Shun Activity

Rule Name

Rule Type

Common Event

Classification

Shun Activity

Base Rule

Traffic Denied by Network Firewall

Network Deny

EVID 401002 : Shun Added

Sub Rule

Traffic Denied by Network Firewall

Network Deny

EVID 401003 : Shun Deleted

Sub Rule

Configuration Modified : Network Access

Configuration

EVID 401004 : Outside Packet Shunned

Sub Rule

Traffic Denied by Network Firewall

Network Deny

Device Key in Log Message

LogRhythm Schema

Data Type

N/A

<vmid>

Number

N/A

<Severity>

Number

N/A

<sip>

IP Address

N/A

<sname>

Text/String

N/A

<dip>

IP Address

N/A

<dname>

Text/String

N/A

<sport>

Number

N/A

<dport>

Number

N/A

<process>

Text/String

N/A

<object>

Text/String