Skip to main content
Skip table of contents

General Catch All Level

Vendor Documentation

Classification

Rule Name

Rule Type

Classification

CommonE vent

General Catch All Level

Base Rule

Information

General Information

EVID 2022: Boot Record Infection Clean Error

Sub Rule

Error

General Error

EVID 3006: Task Error

Sub Rule

Error

General Error

EVID 3008: Directory Length Access Error

Sub Rule

Error

General Error

EVID 3032: ErrorWhileTryingTo Open/Create Log File

Sub Rule

Error

General Error

EVID 3035: Error Launching A Program

Sub Rule

Error

General Error

EVID 3038: Error Writing To Log

Sub Rule

Error

General Error

EVID 3045: CA - Error While Accessing Log File

Sub Rule

Error

General Error

EVID 3047: CA - Directory Length Access Error

Sub Rule

Error

General Error

EVID 3055: Error Stopping Drivers

Sub Rule

Error

General Error

EVID 3026: Error Sending Information To The Driver

Sub Rule

Error

General Error

EVID 3027: Error Sending Folder To The Driver

Sub Rule

Error

General Error

EVID 3028: Error Obtaining Log Data

Sub Rule

Error

General Error

EVID 3029: Error Occurred While Enabling Driver

Sub Rule

Error

General Error

EVID 3030: Error Occurred While Disabling Driver

Sub Rule

Error

General Error

EVID 3031: Error While Obtaining Statistical Data

Sub Rule

Error

General Error

EVID 3016: Error Opening Service Manager

Sub Rule

Error

General Error

EVID 3017: Error Starting Drivers

Sub Rule

Error

General Error

EVID 3018: Error Occurred Starting Log Subsystem

Sub Rule

Error

General Error

EVID 3019: Error Obtaining Device Driver Versions

Sub Rule

Error

General Error

EVID 3021: Scan Engine Error

Sub Rule

Error

General Error

EVID 3025: Error Sending Options To Device Driver

Sub Rule

Error

General Error

EVID 1511: Abnormal Termination

Sub Rule

Warning

General Warning

EVID 1090: OAS Stopped

Sub Rule

Information

General Information

EVID 1127: Scanning Engine Disabled

Sub Rule

Information

General Information

EVID 1128: Scan Time Exceeded

Sub Rule

Information

General Information

EVID 1204: Report OS And Serial

Sub Rule

Information

General Information

EVID 2017: Centralized Alerting

Sub Rule

Information

General Information

EVID 34153: Signed Content Detected

Sub Rule

Information

General Information

EVID 34157: Protected Content Triggered

Sub Rule

Information

General Information

EVID 34158: Password Protected Content Detected

Sub Rule

Information

General Information

EVID 10191: Audit Results

Sub Rule

Information

General Information

EVID 13001:MachineCompliantOrNon-CompliantWithRul

Sub Rule

Information

General Information

EVID 14000: Intercept IPS Security Event

Sub Rule

Information

General Information

EVID 16001: Reserved For Future Use

Sub Rule

Information

General Information

EVID 16007: Subnet Has Become Unmonitored

Sub Rule

Information

General Information

EVID 34152: Mail Size Filter Rule Triggered

Sub Rule

Information

General Information

EVID 10111: Sentry Results Non-Verbose

Sub Rule

Information

General Information

EVID 10114: Informational Event

Sub Rule

Information

General Information

EVID 10127: IDS Testing Text

Sub Rule

Information

General Information

EVID 10130: Informational Event

Sub Rule

Information

General Information

EVID 10159: AutoDiscovery Results

Sub Rule

Information

General Information

EVID 10175: ThreatScan Results

Sub Rule

Information

General Information

EVID 10066: Informational Event

Sub Rule

Information

General Information

EVID 10082: Informational Event

Sub Rule

Information

General Information

EVID 10094: Smb Grind Status

Sub Rule

Information

General Information

EVID 10095: Smb Grind Result

Sub Rule

Information

General Information

EVID 10098: Informational Event

Sub Rule

Information

General Information

EVID 10110: Sentry Results Verbose

Sub Rule

Information

