V 2.0 General DHCP Messages 1
Log Fields and Parsing
This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.
Log Field | LogRhythm Default | LogRhythm Default v2.0 |
---|---|---|
Type (type) | N/A | <vmid> |
Content/Threat Type (subtype) | N/A | <vendorinfo> |
Event ID (eventid) | N/A | <action> <tag1> |
Severity (severity) | <severity> | <severity> |
Description (opaque) | <subject> | <subject> |
<tag1> | N/A | |
<version> | N/A | |
<dname> | N/A | |
<tag2> | N/A | |
<dip> | N/A | |
N/A | <sip> | |
N/A | <smac> | |
N/A | <sname> | |
N/A | <dinterface> | |
N/A | <dip> | |
Device Name (device_name) | N/A | <objectname> |
Log Processing Settings
This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.
LogRhythm Default
Regex ID | Rule Name | Rule Type | Common Events | Classifications |
---|---|---|---|---|
1004489 | Catch All : System Messages | Base Rule | General System Information | Information |
All DNS Proxy Cache Entries Were Cleared | Sub Rule | Cache Information | Information | |
Antivirus Update Job Succeeded | Sub Rule | Process/Service Stopped | Startup and Shutdown | |
Auto Update Agent Found No New WildFire Updates | Sub Rule | General Automatic Updates Information | Information | |
EBL Refresh Aborted : No Changes To List | Sub Rule | No Change Detected In Signature File | Information | |
NTP Restart Synchronization Performed | Sub Rule | System Clock Synchronized | Information | |
User Information Refreshed | Sub Rule | Updated User Data | Information | |
WildFire Update Job Succeeded | Sub Rule | Process/Service Stopped | Startup and Shutdown | |
Communication Error : Fail WildFire Upgrade Check | Sub Rule | Communication Failure | Error | |
Antivirus Version Does Not Match | Sub Rule | General Antivirus Warning | Warning | |
Wildfire Auto Update Failed | Sub Rule | Software Update Failed | Error | |
Antivirus : Upload Deployment Job Failed | Sub Rule | File Upload Failed | Error | |
Antivirus : Upload Deployment Job Succeeded | Sub Rule | File Uploaded | Information | |
Content : Upload Deployment Job Failed | Sub Rule | File Upload Failed | Error | |
Content : Upload Deployment Job Succeeded | Sub Rule | File Uploaded | Information | |
License : Upload Deployment Job Failed | Sub Rule | File Upload Failed | Error | |
Antivirus Install Failed | Sub Rule | General Software Installation Error | Error | |
Antivirus Install Succeeded | Sub Rule | Software Installed | Configuration | |
License Install Failed | Sub Rule | License Warning | Warning | |
License Install Succeeded | Sub Rule | License Installed | Information | |
Succeeded Exporting Config Bundle Via SSH | Sub Rule | Configuration Exporting | Other Audit Success | |
Traffic And Logging Resumed | Sub Rule | General Traffic Other Alert | Critical | |
Abnormal System Memory Usage | Sub Rule | Memory Usage Exceeded The Threshold | Warning | |
Traffic And Logging Are Resumed | Sub Rule | General Traffic Other Alert | Critical | |
Route Removed | Sub Rule | Static Route Removed | Information | |
Route Recovered | Sub Rule | Route Created | Information |
LogRhythm Default v2.0
Regex ID | Rule Name | Rule Type | Common Events | Classifications |
---|---|---|---|---|
1010903 | V 2.0 General DHCP Messages | Base Rule | General DHCP | Information |
V 2.0 DHCP Lease Renewed | Sub Rule | DHCP Lease Renewed | Information | |
V 2.0 DHCP Lease Issued | Sub Rule | DHCP Lease Obtained | Information |