Device Details
|
Vendor |
BlueCedar |
|---|---|
|
Device Type |
Network Security |
|
Supported Model Name/Number |
BlueCedar |
|
Supported Software Version(s) |
4.6 |
|
Collection Method |
Syslog |
|
Configurable Log Output? |
No |
|
Log Source Type |
Syslog – BlueCedar |
|
Log Processing Policy |
LogRhythm Default |
|
Exceptions |
N/A |
|
Additional Information |
Currently Supported Log Types
|
Type |
Product Version |
Supported Schema Fields |
|---|---|---|
|
General Information |
3.2 |
<severity>, <vmid>, <sport> |
|
No Route SubCls:018 |
3.2 |
<severity>, <vmid>, <subject>, <dip> |
|
Process Message |
3.2 |
<severity>, <vmid>, <process>, <action> |
|
Cookie Information |
3.2 |
<severity>, <vmid>, <sip>, <sport>, <hash>, <object>, <size> |
|
No Route SubCls:022 |
3.2 |
<severity>, <vmid>, <subject>, <dip> |
|
Bytes Received |
3.2 |
<severity>, <vmid>, <bytesin>, <sport>, <dip> |
|
Interface Status |
3.2 |
<severity>, <status>, <interface> |
|
Failed Authentication |
3.2 |
<severity>, <vmid>, <processed>, <action>, <reason> |
|
ESP Deleted |
3.2 |
<severity>, <vmid>, <action>, <object>, <sip>, <dip> |
|
Delete Status |
3.2 |
<severity>, <vmid>, <status> |
|
Connection Information |
3.2 |
<severity>, <vmid>, <rate>, <seconds> |
|
Connection Status |
3.2 |
<severity>, <vmid>, <protocol>, <status>, <quantity> |
|
XAUTH Config Status |
3.2 |
<severity>, <vmid>, <process>, <status> |
|
XAUTH Perp Configuration Information |
3.2 |
<severity>, <vmid>, <bytes>, <sip>, <dip> |
|
Revocation Status |
3.2 |
<severity>, <vmid>, <result> |
|
R-U-THERE Message |
3.2 |
<severity>, <vmid>, <subject> |
|
Connection Information |
3.2 |
<severity>, <vmid>, <sip> |
|
Protocol Connection Information |
3.2 |
<severity>, <vmid>, <protocol> |
|
Bytes Sent |
3.2 |
<severity>, <vmid>, <bytes>, <sip> |
|
Username Update |
3.2 |
<severity>, <vmid>, <subject>, <login> |
|
Session Stop |
3.2 |
<severity>, <vmid>, <login>, <sname>, <version>, <sip>, <process>, <packetsin>, <packetsout>, <bytesout> |
|
Object Deleted |
3.2 |
<severity>, <vmid>, <action>, <sip>, <dip> |
|
Tunnel Interface Information |
3.2 |
<severity>, <vmid>, <action>, <object>, <sinterface>, <action>, |
|
Reconnect Token Status |
3.2 |
<severity>, <vmid>, <action>, <login> |
|
OnSignal Received Error |
3.2 |
<severity>, <vmid>, <responsecode>, <object> |
|
LDAP Attribute Retrieval Failure |
3.2 |
<severity>, <vmid>, <subject>, <amount>, <login> |
|
Remove From Dispatch |
3.2 |
<severity>, <vmid>, <object> |
|
PAM Authentication Message |
3.2 |
<severity>, <vmid>, <login>, <subject> |
|
Invalid Tunnel Credentials |
3.2 |
<severity>, <vmid>, <login>, <action> |
|
IKE Message Received |
3.2 |
<severity>, <vmid>, <subject>, <object> |
|
Failed To Find Auth Group State |
3.2 |
<severity>, <vmid>, <subject>, <object> |
|
Object Changed Ports |
3.2 |
<severity>, <vmid>, <subject>, <responsecode> |
|
IKE_SA Information |
3.2 |
<severity>, <vmid>, <protocol>, <result> |
|
UDP Send Status |
3.2 |
<severity>, <vmid>, <subject>, <status> |
|
IKE Status |
3.2 |
<severity>, <vmid>, <responsecode>, <sip>, <sport>, <subject> |
|
Critical Interface Information |
3.2 |
<severity>, <vmid>, <sinterface>, <sip>, smac |
|
SEQ Number |
3.2 |
<severity>, <vmid>, <responsecode> |
|
Socket Removal Failure |
3.2 |
<severity>, <vmid>, <action>, <object> |
|
IKE Dead Peer Information |
3.2 |
<severity>, <vmid>, <action>, <parentprocessname>, <responsecode> |
|
Unexpected Accounting Stop |
3.2 |
<severity>, <vmid>, <subject> |
|
Auth Information |
3.2 |
<severity>, <vmid>, <subject> |
|
Session Status |
3.2 |
<severity>, <vmid>, <subject> |
|
Trigger Message |
3.2 |
<severity>, <vmid>, <subject>, <object> |
|
OnPortsChanged Message |
3.2 |
<severity>, <vmid>, <subject>, <status> |
|
Session Start |
3.2 |
<severity>, <vmid>, <action>, <login>, <sname>, <version>, <process> |
|
IkeStartHdlrSaCleanup Message |
3.2 |
<severity>, <vmid>, <subject>, <object> |
|
Link Status |
3.2 |
<severity>, <vmid>, <object>, <action> |
|
Failed To Get Assigned IP |
3.2 |
<severity>, <vmid>, <action>, <parentprocessname>, <responsecode> |
|
Catch All |
3.2 |
<severity>, <vmid>, |
Parsed Metadata Fields
|
BlueCedar Field Name |
LogRhythm Metadata Field |
Value/Data Type |
|---|---|---|
|
Severity |
<severity> |
Text/String |
|
subcls |
<vmid> |
Numeric |
|
N/A |
<subject> |
Text/String |
|
N/A |
<object> |
Text/String |
|
N/A |
<action> |
Text/String |
|
N/A |
<sip> |
IP Address |
|
N/A |
<dip> |
IP Address |
|
N/A |
<sport> |
Numeric |
|
N/A |
<responsecode> |
Numeric |
|
N/A |
<parentprocesspath> |
Text/String |
|
N/A |
<status> |
Text/String |
|
N/A |
<result> |
Text/String |
|
N/A |
<quantity> |
Numeric |