V 2.0 Configuration Messages 1
Log Fields and Parsing
This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.
Log Field | LogRhythm Default | LogRhythm Default v2.0 |
|---|---|---|
| Type (type) | N/A | <vmid> |
| Threat/Content Type (subtype) | N/A | <vendorinfo> |
| Host (host) | <sip> | <sip> |
| Command (cmd) | <action> <tag1> | <command> <tag1> |
| Admin (admin) | <login> | <login> |
| Client (client) | N/A | <sessiontype> |
| Result (result) | <tag2> | <result> <tag2> |
| Configuration Path (path) | <object> <account> | <object> |
| Sequence Number (seqno) | <session> | N/A |
| Device Name (device_name) | <dname> | <objectname> |
Log Processing Settings
This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.
LogRhythm Default
| Regex ID | Rule Name | Rule Type | Common Events | Classifications |
|---|---|---|---|---|
| 1001983 | Configuration Logs | Base Rule | Configuration Modified : System | Configuration |
| Configuration Commit : Submitted | Sub Rule | Configuration Enabled : System | Configuration | |
| Configuration Edit : Succeeded | Sub Rule | Configuration Modified : System | Configuration | |
| Configuration Delete : Succeeded | Sub Rule | Configuration Deleted : System | Configuration | |
| Configuration Move : Succeeded | Sub Rule | Configuration Modified : System | Configuration | |
| Configuration Rename : Succeeded | Sub Rule | Configuration Modified : System | Configuration | |
| Configuration Set : Succeeded | Sub Rule | Configuration Enabled : System | Configuration |
LogRhythm Default v2.0
Regex ID | Rule Name | Rule Type | Common Events | Classifications |
|---|---|---|---|---|
| 1010894 | V 2.0 Configuration Messages | Base Rule | Configuration Modified : System | Configuration |
| V 2.0 Configuration Apply Failure | Sub Rule | Failed Configuration | Warning | |
| V 2.0 Unauthorized Configuration Change Attempt | Sub Rule | Failed Configuration | Other Audit Failure | |
| V 2.0 Configuration Item Deleted | Sub Rule | Configuration Deleted : System | Configuration |