User Management Events

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/HTML/5200-8214/Content/fir-int.htm

https://www.arubanetworks.com/techdocs/AOS-CX/10.07/PDF/5200-8214.pdf

User Management Events

Base Rule

User Information

Information

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Event ID

<vmid>

Number

Event ID 4701, 4702, 4703, 4704, 4705, 4706

Severity

<severity>

Text/String

For All: Information
For 4704: Error

Message

<subject>
<login>
<account>
<policy>

Text/String

Event ID 4701:
Logs a message when a new user is added to the switch

<subject>
<login>
<account>
<policy>

Text/String

Event ID 4702:
Logs a message when a user is deleted from the switch

<subject>
<account>

Text/String

Event ID 4703:
Logs a message when a user changes his/her password

<subject>
<account>

Text/String

Event ID 4704:
Logs a message when a user fails to change his/her password

<subject>
<account>

Text/String

Event ID 4705:
Logs a message when a user sets export password

<subject>
<account>

Text/String

Event ID 4706:
Logs a message when a user restores default export password