cisco ios
April 24, 2024 · View on GitHub
Expression
product = "cisco ios"
Fields
| Field | Core | Detection | Informational |
|---|---|---|---|
| src_ip | ✓ |
Activity Types
| Activity Type | Field | Status | Core | Detection | Informational |
|---|---|---|---|---|---|
| configuration-modify | event_code | ||||
| local_user_name | |||||
| event_name | |||||
| src_host | ✓ | ||||
| event_category | |||||
| user | |||||
| endpoint-login | src_port | Default | ✓ | ||
| event_code | Default | ✓ | |||
| network-session | src_interface | Default | ✓ | ||
| packets | Default | ✓ | |||
| process-create | user | Default | ✓ |