Patt 5 : SMTP Session Messages
Classification
Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|
Patt 5 : SMTP Session Messages | Base Rule | General Information | Information |
Rejected Message | Sub Rule | Suspicious E-mail Activity | Suspicious |
Accepted Message | Sub Rule | Message Accepted | Other Audit Success |
Timeout Message | Sub Rule | Connection Timeout | Warning |
SMTP Session Deleted | Sub Rule | Session Ended | Information |
Looking For Session Relay | Sub Rule | Session Information | Information |
Lookup SMTP Session | Sub Rule | Session Information | Information |
Put SMTP Session | Sub Rule | Session Information | Information |
Reloaded Session Relay | Sub Rule | Session Started | Other Audit Success |
Save Session Relay | Sub Rule | Session Information | Information |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type |
---|---|---|
N/A | <processid> | Number |
N/A | <subject> | Text/String |
N/A | <sname> | String |
N/A | <sip> | Number |
N/A | <sport> | Text/String/Number |
N/A | <tag1> | Text/String |
N/A | <session>. | String |
N/A | <sender> | String |
N/A | <recipient> | String |
N/A | <protname> | String |
N/A | <vendorinfo> | String |
N/A | <dip> | Number |
N/A | <dport> | Text/String/Number |