Classification
|
Rule Name |
Rule Type |
Common Event |
Classification |
|
Pattern 10 : PIX General Authentication |
Base Rule |
General Firewall Log |
Network Traffic |
|
PIX-X-605003 : HTTP Login Failed |
Sub Rule |
User Logon Failure |
Authentication Failure |
|
PIX-X-315011 : SSH Session Disconnected |
Sub Rule |
SSH Session Closed |
Other Operations |
|
PIX-X-315003 : SSH Session Failed |
Sub Rule |
Traffic Denied by Network Firewall |
Network Deny |
|
PIX-X-315002 : SSH Session Permitted |
Sub Rule |
Traffic Allowed by Network Firewall |
Network Allow |
|
PIX-X-113016 : AAA Credentials Rejected |
Sub Rule |
User Logon Failure |
Authentication Failure |
|
PIX-X-113014 : AAA Auth Server Unavailable |
Sub Rule |
Unable to Communicate With Authentication Server |
Error |
|
PIX-X-113005 : AAA User Authentication Failure |
Sub Rule |
User Logon Failure |
Authentication Failure |
|
PIX-X-113004 : AAA Operation Complete |
Sub Rule |
Authentication Activity |
Authentication Success |
|
PIX-X-109027 : Response Validation Failed |
Sub Rule |
Failed Response Validation |
Error |
Mapping with LogRhythm Schema
|
Device Key in Log Message |
LogRhythm Schema |
Data Type |
|
N/A |
<vmid> |
Number |
|
N/A |
<sip> |
Number |
|
N/A |
<dip> |
Number |
|
N/A |
<sport> |
Number |
|
N/A |
<severity> |
Text/String |
|
N/A |
<login> |
Text/String |