Classification
|
Rule Name |
Rule Type |
Common Event |
Classification |
|---|---|---|---|
|
Local Mail Transfer Protocol Messages |
Base Rule |
Message Transfer Out |
Information |
|
DSN 2.0.0 - Success : Unknown Status |
Sub Rule |
General Message Information |
Information |
|
DSN 2.1.0 - Success : Other Address Status |
Sub Rule |
General Message Information |
Information |
|
DSN 2.1.1 - Success : Bad Dst Mailbox Addr |
Sub Rule |
Bad Destination Mailbox Address |
Warning |
|
DSN 2.1.2 - Success : Bad Dst System Addr |
Sub Rule |
Bad Destination System Address |
Warning |
|
DSN 2.1.3 - Success : Bad Dst Mailbox Syntax |
Sub Rule |
Bad Destination Mailbox Syntax |
Warning |
|
DSN 2.1.4 - Success : Dst Mailbox Addr Ambiguous |
Sub Rule |
Destination Mailbox Address Ambiguous |
Warning |
|
DSN 2.1.5 - Success : Dst Address Valid |
Sub Rule |
Destination Address Valid |
Information |
|
DSN 2.1.6 - Success : Dst Addr Moved No Fwd Addr |
Sub Rule |
Destination Address Moved With No Forwarding |
Warning |
|
DSN 2.1.7 - Success : Bad Sender Mbox Addr Syntax |
Sub Rule |
Bad Sender Mailbox Address Syntax |
Warning |
|
DSN 2.1.8 - Success : Bad Sender System Address |
Sub Rule |
Bad Sender System Address |
Warning |
|
DSN 2.2.0 - Success : Undefined Mbox Status |
Sub Rule |
General Email Delivery Information |
Information |
|
DSN 2.2.1 - Success : Mailbox Disabled |
Sub Rule |
Mailbox Disabled |
Warning |
|
DSN 2.2.2 - Success : Mailbox Full |
Sub Rule |
Mailbox Full |
Error |
|
DSN 2.2.3 - Success : Msg Len Exceeds Admin Limit |
Sub Rule |
Message Length Exceeds Administrative Limit |
Warning |
|
DSN 2.2.4 - Success : Mailing List Expansion Prob |
Sub Rule |
Mailing List Expansion Problem |
Error |
|
DSN 2.3.0 - Success : Undefined Mail System Status |
Sub Rule |
General Email Delivery Information |
Information |
|
DSN 5.3.1 - Failure : Mail System Full |
Sub Rule |
Mail System Full |
Critical |
|
DSN 2.3.2 - Success : System Not Accepting Msgs |
Sub Rule |
System Not Accepting Messages |
Warning |
|
DSN 2.3.3 - Success : System Missing Features |
Sub Rule |
System Missing Required Features |
Warning |
|
DSN 2.3.4 - Success : Message Too Big |
Sub Rule |
Message Too Large |
Warning |
|
DSN 2.3.5 - Success : System Incorrect Config |
Sub Rule |
System Incorrectly Configured |
Warning |
|
DSN 2.4.0 - Success : Undefined Network Status |
Sub Rule |
General Email Delivery Information |
Information |
|
DSN 2.4.1 - Success : No Answer From Host |
Sub Rule |
No Answer From Host |
Warning |
|
DSN 2.4.2 - Success : Bad Connection |
Sub Rule |
Bad Connection |
Warning |
|
DSN 2.4.3 - Success : Directory Server Failure |
Sub Rule |
Host Not Found |
Warning |
|
DSN 2.4.4 - Success : Unable To Route |
Sub Rule |
Unable To Route |
Warning |
|
DSN 2.4.5 - Success : Mail System Congestion |
Sub Rule |
Mail System Congestion |
Warning |
|
DSN 2.4.6 - Success : Routing Loop Detected |
Sub Rule |
Routing Loop Detected |
Warning |
|
DSN 2.4.7 - Success : Delivery Time Expired |
Sub Rule |
