Syslog - LogRhythm NetMon V 2.0 : Incremental Flow Event

https://docs.logrhythm.com/docs/netmon/appendices/stand-alone-netmon-syslog-parsing/syslog-event-type

V 2.0 : Incremental Flow Event

Base Rule

Incremental Flow

Network Traffic

N/A

<severity>

Number

N/A

N/A

<vmid>

Number

N/A

N/A

<session>

Number

N/A

N/A

<sip>

IP Address

N/A

N/A

<dip>

IP Address

N/A

N/A

<sport>

Number

N/A

N/A

<dport>

Number

N/A

N/A

<smac>

Number/Text

N/A

N/A

<dmac>

Number/Text

N/A

N/A

<protnum>

Number

N/A

N/A

<processid>

Number

N/A

N/A

<bytesin>

Number

N/A

N/A

<bytesout>

Number

N/A

N/A

<packetsin>

Number

N/A

N/A

<seconds>

Number

N/A

netmonhostname

 N/A

N/A

N/A

applicationfamily

<group>

Text/String

N/A

applicationtags

 N/A

N/A

N/A

domain

<domainimpacted>

Text/String

N/A

process

<process>

Text/String

N/A

object

<object>

Text/String

N/A

objectname

<objectname>

Text/String

N/A

dname

<dname>

Text/String

N/A

subject

<subject>

Text/String

N/A

version

<version>

Number

N/A

command

<command>

Text/String

N/A