Pattern Catch All : Level 3

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Provider	<tag1>, <objectname>, <process>	N/A
EventID Qualifiers	<vmid>	N/A
Version	N/A	N/A
Level	<severity>	N/A
Task	N/A	N/A
Opcode	N/A	N/A
Keywords	N/A	N/A
TimeCreated	N/A	N/A
EventRecordID	N/A	N/A
Correlation	N/A	N/A
Execution ProcessID	<processid>	N/A
ThreadID	<session>	N/A
Channel	N/A	N/A
Computer	<dname>	N/A
Security	<domain> <login>	N/A
Data	<vendorinfo>	N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1008171	Pattern Catch All : Level 3	Base Rule	General Information	Information
	EVID 57: Failed To Flush Data To Transaction Log	Sub Rule	General Maintenance Warning	Warning
	EVID 6005: Event Log Service Started	Sub Rule	General Logging Information	Information
	EVID 6006: Event Log Service Stopped	Sub Rule	General Logging Information	Information
	EVID 6008: Previous Shutdown Unexpected	Sub Rule	Unclean Shutdown	Warning
	EVID 6009: System Boot Info	Sub Rule	System Started	Startup and Shutdown
	Microsoft-Windows-WinRM	Sub Rule	General Administration Server Information	Information
	EVID 133: Optical Drive Locked - Exclusive Access	Sub Rule	Access Object Failure	Access Failure
	EVID 1001: SNMP Service Started Successfully	Sub Rule	Process/Service Started	Startup and Shutdown
	EVID 13: System Shutting Down	Sub Rule	System Shutting Down	Startup and Shutdown
	EVID 27: Windows Automatic Update Service Paused	Sub Rule	Process/Service Stopped	Startup and Shutdown
	EVID 51046: DHCPv6 Client Service Started	Sub Rule	Process/Service Started	Startup and Shutdown
	EVID 50036: DHCP Client Service Starting	Sub Rule	Process/Service Starting	Startup and Shutdown
	EVID 10016: COM Access Denied	Sub Rule	Initialize Object Failure	Access Failure
	EVID 12: OS Started At Time	Sub Rule	System Starting	Startup and Shutdown
	EVID 129: NTPClient Unable To Set Domain Peer	Sub Rule	NTP Server Unreachable	Error
	EVID 1500: SNMP Traps Not Configured	Sub Rule	General SNMPTRAP Error	Error
	EVID 20001: Driver Install Process Completed	Sub Rule	Software Installed	Configuration
	EVID 20003: Service Install Process Complete	Sub Rule	Software Installed	Configuration
	EVID 20010: PnP Service State Change	Sub Rule	Process/Service Startup Or Shutdown Activity	Startup and Shutdown
	EVID 2242: Patrol Read Started	Sub Rule	Process/Service Started	Startup and Shutdown
	EVID 2243: Patrol Read Stopped	Sub Rule	Process/Service Stopped	Startup and Shutdown
	EVID 26: Application Popup	Sub Rule	General Application Popup Information	Information
	EVID 26: Processor State	Sub Rule	Processor Information	Information
	EVID 3: Virtual Disk Service Started	Sub Rule	Process/Service Started	Startup and Shutdown
	EVID 4: Virtual Disk Service Stopped	Sub Rule	Process/Service Stopped	Startup and Shutdown
	EVID 36885: Too Many Trusted Cert Authorities	Sub Rule	Certificate Services Denied Certificate Request	Warning
	EVID 36888: Schannel Fatal Alert	Sub Rule	General Schannel Error	Error
	EVID 50037: DHCPv4 Service Stopped	Sub Rule	Process/Service Stopped	Startup and Shutdown
	EVID 50037: DHCPv6 Service Stopped	Sub Rule	Process/Service Stopped	Startup and Shutdown
	EVID 5074: Worker Process Recycle Request	Sub Rule	Process/Service Startup Or Shutdown Activity	Startup and Shutdown
