Skip to main content
Skip table of contents

V 2.0 : EVID 1-2 : Cmdlet Succeeded

Vendor Documentation

Classification

Rule NameRule TypeCommon EventClassification
V 2.0 : EVID 1-2 : Cmdlet SucceededBase RuleOperation SucceededInformation
V 2.0 : Cmdlet Set SucceededSub RuleObject SetInformation
V 2.0 : Cmdlet Get SucceededSub RuleProcess CompletedInformation
V 2.0 : Cmdlet Add SucceededSub RuleObject AddedAccess Success
V 2.0 : Cmdlet Remove SucceededSub RuleObject Deleted/RemovedAccess Success
V 2.0 : Cmdlet Disable SucceededSub RuleObject Enabled Or DisabledInformation
V 2.0 : Cmdlet Enable SucceededSub RuleObject Enabled Or DisabledInformation
V 2.0 : Cmdlet Send SucceededSub RuleSend InformationInformation
V 2.0 : Cmdlet Move SucceededSub RuleObject MovedAccess Success
V 2.0 : Cmdlet Update SucceededSub RuleObject ModifiedAccess Success
V 2.0 : Cmdlet New SucceededSub RuleProcess CompletedInformation
V 2.0 : Cmdlet Compare SucceededSub RuleProcess CompletedInformation
V 2.0 : Cmdlet Search SucceededSub RuleSearchInformation
V 2.0 : Cmdlet Connect SucceededSub RuleConnectedInformation
V 2.0 : Cmdlet Mount SucceededSub RuleProcess CompletedInformation

Mapping with LogRhythm Schema

Device Key in Log MessageLogRhythm SchemaData TypeSchema Description
ProviderN/AN/AIdentifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.
EventID<vmid>NumberThe identifier that the provider used to identify the event.
VersionN/AN/AThe version number of the event's definition.
Level<severity>Text/StringThe severity level defined in the event.
TaskN/AN/AThe task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
KeywordsN/AN/AA bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).
TimeCreatedN/AN/AThe time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.
EventRecordID<session>NumberThe record number assigned to the event when it was logged.
Channel<vendorinfo>Text/StringThe channel to which the event was logged.
Computer<dname>Text/StringThe name of the computer on which the event occurred.
EventData

<action>
<command>
<tag1>
<domainorigin>
<login>
<result>

Text/StringN/A
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.