V 2.0 : SEP Logs Purged | LogRhythm Documentation

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
N/A	N/A	<dname>
N/A	N/A	<object>
N/A	N/A	<subject>
N/A	N/A	<quantity>
N/A	<tag1>	<tag1>
N/A	<severity>	N/A
N/A	<amount>	N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Events	Classifications
1001593	Logs Swept	Base Rule	Logs Swept	Other Operations
	No Physical Logs Were Swept	Sub Rule	No Logs Swept	Other Operations
	No Client Logs Got Swept	Sub Rule	No Logs Swept	Other Operations
	No Objects Got Swept	Sub Rule	No Logs Swept	Other Operations
	Client Activity Logs Got Swept	Sub Rule	Logs Swept	Other Operations
	Client Traffic Logs Got Swept	Sub Rule	Logs Swept	Other Operations
	Compressed Risk Events Got Swept	Sub Rule	Logs Swept	Other Operations
	Old Risk Events Got Swept	Sub Rule	Logs Swept	Other Operations
	Risk Events From Deleted Clients Got Swept	Sub Rule	Logs Swept	Other Operations
	System Client-Server Activity Logs Got Swept	Sub Rule	Logs Swept	Other Operations
	Virus Definition Records Got Swept	Sub Rule	Logs Swept	Other Operations

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Events	Classifications
1011172	V 2.0 : SEP Logs Purged	Base Rule	Logs Swept	Other Operations
V 2.0 : No SEP Logs Purged	Sub Rule	No Logs Swept	Other Operations

Regex ID

Rule Name

Rule Type

Common Events

Classifications

1011172

V 2.0 : SEP Logs Purged

Base Rule

Logs Swept

Other Operations

V 2.0 : No SEP Logs Purged

Sub

Rule

No Logs Swept

Other Operations