V 2.0 IPsec-SA/ISAKMP-SA Established Event

Vendor Documentation

Classification

Rule Name

Rule Type

Classification

Common Event

V 2.0 IPsec-SA/ISAKMP-SA Established Event

Base Rule

Network Traffic

Network Connection Established

V 2.0 IPsec-SA Established

Sub Rule

Network Traffic

IPSEC Security Association Established

V 2.0 ISAKMP-SA Established

Sub Rule

Network Traffic

Network Connection Established

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

N/A

N/A

N/A

flow start time

N/A

N/A

N/A

flow stop time

N/A

<object>

Text/String

device

N/A

<vendorinfo>

Text/String

event type

Site-to-site VPN

<action>
<tag1>

Text/String

N/A

spi

N/A

N/A

N/A