Syslog - Generic Linux OS: User Account Created

Vendor Documentation

N/A

Rule Name	Rule Type	Common Event	Classification
User Account Created	Base Rule	User Account Created	Account Created
Group Created	Sub Rule	Group Created	Account Created
User Added To Group	Sub Rule	Account Added To Group	Access Granted
User Added To Shadow Group	Sub Rule	Account Added To Group	Access Granted

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
N/A	<severity>	Text/String	N/A
N/A	<tag1>	Text/String	N/A
N/A	<dip>	IP Address	N/A
N/A	<dname>	Text/String	N/A
N/A	<process>	Text/String	N/A
N/A	<processid>	Number	N/A
N/A	<subject>	Text/String	N/A
N/A	<tag2>	Text/String	N/A
N/A	<account>	Text/String	N/A
N/A	<group>	Text/String	N/A