V 2.0 General Monitoring Events

Rule Name

Rule Type

Common Event 

Classification

V 2.0 General Monitoring Events

Base Rule

Information

Device Key In Log Message

LogRhythm Schema

Data Type

Schema Description

Type (type)

<vmid>

Text/String

Specifies the type of log; value is SYSTEM.

Content/Threat Type (subtype)

<vendorinfo>

Text/String

Subtype of the system log; refers to the system daemon generating the log

Event ID (eventid)

<action>

Text/String

String showing the name of the event.

Object (object)

<object>

Text/String

Name of the object associated with the system event.

Severity (severity)

<severity>

Text/String

Severity associated with the event; values are informational, low, medium, high, critical.

Description (opaque)

<subject>

Text/String

Detailed description of the event, up to a maximum of 512 bytes.

Device Name (device_name)

<objectname>

Text/String

The hostname of the firewall on which the session was logged.