Switch User Command

Classification

Rule Name	Rule Type	Common Event	Classification
Switch User Command	Base Rule	Authentication Activity	Authentication Success
Switch User To Superuser	Sub Rule	Authentication Activity	Authentication Success
Switch User	Sub Rule	Authentication Activity	Authentication Success
Failed Switch User To Superuser	Sub Rule	User Logon Failure	Authentication Failure
Failed Switch User	Sub Rule	User Logon Failure	Authentication Failure

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
N/A	<sip>	Number/Text/String	N/A
Dname	<dname>	Text/String	Destination Hostname Information
N/A	<login>	Text/String	N/A
N/A	<account>	Text/String	N/A
N/A	<object>	Text/String	N/A
N/A	<tag3>	Text/String	N/A

×