V 2.0 : EVID 6 : Cmdlet Failed
Vendor Documentation
Classification
Rule Name | Rule Type | Classification | Common Event |
---|---|---|---|
V 2.0 : EVID 6 : Cmdlet Failed | Base Rule | Operation Failed | Error |
V 2.0 : Cmdlet Set Failed | Sub Rule | Process Failed | Error |
V 2.0 : Cmdlet Get Failed | Sub Rule | Process Failed | Error |
V 2.0 : Cmdlet Add Failed | Sub Rule | Process Failed | Error |
V 2.0 : Cmdlet Remove Failed | Sub Rule | Process Failed | Error |
V 2.0 : Cmdlet Disable Failed | Sub Rule | Action Failed | Information |
V 2.0 : Cmdlet Enable Failed | Sub Rule | Action Failed | Information |
V 2.0 : Cmdlet Move Failed | Sub Rule | Action Failed | Information |
V 2.0 : Cmdlet Update Failed | Sub Rule | Update Failed | Error |
V 2.0 : Cmdlet New Failed | Sub Rule | Process Failed | Error |
V 2.0 : Cmdlet Search Failed | Sub Rule | Failed Operation | Warning |
V 2.0 : Cmdlet Connect Failed | Sub Rule | Failed Operation | Warning |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
---|---|---|---|
Provider | N/A | N/A | Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event. |
EventID | <vmid> | Number | The identifier that the provider used to identify the event. |
Version | N/A | N/A | The version number of the event's definition. |
Level | <severity> | Text/String | The severity level defined in the event. |
Task | N/A | N/A | The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. |
Keywords | N/A | N/A | A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data). |
TimeCreated | N/A | N/A | The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute. |
EventRecordID | <session> | Number | The record number assigned to the event when it was logged. |
Channel | <vendorinfo> | Text/String | The channel to which the event was logged. |
Computer | <dname> | Text/String | The name of the computer on which the event occurred. |
EventData | <action> <command> <tag1> <login> | Text/String | N/A |