Priority B Messages

https://marketplace.microfocus.com/arcsight/content/lancope-stealthwatch-r

https://www.dropbox.com/s/mbwlv9f2t1si5d4/Lancope_StealthWatch_6_6_CEF_Config_Guide_2015.pdf?dl=0

Priority B Messages

Base Rule

General Information

Information

Unknown OS

Sub Rule

System Software Warning

Warning

Policy Violation

Sub Rule

Security Policy Violation

Warning

Target Data Hoarding

Sub Rule

Data Loss Prevention Activity

Activity

Suspect Data Hoarding

Sub Rule

Data Loss Prevention Activity

Activity

Exploitation

Sub Rule

Potential Vulnerability Exploit Allowed

Activity

Data Hoarding

Sub Rule

Data Loss Prevention Activity

Activity

Watch Host Active

Sub Rule

Watchlist Hit

Activity

Watch Port Active

Sub Rule

Watchlist Hit

Activity

Spam Source

Sub Rule

Spam Detected

Activity

Relationship ICMP Flood

Sub Rule

General Attack Activity

Attack

Relationship UDP Flood

Sub Rule

General Attack Activity

Attack

Relationship SYN Flood

Sub Rule

General Attack Activity

Attack

Brute Force Login

Sub Rule

Brute Force Activity

Attack

Anomaly

Sub Rule

Protocol Anomaly

Attack

Packet Flood

Sub Rule

General Attack Activity

Attack

Port Flood

Sub Rule

General Attack Activity

Attack

UDP Flood

Sub Rule

General Attack Activity

Attack

SYN Flood

Sub Rule

General Attack Activity

Attack

ICMP Flood

Sub Rule

General Attack Activity

Attack

Half Open Attack

Sub Rule

General Attack Activity

Attack

Bad Host

Sub Rule

Host Compromised

Compromise

Scanner Talking

Sub Rule

Host Compromised

Compromise

Fake Application Detected

Sub Rule

Host Compromised

Compromise

StealthWatch Flow License Exceeded

Sub Rule

License Exceeded

Critical

SMC Disk Space Low

Sub Rule

Disk / Storage Full

Critical

SMC RAID Rebuilding

Sub Rule

Disk Drive Failure

Critical

SMC RAID Failure

Sub Rule

Disk Drive Failure

Critical

FlowCollector Performance Degraded

Sub Rule

Disk Drive Failure

Critical

FlowCollector RAID Rebuilding

Sub Rule

Disk Drive Failure

Critical

FlowCollector RAID Failure

Sub Rule

Disk Drive Failure

Critical

Data Exfiltration

Sub Rule

Data Loss Alert : High

Critical

High DDoS Source Index

Sub Rule

Host Distributed Denial Of Service

Denial Of Service

High DDoS Target Index

Sub Rule

Host Distributed Denial Of Service

Denial Of Service

Slow Connection Flood

Sub Rule

Network Denial Of Service

Denial Of Service

Unlicensed Feature

Sub Rule

License Error

Error

License Corrupted

Sub Rule

License Error

Error

FlowSensor Management Channel Down

Sub Rule

Flow Manager Error

Error

FlowSensor Time Mismatch

Sub Rule

Flow Manager Error

Error

FlowSensor RAID Rebuilding

Sub Rule

Flow Manager Error

Error

FlowSensor RAID Failure

Sub Rule

Flow Manager Error

Error

FlowSensor Traffic Lost

Sub Rule

Flow Manager Error

Error

FlowSensor VE Configuration Error

Sub Rule

Flow Manager Error

Error

MAC Address Violation

Sub Rule

Invalid MAC Address

Error

SMC Failover Channel Down

Sub Rule

Network Interface Changed State To Down

Information

Identity Channel Down

Sub Rule

Network Interface Changed State To Down

Information

SLIC Channel Down

Sub Rule

Network Interface Changed State To Down

Information

V-Motion

Sub Rule

General VMware Server Information

Information

New VM

Sub Rule

Status For Virtual Machine Set

Information

New Host Active

Sub Rule

Evaluated New Host

Information

Suspect Data Loss

Sub Rule

General Data Loss Message

Information

Bot Command & Control Server

Sub Rule

Detected Botnet Activity

Malware

Bot Infected Host - Successful C&C Activity

Sub Rule

Detected Botnet Activity

Malware

Bot Infected Host - Attempted C&C Activity

Sub Rule

Detected Botnet Activity

Malware

Worm Propagation

Sub Rule

Detected Worm Activity

Malware

Worm Activity

Sub Rule

Detected Worm Activity

Malware

Mail Rejects

Sub Rule

Unauthorized E-mail

Misuse

High Volume Email

Sub Rule

Traffic Denied by Network Firewall

Network Deny

New Flows Served

Sub Rule

Traffic Denied by Network Firewall

Network Deny

New Flows Initiated

Sub Rule

