Syslog - Generic Linux OS: Sudo Messages

Vendor Documentation

N/A

Rule Name	Rule Type	Common Event	Classification
Sudo Messages	Base Rule	General Information	Information
Sudo Session Started	Sub Rule	Authentication Activity	Authentication Success
Sudo Command Executed	Sub Rule	General Sudo Command	Activity

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
N/A	<severity>	Text/String	N/A
N/A	<dip>	IP Address	N/A
N/A	<dname>	Text/String	N/A
N/A	<process>	Text/String	N/A
N/A	<processid>	Number	N/A
N/A	<subject>	Text/String	N/A
N/A	<tag1>	Text/String	N/A
N/A	<account>	Text/String	N/A
N/A	<login>	Text/String	N/A
N/A	<command>	Text/String	N/A