Interactive Authentication 2

Classification

Rule Name

Rule Type

Common Event

Classification

User Logon

Sub Rule

User Logon

Authentication Success

Logon Failed : Invalid Username

Sub Rule

User Logon Failure : Bad Username

Authentication Failure

Logon Failed : Invalid Username

Sub Rule

User Logon Failure : Bad Username

Authentication Failure

Interactive Authentication 2

Base Rule

Authentication Activity

Authentication Success

User Logon Postponed

Sub Rule

Authentication Activity

Authentication Success

Failed User Logon

Sub Rule

User Logon Failure

Authentication Failure

Failed User Logon

Sub Rule

User Logon Failure

Authentication Failure

Mapping with LogRhythm Schema  

Device Key in Log Message

LogRhythm Schema

Data Type

N/A

<login>

Text\String

N/A

<dname>

Number

N/A

<protname>

Text\String

N/A

<object>

Text\String

N/A

<tag3>

Text\String

N/A

<sip>

Number

N/A

<sport>

Number

N/A

<process>

Text\String

N/A

<processid>

Number