Traffic : Local

Vendor Documentation

Classification

Rule Name

Rule Type

Classification

Common Event

Traffic : Local

Base Rule

Network Traffic

General Traffic Log

Traffic Local Closed

Sub Rule

Information

General Traffic Other Notice

Local Traffic Timeout

Sub Rule

Information

Session Disconnected

Traffic Local Accepted

Sub Rule

Network Allow

Traffic Allowed by Network Firewall

Local Traffic Accepted

Sub Rule

Network Allow

Traffic Allowed by Network Firewall

Traffic Local Deny

Sub Rule

Network Deny

Traffic Denied by Network Firewall

Forward Traffic Deny

Sub Rule

Network Deny

Traffic Denied by Network Firewall

Mapping with LogRhythm Schema  

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

devname

<subject>

Text/String

severity

logid

<vmid>

<tag1>

Number

N/A

severity


Number/Text

N/A

srcip

<sip>

IP Address

IP Address

srcport

<sport>

Number

N/A

srcintf

<sinterface>

Text/String/Number

N/A

dstip

<dip>

IP Address

IP Address

dstport

<dport>

Number

N/A

dstintf

<dinterface>

Text/String/Number

N/A

sessionid

<session>

Number/Text/String

N/A

proto

<protnum>

Number

N/A

action

<action>

<tag2>

Text/String

N/A

policyid

<policy>

Number

N/A

sentbyte

<bytesout>

Number

N/A

rcvdbyte

<bytesin>

Number

N/A

sentpkt

<packetsout>

Number

N/A

rcvdpkt

<packetsin>

Number

N/A

appcat

<objectname>

Text/String

N/A