Packet Log

Rule Name

Rule Type

Common Event

Classification

Packet Log

Base Rule

Network Traffic

Network Traffic

Permitted TCP Packet

Sub Rule

Traffic Allowed by Network Firewall

Network Allow

Permitted TCP Packet (Established)

Sub Rule

Traffic Allowed by Network Firewall

Network Allow

Permitted UDP Packet

Sub Rule

Traffic Allowed by Network Firewall

Network Allow

Permitted UDP Packet (Established)

Sub Rule

Traffic Allowed by Network Firewall

Network Allow

Permitted ICMP Packet

Sub Rule

Traffic Allowed by Network Firewall

Network Allow

Permitted Packet

Sub Rule

Traffic Allowed by Network Firewall

Network Allow

Permitted Packet (Established)

Sub Rule

Traffic Allowed by Network Firewall

Network Allow

ASA : Permitted UDP Packet

Sub Rule

Traffic Allowed by Network Firewall

Network Allow

Denied ICMP Packet

Sub Rule

Traffic Denied by Network Firewall

Network Deny

Denied TCP Packet

Sub Rule

Traffic Denied by Network Firewall

Network Deny

Denied UDP Packet

Sub Rule

Traffic Denied by Network Firewall

Network Deny

Denied Packet

Sub Rule

Traffic Denied by Network Firewall

Network Deny

ASA : Denied UDP Packet

Sub Rule

Traffic Denied by Network Firewall

Network Deny

ASA: Denied TCP Packet

Sub Rule

Traffic Denied by Network Firewall

Network Deny

Device Key in Log Message

LogRhythm Schema

Data Type

N/A

<vmid>

Number

N/A

<severity>

Number

N/A

<sip>

Number

N/A

<sname>

Text/String

N/A

<dip>

Number

N/A

<dname>

Text/String

N/A

<sport>

Number

N/A

<dport>

Number

N/A

<login>

Text/String

N/A

<protnum>

Number

N/A

<protname>

Text/String

N/A

<object>

Text/String

N/A

<objectname>

Text/String

N/A

<tag1>

Text/String

N/A

<tag2>

Text/String

N/A

<duration>

Number

N/A

<amount>

Number