dname> |
|
|
Eventdata |
<vendorinfo> |
N/A |
|
|
TargetUserSid |
N/A |
N/A |
|
|
TargetUserName |
<login>, <tag2> |
<login>, <tag1> |
|
|
TargetDomainName |
<domain> |
<domainorigin> |
|
|
TargetLogonId |
<session> |
<session> |
|
|
LogonType |
<sessiontype>, <tag3> |
<sessiontype>, <tag3> |
|
Log Processing Settings
This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.
LogRhythm Default
|
Regex ID |
Rule Name |
Rule Type |
Common Event |
Classification |
|---|---|---|---|---|
|
1006510 |
EVID 4634 & 4647 : Logoff Events |
Base Rule |
Authentication Activity |
Authentication Success |
|
EVID 4634 : User Logoff Type 3 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : System Logoff Type 3 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 3 |
Sub Rule |
Authentication Activity |
Authentication Success |
|
|
EVID 4634 : Administrator Logoff Type 3 |
Sub Rule |
Authentication Activity |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 3 |
Sub Rule |
Authentication Activity |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 5 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 10 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 9 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Administrator Logoff Type 2 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 2 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Administrator Logoff Type 11 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Administrator Logoff Type 8 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 4 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Administrator Logoff Type 10 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Administrator Logoff Type 9 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 8 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Administrator Logoff Type 4 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 7 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Administrator Logoff Type 7 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 11 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Administrator Logoff Type 5 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : System Logoff Type 4 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
EVID 4634 : System Logoff Type 10 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
EVID 4634 : System Logoff Type 7 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 5 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : User Logoff Type 7 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : User Logoff Type 2 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : System Logoff Type 9 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
EVID 4634 : User Logoff Type 8 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : System Logoff Type 11 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 2 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : System Logoff Type 8 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
EVID 4634 : User Logoff Type 5 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : System Logoff Type 2 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 9 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : System Logoff Type 5 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 7 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 4 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 10 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : User Logoff Type 9 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : User Logoff Type 10 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 11 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : User Logoff Type 4 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : User Logoff Type 11 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4634 : Anonymous Logoff Type 8 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
EVID 4647 : User Initiated Logoff |
Sub Rule |
User Logoff |
Authentication Success |
LogRhythm Default v2.0
|
Regex ID |
Rule Name |
Rule Type |
Common Event |
Classification |
|---|---|---|---|---|
|
1011078
|
V 2.0 : EVID 4634/4647 : Account Logoff Events |
Base Rule |
Authentication Activity |
Authentication Success |
|
V 2.0 : EVID 4634 : Computer Account Logoff |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4647 : Computer Account Logoff |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : User Account Logoff |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4647 : User Account Logoff |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Administrator Logoff Type 10 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Administrator Logoff Type 11 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Administrator Logoff Type 2 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Administrator Logoff Type 3 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Administrator Logoff Type 4 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Administrator Logoff Type 5 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Administrator Logoff Type 7 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Administrator Logoff Type 8 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Administrator Logoff Type 9 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Anonymous Logoff Type 10 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Anonymous Logoff Type 11 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Anonymous Logoff Type 2 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Anonymous Logoff Type 3 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Anonymous Logoff Type 4 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Anonymous Logoff Type 5 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Anonymous Logoff Type 7 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Anonymous Logoff Type 8 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : Anonymous Logoff Type 9 |
Sub Rule |
User Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : System Logoff Type 10 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : System Logoff Type 11 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : System Logoff Type 2 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : System Logoff Type 3 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : System Logoff Type 4 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : System Logoff Type 5 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : System Logoff Type 7 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : System Logoff Type 8 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4634 : System Logoff Type 9 |
Sub Rule |
Computer Logoff |
Authentication Success |
|
|
V 2.0 : EVID 4647 : User Initiated Logoff |
Sub Rule |
User Logoff |
Authentication Success |