Pattern 4 : Failed Login

Classification

Rule Name	Rule Type	Classification	Common Event
Failed Login	Sub Rule	Authentication Failure	User Logon Failure
Pattern 4 : Failed Login	Base Rule	Authentication Failure	Authentication Failure Activity
Authentication Failure	Sub Rule	Authentication Failure	User Logon Failure
Permission Denied	Sub Rule	Authentication Failure	User Logon Failure

Mapping with LogRhythm Schema  

Device Key in Log Message	LogRhythm Schema	Data Type
from	<sip>	Number
Attempt for	<login>	Text/String
N/A	<tag1>	Text/String

×