Login Denied and Permitted

Rule Name

Rule Type

Common Event

Classification

Login Denied and Permitted

Base Rule

Authentication Activity

Authentication Success

ASA-6-605005 : Logon Successful

Sub Rule

User Logon

Authentication Success

ASA-6-605004 : Logon Failure

Sub Rule

User Logon Failure

Authentication Failure

FWSM-4-605005 : Logon Successful

Sub Rule

User Logon

Authentication Success

FWSM-6-605004 : Logon Failure

Sub Rule

User Logon Failure

Authentication Failure

Device Key in Log Message

LogRhythm Schema

Data Type

N/A

<vmid>

Number

N/A

<severity>

Number

N/A

<sip>

Number

N/A

<sname>

Text/String

N/A

<dip>

Number

N/A

<dname>

Text/String

N/A

<sport>

Number

N/A

<dport>

Number

N/A

<protname>

Text/String

N/A

<login>

Text/String

N/A

<tag1>

Text/String