V 2.0 : Product Auditing Event

https://docs.trendmicro.com/en-us/enterprise/apex-central-online-help/appendices/syslog-mapping-cef.aspx

https://docs.trendmicro.com/en-us/enterprise/apex-central-online-help/appendices/syslog-mapping-cef/cef-product-auditing.aspx

V 2.0 : Product Auditing Event

Base Rule

Other Audit

General Auditing Message

V 2.0 : Product Auditing : Error

Sub Rule

Error

General Error Message

V 2.0 : Product Auditing : Warning

Sub Rule

Warning

General Warning Log Message

V 2.0 : Product Auditing : Information

Sub Rule

Information

General Information Log Message

V 2.0 : Product Auditing : Failure Audit

Sub Rule

Failure Audit

Auditing Failed

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Header (logVer)

N/A

N/A

CEF format version

Header (vendor)

<vendorinfo>

Text/string

Product vendor

Header (pname)

N/A

N/A

Product name

Header (pver)

N/A

N/A

Product version

Header (eventid)

N/A

N/A

Event ID

Header (eventName)

<vmid>

Text/string

Log name

Header (severity)

N/A

N/A

Severity

cat

N/A

N/A

Log type

deviceFacility

N/A

N/A

Managed product

dvchost

N/A

N/A

Display name of the managed endpoint

rt

N/A

N/A

Log generation time in UTC

cn1Label

N/A

N/A

Corresponding label for the "cn1" field

cn1

N/A

N/A

Category ID Example: "536,870,912"

cn2Label

N/A

N/A

Corresponding label for the "cn2" field

cn2

<severity>

<tag1>

Number

Severity level
Example: "4"
1 = ERROR

2 = WARNING

4 = INFORMATION

16 = FAILURE AUDIT

suser

<login>

Text/string

The name of the user on whose behalf the event occurred

deviceNtDomain

N/A

N/A

Active Directory domain
Example: APEXTMCM

dntdom

N/A

N/A

Apex One domain hierarchy

ApexCentralHost

N/A

N/A

Apex Central host name

devicePayloadId

N/A

N/A

Unique message GUID

act

<action>

Text/string

Action

src

<sip>

Number/Ip address

Source IP

dst

<dip>

Number/Ip address

Destiantion IP

smac

<smac>

Text/string

Source MAC

spt

<sport>

Number

Source Port

dmac

<dmac>

Text/string

Destination MAC

dpt

<dport>

Number

Destination Port

deviceDirection

N/A

N/A

Direction

cn3Label

N/A

N/A

N/A

cn3

N/A

N/A

N/A

cn4Label

N/A

N/A

N/A

cn4

N/A

N/A

N/A

proto

<protnum>

Number

N/A

cs2Label

N/A

N/A

N/A

cs2

N/A

N/A

N/A

cs1Label

N/A

N/A

N/A

cs1

N/A

N/A

N/A

cnt

N/A

N/A

N/A

cn2Label

N/A

N/A

N/A