Scan Messages (LST: Syslog - Symantec ICDX CEF)

https://techdocs.broadcom.com/content/dam/broadcom/techdocs/symantec-security-software/endpoint-security-and-management/integrated-cyber-defense-exchange/generated-pdfs/ICDx_1.4.1_Administration_Guide.pdf

Scan Messages

Base Rule

Scan Activity

Information

Scan Completed

Sub Rule

Scan Completed

Other Audit Success

Scan Started

Sub Rule

Scan Started

Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Version

N/A

N/A

N/A

Vendor

N/A

N/A

N/A

Device Product

N/A

N/A

N/A

Device Version

<version>

Numbers

N/A

Device Event Class_ID

<vmid>

Text/String

The number representing the type of the event.

If translation is used, the type enum name is defined by the ICD Schema.

Name

<vendorinfo>

Text/String

The description of the event.

If the message attribute is missing and translation is used, the name is generated using the type_id and id enum names.

Severity

<severity>

Numbers

The severity of the event, mapped as follows:

• ICD Severity = CEF Severity

• 0 (Unknown or missing) = Unknown

• 1 (Informational) = 1

• 2 (Warning) = 3

• 3 (Minor) = 6

• 4 (Major) = 8

• 5 (Critical) = 9

• 6 (Fatal) = 10

act

<result>, <tag1>

Text/String

The outcome of the event.

It is either a numeric value or text when translation is used.

cat

<objecttype>

Text/String

The event type category.

It is either a numeric value or text when translation is used.

cnt

N/A

N/A

N/A

deviceExternalId

N/A

N/A

The unique identifier of the device.

dtz

N/A

N/A

The time zone of the event’s Device Time, converted from minutes ahead or behind UTC to a standard time zone identifier.

dvc

<sip>

IP Address

The IP address that pertains to the event, if in IPv4 format (otherwise, placed in c6a1).

dvchost

<sname>

Text/String

The name of the device originating the event.

dvcmac

<smac>

Text/Numbers

N/A

externalId

N/A

N/A

N/A

rt

N/A

N/A

N/A

deviceCustomDate1

N/A

N/A

N/A

deviceCustomDate1Label

N/A

N/A

N/A

start

N/A

N/A

The number of milliseconds since 01/01/1970 00:00:00 UTC.

agt

N/A

N/A

The IP address of the collector device, if in IPv4 format.

ahost

N/A

N/A

The host name of the collector device.

aid

N/A

N/A

The unique identifier of the collector.

cs3

<policy>

Text/String

N/A

cs3Label

N/A

N/A

N/A

cs6

N/A

N/A

N/A

cs6Label

N/A

N/A

N/A

cs4

<group>

Text/String

N/A

cs4Label

N/A

N/A

N/A

cs5

N/A

N/A

N/A

cs5Label

N/A

N/A

N/A

suser

<login>

Text/String

The source user by name.

symcICDxLogName

<object>

Text/String

The ICDx archive name (log_name).

symcICDxUUID

N/A

N/A

The JSON-encoded event data that was not mapped to any CEF attributes.

symcICDxData

<subject>

Text/String

N/A