Group
The user group or role impacted by activity reported in the log. Do not use for entity group (zone or domain).
Data Type
String
Aliases
| Use | Alias |
|---|---|
Client Console Full Name | Group |
Client Console Short Name | Not applicable |
Web Console Tab/Name | Group |
Elasticsearch Field Name | group |
Rule Builder Column Name | Group |
Regex Pattern | <group> |
NetMon Name | Not applicable |
Field Relationships
- Login
- Account
- Domain
- Session
- SessionType
- Policy
Common Applications
- AD group
- Linux user group
- Security role
Use Case
- Capturing active directory organizational unit.
- Capturing certificate organizational units.
MPE/Data Masking Manipulations
Not applicable.
Usage Standards
- Not Zone (internet, network, security).
- Only to capture explicitly called out (user) group, organizational units, and roles.
Examples
- Cylance
08 16 2016 22:42:18 1.1.1.1 <USER:NOTE> 250 <44>1 2016-08-17T04:42:20.0816805Z sysloghost CylancePROTECT - - - Event Type: AuditLog, Event Name: ZoneAddDevice, Message: Zone: Corporate; Devices: USABLDRRECFLOW01, , User: Dave Foss (pete.store@recordflow.biz) pete.store@recordflow.biz)
Corporate Zone is parsed here.
- AWS
TS=2015-07-03T07:15:21Z ACCT=22222222222 RSRC=sg-22222222222 ARN= USABLDRRECFLOW01:security-group/sg- USABLDRRECFLOW01CREATETS= STS=ResourceDiscovered REG=us-west-2 RSRCTYP=AWS::EC2::SecurityGroup DETALS=ownerid=9052222962 groupname=launch-wizard-1 groupid=gg22222 description=launch-wizard-1 created 2015-07-03T00:07:57.767-07:00 vpcid=vpc-22222226
Groupname= parses into Group. Is explicit as a group.
- Salesforce
EVT_TYP=RestApi TS=2015-07-13T22:37:51Z REQ_ID=3z1tWodgfdgdH5TjAgF- ORG_ID=00D00000000001 U_N=pete.store@recordflow.biz.isvdev01 RUN_T=77 CPU_T=19 CLNT_IP=1.1.1.1 URI=/services/data/v33.0/query
Organization ID parsed (specific to LogRhythm in this example).