Kernel Firewall Messages
Vendor Documentation
N/A |
Classification
Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|
Kernel Firewall Messages | Base Rule | General Warning Log Message | Warning |
Kernel Emergency Message | Sub Rule | General Emergency Log Message | Critical |
Kernel Alert Message | Sub Rule | General Alert | Critical |
Kernel Critical Message | Sub Rule | General Critical | Critical |
Kernel Error Message | Sub Rule | General Error | Error |
Kernel Warning Message | Sub Rule | General Warning | Warning |
Kernel Notice Message | Sub Rule | General Notice | Information |
Kernel Information Message | Sub Rule | General Information | Information |
Kernel Debug Message | Sub Rule | General Debug Message | Information |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
---|---|---|---|
N/A | <severity> | Text/String | N/A |
N/A | <tag1> | Text/String | N/A |
N/A | <process> | Text/String | N/A |
N/A | <reason> | Text/String | N/A |
MAC | <dmac> | Text/String | N/A |
SRC | <sip> | IP Address | N/A |
DST | <dip> | IP Address | N/A |
LEN | <size> | Number | N/A |
PROTO | <protname> | IP Address | N/A |
SPT | <sport> | Number | N/A |
DPT | <dport> | Number | N/A |
N/A | <object> | Text/String | TCP Flags |