Delivery Time Expired |
Warning |
|
DSN 2.5.0 - Success : Undefined Protocol Status |
Sub Rule |
General Email Delivery Information |
Information |
|
DSN 2.5.1 - Success : Invalid Command |
Sub Rule |
Suspicious Activity |
Suspicious |
|
DSN 2.5.2 - Success : Syntax Error |
Sub Rule |
Syntax Error |
Warning |
|
DSN 2.5.3 - Success : Too Many Recipients |
Sub Rule |
Suspicious Activity |
Suspicious |
|
DSN 2.5.4 - Success : Invalid Command Arguments |
Sub Rule |
Invalid Options |
Warning |
|
DSN 2.5.5 - Success : Wrong Protocol Version |
Sub Rule |
Wrong Protocol Version |
Error |
|
DSN 2.6.0 - Success : Undefined Media Error |
Sub Rule |
Email Delivery Message Queued |
Information |
|
DSN 2.6.1 - Success : Media Not Supported |
Sub Rule |
Media Not Supported |
Warning |
|
DSN 2.6.2 - Success : Conversation Req And Denied |
Sub Rule |
Conversation Required And Denied |
Error |
|
DSN 2.6.3 - Success : Conv Req But Not Supported |
Sub Rule |
Conversation Required But Not Supported |
Error |
|
DSN 2.6.4 - Success : Conv With Loss Performed |
Sub Rule |
Conversation With Loss Performed |
Warning |
|
DSN 2.6.5 - Success : Conversation Failed |
Sub Rule |
Conversation Failed |
Error |
|
DSN 2.7.0 - Success : Undefined Security Status |
Sub Rule |
Undefined Security Status |
Activity |
|
DSN 2.7.1 - Success : Message Refused |
Sub Rule |
Message Refused |
Warning |
|
DSN 2.7.2 - Success : Mailing List Expansion Deny |
Sub Rule |
Mailing List Expansion Denied |
Error |
|
DSN 2.7.3 - Success : Security Conversation Failed |
Sub Rule |
Conversation Failed |
Error |
|
DSN 2.7.4 - Success : Features Not Supported |
Sub Rule |
Feature Not Supported |
Warning |
|
DSN 2.7.5 - Success : Cryptographic Failure |
Sub Rule |
Cryptographic Failure |
Error |
|
DSN 2.7.7 - Success : Message Integrity Failure |
Sub Rule |
Message Failed Validation |
Error |
|
DSN 2.7.6 - Success : Missing Crypto Algorithm |
Sub Rule |
Cryptographic Algorithm Missing |
Error |
|
DSN 5.1.7 - Failure : Bad Sender Mbox Addr Syntax |
Sub Rule |
Bad Sender Mailbox Address Syntax |
Warning |
|
DSN 5.1.8 - Failure : Bad Sender System Address |
Sub Rule |
Bad Sender System Address |
Warning |
|
DSN 5.2.0 - Failure : Undefined Mbox Status |
Sub Rule |
General Email Delivery Information |
Information |
|
DSN 5.0.0 - Failure : Unknown Status |
Sub Rule |
General Message Information |
Information |
|
DSN 5.1.0 - Failure : Other Address Status |
Sub Rule |
General Message Information |
Information |
|
DSN 5.1.1 - Failure : Bad Dst Mailbox Addr |
Sub Rule |
Bad Destination Mailbox Address |
Warning |
|
DSN 5.1.2 - Failure : Bad Dst System Addr |
Sub Rule |
Bad Destination System Address |
Warning |
|
DSN 5.1.3 - Failure : Bad Dst Mailbox Syntax |
Sub Rule |
Bad Destination Mailbox Syntax |
Warning |
|
DSN 5.1.4 - Failure : Dst Mailbox Addr Ambiguous |
Sub Rule |
Destination Mailbox Address Ambiguous |
Warning |
|
DSN 5.1.5 - Failure : Dst Address Valid |
Sub Rule |
Destination Address Valid |
Information |
|
