V 2.0 : Identity Logging Events

Vendor Documentation

Rule Name	Rule Type	Common Event	Classification
V 2.0 : Identity Logging Events	Base Rule	General Information	Information

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
virtuallogsource	N/A	N/A	N/A
subproduct	N/A	N/A	N/A
product	<vmid>	Text/String	Product name
Originip	N/A	N/A	IP of the log origin
origin	N/A	N/A	Name of the first Security Gateway that reported this event
Action	<action>	Text/String	N/A
ifname	N/A	N/A	The name of the Security Gateway interface through which a connection traverses
ifdirection	N/A	N/A	N/A
user	<login>	Text/String	Source user name
src_user_name	N/A	N/A	N/A
src_machine_name	<sname>	Text/String	N/A
SIP	<sip>	IP Address	Source IP
description	N/A	N/A	N/A
dst_machine_name	N/A	N/A	N/A
dst_user_name	N/A	N/A	N/A
domain_name	<domainorigin>	Text/String	N/A
termination_reason	<reason>	Text/String	N/A
duration	<duration>	Numbers	N/A
identity_type	N/A	N/A	N/A
endpoint_ip	N/A	N/A	N/A
identity_src	N/A	N/A	N/A
information	<vendorinfo>	Text/String	N/A
alert	N/A	N/A	N/A
flags	N/A	N/A	N/A
logid	N/A	N/A	N/A
loguid	N/A	N/A	UUID of unified logs
sequencenum	N/A	N/A	Number added to order logs with the same Linux timestamp and origin
version	N/A	N/A	N/A