General Information

EVID 10032: Probe Start

Sub Rule

Information

General Information

EVID 10033: Probe Stop

Sub Rule

Information

General Information

EVID 10034: Informational Event

Sub Rule

Information

General Information

EVID 10046: Probe Results Header

Sub Rule

Information

General Information

EVID 10047: Probe Hop

Sub Rule

Information

General Information

EVID 10050: Informational Event

Sub Rule

Information

General Information

EVID 3037: Memory Grant Unavailable

Sub Rule

Information

General Information

EVID 8500: Banned Item Found

Sub Rule

Information

General Information

EVID 8502: Item Matched Filtering Criteria

Sub Rule

Information

General Information

EVID 8503: Item Matched Spam Criteria

Sub Rule

Information

General Information

EVID 10018: Informational Event

Sub Rule

Information

General Information

EVID 10031: Module Results

Sub Rule

Information

General Information

EVID 3014: Task Reports General System Error

Sub Rule

Error

General System Error

EVID 3053: CA - Scan Reports General System Error

Sub Rule

Error

General System Error

EVID 1200: Process Started

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10064: Crack Started

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10080: Grind Start

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10096: Sentry Started

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10097: Sentry Finished

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10112: IDS Start

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10177: Audit Stop

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 12000: Rogue System Sensor Started

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10113: IDS Stop

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10144: AutoDiscovery Start

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10145: AutoDiscovery Stop

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10157: AutoDiscovery Host Started

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10158: AutoDiscovery Host Finished

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10176: Audit Start

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 1032: File Moved To Quarantine Area

Sub Rule

Activity

Quarantine

EVID 1056: File Moved To Quarantine

Sub Rule

Activity

Quarantine

EVID 1501: Infected Email Quarantined

Sub Rule

Activity

Quarantine

EVID 2008: File Moved To Quarantine Area

Sub Rule

Activity

Quarantine

EVID 2018: CA- Infected FileMovedToQuarantine Area

Sub Rule

Activity

Quarantine

EVID 1065: Service Ended

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 1201: Process Ended

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 10065: Crack Finished

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 10081: Grind Stop

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 10189: Audit Host Started

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 10190: Audit Host Finished

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 12002: Rogue System Sensor Stopped

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 1037: Infected Boot Record Found

Sub Rule

Information

General Virus Infected

EVID 1052: Infected Binder Object

Sub Rule

Information

General Virus Infected

EVID 1053: Infected File Found

Sub Rule

Information

General Virus Infected

EVID 1503: Infected Email Detected

Sub Rule

Information

General Virus Infected

EVID 2000: Infected File Found

Sub Rule

Information

General Virus Infected

EVID 2001: Infected File Cleaned

Sub Rule

Information

General Virus Infected

EVID 2002: Unable To Clean Infected File

Sub Rule

Information

General Virus Infected

EVID 2010: CA-Infected File Found

Sub Rule

Information

General Virus Infected

EVID 1513: Virus Quarantined And Cleaned

Sub Rule

Information

General Virus Infected Information

EVID 1514: Virus Quarantined (Not Cleaned)

