V 2.0 Data/File/Virus/Spyware Threat Messages

Vendor Documentation

https://www.paloaltonetworks.com/documentation

Classification

Rule Name	Rule Type	Common Event	Classification
V 2.0 Data/File/Virus/Spyware Threat Messages	Base Rule	General Threat Message	Activity
V 2.0 Potential Spyware Allowed Messages	Sub Rule	Possible Spyware Activity	Malware
V 2.0 Potential Spyware Allowed	Sub Rule	Possible Spyware Activity	Malware
V 2.0 User Overrode Spyware Block Messages	Sub Rule	Possible Spyware Activity	Malware
V 2.0 User Overrode Spyware Block	Sub Rule	Possible Spyware Activity	Malware
V 2.0 Potentially Threatening File Blocked	Sub Rule	Failed Spyware Activity	Failed Malware
V 2.0 DLP Event Allowed	Sub Rule	Traffic Allowed by DLP	Network Allow
V 2.0 DLP Event Allowed Messages	Sub Rule	Traffic Allowed by DLP	Network Allow
V 2.0 User Overrode DLP Block	Sub Rule	Traffic Allowed by DLP	Network Allow
V 2.0 User Overrode DLP Block Messages	Sub Rule	Traffic Allowed by DLP	Network Allow
V 2.0 DLP Event Denied	Sub Rule	Traffic Denied by DLP	Network Deny
V 2.0 Potentially Threatening File Allowed	Sub Rule	Potentially Threatening File Observed	Activity
V 2.0Potentially Threatening File Allowed Messages	Sub Rule	Potentially Threatening File Observed	Activity
V 2.0 User Overrode File Block	Sub Rule	Potentially Threatening File Observed	Activity
V 2.0 User Overrode File Block Messages	Sub Rule	Potentially Threatening File Observed	Activity
V 2.0 Potentially Threatening File Blocked	Sub Rule	Potentially Threatening File Observed	Activity
V 2.0 Potentially Malicious Content Allowed	Sub Rule	Detected Malware Activity	Malware
V 2.0 Potentially Malicious Content Alert	Sub Rule	Detected Malware Activity	Malware
V 2.0 Potentially Threatening Malware Blocked	Sub Rule	Failed Malware Activity	Failed Malware

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type
N/A	<vmid>	Text/String
N/A	<tag1>	Text/String
N/A	<sip>	Number
N/A	<dip>	Number
N/A	<snatip>	Number
N/A	<dnatip>	Number
N/A	<policy>	Text/String
N/A	<domainorigin>	Text/String
N/A	<login>	Text/String
N/A	<domainimpacted>	Text/String
N/A	<account>	Text/String
N/A	<sinterface>	Text/String
N/A	<dinterface>	Text/String
N/A	<session>	Number
N/A	<quantity>	Number
N/A	<sport>	Number
N/A	<dport>	Number
N/A	<snatport>	Number
N/A	<dnatport>	Number
N/A	<protname>	Text/String
N/A	<action>	Number
N/A	<tag2>	Text/String
N/A	<object>	Text/String
N/A	<threatname>	Text/String
N/A	<threatid>	Number
N/A	<subject>	Text/String
N/A	<severity>	Text/String
N/A	<sender>	Text/String
N/A	<recipient>	Text/String