RADIUS Authentication Request Dropped
Vendor Documentation
Log Fields and Parsing
This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.
Log Field | LogRhythm Default | LogRhythm Default v2.0 |
---|---|---|
Header : Severity | N/A | N/A |
timestamp | N/A | N/A |
IP address/hostname | N/A | N/A |
cat_name | N/A | N/A |
msg_sev | <severity> | N/A |
msg_class | <protname> | N/A |
msg_text | <tag1> | N/A |
Server | <dname> | N/A |
NAS IP Address | <sip> | N/A |
NAS Identifier | <sname> | N/A |
Failure Reason | <vmid> <subject> <reason> | N/A |
Log Processing Settings
This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.
LogRhythm Default
Regex ID | Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|---|
1005069 | RADIUS Authentication Request Dropped | Base Rule | Authentication Failure Activity | Authentication Failure |
Auth Fail : Msg-Auth RADIUS Attribute Is Invalid | Sub Rule | Authentication Failure Activity | Authentication Failure | |
Auth Fail : PEAP Handshake Failed | Sub Rule | Authentication Failure Activity | Authentication Failure | |
Auth Fail : Subject Not Found In Identity Store | Sub Rule | User Logon Failure : Bad Username | Authentication Failure | |
Auth Fail : User Required To Change Password | Sub Rule | User Logon Failure : Bad Password | Authentication Failure | |
Auth Fail : Wrong Password | Sub Rule | User Logon Failure : Bad Password | Authentication Failure | |
Auth Fail : Endpoint Abandoned EAP Session | Sub Rule | Authentication Failure Activity | Authentication Failure | |
Auth Fail : Endpoint Started New EAP Session | Sub Rule | Authentication Failure Activity | Authentication Failure | |
RADIUS Accounting Request Dropped | Sub Rule | Authentication Failure Activity | Authentication Failure | |
Auth Fail : Packet Already In Process | Sub Rule | Authentication Failure Activity | Authentication Failure |
LogRhythm Default v2.0
N/A