DSN 5.1.6 - Failure : Dst Addr Moved No Fwd Addr |
Sub Rule |
Destination Address Moved With No Forwarding |
Warning |
|
DSN 5.2.1 - Failure : Mailbox Disabled |
Sub Rule |
Mailbox Disabled |
Warning |
|
DSN 5.2.2 - Failure : Mailbox Full |
Sub Rule |
Mailbox Full |
Error |
|
DSN 5.2.3 - Failure : Msg Len Exceeds Admin Limit |
Sub Rule |
Message Length Exceeds Administrative Limit |
Warning |
|
DSN 5.2.4 - Failure : Mailing List Expansion Prob |
Sub Rule |
Mailing List Expansion Problem |
Error |
|
DSN 5.3.0 - Failure : Undefined Mail System Status |
Sub Rule |
General Email Delivery Information |
Information |
|
DSN 2.3.1 - Success : Mail System Full |
Sub Rule |
Mail System Full |
Critical |
|
DSN 5.3.2 - Failure : System Not Accepting Msgs |
Sub Rule |
System Not Accepting Messages |
Warning |
|
DSN 5.3.3 - Failure : System Missing Features |
Sub Rule |
System Missing Required Features |
Warning |
|
DSN 5.3.4 - Failure : Message Too Big |
Sub Rule |
Message Too Large |
Warning |
|
DSN 5.3.5 - Failure : System Incorrect Config |
Sub Rule |
System Incorrectly Configured |
Warning |
|
DSN 5.4.0 - Failure : Undefined Network Status |
Sub Rule |
General Email Delivery Information |
Information |
|
DSN 5.4.1 - Failure : No Answer From Host |
Sub Rule |
No Answer From Host |
Warning |
|
DSN 5.4.2 - Failure : Bad Connection |
Sub Rule |
Bad Connection |
Warning |
|
DSN 5.4.3 - Failure : Directory Server Failure |
Sub Rule |
Host Not Found |
Warning |
|
DSN 5.4.4 - Failure : Unable To Route |
Sub Rule |
Unable To Route |
Warning |
|
DSN 5.4.5 - Failure : Mail System Congestion |
Sub Rule |
Mail System Congestion |
Warning |
|
DSN 5.4.6 - Failure : Routing Loop Detected |
Sub Rule |
Routing Loop Detected |
Warning |
|
DSN 5.4.7 - Failure : Delivery Time Expired |
Sub Rule |
Delivery Time Expired |
Warning |
|
DSN 5.5.0 - Failure : Undefined Protocol Status |
Sub Rule |
General Email Delivery Information |
Information |
|
DSN 5.5.1 - Failure : Invalid Command |
Sub Rule |
Suspicious Activity |
Suspicious |
|
DSN 5.5.2 - Failure : Syntax Error |
Sub Rule |
Syntax Error |
Warning |
|
DSN 5.5.3 - Failure : Too Many Recipients |
Sub Rule |
Suspicious Activity |
Suspicious |
|
DSN 5.5.4 - Failure : Invalid Command Arguments |
Sub Rule |
Invalid Options |
Warning |
|
DSN 5.5.5 - Failure : Wrong Protocol Version |
Sub Rule |
Wrong Protocol Version |
Error |
|
DSN 5.6.0 - Failure : Undefined Media Error |
Sub Rule |
Undefined Media Error |
Error |
|
DSN 5.6.1 - Failure : Media Not Supported |
Sub Rule |
Media Not Supported |
Warning |
|
DSN 5.6.2 - Failure : Conversation Req And Denied |
Sub Rule |
Conversation Required And Denied |
Error |
|
DSN 5.6.3 - Failure : Conv Req But Not Supported |
Sub Rule |
Conversation Required But Not Supported |
Error |
|
DSN 5.6.4 - Failure : Conv With Loss Performed |
Sub Rule |
Conversation With Loss Performed |
Warning |
|
DSN 5.6.5 - Failure : Conversation Failed |
Sub Rule |
Conversation Failed |
Error |
|
DSN 5.7.0 - Failure : Undefined Security Status |
