V 2.0 : Catch-All
Classification
Rule Name | Rule Type | Common Event | Classification |
|---|---|---|---|
| V 2.0 : Catch-All | Base Rule | General Information Log Message | Information |
| V 2.0 : EVID 1: NCR_LKF | Sub Rule | General System Event | Information |
| V 2.0 : EVID 1: Tbimdsa | Sub Rule | General System Event | Information |
| V 2.0 : EVID 4: B57nd60a | Sub Rule | General System Event | Information |
| V 2.0 : EVID 5: Hyper-V-VmSwitch | Sub Rule | General System Event | Information |
| V 2.0 : EVID 6: EPSON_PCS_Parallel_Port_Driver | Sub Rule | General System Event | Information |
| V 2.0 : EVID 7: Hyper-V-VmSwitch | Sub Rule | General System Event | Information |
| V 2.0 : EVID 9: Hyper-V-VmSwitch | Sub Rule | General System Event | Information |
| V 2.0 : EVID 15: B57nd60a | Sub Rule | General System Event | Information |
| V 2.0 : EVID 27: E1cexpress | Sub Rule | General System Event | Information |
| V 2.0 : EVID 33: E1cexpress | Sub Rule | General System Event | Information |
| V 2.0 : EVID 33: E1kexpress | Sub Rule | General System Event | Information |
| V 2.0 : EVID 34: E1cexpress | Sub Rule | General System Event | Information |
| V 2.0 : EVID 46: Mpio | Sub Rule | General System Event | Information |
| V 2.0 : EVID 104: Application Mgmt. Group Policy | Sub Rule | General Application Management Information | Information |
| V 2.0 : EVID 4342 : Wins | Sub Rule | General System Event | Information |
| V 2.0 : EVID 5060 : NETwNs32 | Sub Rule | General System Event | Information |
| V 2.0 : EVID 7003 : Netwtw06 | Sub Rule | General System Event | Information |
| V 2.0 : EVID 8000 : NETwNs32 | Sub Rule | General System Event | Information |
| V 2.0 : EVID 8225 : CMGShieldReg | Sub Rule | General System Event | Information |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
|---|---|---|---|
| Provider | <tag2> | Text/String | Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event. |
| EventID | <vmid> <tag1> | Number | The identifier that the provider used to identify the event. |
| Version | N/A | N/A | N/A |
| Level | N/A | N/A | The severity level is defined in the event. |
| Task | N/A | N/A | The task is defined in the event. The task and opcode are typically used to identify the location in the application from where the event was logged. |
| Opcode | N/A | N/A | The opcode is defined in the event. The task and opcode are typically used to identify the location in the application from where the event was logged. |
| Keywords | N/A | N/A | A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data). |
| TimeCreated | N/A | N/A | The time stamp that identifies when the event was logged. The timestamp will include either the SystemTime attribute or the RawTime attribute. |
| EventRecordID | N/A | N/A | The record number assigned to the event when it was logged. |
| Correlation | N/A | N/A | The activity identifiers that consumers can use to group related events together. |
| Execution | N/A | N/A | Contains information about the process and thread that logged the event. |
| Channel | N/A | N/A | The channel to which the event was logged. |
| Computer | N/A | N/A | The name of the computer on which the event occurred. |
| Security | N/A | N/A | N/A |
| Data | N/A | N/A | N/A |
| Binary | N/A | N/A | N/A |