This document explains the changes required to apply new Message Processing Engine (MPE) rules developed during the Log Source Optimization (LSO) project for the Syslog - Symantec DLP CEF log source type.
Vendor Documentation
Prerequisites
-
Download and apply the Knowledge Base. For more information, see KB Synchronization Settings for LSO.
-
Select log source type Syslog - Symantec DLP CEF.
-
Enable log processing policy LogRhythm Default v2.0.
-
Enable the new MPE rules in the LogRhythm System Monitor.
For details on how to enable LogRhythm Default v2.0, see Apply LogRhythm Default v2.0 on a Log Source.
-
Supported Log Messages
The following table lists the log message types supported in the current MPE rules. Each page contains detailed information on parsing changes and new log processing settings.
|
Log Message Type |
Event Type |
|---|---|
|
Catch All : Level 1 |
General Information |
|
DLP Enforce Archive Message |
Email DLP Archive Message |
|
DLP Messages |
General Data Loss Message |
|
DLP Messages - CEF Format |
General Data Loss Message |
|
DLP Messages - CEF Format 2 |
General DLP Message |
|
Last Message Repeated |
Last Message Repeated |
|
Personal Information |
General User Information |
|
Personal Information - CEF Format |
User Information |
|
Security Number Pattern Log Messages |
General Security Information |
|
Symantec Service Request |
Symantec Server Information Message |
Log Processing Policy Updates
This section details log processing policy updates made to AIE Rules, system reports, system investigations, system report templates, and system tails as part of LSO.
Updates to AIE Rules
-
No changes
Updates to System Reports
-
No changes
Updates to System Investigations
-
No changes
Updates to System Report Templates
-
No changes
Updates to System Tails
-
No changes