Usermod Messages
Classification
Rule Name | Rule Type | Classification | Common Event |
|---|---|---|---|
| Usermod Messages | Base Rule | Account Modified | User Account Attribute Modified |
| General User Account Modification | Sub Rule | Account Modified | User Account Attribute Modified |
| User ID Changed | Sub Rule | Account Modified | User Account Attribute Modified |
| Password Change | Sub Rule | Account Modified | Password Modified |
| User ID Changed To Root | Sub Rule | Account Modified | Group Attribute Modified |
| Group ID Changed To Root | Sub Rule | Account Modified | Group Attribute Modified |
| Group ID Changed | Sub Rule | Account Modified | Group Attribute Modified |
Mapping with LogRhytm Schema
| Device Key in Log Message | LogRhythm Schema | Data Type |
| N/A | <login> | Text\String |
| N/A | <tag1> | Text\String |
| N/A | <tag2> | Text\String |
| N/A | <tag3> | Text\String |