Vendor Documentation
Classification
|
Rule Name |
Rule Type |
Classification |
Common Event |
|---|---|---|---|
|
V 2.0 : EVID 6 : Cmdlet Failed |
Base Rule |
Operation Failed |
Error |
|
V 2.0 : Cmdlet Set Failed |
Sub Rule |
Process Failed |
Error |
|
V 2.0 : Cmdlet Get Failed |
Sub Rule |
Process Failed |
Error |
|
V 2.0 : Cmdlet Add Failed |
Sub Rule |
Process Failed |
Error |
|
V 2.0 : Cmdlet Remove Failed |
Sub Rule |
Process Failed |
Error |
|
V 2.0 : Cmdlet Disable Failed |
Sub Rule |
Action Failed |
Information |
|
V 2.0 : Cmdlet Enable Failed |
Sub Rule |
Action Failed |
Information |
|
V 2.0 : Cmdlet Move Failed |
Sub Rule |
Action Failed |
Information |
|
V 2.0 : Cmdlet Update Failed |
Sub Rule |
Update Failed |
Error |
|
V 2.0 : Cmdlet New Failed |
Sub Rule |
Process Failed |
Error |
|
V 2.0 : Cmdlet Search Failed |
Sub Rule |
Failed Operation |
Warning |
|
V 2.0 : Cmdlet Connect Failed |
Sub Rule |
Failed Operation |
Warning |
Mapping with LogRhythm Schema
|
Device Key in Log Message |
LogRhythm Schema |
Data Type |
Schema Description |
|---|---|---|---|
|
Provider |
N/A |
N/A |
Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event. |
|
EventID |
<vmid> |
Number |
The identifier that the provider used to identify the event. |
|
Version |
N/A |
N/A |
The version number of the event's definition. |
|
Level |
<severity> |
Text/String |
The severity level defined in the event. |
|
Task |
N/A |
N/A |
The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. |
|
Keywords |
N/A |
N/A |
A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data). |
|
TimeCreated |
N/A |
N/A |
The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute. |
|
EventRecordID |
<session> |
Number |
The record number assigned to the event when it was logged. |
|
Channel |
<vendorinfo> |
Text/String |
The channel to which the event was logged. |
|
Computer |
<dname> |
Text/String |
The name of the computer on which the event occurred. |
|
EventData |
<action>
|
Text/String |
N/A |