Pattern 12 : General WMWare Messages
Vendor Documentation
https://www.vmware.com/in/products/esxi-and-esx.html https://www.vmware.com/topics/glossary/content/bare-metal-hypervisor |
Classification
Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|
Pattern 12 : General WMWare Messages | Base Rule | General Operations | Other Operations |
XINETD : Process Started | Sub Rule | Process/Service Started | Startup and Shutdown |
SSHD : Built Connection | Sub Rule | Connection Built | Network Traffic |
SSHD : Administrator Failed Password | Sub Rule | User Logon Failure : Bad Password | Authentication Failure |
VMWARE-HOSTD : Redirection | Sub Rule | Redirection | Information |
VMWARE-HOSTD : Process Found | Sub Rule | Process Found | Information |
VMWARE-HOSTD : Administrator Password Accepted | Sub Rule | Authentication Activity | Authentication Success |
VMWARE-HOSTD : Password Accepted | Sub Rule | Authentication Activity | Authentication Success |
SSHD : Authentication Failure | Sub Rule | User Logon Failure | Authentication Failure |
SSHD : Failed Password | Sub Rule | User Logon Failure | Authentication Failure |
SSHD : Multiple Authentication Failures | Sub Rule | User Logon Failure | Authentication Failure |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type |
---|---|---|
process | <process> | Text/String |
tag1 | <tag1> | Text/String |
object | <object> | Text/String |
sip | <sip> | IP Address |
login | <login> | Text/String |
dip | <dip> | IP Address |
dport | <dport> | Number |
amount | <amount> | Number |
session | <session> | Text/String/Number |
dname | <dname> | Text/String |
sport | <sport> | Number |