Process Information

Classification

Rule Name

Rule Type

Common Event

Classification

Process Information

Base Rule

User Process Information

Information

User Logout

Sub Rule

User Logoff

Authentication Success

User Login

Sub Rule

User Logon

Authentication Success

GET Info

Sub Rule

HTTP GET Method Event

Information

Analysis Information

Sub Rule

Analysis Complete

Information

Device Information

Sub Rule

Device Registered

Other Audit Success

Intrusion Policy Information

Sub Rule

General POLICY Information

Information

Object Information

Sub Rule

Object Attributes Listed

Information

Overview

Sub Rule

Object Attributes Listed

Information

Policy Information

Sub Rule

General POLICY Information

Information

System Information

Sub Rule

General System Information

Information

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

N/A

<severity>

String

N/A

<process>

String

N/A

<login>

String

N/A

<sip>

Number

N/A

<action>

String

N/A

<url>

String

N/A

<status>

String

N/A

<vmid>

Number

N/A

<object>

String

N/A

<policy>

Sting