Skip to main content
Skip table of contents

V 2.0 : EVID 3: General Log Message

Vendor Documentation

Classification

Rule NameRule TypeCommon EventClassification
V 2.0 : EVID 3: General Log MessageBase RuleGeneral Information Log MessageInformation
V 2.0 : EVID 3: BTHUSB: Warning MessageSub RuleGeneral BTHUSB WarningWarning
V 2.0 : EVID 3: FilterManager:Vol Unavail For FiltSub RuleGeneral Error Log MessageError
V 2.0 : EVID 3: Hyper-V-Netvsc:Miniport Ini SuccessSub RuleSuccessful ActivityOther Audit Success
V 2.0 : EVID 3: IsolatedUserMode: Secure Kernel StSub RuleGeneral Kernel InformationInformation
V 2.0 : EVID 3: Virtual Disk Service: Info MessageSub RuleGeneral Information Log MessageInformation
V 2.0 : EVID 3: Vmci: Information MessageSub RuleGeneral Information Log MessageInformation

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Provider<tag2>Text/StringIdentifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.
EventID/EventID Qualifiers<vmid>NumberThe identifier that the provider used to identify the event.
VersionN/AN/AN/A
Level<severity>Text/StringThe severity level defined in the event.
Task<vendorinfo>Text/StringThe task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
Opcode

N/A

N/AThe opcode defined in the event. Task and opcode are typcially used to identify the location in the application from where the event was logged.
Keywords<result>Text/StringA bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).
TimeCreatedN/AN/AThe time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.
EventRecordIDN/AN/AThe record number assigned to the event when it was logged.
CorrelationN/AN/AThe activity identifiers that consumers can use to group related events together.
ExecutionN/AN/AContains information about the process and thread that logged the event.
ChannelN/AN/AThe channel to which the event was logged.
Computer<dname>Text/StringThe name of the computer on which the event occurred.
SecurityN/AN/AN/A
DataN/AN/AN/A
Message<subject>Text/StringN/A
Data<subject>Text/StringN/A
BinaryN/AN/AN/A
Status<status>NumberN/A
FlagsN/AN/AN/A
MiniportName<object>Text/StringN/A
MiniportNameLen<size>NumberN/A
FinalStatus<status>Text/StringN/A
ExtraStringLength<size>NumberN/A
ExtraString<object>Text/StringN/A
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.