Skip to main content
Skip table of contents

V 2.0 : Catch-All

Classification

Rule Name

Rule Type

Common Event

Classification

V 2.0 : Catch-AllBase RuleGeneral Information Log MessageInformation
V 2.0 : EVID 1: NCR_LKFSub RuleGeneral System EventInformation
V 2.0 : EVID 1: TbimdsaSub RuleGeneral System EventInformation
V 2.0 : EVID 4: B57nd60aSub RuleGeneral System EventInformation
V 2.0 : EVID 5: Hyper-V-VmSwitchSub RuleGeneral System EventInformation
V 2.0 : EVID 6: EPSON_PCS_Parallel_Port_DriverSub RuleGeneral System EventInformation
V 2.0 : EVID 7: Hyper-V-VmSwitchSub RuleGeneral System EventInformation
V 2.0 : EVID 9: Hyper-V-VmSwitchSub RuleGeneral System EventInformation
V 2.0 : EVID 15: B57nd60aSub RuleGeneral System EventInformation
V 2.0 : EVID 27: E1cexpressSub RuleGeneral System EventInformation
V 2.0 : EVID 33: E1cexpressSub RuleGeneral System EventInformation
V 2.0 : EVID 33: E1kexpressSub RuleGeneral System EventInformation
V 2.0 : EVID 34: E1cexpressSub RuleGeneral System EventInformation
V 2.0 : EVID 46: MpioSub RuleGeneral System EventInformation
V 2.0 : EVID 104: Application Mgmt. Group PolicySub RuleGeneral Application Management InformationInformation
V 2.0 : EVID 4342 : WinsSub RuleGeneral System EventInformation
V 2.0 : EVID 5060 : NETwNs32Sub RuleGeneral System EventInformation
V 2.0 : EVID 7003 : Netwtw06Sub RuleGeneral System EventInformation
V 2.0 : EVID 8000 : NETwNs32Sub RuleGeneral System EventInformation
V 2.0 : EVID 8225 : CMGShieldRegSub RuleGeneral System EventInformation

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Provider<tag2>Text/StringIdentifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.
EventID 

<vmid>

<tag1>

NumberThe identifier that the provider used to identify the event.
VersionN/AN/AN/A
LevelN/AN/AThe severity level is defined in the event.
TaskN/AN/AThe task is defined in the event. The task and opcode are typically used to identify the location in the application from where the event was logged.
OpcodeN/AN/AThe opcode is defined in the event. The task and opcode are typically used to identify the location in the application from where the event was logged.
KeywordsN/AN/AA bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).
TimeCreatedN/AN/AThe time stamp that identifies when the event was logged. The timestamp will include either the SystemTime attribute or the RawTime attribute.
EventRecordIDN/AN/AThe record number assigned to the event when it was logged.
CorrelationN/AN/AThe activity identifiers that consumers can use to group related events together.
ExecutionN/AN/AContains information about the process and thread that logged the event.
ChannelN/AN/AThe channel to which the event was logged.
ComputerN/AN/AThe name of the computer on which the event occurred.
SecurityN/AN/AN/A
DataN/AN/AN/A
BinaryN/AN/AN/A
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.