User Exit

Classification

Rule Name	Rule Type	Common Event	Classification
User Exit	Base Rule	User Logoff	Authentication Success
Exit After Authentication : Disconnect Received	Sub Rule	User Logoff	Authentication Success
Exit Before Authentication : Disconnect Received	Sub Rule	User Logoff	Authentication Success
Exit Before Authentication : Exited Normally	Sub Rule	User Logoff	Authentication Success

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type
N/A	<severity>	Text/String
N/A	<process>	Text/String
N/A	<processid>	Number
N/A	<tag1>	Text/String
N/A	<domainorigin>	Text/String
N/A	<login>	Text/String
N/A	<tag2>	Text/String

×