logrhythm

Expression

product = "logrhythm"

Fields

There are no fields for this extension.

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
process-create	src_port	Default			✓
	src_ip	Default		✓
	protocol	Default			✓
	dest_ip	Default		✓
	domain	Default			✓
	event_name	Default			✓
	domain_user_name
	user	Default		✓
	dest_port	Default			✓