Sub Rule

Information

General Virus Infected Information

EVID 1515: Virus Replaced

Sub Rule

Information

General Virus Infected Information

EVID 2020: Boot Record Infection Found

Sub Rule

Information

General Virus Infected Information

EVID 2023: New File Virus Found

Sub Rule

Information

General Virus Infected Information

EVID 2025: New File Virus Found But Move Failed

Sub Rule

Information

General Virus Infected Information

EVID 3005: Cleaned Infected Files

Sub Rule

Information

General Virus Infected Information

EVID 3041: CA - Virus Found In Memory

Sub Rule

Information

General Virus Infected Information

EVID 3042: CA - Infected Boot Record Found

Sub Rule

Information

General Virus Infected Information

EVID 3043: CA - Scan Found Infected Files

Sub Rule

Information

General Virus Infected Information

EVID 3044: CA - Cleaned Infected Files

Sub Rule

Information

General Virus Infected Information

EVID 8000: Infected Item Found

Sub Rule

Information

General Virus Infected Information

EVID 2026: New File Virus Found And Moved

Sub Rule

Information

General Virus Infected Information

EVID 2027: New File Virus Found But Move Failed

Sub Rule

Information

General Virus Infected Information

EVID 2028: MBR Virus Found

Sub Rule

Information

General Virus Infected Information

EVID 3002: Virus Found In Memory

Sub Rule

Information

General Virus Infected Information

EVID 3003: Infected Boot Record Found

Sub Rule

Information

General Virus Infected Information

EVID 3004: Task Found Infected Files

Sub Rule

Information

General Virus Infected Information

EVID 3034: Unable To Write The Activity Log File

Sub Rule

Warning

Unable To Write Data

EVID 1123: Upgrade Failed

Sub Rule

Error

Upgrade Failed

EVID 1050: Unable To Repair

Sub Rule

Failed Activity

General Failed Activity

EVID 2201: Failed To Install Software Package

Sub Rule

Failed Activity

General Failed Activity

EVID 2216: Cannot Install Software

Sub Rule

Failed Activity

General Failed Activity

EVID 2264: Property Collection Failed

Sub Rule

Failed Activity

General Failed Activity

EVID 2328: Enforce Task Failed

Sub Rule

Failed Activity

General Failed Activity

EVID 4700: Failed To Connect To CMA Updater

Sub Rule

Failed Activity

General Failed Activity

EVID 8621: Failed To Load VSAPIScanSource Module

Sub Rule

Failed Activity

General Failed Activity

EVID 8622: Failed To Load TransportScan Module

Sub Rule

Failed Activity

General Failed Activity

EVID 8625: Failed To Load DLLhost

Sub Rule

Failed Activity

General Failed Activity

EVID 8626: Product Service Failed To Start

Sub Rule

Failed Activity

General Failed Activity

EVID 12001: Rogue System Sensor Failed To Start

Sub Rule

Failed Activity

General Failed Activity

EVID 16009: AD Discovery Task Failed

Sub Rule

Failed Activity

General Failed Activity

EVID 4701: Failed To Connect To CMA Scheduler

Sub Rule

Failed Activity

General Failed Activity

EVID 4702: Failed To Save Schedule Data Into CMA

Sub Rule

Failed Activity

General Failed Activity

EVID 8602: Failed To Download DATs

Sub Rule

Failed Activity

General Failed Activity

EVID 8604: Failed To Load AV Engine

Sub Rule

Failed Activity

General Failed Activity

EVID 8605: On-demand Scan Task Failed

Sub Rule

Failed Activity

General Failed Activity

EVID 8608: Failed To Download Anti-Spam Rules

Sub Rule

Failed Activity

General Failed Activity

EVID 1504: Infected Mail Item Deleted

Sub Rule

Information

Email Deleted

EVID 1500: Infected Email Cleaned

Sub Rule

Information

Email Virus Cleaned

EVID 1004: Task Completed Successfully

Sub Rule

Information

Task Completed

EVID 1070: Task Successful

Sub Rule

Information

Task Completed

EVID 3000: Scan Task Completed

Sub Rule

Information

Task Completed

EVID 16008: AD Discovery Task Ran

Sub Rule

Information

Task Completed

EVID 1005: Error While Stopping Task

Sub Rule

Error

Error Stopping Task

EVID 1089: Scan Settings

Sub Rule

Warning

Virus Scan Configuration

EVID 1035: Scan Was Cancelled

Sub Rule

Warning

Scan Cancelled

EVID 1126: Scan Cancelled

Sub Rule

Warning

Scan Cancelled

EVID 3040: CA - Scan Was Cancelled

Sub Rule

Warning

Scan Cancelled

EVID 1040: Activity Log Error

Sub Rule

Error

Activity Log Error

