Guest Message
Vendor Documentation
Log Fields and Parsing
This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.
| Log Field | LogRhythm Default | LogRhythm Default v2.0 |
|---|---|---|
| pri_num | N/A | N/A |
| time | N/A | N/A |
| IP address/hostname | N/A | N/A |
| cat_name | N/A | <vendorinfo> |
| msg_id | N/A | N/A |
| total_seg | N/A | N/A |
| seg_num | N/A | N/A |
| timestamp | N/A | N/A |
| sequence_num | N/A | N/A |
| msg_code | N/A | <vmid> <tag1> |
| msg_sev | N/A | <severity> |
| msg_class | <process> | <subject> |
| msg_text | <status> <tag1> | <action> |
| ConfigVersionId | <version> | N/A |
| UserType | <objecttype> | N/A |
| UserName | <login> | <account> |
| Firstname | N/A | N/A |
| Lastname | N/A | N/A |
| PhoneNumber | N/A | N/A |
| MacAddress | <smac> | <smac> |
| IpAddress | <sip> | <sip> |
| AuthenticationIdentityStore | N/A | N/A |
| PortalName | N/A | N/A |
| SponsorUser | N/A | N/A |
| IdentityGroup | N/A | N/A |
| PsnHostName | N/A | N/A |
| GuestUser | N/A | N/A |
| GuestUserName | N/A | N/A |
| GuestFirstname | N/A | N/A |
| GuestLastname | N/A | N/A |
| GuestEmailAddress | N/A | N/A |
| GuestAuthenticationIdentityStore | N/A | N/A |
| GuestType | N/A | N/A |
| GuestValidDays | N/A | N/A |
| GuestLocation | N/A | N/A |
| GuestStatus | N/A | N/A |
| EPMacAddress | <dmac> | N/A |
| NADAddress | <dip> | N/A |
| ResponseTime | N/A | N/A |
| AuditSessionId | <session> | N/A |
| ETS | N/A | N/A |
| Key1 | N/A | N/A |
| Key2 | N/A | N/A |
Log Processing Settings
This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.
LogRhythm Default
Regex ID | Rule Name | Rule Type | Common Event | Classification |
|---|---|---|---|---|
| 1010154 | Guest Message | Base Rule | General POLICY Information | Information |
LogRhythm Default v2.0
| Regex ID | Rule Name | Rule Type | Common Event | Classification |
|---|---|---|---|---|
| 1012622 | V 2.0 Guest Event | Base Rule | General Information Log Message | Information |
| V 2.0 EVID 86001 Guest User Logged In | Sub Rule | User Logon | Authentication Success | |
| V 2.0 EVID 86002 Guest Account Suspended | Sub Rule | Access Revoked Activity | Access Revoked | |
| V 2.0 EVID 86003 Guest Account Enabled | Sub Rule | Account Enabled | Access Granted | |
| V 2.0 EVID 86004 Password Changed By Guest User | Sub Rule | Password Modified | Account Modified | |
| V 2.0 EVID 86005 Policy Accepted By Guest User | Sub Rule | Policy Created User/Password | Policy | |
| V 2.0 EVID 86006 Guest Account Created | Sub Rule | User Account Created | Account Created | |
| V 2.0 EVID 86007 Guest Account Updated | Sub Rule | User Account Attribute Modified | Account Modified | |
| V 2.0 EVID 86008 Guest Account Deleted | Sub Rule | User Account Deleted | Account Deleted | |
| V 2.0 EVID 86009 Guest Account Not Found | Sub Rule | User Not Found | Error | |
| V 2.0 EVID 86010 Guest User Auth Failure | Sub Rule | User Logon Failure | Authentication Failure | |
| V 2.0 EVID 86011 Guest User Not Enabled | Sub Rule | User Logon Failure Account Disabled | Authentication Failure | |
| V 2.0 EVID 86012 Access Policy Declined By Guest | Sub Rule | Policy Disabled User/Password | Policy | |
| V 2.0 EVID 86013 Portal Not Found | Sub Rule | Default Address Not Found | Error | |
| V 2.0 EVID 86014 User Account Suspended | Sub Rule | Access Revoked Activity | Access Revoked | |
| V 2.0 EVID 86015 Invalid Password Change | Sub Rule | Password Modified | Account Modified | |
| V 2.0 EVID 86016 Guest Timout Exceeded | Sub Rule | User Disconnected Due To Time Out | Information | |
| V 2.0 EVID 86017 SessionID Missing | Sub Rule | Session Could Not Be Established | Warning | |
| V 2.0 EVID 86018 Guest CoA Failed | Sub Rule | Authorization Failed | Warning | |
| V 2.0 EVID 86019 Guest User Restricted | Sub Rule | Access Revoked Activity | Access Revoked | |
| V 2.0 EVID 86020 Guest Unknown Error | Sub Rule | Unknown Error | Error | |
| V 2.0 EVID 86021 Entering Device Reg Web Auth | Sub Rule | Device Registered | Information | |
| V 2.0 EVID 86022 Device Reg Web Auth AUP Accept | Sub Rule | Device Registered | Other Audit Success | |
| V 2.0 EVID 86023 Device Re Web Auth AUP Declined | Sub Rule | Policy Disabled Domain | Policy | |
| V 2.0 EVID 86024 Dev Reg WAP EP Creation Passed | Sub Rule | Device Registered | Other Audit Success | |
| V 2.0 EVID 86025 Dev Reg WAP EP Creation Failed | Sub Rule | Communication Endpoint Creation Failure | Error | |
| V 2.0 EVID 86026 Dev Reg WAP CoA Termination Fail | Sub Rule | Process Termination Failed | Error | |
| V 2.0 EVID 86027 Dev Reg WAP Send CoA Termination | Sub Rule | Registration | Information | |
| V 2.0 EVID 86028 CoA Termination Success | Sub Rule | User Session Terminated | Information | |
| V 2.0 EVID 86029 CoA Termination Failed | Sub Rule | Process Termination Failed | Error | |
| V 2.0 EVID 86030 Policy Accepted By Sponsor User | Sub Rule | User Account Created | Account Created | |
| V 2.0 EVID 86031 Policy Declined By Sponsor User | Sub Rule | Policy Disabled User/Password | Policy |