V 2.0 : Query-database Events

Vendor Documentation

Rule Name	Rule Type	Common Event	Classification
V 2.0 : Query-database Events	Base Rule	General Information	Information

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
Product	<vmid>	Text/String	Product name
Originip	<sip>	IP Address	IP of the log origin
origin	N/A	N/A	Name of the first Security Gateway that reported this event
operation	N/A	N/A	N/A
subject	<subject>	Text/String	N/A
status	<status>	Text/String	N/A
administrator	<login>	Text/String	N/A
client	N/A	N/A	N/A
performedon	<object>	Text/String	N/A
objecttable	N/A	N/A	N/A
objecttype	<objecttype>	Text/String	N/A
generalinformation	N/A	N/A	N/A
time	N/A	N/A	N/A
Action	<action>	Text/String	Description of detected malware activity
ifdirection	N/A	N/A	Connection direction
ifname	<sinterface>	Text/String	The name of the Security Gateway interface, through which a connection traverses
session_id	N/A	N/A	N/A
alert	N/A	N/A	Alert level of matched rule (for connection logs)
client_ip_host	N/A	N/A	N/A
flags	N/A	N/A	Checkpoint internal field
loguid	N/A	N/A	UUID of unified logs
sequencenum	N/A	N/A	Number added to order logs with the same linux timestamp and origin
originsicname	N/A	N/A	N/A
sendtotrackerasadvancedauditlog	N/A	N/A	N/A
admin_level	N/A	N/A	N/A
cma_name	N/A	N/A	N/A
operation_number	N/A	N/A	N/A
mds_name	N/A	N/A	N/A
uid	N/A	N/A	N/A
fieldschanges	N/A	N/A	N/A
customer_name	N/A	N/A	N/A
version	<version>	Number	N/A