V 2.0 : EVID 16: General Log Message
Vendor Documentation
Classification
| Rule Name | Rule Type | Common Event | Classification |
|---|---|---|---|
| V 2.0 : EVID 16: General Log Message | Base Rule | General Information Log Message | Information |
| V 2.0 : EVID 16: ExtMirr: Mirrored State Changed | Sub Rule | Mirror State Changed | Information |
| V 2.0 : EVID 16: Kerberos Ticket Not Generated | Sub Rule | General Kerberos Error | Error |
| V 2.0 : EVID 16: Access History Cleared | Sub Rule | Log Cleared | Access Success |
| V 2.0 : EVID 16: WindowsUpdateClient | Sub Rule | Connection Information | Information |
| V 2.0 : EVID 16: Mpio: MPIO Error | Sub Rule | General Error Log Message | Error |
Mapping with LogRhythm Schema
| Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
|---|---|---|---|
| Provider | <tag2> | Text/String | Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event. |
| EventID Qualifiers | <vmid> | Number | The identifier that the provider used to identify the event. |
| Version | N/A | N/A | N/A |
| Level | <severity> | Text/String | The severity level defined in the event. |
| Task | <vendorinfo> | Text/String | The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. |
| Opcode | N/A | N/A | The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. |
| Keywords | <result> | Text/String | A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data). |
| TimeCreated | N/A | N/A | The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute. |
| EventRecordID | N/A | N/A | The record number assigned to the event when it was logged. |
| Correlation | N/A | N/A | The activity identifiers that consumers can use to group related events together. |
| Execution | N/A | N/A | Contains information about the process and thread that logged the event. |
| Channel | N/A | N/A | The channel to which the event was logged. |
| Computer | <dname> | Text/String | The name of the computer on which the event occurred. |
| Security | N/A | N/A | N/A |
| Data | <object> | Text/String | N/A |
| Data | N/A | N/A | N/A |
| Data | N/A | N/A | N/A |
| Data | N/A | N/A | N/A |
| Data | N/A | N/A | N/A |
| Data | <dip> | IP Address | N/A |
| Binary | N/A | N/A | N/A |
| Target | <dname> <domainimpacted> | Text/String | N/A |
| Account | N/A | N/A | N/A |
| ID | N/A | N/A | N/A |
| RequestedEtypes | N/A | N/A | N/A |
| AvailableEtypes | N/A | N/A | N/A |
| AccountToReset | <account> | Text/String | N/A |
| HiveNameLength | <size> | Number | N/A |
| HiveName | <object> | Text/String | N/A |
| KeysUpdated | N/A | N/A | N/A |
| DirtyPages | <quantity> | Number | N/A |