IPS Messages
Vendor Documentation
Classification
Rule Name | Rule Type | Common Event | Classification |
|---|---|---|---|
| IPS Messages | Base Rule | General IPS/IDS Log Message | Other Security |
| EVID 503200 : Xssauditor-Filter-Sec-Policy-Bypass | Sub Rule | Vuln Low Severity : Web Server | Vulnerability |
| EVID 502970 : File-Text_HTML-Suspicious-Webkit | Sub Rule | Vuln Low Severity : Web Server | Vulnerability |
| EVID 502969 : File-Text_Script-In-HTML-Head | Sub Rule | Vuln Low Severity : Web Server | Vulnerability |
| EVID 502516 : File-Text_Invisible-Inline-Frame | Sub Rule | Vuln Low Severity : Web Server | Vulnerability |
| EVID 501776 : HTTP_SHS-Invalid-Response-HTTP-1.0 | Sub Rule | Protocol Anomaly | Attack |
| EVID 501774 : HTTP_SHS-Invalid-Response-HTTP-1.1 | Sub Rule | Protocol Anomaly | Attack |
| EVID 501486 : Conflicting-Content-Type-Text-HTML | Sub Rule | Vuln Low Severity : Protocol Violation | Vulnerability |
| EVID 501485 : Binary_Conflicting-Content-Type-Text | Sub Rule | Vuln Low Severity : Protocol Violation | Vulnerability |
| EVID 501280 : Google-Chrome-CRX-Extension-Package | Sub Rule | Vuln Low Severity : Web Server | Vulnerability |
| EVID 398857 : ARCserve-Bckp-Lgsrvr-Stack-Buffer-OF | Sub Rule | Host Compromised | Compromise |
| EVID 398400 : Timeout-Status-Code-In-HTTP-10-Resp | Sub Rule | Vuln Low Severity : Protocol Violation | Vulnerability |
| EVID 324107 : SNMP-UDP_Def-Comm-Strng-Pblic-Accptd | Sub Rule | Vuln Low Severity : SNMP | Vulnerability |
| EVID 324106 : SNMP-UDP_Def-Community-String-Rej | Sub Rule | Vuln Low Severity : SNMP | Vulnerability |
| EVID 320003 : Name-Null-Byte-Input-Validation-Err | Sub Rule | Host Compromised | Compromise |
| EVID 319510 : HTTPS_CS-SSL-3.0-Client-Hello | Sub Rule | Vuln Low Severity : Web Server | Vulnerability |
| EVID 319501 : ChangeCipher-Before-Key-Exchange | Sub Rule | Host Compromised | Compromise |
| EVID 318509 : Out-Of-Bounds-Array-Vuln-Func-Call | Sub Rule | Vuln Low Severity : SMB / NETBIOS | Vulnerability |
| EVID 316105 : MSRPC-TCP_NTLMSSP-Auth-Null-Sess-DOS | Sub Rule | Vuln Low Severity : Denial Of Service | Vulnerability |
| EVID 278056 : HTTP_SHS-Server-Version-Number-Discl | Sub Rule | Vuln Low Severity : Web Server | Vulnerability |
| EVID 275505 : HTTP_SLS-Unauthorized-Status-Code | Sub Rule | User Logon Failure | Authentication Failure |
| EVID 267329 : Windows-NAT-Helper-DNS-Query-DOS | Sub Rule | Vuln Low Severity : Denial Of Service | Vulnerability |
| EVID 264753 : Shared_Microsoft-Cabnet-File-Dwnload | Sub Rule | Compressed Executable Download | Activity |
| EVID 261653 : Analyzer_Compress-SIDs | Sub Rule | Suspicious Network Activity | Suspicious |
| EVID 79969 : SMB2_Unknown-Message-Identifier | Sub Rule | Suspicious Network Activity | Suspicious |
| EVID 79963 : SMB2_Unknown-Tree-Identifier | Sub Rule | Suspicious Network Activity | Suspicious |
| EVID 79917 : MSRPC_Request-Without-Bind | Sub Rule | Vuln Low Severity : RPC | Vulnerability |
| EVID 79914 : MSRPC_Parsing-Error | Sub Rule | Vuln Low Severity : RPC | Vulnerability |
| EVID 79192 :_Client-Session-Packet-Type-Unknown | Sub Rule | Vuln Low Severity : SMB / NETBIOS | Vulnerability |
