Session State Changed

Classification

Rule Name	Rule Type	Common Event	Classification
Session Closed	Sub Rule	Session Ended	Other Audit Success
Session Closed	Sub Rule	Session Ended	Other Audit Success
Session State Changed	Base Rule	Session State Changed	Other Audit
New Session	Sub Rule	Start New Session Success	Other Audit Success
Session Removed	Sub Rule	Session Closed	Other Audit Success
Session Opened	Sub Rule	Begin Session	Other Audit Success
Session Opened	Sub Rule	Begin Session	Other Audit Success

Mapping with LogRhythm Schema  

Device Key in Log Message	LogRhythm Schema	Data Type
N/A	<dname>	Text\String
N/A	<login>	Text\String
N/A	<process>	Text\String
N/A	<processid>	Number
N/A	<tag1>	Text\String

×