Pattern 11 : TaskManager : Task Manager Messages

Classification

Rule Name

Rule Type

Common Event

Classification

Pattern 11 : TaskManager : Task Manager Messages

Base Rule

General Information

Information

haTask-ha-host-vim.DiagnosticManager.browse

Sub Rule

Process/Service Started

Startup and Shutdown

haTask-ha-host-vim.DiagnosticManager.browse

Sub Rule

Task Completed

Information

haTask-16-vim.VirtualMachine.powerOff Started

Sub Rule

Process/Service Started

Startup and Shutdown

haTask-16-vim.VirtualMachine.powerOff Completed

Sub Rule

System Shutdown

Startup and Shutdown

haTask-16-vim.VirtualMachine.powerOn Completed

Sub Rule

System Started

Startup and Shutdown

haTask-16-vim.VirtualMachine.powerOn Created

Sub Rule

Virtual Machine Startup Task Created

Information

haTask-ha-host-vim.option.OptionManager Created

Sub Rule

Process/Service Started

Startup and Shutdown

haTask-ha-host-vim.option.OptionManager Completed

Sub Rule

Task Completed

Information

TaskManager : General Task Completed

Sub Rule

Task Completed

Information

TaskManager : General Task Created

Sub Rule

Task Completed

Information

haTask-ha-folder-root-vim.host.LclAcctmgr.CrtUsr

Sub Rule

User Account Created

Account Created

haTask-ha-folder-root-vim.host.LclAcctMgr.RmvUsr

Sub Rule

User Account Deleted

Account Deleted

haTask-ha-host-vim.HostSystem.reboot

Sub Rule

System Reboot Task Created

Information

haTask-ha-host-vim.HostSystem.reboot

Sub Rule

System Restarted

Startup and Shutdown

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Process

<process>

Text/String

Tag1

<tag1>

Text/String

Tag2

<tag2>

Text/String

Vmid

<vmid>

Text/String