	EVID 5186: Inactive Worker Process Shutdown	Sub Rule	Process/Service Stopped	Startup and Shutdown
	EVID 5719: No DC Available For Domain	Sub Rule	Domain Controller Unreachable	Error
	EVID 10010: Server Registration With DCOM Timeout	Sub Rule	Device Timeout	Error
	EVID 10020: Dynamic IPv6 Assigned To Server	Sub Rule	General DHCPServer Warning	Warning
	EVID 10149: WinRM Is Not Listening	Sub Rule	Listener Failed	Error
	EVID 1: CBA Filter Disk Info	Sub Rule	General Disk Information	Information
	EVID 103: MSISCSI Timeout	Sub Rule	General iSCSI Error	Error
	EVID 41: System Did Not Shutdown Properly	Sub Rule	Unclean Shutdown	Warning
	EVID 14531: DFS Finished Initialization	Sub Rule	Process/Service Starting	Startup and Shutdown
	EVID 14533: DFS Finished Building Name Space	Sub Rule	Process/Service Starting	Startup and Shutdown
	EVID 14550: DFS Cross Forest Initialization Error	Sub Rule	General DfsSvc Error	Error
	EVID 14551: DFS Cross Forest Initialization	Sub Rule	General DfsSvc Information	Information
	EVID 1: DataKeeper Driver Started	Sub Rule	Process/Service Started	Startup and Shutdown
	EVID 144: Error Locking Volume	Sub Rule	Error Locking Volume	Error
	EVID 146: Volume Has Been Locked	Sub Rule	Object Modified	Access Success
	EVID 147: Volume Has Been Unlocked	Sub Rule	Object Modified	Access Success
	EVID 149: Open Handled Detected On Volume	Sub Rule	Open Handles Detected On Volume	Warning
	EVID 150: Invalid Attempt To Establish Mirror	Sub Rule	Create Object Failure	Access Failure
	EVID 152: Media Is Now Write Protected	Sub Rule	Media Is Now Write Protected	Information
	EVID 167 :Unable To Connect To Volume	Sub Rule	Unable To Connect To Volume Port	Error
	EVID 23: Mirror Role Changed	Sub Rule	Mirror Role Changed	Information
	EVID 58: Error Writing Keep-Alive Packet	Sub Rule	Error Writing Keep-Alive Packet	Error
	Microsoft-Windows-Kernel-Boot Message	Sub Rule	Process/Service Startup Or Shutdown Activity	Startup and Shutdown
	EVID 1030: Username Or Password Incorrect	Sub Rule	Windows Group Policy Problem	Error
	EVID 1: Power Setup	Sub Rule	Power Info Msg	Information
	EVID 10001: Unable To Start DCOM Server	Sub Rule	Server Timed Out	Information
	EVID 10006: Unable To Start DCOM Server	Sub Rule	Server Timed Out	Information
	EVID 10009: Unable To Start DCOM Server	Sub Rule	Server Timed Out	Information
	EVID 101: Group Policy	Sub Rule	Windows Group Policy Problem	Error
	EVID 103: Group Policy	Sub Rule	Windows Group Policy Problem	Error
	EVID 105: Group Policy	Sub Rule	Install Failed	Error
	EVID 107: Group Policy	Sub Rule	Install Failed	Error
	EVID 108: Group Policy	Sub Rule	Install Failed	Error
EVID 10028: DCOM Unable To Communicate	Sub Rule	Unable To Create Connection	Error
EVID 10029: DCOM Unable To Communicate	Sub Rule	Update Stopped	Information
EVID 10036: DCOM Unable To Communicate	Sub Rule	Update Stopped	Information
EVID 1129: Group Policy	Sub Rule	ICMP Flow Events	Network Traffic
EVID 1130: Group Policy	Sub Rule	Policy Notification	Information
EVID 13: Group Policy	Sub Rule	Windows Group Policy Problem	Error
EVID 130: Power Setup	Sub Rule	Power Failure Detected In Other Failover Device	Error
