V 2.0 General Authentication Event (auth)

Vendor Documentation

Classification

Rule Name

Rule Type

Common Event

Classification

V 2.0 General Authentication Event

Base Rule

General Authentication Event

Other Audit

V 2.0 User Logon Failure

Sub Rule

User Logon Failure

Authentication Failure

V 2.0 User Logon Success

Sub Rule

User Logon

Authentication Success

Mapping with LogRhythm Schema  

Device Key in Log Message

LogRhythm Schema

Data Type

N/A

<vmid>

Text/String

N/A

<severity>

Text/String

N/A

<vendorinfo>

Text/String

N/A

<sip>

Number

N/A

<dip>

Number

N/A

<login>

Text/String

N/A

<reason>

Text/String

N/A

<tag1>

Text/String