Skip to main content
Skip table of contents

V 2.0 : Data Loss Prevention Event

Vendor Documentation

Classification

Rule Name

Rule Type

Classification

Common Event

V 2.0 : Data Loss Prevention EventBase RuleInformationGeneral DLP Message
V 2.0 : DLP : Not AvailableSub RuleInformationGeneral DLP Message
V 2.0 : DLP : BlockedSub RuleNetwork DenyTraffic Denied by DLP
V 2.0 : DLP : DeletedSub RuleNetwork DenyTraffic Denied by DLP
V 2.0 : DLP : DeliveredSub RuleNetwork AllowTraffic Allowed by DLP
V 2.0 : DLP : LoggedSub RuleInformationGeneral DLP Message
V 2.0 : DLP : PassedSub RuleNetwork AllowTraffic Allowed by DLP
V 2.0 : DLP : QuarantinedSub RuleInformationGeneral DLP Message
V 2.0 : DLP : ReplacedSub RuleInformationGeneral DLP Message
V 2.0 : DLP : ArchivedSub RuleInformationGeneral DLP Message
V 2.0 : DLP : Archived (Message Body Only)Sub RuleInformationGeneral DLP Message
V 2.0 : DLP : Quarantined (Message Body Only)Sub RuleInformationGeneral DLP Message
V 2.0 : DLP : Passed (Message Body Only)Sub RuleNetwork AllowTraffic Allowed by DLP
V 2.0 : DLP : EncryptedSub RuleNetwork TrafficEncrypt Packet
V 2.0 : DLP : Alerted (Endpoint)Sub RuleInformationGeneral DLP Message
V 2.0 : DLP : Alerted (Server)Sub RuleInformationGeneral DLP Message
V 2.0 : DLP : Data RecordedSub RuleInformationGeneral DLP Message
V 2.0 : DLP : User JustifiedSub RuleNetwork AllowTraffic Allowed by DLP
V 2.0 : DLP : Handed OffSub RuleInformationGeneral DLP Message
V 2.0 : DLP : Recipient AlteredSub RuleInformationGeneral DLP Message
V 2.0 : DLP : Blind Carbon CopiedSub RuleInformationGeneral DLP Message
V 2.0 : DLP : Delivery PostponedSub RuleInformationGeneral DLP Message
V 2.0 : DLP : StampedSub RuleInformationGeneral DLP Message
V 2.0 : DLP : Attachment DeletedSub RuleInformationGeneral DLP Message
V 2.0 : DLP : Subject TaggedSub RuleInformationGeneral DLP Message
V 2.0 : DLP : X-header TaggedSub RuleInformationGeneral DLP Message
V 2.0 : DLP : DecryptedSub RuleInformationGeneral DLP Message
V 2.0 : DLP : Re-encryptedSub RuleInformationGeneral DLP Message
V 2.0 : DLP : Tagged (Mail)Sub RuleInformationGeneral DLP Message
V 2.0 : DLP : Encrypted (User Key)Sub RuleNetwork TrafficEncrypt Packet
V 2.0 : DLP : Encrypted (Group Key)Sub RuleNetwork TrafficEncrypt Packet
V 2.0 : DLP : MovedSub RuleInformationGeneral DLP Message
V 2.0 : DLP : Passed (Encrypted)Sub RuleNetwork AllowTraffic Allowed by DLP
V 2.0 : DLP : Passed (User Justified)Sub RuleNetwork AllowTraffic Allowed by DLP
V 2.0 : DLP : Block (Endpoint Encryption not installed)Sub RuleNetwork DenyTraffic Denied by DLP
V 2.0 : DLP : Blocked (user justified)Sub RuleNetwork DenyTraffic Denied by DLP
V 2.0 : DLP : Blocked (Endpoint Encryption logged off)Sub RuleNetwork DenyTraffic Denied by DLP
V 2.0 : DLP : Blocked (Endpoint Encryption error)Sub RuleNetwork DenyTraffic Denied by DLP
V 2.0 : DLP : Web UploadSub RuleInformationGeneral DLP Message

Mapping with LogRhythm Schema

Device Key in Log MessageLogRhythm SchemaData TypeSchema Description
Header (logVer)N/AN/ACEF format version
Header (vendor)N/A N/AAppliance vendor
Header (pname)N/AN/AAppliance product
Header (pver)N/AN/AAppliance version
Header (eventid)N/AN/AEvent ID
Header (eventName)<vmid> Text/StringLog name
Header (severity)<severity>NumberSeverity
cs3LabelN/AN/ACorresponding label for the "cs3" field
cs3N/A N/AEndpoint host name
cs1LabelN/A N/ACorresponding label for the "cs1" field
cs1N/A N/APolicy GUID
cs2LabelN/AN/ACorresponding label for the "cs2" field
cs2<policy>Text/StringPolicy name
cn1LabelN/A N/ACorresponding label for the "cn1" field
cn1N/A N/AProduct type value
rtN/A N/ALog generation time in UTC
src<sip>Ip AddressSource host IP address
smac<smac>Text/String/NumberSource host MAC address
shost<sname>Text/String/NumberSource host name
cs4LabelN/AN/ACorresponding label for the "cs4" field
cs4<login>Text/String/NumberThe user name in violation
request<url>Text/String/NumberThe URL accessed
suser<sender>Text/String/NumberEmail sender
duser<recipient>Text/String/NumberComma (,) separated list of recipients
msgN/AN/ASubject
filepathN/AN/AFile path
fname<object>Text/String/NumberTrigger file name
cs5LabelN/AN/ACorresponding label for the "cs5" field
cs5N/AN/ARule name
cs6LabelN/AN/ACorresponding label for the "cs6" field
cs6N/AN/ATemplate name
cn3LabelN/AN/ACorresponding label for the "cn3" field
cn3N/AN/AChannel type
cn2LabelN/AN/ACorresponding label for the "cn2" field
cn2<action>
<tag1>
NumberAction result
fsize<size>NumberFile size in bytes
deviceFacilityN/AN/AProduct name
deviceNtDomainN/AN/AActive Directory domain
dntdomN/AN/AApex One domain hierarchy
externalIdN/AN/ALog ID of the event
cfp1LabelN/AN/ACorresponding label for the "cfp1Label" field
cfp1N/AN/AIndicates whether the forensic file can be downloaded
dvchostN/AN/AServer host name
TMCMLogDetectedHostN/AN/AEndpoint name where the log event occurred
TMCMLogDetectedIPN/AN/AIP address where the log event occurred
ApexCentralHostN/AN/AApex Central host name
devicePayloadIdN/AN/AUnique message GUID
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.