Vendor Documentation
Classification
|
Rule Name |
Rule Type |
Common Event |
Classification
|
|---|---|---|---|
|
Firewall Messages |
Base Rule |
General Firewall Log |
Network Traffic |
|
1004 : FW_Related-Connection |
Sub Rule |
Traffic Allowed by Host Firewall |
Network Allow |
|
70022 : Connection_Closed-Abnormally |
Sub Rule |
Connection Terminated |
Network Traffic |
|
70026 : Connection_Progress |
Sub Rule |
Connection Starting |
Network Traffic |
|
70019 : Connection_Discarded |
Sub Rule |
Connection Closed |
Network Traffic |
|
70018 : Connection_Allowed |
Sub Rule |
Traffic Allowed by Host Firewall |
Network Allow |
|
71257 : TCP_Segment-SYN-No-Options |
Sub Rule |
TCP SYN Received |
Network Traffic |
|
70021 : Connection_Closed |
Sub Rule |
Connection Closed |
Network Traffic |
Mapping with LogRhythm Schema
|
Device Key in Log Message |
LogRhythm Schema |
Data Type |
|
Version |
<version> |
Number |
|
vmid |
<vmid> |
Number |
|
objectname |
<objectname> |
Text/String |
|
severity |
<severity> |
Text/String/Number |
|
spt |
<sport> |
Number |
|
dst |
<dip> |
IP Address |
|
request |
<object> |
Text/String |
|
app |
<session> |
Text/String/Number |
|
act |
<command> |
Text/String |
|
msg |
<object> |
Text/String |
|
deviceoutboundinterface |
<sinterface> |
Text/String/Number |
|
deviceinboundinterface |
<dinterface> |
Text/String/Number |
|
proto |
<protnum> |
Number |
|
dpt |
<dport> |
Number |
|
in |
<bytesin> |
Number |
|
out |
<bytesout> |
Number |
|
src |
<sip> |
IP Address |