Skip to main content
Skip table of contents

V 2.0 : Authentication Success Events

Vendor Documentation

Classification

Rule NameRule TypeCommon EventClassification
V 2.0 : Authentication Success EventsBase RuleGeneral Authentication EventOther Audit
V 2.0 : User Logon SuccessSub RuleUser LogonAuthentication Success
V 2.0 : User Account LogOffSub RuleUser LogoffAuthentication Success

Mapping with LogRhythm Schema

Device Key in Log MessageLogRhythm SchemaData TypeSchema Description
N/AN/AN/AVendor or manufacturer name.
N/AN/AN/AProduct name.
N/AN/AN/AProduct version.
N/AN/AN/AEventID.
auditrowidN/AN/AThe row ID from the database table.
creationtimeN/AN/AThe UTC timestamp of the sign-on attempt.
details<login>
<session>
<sessiontype>
<sip>
String
Number
String
IP Address
Contains a description of the sign-on attempt. A successful sign-on shows the user, session ID, and IP address. A failed sign-on contains a reason for the failed attempt.
lastmodifiedbyN/AN/ANot used for this audit source.
moduserN/AN/ADetails of the user who initiated the sign-on attempt.
modpersonaN/AN/ANot used for this audit source.
modificationtimeN/AN/AThe UTC timestamp of the sign-on attempt.
modifieruseridN/AN/AThe unique ID of the user who initiated the sign-on attempt. If the ID is 0, this is a system-generated event; see the details column for more information.
objectidN/AN/AThe ID of the user who initiated the sign-on attempt. If the ID is 0, the user does not exist; see the details column for more information.
typeN/AN/AThe type of the sign-on event that generated the entry. Values include:
0 - New session created
1 - Unused
2 - User signed out
3 - Failed authentication
audittype<vendorinfo>Text/StringThe type of audit entry.
objecttypenameN/AN/AThe type of audit entry.
typename<tag1>Text/StringThe type of the sign-on event that generated the entry. Values include:
  • CreateObject - New session created
  • DeleteObject - User Logged Out
  • FailedCreateObject - Failed authentication
objectnameN/AN/ANot used for this audit source.
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.