IPS Events

Vendor Documentation

Rule Name	Rule Type	Common Event	Classification
IPS Events	Base Rule	General IPS Message	Information
TCP/UDP Attack Signature	Sub Rule	General Attack Activity	Attack
ICMP Attack Signature	Sub Rule	General Attack Activity	Attack
Other Attack Signature	Sub Rule	General Attack Activity	Attack
ICMP Attack Anomaly	Sub Rule	Protocol Anomaly	Attack
Attack Anomaly	Sub Rule	General IDS Anomaly Critical	Critical
TCP/UDP Attack Anomaly	Sub Rule	Protocol Anomaly	Attack
TCP/UDP Attack Signature Dropped	Sub Rule	Failed General Attack Activity	Failed Attack
ICMP Attack Signature Dropped	Sub Rule	Failed General Attack Activity	Failed Attack
Other Attack Signature Dropped	Sub Rule	Failed General Attack Activity	Failed Attack
ICMP Attack Anomaly Dropped	Sub Rule	Failed Protocol Anomaly	Failed Attack
Attack Anomaly Dropped	Sub Rule	Failed Protocol Anomaly	Failed Attack
TCP/UDP Attack Anomaly Dropped	Sub Rule	Failed Protocol Anomaly	Failed Attack

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
logid	<vmid>	Number	The ID (logid) is a 10-digit field. It is a unique identifier for that specific log.
level	<severity>	Text\String	Each log entry contains a Level (level) field that indicates the estimated severity of the event that caused the log entry.
srcip	<sip>	IP Address	IP address of the traffic’s origin.
dstip	<dip>	IP Address	Destination IP address for the web.
srcport	<sport>	Number	Port number of the traffic's origin.
dstport	<dport>	Number	Port number of the traffic's destination.
srcintf	<sinterface>	Text\String	Interface name of the traffic's origin.
dstintf	<dinterface>	Text\String	Interface of the traffic's destination.
proto	<protnum>	Number	The protocol used by web traffic (tcp by default).
service	<protname>	Text\String	N/A
hostname	<domainorigin>	Text\String	N/A
vd	<domainimpacted>	Text\String	Name of the virtual domain in which the log message was recorded.
sessionid	<session>	Number	ID for the session.
subtype	<process>	Text\String	N/A
attack	<object>	Text\String	N/A
msg	<subject>	Text\String	N/A
attack	<threatname>	Text\String	N/A
attackid	<threatid>	Number	N/A
ref	<url>	Text\String	N/A
profile	<group>	Text\String	N/A
action	<command>	Text\String	N/A
action	<tag1>	Text\String	N/A
eventtype	<tag2>	Number	N/A