MSExchange Cmdlet Logs (Part 2)

Vendor Documentation

https://social.technet.microsoft.com/Forums/ie/en-US/c663ad93-3712-45da-b7f9-d6d914ad71a5/event-id-6-cmdlet-failed?forum=exchangesvravailabilityandisasterrecoverylegacy

https://community.spiceworks.com/topic/2301316-exchange-2013-1000s-of-event-id-6-logs

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
EventID	<vmid>	<vmid>
Level	<severity>	<severity>
EventRecordID	<session>	<session>
Channel	N/A	<vendorinfo>
Computer	<dname>	<dname>
EventData	<vendorinfo>, <tag3>, <command>, <process>, <tag1>, <login>, <subject>, <account>, <objectname>, <domain>, <object>	<action>, <command>, <tag1>, <login>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1002759	MSExchange Cmdlet Logs	Base Rule	General Information	Information
	Cmdlet Get Succeeded	Sub Rule	Process Completed	Information
	Cmdlet Add Succeeded	Sub Rule	Process Completed	Information
	Cmdlet Mount Succeeded	Sub Rule	Process Completed	Information
	Cmdlet New Succeeded	Sub Rule	Process Completed	Information
	Cmdlet Remove Succeeded	Sub Rule	Process Completed	Information
	Cmdlet Set Succeeded	Sub Rule	Process Completed	Information
	Cmdlet Update Succeeded	Sub Rule	Process Completed	Information
	Cmdlet Get Failed	Sub Rule	Process Failed	Error
	Cmdlet Get Stopped	Sub Rule	Process Is Stopped	Information
	Cmdlet Test Succeeded	Sub Rule	Process Completed	Information
	Cmdlet Test Failed	Sub Rule	Process Failed	Error
	Cmdlet New Failed	Sub Rule	Process Failed	Error
	Cmdlet Search Succeeded	Sub Rule	Process Completed	Information
	Cmdlet Add Failed	Sub Rule	Process Failed	Error
	Cmdlet Test Succeeded	Sub Rule	Process Completed	Information
	Send On Behalf Of	Sub Rule	Send On Behalf Of Change	Information

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1012590	V 2.0 : EVID 6 : Cmdlet Failed	Base Rule	Operation Failed	Error
	V 2.0 : Cmdlet Set Failed	Sub Rule	Process Failed	Error
	V 2.0 : Cmdlet Get Failed	Sub Rule	Process Failed	Error
	V 2.0 : Cmdlet Add Failed	Sub Rule	Process Failed	Error
	V 2.0 : Cmdlet Remove Failed	Sub Rule	Process Failed	Error
	V 2.0 : Cmdlet Disable Failed	Sub Rule	Action Failed	Information
	V 2.0 : Cmdlet Enable Failed	Sub Rule	Action Failed	Information
	V 2.0 : Cmdlet Move Failed	Sub Rule	Action Failed	Information
	V 2.0 : Cmdlet Update Failed	Sub Rule	Update Failed	Error
	V 2.0 : Cmdlet New Failed	Sub Rule	Process Failed	Error
	V 2.0 : Cmdlet Search Failed	Sub Rule	Failed Operation	Warning
	V 2.0 : Cmdlet Connect Failed	Sub Rule	Failed Operation	Warning