V 2.0 : EVID 1: General Log Message
Vendor Documentation
Classification
Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|
V 2.0 : EVID 1: General Log Message | Base Rule | General Information Log Message | Information |
V 2.0 : EVID 1: Cbafilt:Cba FS Filter Driver Event | Sub Rule | General Information Log Message | Information |
V 2.0 : EVID 1: ExtMirr:Driver Started Successfully | Sub Rule | Process/Service Started | Startup and Shutdown |
V 2.0 : EVID 1: IScsiPrt : Connection Error | Sub Rule | Connection Error | Error |
V 2.0 : EVID 1: MEI: Interface Reset Event | Sub Rule | General Warning Log Message | Warning |
V 2.0 : EVID 1: MEIx64: Interface Reset Event | Sub Rule | General Warning Log Message | Warning |
V 2.0 : EVID 1: Filter Manager FS Filter Unloaded | Sub Rule | General Information Log Message | Information |
V 2.0 : EVID 1: Hyper-V-Hypervisor: Hypervisor Suc | Sub Rule | Service Started | Information |
V 2.0 : EVID 1: Hyper-V-Netvsc: Protocol Ver Succ | Sub Rule | Successful Activity | Other Audit Success |
V 2.0 : EVID 1: Kernel-General:System Time Changed | Sub Rule | System Time Updated | Information |
V 2.0 : EVID 1: Kernel-Tm:Transaction Unable To Com | Sub Rule | Commit Transaction Failure | Error |
V 2.0 : EVID 1: Mpio: Object Created | Sub Rule | Object Created | Access Success |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
---|---|---|---|
Provider | <tag2> | Text/String | Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event. |
EventID/EventID Qualifiers | <vmid> | Number | The identifier that the provider used to identify the event. |
Version | N/A | N/A | N/A |
Level | <severity> | Text/String | The severity level defined in the event. |
Task | <vendorinfo> | Text/String | The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. |
Opcode | N/A | N/A | The opcode defined in the event. Task and opcode are typcially used to identify the location in the application from where the event was logged. |
Keywords | <result> | Text/String | A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data). |
TimeCreated | N/A | N/A | The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute. |
EventRecordID | N/A | N/A | The record number assigned to the event when it was logged. |
Correlation | N/A | N/A | The activity identifiers that consumers can use to group related events together. |
Execution | N/A | N/A | Contains information about the process and thread that logged the event. |
Channel | N/A | N/A | The channel to which the event was logged. |
Computer | <dname> | Text/String | The name of the computer on which the event occurred. |
Security | N/A | N/A | N/A |
ErrorCode | <responsecode> | Number | N/A |
DataItemName | N/A | N/A | N/A |
EventPayload | N/A | N/A | N/A |
NewTime | N/A | N/A | N/A |
OldTime | N/A | N/A | N/A |
VersionLen | <size> | Number | N/A |
Version | <version> | Number/Text/String | N/A |
Status | <status> | Number | N/A |
FinalStatus | <status> | Text/String | N/A |
DeviceVersionMajor | <version> | Number | N/A |
DeviceVersionMinor | N/A | N/A | N/A |
DeviceNameLength | N/A | N/A | N/A |
DeviceName | <object> | Text/String | N/A |
DeviceTime | N/A | N/A | N/A |
Data | N/A | N/A | N/A |
Data | <object> | Text/String | N/A |
Binary | N/A | N/A | N/A |
RenderingInfo | N/A | N/A | N/A |
Message | <subject> | Text/String | N/A |