EVID 1041: Memory Allocation Error

Sub Rule

Error

Memory Allocation Error

EVID 1077: Memory Allocation Error

Sub Rule

Error

Memory Allocation Error

EVID 3007: Task Reports Memory Allocation Error

Sub Rule

Error

Memory Allocation Error

EVID 3023: Memory Allocation Error

Sub Rule

Error

Memory Allocation Error

EVID 3046: CA - Memory Allocation Error

Sub Rule

Error

Memory Allocation Error

EVID 1042: Path Too Long

Sub Rule

Warning

Path Too Long

EVID 1043: Media Is Write Protected

Sub Rule

Warning

Media Is Write Protected

EVID 3009: Media Write Protected

Sub Rule

Warning

Media Is Write Protected

EVID 3048: CA - Media Write Protected

Sub Rule

Warning

Media Is Write Protected

EVID 1044: Specified Media Not Found

Sub Rule

Warning

Media Not Found

EVID 3010: Specified Media Not Found

Sub Rule

Warning

Media Not Found

EVID 3049: CA - Specified Media Not Found

Sub Rule

Warning

Media Not Found

EVID 1045: Specified Scan Item Invalid

Sub Rule

Warning

Scan Item Invalid

EVID 3011: Specified Scan Item Is Invalid

Sub Rule

Warning

Scan Item Invalid

EVID 3050: CA - Specified Scan Item Invalid

Sub Rule

Warning

Scan Item Invalid

EVID 1046: File I/O Errors

Sub Rule

Error

File I/O Error

EVID 3012: File I/O Errors

Sub Rule

Error

File I/O Error

EVID 3013: Disk I/O Errors

Sub Rule

Error

File I/O Error

EVID 3051: CA - File I/O Errors

Sub Rule

Error

File I/O Error

EVID 1047: Disk I/O Errors

Sub Rule

Error

Disk I/O Error

EVID 3052: CA - Disk I/O Errors

Sub Rule

Error

Disk I/O Error

EVID 1051: Unable To Scan

Sub Rule

Warning

Scan Failure - Password Protected

EVID 1059: Scan Timed Out

Sub Rule

Warning

Scan Timeout

EVID 1062: Error Sending Alert

Sub Rule

Error

Error Sending Alert

EVID 1063: Invalid Options Specified

Sub Rule

Warning

Invalid Options

EVID 1067: Unable To Start Scheduled Task

Sub Rule

Error

Failed To Start Scheduled Task

EVID 1068: Scheduled Task Stopped

Sub Rule

Warning

Scheduled Task Stopped

EVID 1069: Error Stopping Scheduled Task

Sub Rule

Error

Error Stopping Scheduled Task

EVID 1071: Task Cancelled

Sub Rule

Information

Scheduled Task Canceled

EVID 3001: Task Was Cancelled

Sub Rule

Information

Scheduled Task Canceled

EVID 1076: Error Logging Information

Sub Rule

Error

Error Logging Information

EVID 1086: Scan Process Error

Sub Rule

Error

Scan Process Error

EVID 1088: On-Access Scan Stopped

Sub Rule

Information

On-Access Virus Scan Stopped

EVID 16005: Distributed Reposit Replication Failed

Sub Rule

Error

Replication Failed

EVID 10129: Upgrade Stop

Sub Rule

Information

Upgrade Stopped

EVID 2204: Insufficient Disk Space To Install SW

Sub Rule

Warning

Insufficient Disk Space

EVID 2208: Insufficient Disk Space To Download SW

Sub Rule

Warning

Insufficient Disk Space

EVID 8603: Insufficient Disk Space

Sub Rule

Warning

Insufficient Disk Space

EVID 34154: Encrypted Content Detected

Sub Rule

Warning

Encrypted / Corrupted Data Found

EVID 1029: File Excluded From Scans

Sub Rule

Information

Items Excluded From Scan

EVID 2005: File Excluded From Scans

Sub Rule

Information

Items Excluded From Scan

EVID 2015: CA-File Excluded From Scans

Sub Rule

Information

Items Excluded From Scan

EVID 1120: Update Running

Sub Rule

Information

Update Running

EVID 1124: Upgrade Was Cancelled

Sub Rule

Warning

Upgrade Canceled

EVID 16000: Computers Are Non-Compliant

Sub Rule

Other Audit

Computers Are Non-Compliant

EVID 1094: Rule Violation Detected

Sub Rule

Warning

Rule Violation

EVID 13002: System Compliance Profiler Rule Violation

Sub Rule

Warning

Rule Violation

EVID 3020: Invalid Virus Signature Files

Sub Rule

Warning

Invalid Signature File

EVID 1507: Inbound Email Suspend

Sub Rule

Warning

Inbound Email Suspend For Low Disk

EVID 1508: Inbound Mail Resumed

Sub Rule

Information

Inbound Mail Resumed

EVID 1030: Unable To Exclude From Scans

Sub Rule

Warning

Can't Exclude Items From Scan

EVID 2006: Unable To Exclude From Scans

Sub Rule

Warning

Can't Exclude Items From Scan

EVID 2016: CA-Unable To Exclude Item From Scans

Sub Rule

Warning

Can't Exclude Items From Scan

EVID 1125: DAT Version Not New

Sub Rule

Warning

Data Version Not New Enough

EVID 8623: Postgres Process Stopped Responding

Sub Rule