Sub Rule |
Undefined Security Status |
Activity |
|
DSN 5.7.1 - Failure : Message Refused |
Sub Rule |
Message Refused |
Warning |
|
DSN 5.7.2 - Failure : Mailing List Expansion Deny |
Sub Rule |
Mailing List Expansion Denied |
Error |
|
DSN 5.7.3 - Failure : Security Conversation Failed |
Sub Rule |
Conversation Failed |
Error |
|
DSN 5.7.4 - Failure : Features Not Supported |
Sub Rule |
Feature Not Supported |
Warning |
|
DSN 5.7.5 - Failure : Cryptographic Failure |
Sub Rule |
Cryptographic Failure |
Error |
|
DSN 5.7.6 - Failure : Missing Crypto Algorithm |
Sub Rule |
Cryptographic Algorithm Missing |
Error |
|
DSN 5.7.7 - Failure : Message Integrity Failure |
Sub Rule |
Message Failed Validation |
Error |
|
DSN 4.0.0 - Delayed : Unknown Status |
Sub Rule |
General Message Information |
Information |
|
DSN 4.1.0 - Delayed : Other Address Status |
Sub Rule |
General Message Information |
Information |
|
DSN 4.1.1 - Delayed : Bad Dst Mailbox Addr |
Sub Rule |
Bad Destination Mailbox Address |
Warning |
|
DSN 4.1.2 - Delayed : Bad Dst System Addr |
Sub Rule |
Bad Destination System Address |
Warning |
|
DSN 4.1.3 - Delayed : Bad Dst Mailbox Syntax |
Sub Rule |
Bad Destination Mailbox Syntax |
Warning |
|
DSN 4.1.4 - Delayed : Dst Mailbox Addr Ambiguous |
Sub Rule |
Destination Mailbox Address Ambiguous |
Warning |
|
DSN 4.1.5 - Delayed : Dst Address Valid |
Sub Rule |
Destination Address Valid |
Information |
|
DSN 4.1.6 - Delayed : Dst Addr Moved No Fwd Addr |
Sub Rule |
Destination Address Moved With No Forwarding |
Warning |
|
DSN 4.1.7 - Delayed : Bad Sender Mbox Addr Syntax |
Sub Rule |
Bad Sender Mailbox Address Syntax |
Warning |
|
DSN 4.1.8 - Delayed : Bad Sender System Address |
Sub Rule |
Bad Sender System Address |
Warning |
|
DSN 4.2.0 - Delayed : Undefined Mbox Status |
Sub Rule |
General Email Delivery Information |
Information |
|
DSN 4.2.1 - Delayed : Mailbox Disabled |
Sub Rule |
Mailbox Disabled |
Warning |
|
DSN 4.2.2 - Delayed : Mailbox Full |
Sub Rule |
Mailbox Full |
Error |
|
DSN 4.2.3 - Delayed : Msg Len Exceeds Admin Limit |
Sub Rule |
Message Length Exceeds Administrative Limit |
Warning |
|
DSN 4.2.4 - Delayed : Mailing List Expansion Prob |
Sub Rule |
Mailing List Expansion Problem |
Error |
|
DSN 4.3.0 - Delayed : Undefined Mail System Status |
Sub Rule |
General Email Delivery Information |
Information |
|
DSN 4.3.1 - Delayed : Mail System Full |
Sub Rule |
Mail System Full |
Critical |
|
DSN 4.3.2 - Delayed : System Not Accepting Msgs |
Sub Rule |
System Not Accepting Messages |
Warning |
|
DSN 4.3.3 - Delayed : System Missing Features |
Sub Rule |
System Missing Required Features |
Warning |
|
DSN 4.3.4 - Delayed : Message Too Big |
Sub Rule |
Message Too Large |
Warning |
|
DSN 4.3.5 - Delayed : System Incorrect Config |
Sub Rule |
System Incorrectly Configured |
Warning |
|
DSN 4.4.0 - Delayed : Undefined Network Status |
Sub Rule |
General Email Delivery Information |
Information |
|
DSN 4.4.1 - Delayed : No Answer From Host |