Traffic Denied by Network Firewall

Network Deny

Max Flows Served

Sub Rule

Traffic Denied by Network Firewall

Network Deny

Max Flows Initiated

Sub Rule

Traffic Denied by Network Firewall

Network Deny

High Total Traffic

Sub Rule

Traffic Denied by Network Firewall

Network Deny

High Target Index

Sub Rule

Traffic Denied by Network Firewall

Network Deny

High File Sharing Index

Sub Rule

Traffic Denied by Network Firewall

Network Deny

High Concern Index

Sub Rule

Traffic Denied by Network Firewall

Network Deny

FlowCollector FlowSensor VE Count Exceeded

Sub Rule

Lost Flow Detail Records

Network Traffic

FlowCollector Exporter Count Exceeded

Sub Rule

Lost Flow Detail Records

Network Traffic

FlowCollector Log Retention Reduced

Sub Rule

Lost Flow Detail Records

Network Traffic

FlowCollector Data Deleted

Sub Rule

Lost Flow Detail Records

Network Traffic

Interface Utilization Exceeded Outbound

Sub Rule

Max Flow Limit Reached

Network Traffic

Interface Utilization Exceeded Inbound

Sub Rule

Max Flow Limit Reached

Network Traffic

FlowCollector Flow Data Lost

Sub Rule

Lost Flow Detail Records

Network Traffic

ICMP Received

Sub Rule

ICMP Flow Events

Network Traffic

UDP Received

Sub Rule

UDP Flow Events

Network Traffic

NAT IP

Sub Rule

NAT Detection Status

Network Traffic

SYNs Received

Sub Rule

TCP SYN Received

Network Traffic

Short Fragments

Sub Rule

Fragmented Packet Received

Network Traffic

Port Scan

Sub Rule

Port Scan

Reconnaissance

Recon

Sub Rule

Reconnaissance Activity

Reconnaissance

FlowCollector Management Channel Down

Sub Rule

Process/Service Stopped

Startup and Shutdown

Cisco ISE Management Channel Down

Sub Rule

Process/Service Stopped

Startup and Shutdown

FlowCollector Stopped

Sub Rule

Process/Service Stopped

Startup and Shutdown

Relationship TCP Retransmission Ratio

Sub Rule

Suspicious Network Activity

Suspicious

Relationship Server Response Time

Sub Rule

Suspicious Network Activity

Suspicious

Relationship Round Trip Time

Sub Rule

Suspicious Network Activity

Suspicious

Relationship New Flows

Sub Rule

Suspicious Network Activity

Suspicious

Relationship Max Flows

Sub Rule

Suspicious Network Activity

Suspicious

Relationship Low Traffic

Sub Rule

Suspicious Network Activity

Suspicious

Relationship High Traffic

Sub Rule

Suspicious Network Activity

Suspicious

Relationship High Total Traffic

Sub Rule

Suspicious Network Activity

Suspicious

Suspect Quiet Long Flow

Sub Rule

Suspicious Network Activity

Suspicious

Command and Control

Sub Rule

Suspicious Network Activity

Suspicious

Beaconing Host

Sub Rule

Suspicious Host Activity

Suspicious

Trapped Host

Sub Rule

Suspicious Host Activity

Suspicious

Suspect Long Flow

Sub Rule

Suspicious Network Activity

Suspicious

Low Traffic

Sub Rule

Suspicious Network Activity

Suspicious

Touched

Sub Rule

Suspicious Host Activity

Suspicious

Suspect UDP Activity

Sub Rule

Suspicious Network Activity

Suspicious

Malformed Fragments

Sub Rule

Malformed Object

Suspicious

Host Lock Violation

Sub Rule

Suspicious Host Activity

Suspicious

High Traffic

Sub Rule

Suspicious Network Activity

Suspicious

Hi SMB Peers

Sub Rule

Vuln Low Severity : SMB / NETBIOS

Vulnerability

Mail Relay

Sub Rule

Vuln Medium Severity : Mail Services

Vulnerability

Device Vendor

 N/A

N/A

Device Product

 N/A

 N/A

time

  N/A

 N/A

target_hostname

<dname>

Text/String

alarm_severity_id

<severity>

Number

alarm_type_id

<vmid>

Number

alarm_type_description

<subject>, <threatname>

Text/String

port

<sport>

Number

target_ip

<dip>

Number

target_mac_address

<dmac>

 N/A

target_label

<dname>

Text/String

alarm_type_name

<command>

Text/String

source_hostname

<sname>

 N/A

source_ip

<sip>

Number

source_mac_address

<smac>

 N/A

source_username

<login>

 N/A

device_ip

<object>

Number

device_name

<objectname>

Text/String

details

 N/A

 N/A

protocol

 N/A

 N/A

alarm_id

 N/A

 N/A

alarm_category_name

 N/A

 N/A

start_active_time

 N/A

 N/A

end_active_time

 N/A

 N/A