Virus Infection

Virus Infection

Base Rule

General Virus Infected Warning

Warning

Virus Blocked

Sub Rule

Failed Malware Activity

Failed Malware

Object Monitored

Sub Rule

Monitor Only

Activity

Virus Filter Passthrough

Sub Rule

Traffic Allowed by Network Firewall

Network Allow

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

logid

<vmid>

Number

The ID (logid) is a 10-digit field. It is a unique identifier for that specific log.

crlevel

<severity>

Text\String

Each log entry contains a Level (level) field that indicates the estimated severity of the event that caused the log entry.

srcip

<sip>

IP Address

IP address of the traffic’s origin.

dstip

<dip>

IP Address

Destination IP address for the web.

srcport

<sport>

Number

Port number of the traffic's origin.

dstport

<dport>

Number

Port number of the traffic's destination.

srcintf

<sinterface>

Text\String

Interface name of the traffic's origin.

dstintf

<dinterface>

Text\String

Interface of the traffic's destination.

proto

<protnum>

Number

The protocol used by web traffic (tcp by default).

service

<protname>

Text\String

Name of the service.

user

<login>

Text\String

N/A

vd

<domainorigin>

Text\String

N/A

sessionid

<session>

Number

N/A

filename

<object>

Text\String

N/A

virus

<objectname>

<threatname>

Text\String

N/A

ref

<subject>

Text\String

N/A

agent

<version>

Text\String

N/A

url

<url>

Text\String

N/A

action

<command>

Text\String

N/A

direction

<tag2>

Text\String

N/A