Zscalar General Network Traffic Messages

Classification

Rule Name	Rule Type	Common Event	Classification
Zscalar General Network Traffic Messages	Base Rule	General Network Traffic	Network Traffic
Http Get Mesaages	Sub Rule	HTTP 200 : Success Reply - OK	Information
HTTP Post Messages	Sub Rule	HTTP 200 : Success Reply - OK	Information
HTTPS  Connect Success Messages	Sub Rule	HTTP 200 : Success Reply - OK	Information
HTTP HEAD Success  Messages	Sub Rule	HTTP 200 : Success Reply - OK	Information
HTTP OPTION Sucess Messages	Sub Rule	HTTP 200 : Success Reply - OK	Information
HTTP GET Redirect Messages	Sub Rule	HTTP 304 : Redirect - Not Modified	Information
HTTP Termporarily Moved Messages	Sub Rule	HTTP 302 : Redirect - Moved Temporarily	Information
HTTP POST Success  Messages	Sub Rule	HTTP 204 : Success Reply - No Content	Information
HTTP POST Redirect Moved Temporarily Messages	Sub Rule	HTTP 302 : Redirect - Moved Temporarily	Information
HTTP Head Redirect Messages	Sub Rule	HTTP 301 : Redirect - Moved Permanently	Information

Mapping with LogRhythm Schema  

Device Key in Log Message	LogRhythm Schema	Data Type
N/A	<severity>	Text/String
N/A	<protname>	Text/String
N/A	<url>	Number/String
N/A	<action>	Text/String
N/A	<bytesin>	Number
N/A	<bytesout>	Number
N/A	<reason>	Text/String
N/A	<dip>	Number
N/A	<sip>	Number
N/A	<tag1>	Text/String
N/A	<command>	Text/String
N/A	<tag2>	Number
N/A	<responsecode>	Number
N/A	<useragent>	Text/String

×