V 2.0 : Log Update Events

Vendor Documentation

Classification

Rule Name

Rule Type

Common Event

Classification

V 2.0: Log Update Events

Base Rule

General Information

Information

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

virtuallogsource

N/A

N/A

N/A

subproduct

N/A

N/A

N/A

product

<vmid>

Text/String

Product name

Originip

N/A

N/A

IP of the log origin 

origin

N/A

N/A

Name of the first Security Gateway that reported this event

Action

<action>

Text/String

N/A

SIP

<sip>

IP Address

Source IP

SPort

<sport>

Number

Source host port number

DIP

<dip>

IP Address

Destination IP

dport

<dport>

Number

N/A

protocol

<protnum>

Number

Protocol detected on the connection

ifname

N/A

N/A

The name of the Security Gateway interface through which a connection traverses

ifdirection

N/A

N/A

N/A

reason

N/A

N/A

Information on the error occurred

Rule

N/A

N/A

N/A

Info

N/A

N/A

N/A

XlateSIP

N/A

N/A

N/A

XlateSport

N/A

N/A

N/A

XlateDIP

N/A

N/A

N/A

XlateDPort

N/A

N/A

N/A

user

N/A

N/A

Source user name

alert

N/A

N/A

N/A

icmp-code

N/A

N/A

N/A

icmp-type

N/A

N/A

N/A

matched_category

N/A

N/A

N/A

rule_name

N/A

N/A

Access rule name

Url

N/A

N/A

N/A

time

N/A

N/A

The timestamp when the log was created

flags

N/A

N/A

N/A

logid

N/A

N/A

N/A

loguid

N/A

N/A

UUID of unified logs 

originsicname

N/A

N/A

N/A

sequencenum

N/A

N/A

Number added to order logs with the same Linux timestamp and origin

version

N/A

N/A

N/A

__nsons

N/A

N/A

N/A

__p_dport=0

N/A

N/A

N/A

__policy_id_tag

<policy>

Text/String

N/A

__pos

N/A

N/A

N/A

bytes

N/A

N/A

N/A

client_inbound_bytes

<bytesin>

Number

N/A

client_inbound_interface

N/A

N/A

N/A

client_inbound_packets

<packetsin>

Number

N/A

client_outbound_bytes

<bytesout>

Number

N/A

client_outbound_interface

N/A

N/A

N/A

client_outbound_packets

<packetsout>

Number

N/A

context_num

N/A

N/A

N/A

elapsed

N/A

N/A

N/A

hll_key

N/A

N/A

N/A

packets

N/A

N/A

N/A

segment_time

N/A

N/A

N/A

server_inbound_bytes

N/A

N/A

N/A

server_inbound_interface

N/A

N/A

N/A

server_inbound_packets

N/A

N/A

N/A

server_outbout_bytes

N/A

N/A

N/A

server_outbound_interface

N/A

N/A

N/A

server_outbound_packets

N/A

N/A

N/A

start_time

N/A

N/A

N/A