Virus Infection

Vendor Documentation

Rule Name	Rule Type	Common Event	Classification
Virus Infection	Base Rule	General Virus Infected Warning	Warning
Virus Blocked	Sub Rule	Failed Malware Activity	Failed Malware
Object Monitored	Sub Rule	Monitor Only	Activity
Virus Filter Passthrough	Sub Rule	Traffic Allowed by Network Firewall	Network Allow

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
logid	<vmid>	Number	The ID (logid) is a 10-digit field. It is a unique identifier for that specific log.
crlevel	<severity>	Text\String	Each log entry contains a Level (level) field that indicates the estimated severity of the event that caused the log entry.
srcip	<sip>	IP Address	IP address of the traffic’s origin.
dstip	<dip>	IP Address	Destination IP address for the web.
srcport	<sport>	Number	Port number of the traffic's origin.
dstport	<dport>	Number	Port number of the traffic's destination.
srcintf	<sinterface>	Text\String	Interface name of the traffic's origin.
dstintf	<dinterface>	Text\String	Interface of the traffic's destination.
proto	<protnum>	Number	The protocol used by web traffic (tcp by default).
service	<protname>	Text\String	Name of the service.
user	<login>	Text\String	N/A
vd	<domainorigin>	Text\String	N/A
sessionid	<session>	Number	N/A
filename	<object>	Text\String	N/A
virus	<objectname> <threatname>	Text\String	N/A
ref	<subject>	Text\String	N/A
agent	<version>	Text\String	N/A
url	<url>	Text\String	N/A
action	<command>	Text\String	N/A
direction	<tag2>	Text\String	N/A