V 2.0 Internal MDM Event

Vendor Documentation

https://www.cisco.com/c/en/us/td/docs/security/ise/syslog/Cisco_ISE_Syslogs/m_SyslogsList.html

Classification

Rule Name	Rule Type	Common Event	Classification
V 2.0 Internal MDM Event	Base Rule	General MDM Information	Information
V 2.0 EVID 89050 Administrative Action Submitted	Sub Rule	General Administrative Operation	Information
V 2.0 EVID 89051 Administrative Action Delivered	Sub Rule	General Administrative Operation	Information
V 2.0 EVID 89052 Administrative Action Failed	Sub Rule	Action Failure	Error
V 2.0 EVID 89100 Device Enrollment Initiated	Sub Rule	General Information Log Message	Information
V 2.0 EVID 89101 Device Enrollment Failed	Sub Rule	Device Initialization Failed	Critical
V 2.0 EVID 89102 Device Enrolled Successfully	Sub Rule	Successful Activity	Other Audit Success
V 2.0 EVID 89103 Device Deregistered	Sub Rule	Device Unregistered	Warning
V 2.0 EVID 89104 Device Service Initialized	Sub Rule	General Information Log Message	Information
V 2.0 EVID 89105 Device Svc Initialization Fail	Sub Rule	General Failed Activity	Failed Activity
V 2.0 EVID 89106 Device Service Stopped	Sub Rule	Process/Service Stopped	Startup and Shutdown
V 2.0 EVID 89107 Unable To Send Notifications	Sub Rule	General Notification	Information
V 2.0 EVID 89108 APNS Certificate Expired	Sub Rule	Certificate Expired	Warning
V 2.0 EVID 89109 Endpoint Certificate Expire	Sub Rule	Certificate Expired	Warning
V 2.0 EVID 89110 Dev Check Not Auth. Expired Cert	Sub Rule	Certificate Expired	Warning
V 2.0 EVID 89111 Device Check Authorized	Sub Rule	General Information Log Message	Information
V 2.0 EVID 89112 Certificate Renewed	Sub Rule	Certificate Renewal Request	Activity
V 2.0 EVID 89113 Inactive Device Detected	Sub Rule	General Information Log Message	Information
V 2.0 EVID 89114 GeoLocation Coordinates Receive	Sub Rule	General Information Log Message	Information
V 2.0 EVID 89115 Profile Installed	Sub Rule	General Information Log Message	Information
V 2.0 EVID 89116 Profile Removed	Sub Rule	General Information Log Message	Information
V 2.0 EVID 89117 Application Installed	Sub Rule	General Application Information	Information
V 2.0 EVID 89118 Application Removed	Sub Rule	General Application Information	Information
V 2.0 EVID 89119 Device Reassessment Failed	Sub Rule	General Failed Activity	Failed Activity
V 2.0 EVID 89132 Endpoint Cert Going To Expired	Sub Rule	General Endpoint Message	Information
V 2.0 EVID 89133 Endpoint Certificate Expired	Sub Rule	General Endpoint Message	Information
V 2.0 EVID 89142 Provisioning Operation Failed	Sub Rule	Provisioning Failed	Warning
V 2.0 EVID 89143 Device Updated	Sub Rule	General Information Log Message	Information
V 2.0 EVID 89144 Certificate Renewal Failed	Sub Rule	General Failed Activity	Failed Activity
V 2.0 EVID 89149 Device Compliant	Sub Rule	General Information Log Message	Information
V 2.0 EVID 89150 Device Not Compliant	Sub Rule	General Information Log Message	Information
V 2.0 EVID 89151 Cert Issued Can Be Revoked	Sub Rule	Revoke Certificate Request	Activity
V 2.0 EVID 89152 Mob Dev Unenrollment Initiated	Sub Rule	General Information Log Message	Information
V 2.0 EVID 89153 Cert Missing For Notifification	Sub Rule	General Information Log Message	Information
V 2.0 EVID 89154 Invalid Token TO Apple VPP	Sub Rule	General Information Log Message	Information
V 2.0 EVID 89155 Access Failed To Apple VPP	Sub Rule	Access Object Failure	Access Failure
V 2.0 EVID 89156 CMCS Server Unreachable	Sub Rule	Destination Unreachable	Error
V 2.0 EVID 89157 CMCS Authentication Failure	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 89158 APNS Server Unreachable	Sub Rule	Destination Unreachable	Error
V 2.0 EVID 89159 APNS Authentication Failure	Sub Rule	Authentication Failure Activity	Authentication Failure
V 2.0 EVID 89160 MDM User Auth Completed	Sub Rule	Authentication Complete	Information

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
pri_num	N/A	N/A	Priority value of the message, a combination of the facility value and the severity value of the message. Priority value = (facility value * 8) + severity value. The facility code valid options are: LOCAL0 (Code = 16) LOCAL1 (Code = 17) LOCAL2 (Code = 18) LOCAL3 (Code = 19) LOCAL4 (Code = 20) LOCAL5 (Code = 21) LOCAL6 (Code = 22; default) LOCAL7 (Code = 23)
time	N/A	N/A	Date of the message generation, according to the local clock of the originating Cisco ISE server, in the format Mmm DD hh:mm:ss.
IP address/hostname	N/A	N/A	IP address of the originating Cisco ISE node, or the hostname.
cat_name	<vendorinfo>	Text/String	Logging category name preceded by the CSCOxxx string.
msg_id	N/A	N/A	Unique message ID; 1 to 4294967295. The message ID increases by 1 with each new message. Message IDs restart at 1 each time the application is restarted.
total_seg	N/A	N/A	Total number of segments in a log message. Long messages are divided into more than one segment. Note: The total_seg depends on the Maximum Length setting in the remote logging targets page. See Remote Logging Target Settings.
seg_num	N/A	N/A	Segment sequence number within a message. Use this number to determine what segment of the message you are viewing.
timestamp	N/A	N/A	Date of the message generation, according to the local clock of the originating the Cisco ISE node, in the following format: YYYY-MM-DD hh:mm:ss:xxx +/-zh:zm.
sequence_num	N/A	N/A	Global counter of each message. If one message is sent to the local store and the next to the syslog server target, the counter increments by 2. Possible values are 0000000001 to 999999999.
msg_code	<vmid> <tag1>	Number	Message code as defined in the logging categories.
msg_sev	<severity>	Text/String	Message severity level of a log message.
msg_class	<subject>	Text/String	Message class, which identifies groups of messages with the same context.
msg_text	<action>	Text/String	English language descriptive text message.
key1	N/A	N/A	N/A
key2	N/A	N/A	N/A