Interactive Authentication
Classification
Rule Name | Rule type | common event | Classification |
---|---|---|---|
Interactive Authentication | Base Rule | User Logon | Authentication Success |
Keyboard Interactive Authentication Accepted | Sub Rule | User Logon | Authentication Success |
Keyboard Interactive Authentication Failed | Sub Rule | User Logon Failure | Authentication Failure |
Password Authentication Accepted | Sub Rule | Authentication Activity | Authentication Success |
Password Authentication Failed | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type |
N/A | <dname> | String/Number |
N/A | <process> | String |
N/A | <tag2> | String |
N/A | <tag1> | String |
N/A | <login> | String |
N/A | <sipn> | Number |
N/A | <dip> | Number |
N/A | <sessiontype> | Text/String |
N/A | <sport> | Number |