Sub Rule |
No Answer From Host |
Warning |
|
DSN 4.4.2 - Delayed : Bad Connection |
Sub Rule |
Bad Connection |
Warning |
|
DSN 4.4.3 - Delayed : Directory Server Failure |
Sub Rule |
Host Not Found |
Warning |
|
DSN 4.4.4 - Delayed : Unable To Route |
Sub Rule |
Unable To Route |
Warning |
|
DSN 4.4.5 - Delayed : Mail System Congestion |
Sub Rule |
Mail System Congestion |
Warning |
|
DSN 4.4.6 - Delayed : Routing Loop Detected |
Sub Rule |
Routing Loop Detected |
Warning |
|
DSN 4.4.7 - Delayed : Delivery Time Expired |
Sub Rule |
Delivery Time Expired |
Warning |
|
DSN 4.5.0 - Delayed : Undefined Protocol Status |
Sub Rule |
General Email Delivery Information |
Information |
|
DSN 4.5.1 - Delayed : Invalid Command |
Sub Rule |
Suspicious Activity |
Suspicious |
|
DSN 4.5.2 - Delayed : Syntax Error |
Sub Rule |
Syntax Error |
Warning |
|
DSN 4.5.3 - Delayed : Too Many Recipients |
Sub Rule |
Suspicious Activity |
Suspicious |
|
DSN 4.5.4 - Delayed : Invalid Command Arguments |
Sub Rule |
Invalid Options |
Warning |
|
DSN 4.5.5 - Delayed : Wrong Protocol Version |
Sub Rule |
Wrong Protocol Version |
Error |
|
DSN 4.6.0 - Delayed : Undefined Media Error |
Sub Rule |
Undefined Media Error |
Error |
|
DSN 4.6.1 - Delayed : Media Not Supported |
Sub Rule |
Media Not Supported |
Warning |
|
DSN 4.6.2 - Delayed : Conversation Req And Denied |
Sub Rule |
Conversation Required And Denied |
Error |
|
DSN 4.6.3 - Delayed : Conv Req But Not Supported |
Sub Rule |
Conversation Required But Not Supported |
Error |
|
DSN 4.6.4 - Delayed : Conv With Loss Performed |
Sub Rule |
Conversation With Loss Performed |
Warning |
|
DSN 4.6.5 - Delayed : Conversation Failed |
Sub Rule |
Conversation Failed |
Error |
|
DSN 4.7.0 - Delayed : Undefined Security Status |
Sub Rule |
Undefined Security Status |
Activity |
|
DSN 4.7.1 - Delayed : Message Refused |
Sub Rule |
Message Refused |
Warning |
|
DSN 4.7.2 - Delayed : Mailing List Expansion Deny |
Sub Rule |
Mailing List Expansion Denied |
Error |
|
DSN 4.7.3 - Delayed : Security Conversation Failed |
Sub Rule |
Conversation Failed |
Error |
|
DSN 4.7.4 - Delayed : Features Not Supported |
Sub Rule |
Feature Not Supported |
Warning |
|
DSN 4.7.5 - Delayed : Cryptographic Failure |
Sub Rule |
Cryptographic Failure |
Error |
|
DSN 4.7.6 - Delayed : Missing Crypto Algorithm |
Sub Rule |
Cryptographic Algorithm Missing |
Error |
|
DSN 4.7.7 - Delayed : Message Integrity Failure |
Sub Rule |
Message Failed Validation |
Error |
Mapping with LogRhythm Schema
|
Device Key in Log Message |
LogRhythm Schema |
Data Type |
|---|---|---|
|
N/A |
<severity> |
Text/String |
|
N/A |
<process> |
Text/String |
|
N/A |
<protname> |
String |
|
N/A |
<processid> |
Numeric |
|
N/A |
<session> |
Text/String |
|
N/A |
<recipient> |
Text/String |
|
N/A |
<dname> |
Text/String |
|
N/A |
<dip> |
Numeric |
|
N/A |
<dport> |
Numeric |
|
N/A |
<milliseconds> |
Numeric |
|
N/A |
<vmid> |
Numeric |
|
N/A |
<status> |
Text/String |
|
N/A |
<responsecode> |
Numeric |