Vendor Documentation
Log Fields and Parsing
This section details the log fields available in this log message type and values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.
|
Log Field |
LogRhythm Default |
LogRhythm Default v2.0 |
|---|---|---|
|
N/A |
<severity> |
<severity> |
|
N/A |
<sip> |
<vmid> |
|
N/A |
<dip> |
<session> |
|
N/A |
<sport> |
<sip> |
|
N/A |
<dport> |
<dip> |
|
N/A |
<smac> |
<sport> |
|
N/A |
<dmac> |
<dport> |
|
N/A |
<protnum> |
<smac> |
|
N/A |
<vmid> |
<dmac> |
|
N/A |
<bytesin> |
<protnum> |
|
N/A |
<bytesout> |
<processid> |
|
N/A |
<packetsin> |
<bytesin> |
|
N/A |
<seconds> |
<bytesout> |
|
N/A |
<login> |
<packetsin> |
|
N/A |
<domain> |
<seconds> |
|
N/A |
<group> |
<vendorinfo> |
|
N/A |
<command> |
N/A |
|
N/A |
<sender> |
N/A |
|
N/A |
<recipient> |
N/A |
|
N/A |
<subject> |
N/A |
|
N/A |
<version> |
N/A |
|
N/A |
<object> |
N/A |
|
N/A |
<useragent> |
N/A |
|
N/A |
<objectname> |
N/A |
|
N/A |
<url> |
N/A |
|
N/A |
<vendorinfo> |
N/A |
|
N/A |
<session> |
N/A |
|
N/A |
<account> |
N/A |
Log Processing Settings
This section details log processing changes from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to parse log message types by their event types appropriately.
LogRhythm Default
|
Regex ID |
Rule Name |
Rule Type |
Common Event |
Classification |
|---|---|---|---|---|
|
1007149 |
LogRhythm Network Monitor Lua Alarm |
Base Rule |
Network Monitor Lua Alarm |
Network traffic |
LogRhythm Default v2.0
|
Regex ID |
Rule Name |
Rule Type |
Common Event |
Classification |
|---|---|---|---|---|
|
1013934 |
V 2.0: Netmon DPA |
Base Rule |
End of Flow |
Network traffic |