Traffic : Multicast 1

Vendor Documentation

Rule Name	Rule Type	Common Event	Classification
Traffic : Multicast	Base Rule	General IP Multicast Information	Information
Traffic: Multicast Start	Sub Rule	Session Started	Other Audit Success
Traffic: Multicast Deny	Sub Rule	Auditing Session Failed	Other Audit Failure

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
logid	<vmid> <tag1>	Number	The ID (logid) is a 10-digit field. It is a unique identifier for that specific log.
	<severity>	Text\String	Each log entry contains a Level (level) field that indicates the estimated severity of the event that caused the log entry.
srcip	<sip>	IP Address	IP address of the traffic’s origin.
dstip	<dip>	IP Address	Destination IP address for the web.
srcport	<sport>	Number	Port number of the traffic's origin.
dstport	<dport>	Number	Port number of the traffic's destination.
srcintf	<sinterface>	Text\String	Interface name of the traffic's origin.
dstintf	<dinterface>	Text\String	Interface of the traffic's destination.
proto	<protnum>	Number	The protocol used by web traffic (tcp by default).
sessionid	<session>	Number	N/A
policytype	<policy>	Text\String	N/A
action	<action> <tag2>	Text\String	N/A
rcvdbyte	<bytesin>	Number	N/A
sentbyte	<bytesout>	Number	N/A
rcvdpkt	<packetsin>	Number	N/A
sentpkt	<packetsout>	Number	N/A