Skip to main content
Skip table of contents

V 2.0 Profiler Event

Vendor Documentation

Classification

Rule NameRule TypeCommon EventClassification
V 2.0 Profiler EventBase RuleDiagnostic InformationInformation
V 2.0 EVID 80001 Profiler EndPoint CollectionSub RuleEndpoint Profiling ActivityInformation
V 2.0 EVID 80002 Profiler EndPoint ProfilingSub RuleEndpoint Profiling ActivityInformation
V 2.0 EVID 80003 Profiler Probe FailSub RuleProbing FailureError
V 2.0 EVID 80004 Profiler Performance CountersSub RuleGeneral Information Log MessageInformation
V 2.0 EVID 80005 Profiler Exception Action Exec.Sub RuleGeneral Information Log MessageInformation
V 2.0 EVID 80006 Profiler Change Auth RequestSub RuleAuthorization Request ReceivedOther Audit
V 2.0 EVID 80007 Profiler SNMP Request SentSub RuleGeneral SNMP InformationInformation
V 2.0 EVID 80008 Profiler Receive SNMP ResponseSub RuleGeneral SNMP InformationInformation
V 2.0 EVID 80009 Profiler SNMP Request FailureSub RuleGeneral SNMP InformationInformation
V 2.0 EVID 80010 Profiler DNS Request SentSub RuleDNS RequestNetwork Traffic
V 2.0 EVID :80013 Profiler EndPoint Feed ProfilingSub RuleEndpoint Profiling ActivityInformation
V 2.0 EVID 80014 Profiler EndPoint PurgeSub RuleEndpoint Profiling ActivityInformation
V 2.0 EVID 80015 Profiler Queue Size Limit ReachSub RuleEndpoint Profiling ActivityInformation
V 2.0 EVID 80016 Anomalous Behavior DetectedSub RuleGeneral Information Log MessageInformation

Mapping with LogRhythm Schema

Device Key in Log MessageLogRhythm SchemaData TypeSchema Description
pri_numN/AN/APriority value of the message, a combination of the facility value and the severity value of the message. Priority value = (facility value * 8) + severity value.
The facility code valid options are:
LOCAL0 (Code = 16)
LOCAL1 (Code = 17)
LOCAL2 (Code = 18)
LOCAL3 (Code = 19)
LOCAL4 (Code = 20)
LOCAL5 (Code = 21)
LOCAL6 (Code = 22; default)
LOCAL7 (Code = 23)
timeN/AN/ADate of the message generation, according to the local clock of the originating Cisco ISE server, in the format Mmm DD hh:mm:ss.
IP address/hostnameN/AN/AIP address of the originating Cisco ISE node, or the hostname.
cat_name<vendorinfo>Text/StringLogging category name preceded by the CSCOxxx string.
msg_idN/AN/AUnique message ID; 1 to 4294967295. The message ID increases by 1 with each new message. Message IDs restart at 1 each time the application is restarted.
total_segN/AN/ATotal number of segments in a log message. Long messages are divided into more than one segment.
Note : The total_seg depends on the Maximum Length setting in the remote logging targets page. See Remote Logging Target Settings.
seg_numN/AN/ASegment sequence number within a message. Use this number to determine what segment of the message you are viewing.
timestampN/AN/ADate of the message generation, according to the local clock of the originating the Cisco ISE node, in the following format :
YYYY-MM-DD hh:mm:ss:xxx +/-zh:zm.
sequence_numN/AN/AGlobal counter of each message. If one message is sent to the local store and the next to the syslog server target, the counter increments by 2. Possible values are 0000000001 to 999999999.
msg_code<vmid>
<tag1>
NumberMessage code as defined in the logging categories.
msg_sev<severity>Text/StringMessage severity level of a log message.
msg_class<subject> Text/StringMessage class, which identifies groups of messages with the same context.
msg_text<action> Text/StringEnglish language descriptive text message.
ConfigVersionIdN/AN/AN/A
OperatingSystemN/AN/AN/A
EndpointCertainityMetricN/AN/AN/A
EndpointIPAddress<sip>IP AddressN/A
EndpointCoAN/AN/AN/A
EndpointMacAddress<smac>Text/StringN/A
EndpointMatchedPolicyN/AN/AN/A
EndpointNADAddressN/AN/AN/A
EndpointOUIN/AN/AN/A
EndpointPolicy<policy>Text/StringN/A
EndpointPropertyN/AN/AN/A
AuthenticationIdentityStoreN/AN/AN/A
AuthenticationMethodN/AN/AN/A
DestinationPort<dport>NumberN/A
PortalUser.GuestStatusN/AN/AN/A
allowEasyWiredSessionN/AN/AN/A
User-Fetch-StreetAddressN/AN/AN/A
PostureExpiryN/AN/AN/A
SelectedAccessServiceN/AN/AN/A
NetworkDeviceNameN/AN/AN/A
User-Fetch-Job-TitleN/AN/AN/A
DestinationIPAddress<dip>IP AddressN/A
SelectedAuthenticationIdentityStoresN/AN/AN/A
MessageCode<result>NumberN/A
EndPointPolicyIDN/AN/AN/A
UseCaseN/AN/AN/A
NAS-Port-IdN/AN/AN/A
NAS-Port-TypeN/AN/AN/A
Response<account>
<status>

Text/String
Text/String

N/A
ProfilerServerN/AN/AN/A
ProfilerErrorMessage<result>Text/StringN/A
SNMPOIDValueN/AN/AN/A
PortalUser.PhoneNumberN/AN/AN/A
User-Fetch-Organizational-UnitN/AN/AN/A
Key1N/AN/AN/A
Key2N/AN/AN/A
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.