Kernel Firewall Messages

Vendor Documentation

N/A

Rule Name	Rule Type	Common Event	Classification
Kernel Firewall Messages	Base Rule	General Warning Log Message	Warning
Kernel Emergency Message	Sub Rule	General Emergency Log Message	Critical
Kernel Alert Message	Sub Rule	General Alert	Critical
Kernel Critical Message	Sub Rule	General Critical	Critical
Kernel Error Message	Sub Rule	General Error	Error
Kernel Warning Message	Sub Rule	General Warning	Warning
Kernel Notice Message	Sub Rule	General Notice	Information
Kernel Information Message	Sub Rule	General Information	Information
Kernel Debug Message	Sub Rule	General Debug Message	Information

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
N/A	<severity>	Text/String	N/A
N/A	<tag1>	Text/String	N/A
N/A	<process>	Text/String	N/A
N/A	<reason>	Text/String	N/A
MAC	<dmac>	Text/String	N/A
SRC	<sip>	IP Address	N/A
DST	<dip>	IP Address	N/A
LEN	<size>	Number	N/A
PROTO	<protname>	IP Address	N/A
SPT	<sport>	Number	N/A
DPT	<dport>	Number	N/A
N/A	<object>	Text/String	TCP Flags