General Authentication

Classification

Rule Name	Rule type	common event	Classification
General Authentication	Base Rule	Authentication Activity	Authentication Success
Authentication	Sub Rule	User Logon	Authentication Success
Failed Authentication	Sub Rule	Authentication Failure Activity	Authentication Failure
Authentication	Sub Rule	User Logon	Authentication Success
Failed Authentication - Bad Password	Sub Rule	User Logon Failure : Bad Password	Authentication Failure

Mapping with LogRhythm Schema  

Device Key in Log Message	LogRhythm Schema	Data Type
N/A	<severity>	String
N/A	<process>	String
N/A	<tag1>	String
N/A	<login>	String
N/A	<tag2>	String
N/A	<sip>	Number
N/A	<sname>	String

×