Network Traffic

Classification

Rule Name	Rule Type	Common Event	Classification
Network Traffic	Base Rule	General Network Traffic Log Message	Network Traffic
Blocked Network Traffic	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Allowed Network Traffic	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Anonymizer : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Anonymizer : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Blacklist : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Blacklist : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Blogs : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Blogs : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Business and Economy : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Continuing Education/Colleges : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Continuing Education/Colleges : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Business and Economy : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Corporate Marketing : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Corporate Marketing : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Discussion Forums : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Discussion Forums : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Education : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Education : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Entertainment : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Entertainment : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
File Host : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Finance : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Finance : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
File Host : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Flowserve-BlackList : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Flowserve-BlackList : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Gambling : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Gambling : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Games : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Games : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Hobbies/Leisure : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Hobbies/Leisure : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Image Host : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Image Host : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Information Technology : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Information Technology : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Internet Services : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Internet Services : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
K-12 : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
K-12 : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Miscellaneous or Unknown : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Miscellaneous or Unknown : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Music : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Music : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
News and Media : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
News and Media : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Office_365 : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Office_365 : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Online Chat : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Online Chat : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Online Shopping : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Online Shopping : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Portals : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Portals : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Professional Services : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Professional Services : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Radio Stations : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Radio Stations : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Real Estate : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Real Estate : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Reference Sites : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Reference Sites : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Science/Tech : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Science/Tech : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Shareware Download : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Shareware Download : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Shopping and Auctions : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Shopping and Auctions : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Social Networking : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Social Networking : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Special Interests/Social Organizations : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Special Interests/Social Organizations : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Sports : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Sports : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Spyware/Adware : Allowed	Sub Rule	Detected Spyware Activity	Malware
Spyware/Adware : Blocked	Sub Rule	Failed Spyware Activity	Failed Malware
Streaming Media : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Streaming Media : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Television/Movies : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Television/Movies : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Travel : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Travel : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
User_Defined-Bypass_Authentication : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
User_Defined-Bypass_Authentication : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
User_Defined-Bypass_SSL : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
User_Defined-Bypass_SSL : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
User_Defined-O365-SSL_Bypass : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
User_Defined-O365-SSL_Bypass : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
User-defined : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
User-defined : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Vehicles : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Vehicles : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Web Banners : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Web Banners : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Web Host : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Web Host : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Web Search : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Web Search : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny
Webmail : Allowed	Sub Rule	Traffic Allowed by Network Firewall	Network Allow
Webmail : Blocked	Sub Rule	Traffic Denied by Network Firewall	Network Deny

Mapping with LogRhythm Schema  

Device Key in Log Message	LogRhythm Schema	Data Type
login	<login>	Text/String
dname	<domainimpacted>	Text/String
dip	<dip>	Number
sip	<sip>	Number
natPublicIp	<snatip>	Number
website	<dport>	Number
url	<url>	Number/Text
ua	<useragent>	Number/Text
ua	<object>	Number/Text
module	<subject>	Text/String
proto	<protname>	Text/String
action	<action>	Text/String
action	<tag1>	Text/String
reason	<reason>	Text/String
appName	<parentprocessname>	Text/String
fileType	<objecttype>	Text/String
reqSize	<bytesout>	Number
responseSize	<bytesin>	Number
totalSize	<size>	Number
malwareCat	<status>	Text/String
threatName	<threatname>	Text/String
filename	<objectname>	Number/Text
bamd5	<hash>	Number/Text
riskScore	<severity>	Number
location	<sinterface>	Number/Text
reqMethod	<command>	Text/String
respCode	<responsecode>	Number
urlClass	<policy>	Text/String
urlSuperCat	<session>	Text/String
urlCat	<tag2>	Text/String
urlCat	<group>	Text/String
referer	<vendorinfo>	Number/Text/String

×