Port Security Events

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/fir-int.htm

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/PDF/5200-8214.pdf

Port Security Events

Base Rule

General PORT Message

Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Event ID

<vmid>

Number

Event ID 9401, 9402

Severity

<severity>

Text/String

For All: Error

Message

<subject>
<dinterface>
<dmac>

Text/String

Event ID 9401:
Log event when an intruder is detected on the port

<subject>
<dport>
<dmac>

Text/String/Number

Event ID 9402:
Log event when sticky mac is moved to other port