Interactive Authentication 2 1

Vendor Documentation

Rule Name	Rule Type	Common Event	Classification
Interactive Authentication 2	Base Rule	Authentication Activity	Authentication Success
User Logon	Sub Rule	User Logon	Authentication Success
Logon Failed : Invalid Username	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
Logon Failed : Invalid Username	Sub Rule	User Logon Failure : Bad Username	Authentication Failure
User Logon Postponed	Sub Rule	Authentication Activity	Authentication Success
Failed User Logon	Sub Rule	User Logon Failure	Authentication Failure
Failed User Logon	Sub Rule	User Logon Failure	Authentication Failure

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
N/A	<sip>	Number/Text/String	Ip Address
Dname	<dname>	Text/String	Destination Hostname Information
N/A	<sport>	Number	N/A
N/A	<protname>	Text/String	N/A
N/A	<login>	Text/String	N/A
N/A	<process>	Text/String	process information
N/A	<processid>	Number	N/A
N/A	<object>	Text/String	N/A
N/A	<tag3>	Text/String	N/A