EVID 131: Power Setup	Sub Rule	Power Failure Detected In Other Failover Device	Error
EVID 137: Power Setup	Sub Rule	Power Info Msg	Information
EVID 15: General Information	Sub Rule	General Information Log Message	Information
EVID 1500: Group Policy	Sub Rule	Successfully Loaded Policy From Policy Server	Information
EVID 1501: Group Policy	Sub Rule	Successfully Loaded Policy From Policy Server	Information
EVID 16: Hardware Issue	Sub Rule	Hardware Problem	Warning
EVID 187: Power Setup	Sub Rule	Power Info Msg	Information
EVID 44: Windows Update	Sub Rule	General Windows Update Agent Warning	Warning
EVID 7016: Windows Service	Sub Rule	Service Stop Failed	Error
EVID 2004: Windows Memory	Sub Rule	System Memory Low	Warning
EVID 23: Power Setup	Sub Rule	Power Failure Detected In Other Failover Device	Error
EVID 24: Power Setup	Sub Rule	Power Failure Detected In Other Failover Device	Error
EVID 292: Power Setup	Sub Rule	Power Notification	Warning
EVID 33: Ethernet Info	Sub Rule	Ethernet Port Down	Warning
EVID 34: Ethernet Info	Sub Rule	Ethernet Port Down	Warning
EVID 35: Group Policy	Sub Rule	General Policy	Other Audit
EVID 36874: Connection Request	Sub Rule	Connection Request	Network Traffic
EVID 36876: Certificate Error	Sub Rule	Server Certificate Issued	Information
EVID 36882: Certificate Error	Sub Rule	Unknown Certificate	Information
EVID 36887: Certificate Error	Sub Rule	SSL/VPN Warning	Warning
EVID 37: Security Check	Sub Rule	General System Warning	Warning
EVID 40: Power Setup	Sub Rule	Power Failure Detected In Other Failover Device	Error
EVID 42: Kerberos KDC Lacks Strong Account Key	Sub Rule	General Kerberos Error	Error
EVID 43: Installation Of Updated KB	Sub Rule	KB Auto Sync Completed	Information
EVID 4321: NBT Over TCP	Sub Rule	General NetBIOS Error	Error
EVID 5002: Wireless	Sub Rule	Wireless Activity	Information
EVID 5009: SSD Not Working	Sub Rule	General TermServSessDir Information	Information
EVID 506: Power Setup	Sub Rule	Display Page Failure	Warning
EVID 507: Power Setup	Sub Rule	Power Info Msg	Information
EVID 566: Power Setup	Sub Rule	Power Failure Detected In Other Failover Device	Error
EVID 6062: Wireless	Sub Rule	Wireless Activity	Information
EVID 610: Smart Card	Sub Rule	General SCardSvr Error	Error
EVID 7003: Wireless	Sub Rule	Wireless Activity	Information
EVID 7012: Wireless	Sub Rule	Wireless Activity	Information
EVID 7021: Wireless	Sub Rule	Wireless Activity	Information
EVID 7023: Wireless	Sub Rule	Wireless Activity	Information
EVID 7024: Service Control	Sub Rule	Service Stop Failed	Error
EVID 7025: Power Setup	Sub Rule	Power Failure Detected In Other Failover Device	Error
EVID 8012: DNS Client Events	Sub Rule	DNS Information-Only Event	Information
EVID 308: App Mgmt Group Policy	Sub Rule	Policy Notification	Information
EVID 57: Failed To Flush Data To Transaction Log	Sub Rule	General Maintenance Warning	Warning
General: Service Control Manager Information	Sub Rule	General Service Control Manager Information	Information
General: DfsSvc Information	Sub Rule	General DfsSvc Information	Information
EVID 23: Change Password	Sub Rule	Password Reminder	Information
EVID 23: Update	Sub Rule	Update Event	Information

LogRhythm Default v2.0

N/A