Information

General Process Information

EVID 8624: RPCServ Process Stopped Responding

Sub Rule

Information

General Process Information

EVID 2232: Enforce Policy Failed

Sub Rule

Information

General POLICY Information

EVID 1129: Scan Shut Down By Windows

Sub Rule

Information

Scan Stopped

EVID 10161: ThreatScan Stop

Sub Rule

Information

Scan Stopped

EVID 10174: ThreatScan Host Finished

Sub Rule

Information

Scan Stopped

EVID 1091: Violation Detected And Blocked

Sub Rule

Other Security

Security Violation

EVID 4650: Detected Spam Email

Sub Rule

Activity

Spam Detected

EVID 4651: Spam Email Scanning Statistics

Sub Rule

Information

Email And Web Statistics

EVID 3022: Initialization Error With Scan Buffer

Sub Rule

Error

Initialization Error

EVID 3036: Error During Initialization

Sub Rule

Error

Initialization Error

EVID 10128: Upgrade Start

Sub Rule

Information

Upgrade Started

EVID 10049: Update Stop

Sub Rule

Information

Update Stopped

EVID 1122: Upgrade Running

Sub Rule

Information

The Upgrade Is Running

EVID 2402: Update Failed

Sub Rule

Error

Update Failed

EVID 16003: Master Repository Update Failed

Sub Rule

Error

Update Failed

EVID 1003: Error Starting Task

Sub Rule

Error

Error Starting Task

EVID 1506: Email Content Blocked

Sub Rule

Warning

Email Content Denied

EVID 10061: Update Results Header

Sub Rule

Information

Update Event

EVID 10062: Update Download File

Sub Rule

Information

Update Event

EVID 10063: Update Install File

Sub Rule

Information

Update Event

EVID 1033: Unable To Move File To Quarantine

Sub Rule

Failed Activity

Quarantined Message

EVID 1057: Unable To Move Infected To Quarantine

Sub Rule

Failed Activity

Quarantined Message

EVID 2009: Unable To Move File To Quarantine

Sub Rule

Failed Activity

Quarantined Message

EVID 2019: CA- Unable To Move File To Quarantine

Sub Rule

Failed Activity

Quarantined Message

EVID 8606: Failed To Quarantine

Sub Rule

Failed Activity

Quarantined Message

EVID 11002: Failed Quarantine Check

Sub Rule

Failed Activity

Quarantined Message

EVID 8607: Process Failed To Recreate

Sub Rule

Error

Process Failed

EVID 1031: Infected File Access Denied

Sub Rule

Warning

Access Denied

EVID 2007: Infected File Access Denied

Sub Rule

Warning

Access Denied

EVID 10143: Upgrade Results

Sub Rule

Information

Upgrade Information

EVID 34160: Statistics And Average Scan Time

Sub Rule

Information

System Statistics

EVID 16004: Distributed Repo Replication Succeeded

Sub Rule

Information

Replication Successful

EVID 3033: Activity Log File Maximum Size Reached

Sub Rule

Warning

File Exceeds Defined Size Limit

EVID 16002: Master Repository Update Succeeded

Sub Rule

Information

Update Successful

EVID 1509: Startup Request Processed

Sub Rule

Other Audit Success

Request Approved

EVID 1510: Shutdown Request Processed

Sub Rule

Other Audit Success

Request Approved

EVID 2202: Install Retry Limit Reached

Sub Rule

Error

Client Limit Reached

EVID 1055: Unable To Delete Infected File

Sub Rule

Error

File Delete Failure

EVID 2004: Unable To Delete Infected File

Sub Rule

Error

File Delete Failure

EVID 2014: CA-Unable To Delete Infected File

Sub Rule

Error

File Delete Failure

EVID 3024: Unknown Error Reported

Sub Rule

Error

Unknown Error

EVID 1512: A Maximum Load Occurring

Sub Rule

Warning

Approaching Maximum Capacity

EVID 1900: New MIB File Available

Sub Rule

Information

New File Found On Network

EVID 14500: Intercept Firewall Event

Sub Rule

Information

General Firewall Event

EVID 3039: CA - Scan Completed

Sub Rule

Other Audit Success

Scan Completed

EVID 10017: Scan Finished

Sub Rule

Other Audit Success

Scan Completed

EVID 10030: Scan Host Finished

Sub Rule

Other Audit Success

Scan Completed

EVID 8501: Encrypted/Corrupted Item Found

Sub Rule

Warning

Damaged Object Found

EVID 16006: New Rogue System Detected

Sub Rule

Information

New Device Found

EVID 1028: Unable To Delete Infected File

Sub Rule

Error

Unable To Delete File

EVID 2024: New File Virus Found And Deleted

Sub Rule

Access Success

Object Deleted/Removed

EVID 16013: AD Discovery Task Removed Computers

Sub Rule

Access Success

Object Deleted/Removed

EVID 16012: AD Discovery Task Added Computers

