Skip to main content
Skip table of contents

V 2.0 : Network Policy Server Events

Vendor Documentation

Classification

Rule NameRule TypeCommon EventClassification
V 2.0 : Network Policy Server EventsBase RuleGeneral Audit MessageOther Audit
V 2.0 : EVID 6272 : NPS - Access Granted to UserSub RuleUser LogonAuthentication Success
V 2.0 : EVID 6273 : NPS - Access Denied to UserSub RuleUser Logon FailureAuthentication Failure
V 2.0 : EVID 6274 : NPS - Access Request DiscardedSub RuleBad RequestWarning
V 2.0 : EVID 6278 : NPS - Full Access Granted to UserSub RuleUser LogonAuthentication Success

Mapping with LogRhythm Schema  

Device Key in Log MessageLogRhythm SchemaData TypeSchema Description
Provider N/AN/AIdentifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events. The EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.
EventID<vmid>NumberThe identifier that the provider used to identify the event.
VersionN/A N/AThe version number of the event's definition.
Level<severity>String/NumberThe severity level defined in the event.
Task<vendorinfo>String/NumberThe task defined in the event. Task and Opcode are typically used to identify the location in the application from where the event was logged.
OpcodeN/A N/AThe opcode defined in the event. Task and Opcode are typically used to identify the location in the application from where the event was logged.
Keywords<result>Text/StringA bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).
TimeCreatedN/A N/AThe time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.
EventRecordIDN/A N/AThe record number assigned to the event when it was logged.
CorrelationN/A N/AThe activity identifiers that consumers can use to group related events together.
ExecutionN/A N/AContains information about the process and thread that logged the event.
ChannelN/A N/AThe channel to which the event was logged.
ComputerN/AN/AThe name of the computer on which the event occurred.
SubjectUserSidN/A N/AN/A 
SubjectUserName<login>Text/StringThe user identity, as specified by the user.
SubjectDomainName<domainorigin>Text/StringN/A 
FullyQualifiedSubjectUserNameN/A N/AThe user name in canonical format (this is an IAS-internal attribute).
SubjectMachineSIDN/A N/AN/A 
SubjectMachineNameN/A N/AN/A 
FullyQualifiedSubjectMachineNameN/A N/AN/A 
CalledStationIDN/AN/AThe phone number dialed by the user.
CallingStationID

<sip>

<smac>

IP Address

Text/String

The phone number from which the call originated.
NASIPv4AddressN/AN/AThe IP address of the network access server originating the request.
NASIPv6AddressN/AN/AThe IP address of the network access server originating the request.
NASIdentifierN/A N/AThe text that identifies the network access server originating the request.
NASPortType<object>Text/StringThe type of physical port that is used by the network access server originating the request.
NASPortN/A NumberThe physical port number of the network access server originating the request.
ClientName<dname>Text/StringThe friendly name for the RADIUS client (this is an IAS-internal attribute).
ClientIPAddress<dip>IP AddressThe IP address of the RADIUS client (this is an IAS-internal attribute).
ProxyPolicyName<policy>Text/StringThe name of the connection request policy that matched the connection request.
NetworkPolicyName<policy>Text/StringThe friendly name of the network policy that either granted or denied access. This attribute is logged in Access-Accept and Access-Reject messages. If a user is rejected because none of the network policies matched, then this attribute is blank.
AuthenticationProviderN/A N/AA string value that corresponds to Provider-Type. Possible values are "None" for a Provider-Type value of 0, "Windows" for a Provider-Type value of 1, and "Radius Proxy" for Provider-Type value of 2.
AuthenticationServerN/A N/AN/A
AuthenticationTypeN/A N/AThe authentication scheme, which is used to verify the user.
EAPTypeN/A N/AThe friendly name of the EAP-based authentication method that was used by the access client and NPS server during the authentication process. For example, if the client and server use Extensible Authentication Protocol (EAP) and the EAP type MS-CHAP v2, the value of EAP-Friendly-Name is Microsoft Secured Password (EAP-MSCHAPv2).
AccountSessionIdentifierN/A N/AThe unique numeric string that identifies the server session.
ReasonCode<responsecode>NumberN/A
Reason<reason>Text/StringN/A
LoggingResult<subject>Text/StringN/A 
QuarantineState<status>Text/StringN/A
ExtendedQuarantineState N/AN/AN/A
QuarantineSessionID<session>Text/StringN/A
QuarantineHelpURL<url>Text/StringN/A
QuarantineSystemHealthResult<subject>Text/StringN/A
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.