IPS Events

IPS Events

Base Rule

General IPS Message

Information

TCP/UDP Attack Signature

Sub Rule

General Attack Activity

Attack

ICMP Attack Signature

Sub Rule

General Attack Activity

Attack

Other Attack Signature

Sub Rule

General Attack Activity

Attack

ICMP Attack Anomaly

Sub Rule

Protocol Anomaly

Attack

Attack Anomaly

Sub Rule

General IDS Anomaly Critical

Critical

TCP/UDP Attack Anomaly

Sub Rule

Protocol Anomaly

Attack

TCP/UDP Attack Signature Dropped

Sub Rule

Failed General Attack Activity

Failed Attack

ICMP Attack Signature Dropped

Sub Rule

Failed General Attack Activity

Failed Attack

Other Attack Signature Dropped

Sub Rule

Failed General Attack Activity

Failed Attack

ICMP Attack Anomaly Dropped

Sub Rule

Failed Protocol Anomaly

Failed Attack

Attack Anomaly Dropped

Sub Rule

Failed Protocol Anomaly

Failed Attack

TCP/UDP Attack Anomaly Dropped

Sub Rule

Failed Protocol Anomaly

Failed Attack

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

logid

<vmid>

Number

The ID (logid) is a 10-digit field. It is a unique identifier for that specific log.

level

<severity>

Text\String

Each log entry contains a Level (level) field that indicates the estimated severity of the event that caused the log entry.

srcip

<sip>

IP Address

IP address of the traffic’s origin.

dstip

<dip>

IP Address

Destination IP address for the web.

srcport

<sport>

Number

Port number of the traffic's origin.

dstport

<dport>

Number

Port number of the traffic's destination.

srcintf

<sinterface>

Text\String

Interface name of the traffic's origin.

dstintf

<dinterface>

Text\String

Interface of the traffic's destination.

proto

<protnum>

Number

The protocol used by web traffic (tcp by default).

service

<protname>

Text\String

N/A

hostname

<domainorigin>

Text\String

N/A

vd

<domainimpacted>

Text\String

Name of the virtual domain in which the log message was recorded.

sessionid

<session>

Number

ID for the session.

subtype

<process>

Text\String

N/A

attack

<object>

Text\String

N/A

msg

<subject>

Text\String

N/A

attack

<threatname>

Text\String

N/A

attackid

<threatid>

Number

N/A

ref

<url>

Text\String

N/A

profile

<group>

Text\String

N/A

action

<command>

Text\String

N/A

action

<tag1>

Text\String

N/A

eventtype

<tag2>

Number

N/A