Pam Unix Authentication

Classification

Rule Name	Rule Type	Common Event	Classification
Authentication Failure	Sub Rule	Authentication Failure Activity	Authentication Failure
Pam Unix Authentication	Base Rule	General Authentication Event	Other Audit
Authentication Success	Sub Rule	Authentication Activity	Authentication Success

Mapping with LogRhythm Schema  

Device Key in Log Message	LogRhythm Schema	Data Type
N/A	<severity>	Text\String
N/A	<sip>	IP Address
N/A	<sname>	Text\String
N/A	<login>	Text\String
N/A	<account>	Text\String
N/A	<session>	Text\String
N/A	<process>	Text\String
N/A	<processid>	Number
N/A	<object>	Text\String
N/A	<tag1>	Text\String

×