Netskope: UBA

Vendor Documentation

N/A

Classification

Rule Name	Rule Type	Classification	Common Event
Netskope: UBA	Base Rule	Other Audit	General User Activity Monitor Event
Netspoke: UBA : Login Failed	Sub Rule	Activity	PcAnywhere Login Failed

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type
Device Vendor	N/A	N/A
Device Product	N/A	N/A
Device Version	N/A	N/A
Device Event Class ID	<vmid>	Text/String
Name of the event	N/A	N/A
Severity of the event	<severity>	Text/String
accessMethod	N/A	N/A
action	<action> <tag1>	Text/String
appcategory	<subject>	Text/String
browser	N/A	N/A
device	N/A	N/A
dst	<dip>	IP Address
hostname	<dname>	Text/String
os	N/A	N/A
src	<sip>	IP Address
suser	<login>	Text/String
timestamp	N/A	N/A
url	<url>	Text/String