V 2.0 : FireEye MPS Events
Vendor Documentation
Classification
Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|
V 2.0: FireEye MPS Events | Base Rule | FireEye Notification | Operations: Other Operations |
V 2.0: Trellix FMPS Events | Sub Rule | General Firewall Event | Operations: Information |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
---|---|---|---|
N/A | N/A | N/A | Format |
N/A | <tag1> | Text/String | Device Vendor |
N/A | <vendorinfo> | Text/String | Device Product |
N/A | N/A | N/A | Device Version |
N/A | N/A | N/A | Signature ID |
N/A | <process> | Text/String | Name |
N/A | <severity> | Number | Severity |
rt | N/A | N/A | Log generation time in UTC |
src | <sip> | Ip Address | Source IP address |
cn2Label | N/A | N/A | Corresponding label for the "cn2" field |
cn2 | N/A | N/A | Protocol |
shost | <sname> | Text/String | Endpoint hostname |
proto | <protname> | Text/String | The network protocol being exploited |
dvchost | <dname> | Text/String | Host Name |
dst | <dip> | Ip Address | Destination IP address |
spt | <sport> | Number | Source Port |
dvc | N/A | N/A | Device IP address |
smac | <smac> | Text/String/Number | Source Mac address |
cn1Label | N/A | N/A | Corresponding label for the "cn1" field |
cn1 | N/A | N/A | VLAN |
dpt | <dport> | Number | Destination Port |
externalId | N/A | N/A | ID |
cs4Label | N/A | N/A | Corresponding label for the "cs4" field |
cs4 | <url> | Text/String | URL |
dmac | <dmac> | Text/String/Number | Destination MAC address |
cs1Label | N/A | N/A | Corresponding label for the "cs1" field |
cs1 | <subject> | Text/String | Message |