Sub Rule

Access Success

Object Added

EVID 34155: Corrupted Content Detected

Sub Rule

Warning

Data Corrupt

EVID 34150: Packer Detected

Sub Rule

Information

Device Detected

EVID 1505: Email Content Filtered

Sub Rule

Information

Email Filter Information

EVID 4600: WebShield - URL Blocked

Sub Rule

Information

URL Information

EVID 34159: Blocked Mime Type Detected

Sub Rule

Warning

Device Blocked

EVID 8601: File Reputation Failed

Sub Rule

Information

General Reputation Information

EVID 1093: Buffer Overflow Detected

Sub Rule

Attack

Buffer Overflow/Underflow

EVID 1099: Buffer Overflow Not Blocked

Sub Rule

Attack

Buffer Overflow/Underflow

EVID 34151: Phish Detected

Sub Rule

Attack

Phishing Activity

EVID 1002: Task Started Successfully

Sub Rule

Information

Scheduled Task Started

EVID 1066: Task Started OK

Sub Rule

Information

Scheduled Task Started

EVID 1049: Internal Application Error

Sub Rule

Error

Application Error

EVID 3015: Internal Application Error

Sub Rule

Error

Application Error

EVID 3054: CA - Internal Application Error

Sub Rule

Error

Application Error

EVID 1054: Infected File Deleted

Sub Rule

Information

File Deleted

EVID 2003: Infected File Deleted

Sub Rule

Information

File Deleted

EVID 2013: CA-Infected File Deleted

Sub Rule

Information

File Deleted

EVID 1025: Infected File Successfully Cleaned

Sub Rule

Activity

General Threat Message

EVID 1026: Unable To Clean Infected File

Sub Rule

Activity

General Threat Message

EVID 1036: Memory Infected

Sub Rule

Activity

General Threat Message

EVID 1038: Scan Found Infected Files

Sub Rule

Activity

General Threat Message

EVID 1039: Cleaned Infected Files

Sub Rule

Activity

General Threat Message

EVID 1060: Virus Cleaned

Sub Rule

Activity

General Threat Message

EVID 2021: Boot Record Infection Cleaned

Sub Rule

Activity

General Threat Message

EVID 2100: Outbreak Rule Name

Sub Rule

Activity

General Threat Message

EVID 11001: Intrusion Detected

Sub Rule

Activity

General Threat Message

EVID 1061: Error While Cleaning Virus

Sub Rule

Activity

General Threat Message

EVID 1100: Macro Detected In File

Sub Rule

Activity

General Threat Message

EVID 1101: Macro Deleted From File

Sub Rule

Activity

General Threat Message

EVID 1502: Unable To Clean Infected Mail

Sub Rule

Activity

General Threat Message

EVID 2011: CA-Infected File Cleaned

Sub Rule

Activity

General Threat Message

EVID 2012: CA-Unable To Clean Infected File

Sub Rule

Activity

General Threat Message

EVID 10016: Scan Started

Sub Rule

Information

Scan Started

EVID 10029: Scan Host Started

Sub Rule

Information

Scan Started

EVID 10160: ThreatScan Start

Sub Rule

Information

Scan Started

EVID 10173: ThreatScan Host Started

Sub Rule

Information

Scan Started

EVID 34156: Denial Of Service Triggered

Sub Rule

Denial Of Service

Application Denial Of Service

EVID 10048: Update Start

Sub Rule

Information

Update Process Started

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

MachineName

<dname>

Text/String

Name of the system hosting the detecting product.

AgentGUID

N/A

N/A

Unique identifier of the agent that forwarded the event.

IPAddress

<dip>

IP Address

IP address of the system hosting the detecting product (if given in the event).

OSName

N/A

N/A

N/A

UserName

<domainimpacted>
<account>

Text/String

N/A

TimeZoneBias

N/A

N/A

N/A

RawMACAddress

<dmac>

Text/String/Number

MAC address of the system hosting the detecting product.

ProductName

<vendorinfo>

Text/String

Name of the detecting managed product.

ProductVersion

<version>

Text/String/Number

Version number of the detecting product.

ProductFamily

N/A

N/A

N/A

EngineVersion

N/A

N/A

Version number of the detecting product’s engine

DATVersion

N/A

N/A

DAT version on the system that sent the event.

ScannerType

N/A

N/A

N/A

TaskName

<object>

Text/String

N/A

ProductFamily

N/A

N/A

N/A

ProductName

N/A

N/A

Name of the detecting managed product.

ProductVersion

N/A

N/A

Version number of the detecting product.

EventID

<vmid>

Number

Unique identifier of the event class.

Severity

<severity>

Text/String/Number

N/A

GMTTime

N/A

N/A

N/A

UTCTime

N/A

N/A

N/A

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.