V 2.0 General SAML Message

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Header : Severity	<severity>	N/A
N/A	<objectname>	N/A
Type (type)	N/A	<vmid>
Content/Threat Type (subtype)	N/A	<vendorinfo>
Event ID (eventid)	<tag1>	<result> <tag1>
Object (object)	N/A	<object>
Severity (severity)	<severity>	<severity>
Description (opaque)	<tag2>	<subject>
	<domain> <login>	<login>
	<sessiontype>	N/A
	<group>	N/A
	<dip>	N/A
	N/A	<reason>
	<sip> <sname>	<sip>
Device Name (device_name)	N/A	<objectname>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Events	Classifications
1001607	Authentication Activity	Base Rule	Authentication Activity	Authentication Success
	Web Logon	Sub Rule	User Logon	Authentication Success
	Remote Authentication	Sub Rule	User Logon	Authentication Success
	User Failed Authentication	Sub Rule	User Logon Failure	Authentication Failure

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Events	Classifications
1010877	V 2.0 General SAML Message	Base Rule	General Authentication Event	Other Audit
	V 2.0 User Logon Failure	Sub Rule	User Logon Failure	Authentication Failure
	V 2.0 User Logon Success	Sub Rule	User Logon	Authentication Success