EVID 500005 : Connection Termination

Classification

Rule Name	Rule Type	Common Event	Classification
EVID 500005 : Connection Termination	Base Rule	Connection Terminated	Network Traffic

Mapping with LogRhythm Schema  

Device Key in Log Message	LogRhythm Schema	Data Type
N/A	<vmid>	Number
N/A	<sip>	IP Address
N/A	<dip>	IP Address
N/A	<sport>	Number
N/A	<dport>	Number
N/A	<sinterface>	Text/String
N/A	<dinterface>	Text/String
N/A	<protname>	Text/String
N/A	<object>	Text/String
N/A	<subject>	Text/String

×