Skip to main content
Skip table of contents

Traffic/UTM Messages - D Series

Vendor Documentation

Classification

Rule NameRule TypeCommon EventClassification
Traffic/UTM Messages - D SeriesBase RuleGeneral Network TrafficNetwork Traffic
Syslog AlertSub RuleGeneral Syslog AlertCritical
Syslog WarningSub RuleGeneral Syslog WarningWarning

Mapping with LogRhythm Schema  

Device Key in Log MessageLogRhythm SchemaData TypeSchema Description
logid<vmid>NumberThe ID (logid) is a 10-digit field. It is a unique identifier for that specific log.
level<severity>Text\StringEach log entry contains a Level (level) field that indicates the estimated severity of the event that caused the log entry.
srcip<sip>IP AddressIP address of the traffic’s origin.
dstip<dip>IP AddressDestination IP address for the web.
srcport<sport>NumberPort number of the traffic's origin.
dstport<dport>NumberPort number of the traffic's destination.
trueclntip<snatip>IP AddressN/A
srcintf<sinterface>Text\StringInterface name of the traffic's origin.
dstintf<dinterface>Text\StringInterface of the traffic's destination.
proto<protnum>NumberThe protocol used by web traffic (tcp by default).
service<protname>Text\StringName of the service.
vd<domainorigin>Text\String
N/A
forwardedfor<object>Text\String
N/A
type<subject>Text\String
N/A
url<url>Text\StringN/A
action<command>Text\StringN/A
crscore

<result>

Number
N/A
crlevel<status>Text\String
N/A
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.