General Authentication

Classification


Rule Name

Rule type

common event

Classification

General Authentication

Base Rule

Authentication Activity

Authentication Success

Authentication

Sub Rule

User Logon

Authentication Success

Failed Authentication

Sub Rule

Authentication Failure Activity

Authentication Failure

Authentication

Sub Rule

User Logon

Authentication Success

Failed Authentication - Bad Password

Sub Rule

User Logon Failure : Bad Password

Authentication Failure

Mapping with LogRhythm Schema  

Device Key in Log Message

LogRhythm Schema

Data Type

N/A

<severity>

String

N/A

<process>

String

N/A

<tag1>

String

N/A

<login>

String

N/A

<tag2>

String

N/A

<sip>

Number

N/A

<sname>

String