| EVID 79080 : TCP_Segment-Content-Conflict | Sub Rule | TCP Pending Crash Or Severe Problem | Critical |
| EVID 76506 : File_Allowed | Sub Rule | File Sent | Information |
| EVID 76461 : HTTP_Response-Version-Malformed | Sub Rule | Malformed Object | Suspicious |
| EVID 71038 : TLS_Server-Syntax-Error | Sub Rule | Bad Request/Invalid Syntax | Error |
| EVID 71037 : TLS_Client-Syntax-Error | Sub Rule | Bad Request/Invalid Syntax | Error |
| EVID 70977 : HTTP_Decompression-Stream-Error | Sub Rule | Stream Processing Error | Error |
| EVID 70512 : DNS_Client-UDP-QR-Wrong-Direction | Sub Rule | Non Compliant DNS | Activity |
| EVID 70511 : HTTP_URL-Logged | Sub Rule | URL Logged - Category | Activity |
| EVID 70414 : DNS_Client-QDCOUNT-Not-1 | Sub Rule | Non Compliant DNS | Activity |
| EVID 70080 : HTTP_Reply-Header-Line-Unparseable | Sub Rule | HTTP Security Violation | Other Security |
| EVID 70061 : HTTP_Request-Unknown | Sub Rule | Vuln Low Severity : Protocol Violation | Vulnerability |
| EVID 70026 : Connection_Progress | Sub Rule | General Connection Messages | Network Traffic |
| EVID 70021 : Connection_Closed | Sub Rule | Connection Closed | Network Traffic |
| EVID 70018 : Connection_Allowed | Sub Rule | Traffic Allowed by Network Firewall | Network Allow |
| EVID 1004 : FW_Related-Connection | Sub Rule | Traffic Allowed by Network Firewall | Network Allow |
| EVID 500 : FW_Notice | Sub Rule | General Firewall Event | Information |
| EVID 79891 : HTTP_Headerline_LF | Sub Rule | Non Compliant DNS | Activity |
| EVID 503093 : Mcrsft-Xml-Core-Svs-Vuln-ActivX-Ctrl | Sub Rule | Vuln Low Severity : Web Server | Vulnerability |
| EVID 502478 : Microsoft-Embedded-Font-EOT-File-Ref | Sub Rule | Vuln Low Severity : Web Server | Vulnerability |
| EVID 501770 : Mult-Products-Mult-Location-Headers | Sub Rule | Protocol Anomaly | Attack |
| EVID 501657 : File-Binary_Microsoft-Cabinet-Trnsfr | Sub Rule | Vuln Low Severity : Web Server | Vulnerability |
| EVID 501338 : PNG-Img-With-Large-Data-Length-Value | Sub Rule | Vuln Low Severity : Web Server | Vulnerability |
| EVID 501274 : File-Exe_Executable-File-Upload | Sub Rule | Vuln Low Severity : Web Server | Vulnerability |
| EVID 323594 : Write-Atmt-Using-Def-Community-Strng | Sub Rule | Vuln Low Severity : SNMP | Vulnerability |
| EVID 264225 : Shared_Executable-File-Upload | Sub Rule | Compressed Executable Download | Activity |
Mapping with LogRhythm Schema
| Device Key in Log Message | LogRhythm Schema | Data Type |
| Version | <version> | Number |
| vmid | <vmid> | Number |
| objectname | <objectname> | Text/String |
| severity | <severity> | Text/String/Number |
| spt | <sport> | Number |
| suser | <login> | Text/String |
| dmac | <dmac> | Text/String/Number |
| dst | <dip> | IP Address |
| cat | <subject> | Text/String |
| requestURL | <url> | Text/String |
| app | <session> | Text/String/Number |
| act | <command> | Text/String |
| msg | <object> | Text/String |
| deviceoutboundinterface | <sinterface> | Text/String/Number |
| deviceinboundinterface | <dinterface> | Text/String/Number |
| proto | <protnum> | Number |
| dpt | <dport> | Number |
| in | <bytesin> | Number |
| out | <bytesout> | Number |
| src | <sip> | IP Address |
| smac | <smac> | Text/String/Number |