What are the custom events generated by EventTracker?
The following Events are generated for Event source = EventTracker
Event ID | Event Description |
---|---|
2001 | The EventTracker Manager service was started. |
2002 | EventTracker Agent on %1 is running and okay. |
2003 | Accepted EventTracker Viewer connection from %1. |
2004 | The EventTracker Viewer from %1 was disconnected. |
2005 | The EventTracker Manager Console was started. |
2006 | EventTracker Agent on %1 was not running. Restarted successfully. |
2007 | EventTracker Agent on %1 is not running. Failed to restart. |
2008 | Detected system %1 is not reachable. No reply received on ping poll. |
2009 | Detected system %1 is reachable. Reply received on ping poll. |
2010 | Number of events in the database exceeded %1. Please purge the database or you may see slow performance of EventTracker software. |
2011 | System %1 may be generating high number of events. Please filter unnecessary events emitted from this system. |
2012 | Scheduled Report: %1 was generated and emailed successfully. |
2013 | Scheduled Report: %1 was not generated. Please cross-check configuration. |
2014 | Archival of old events done successfully. Status %1. |
2015 | Archival of old events failed. Status %1. |
2016 | Archive CAB integrity check failed. CAB Name:%1 MDB Name:%2 |
2017 | Archive CAB integrity check successful. CAB Name: %1 MDB Name: %2 |
2018 | Archive CAB extraction failed. Unable to proceed with verification. CAB Name:%1 MDB Name:%2 |
2019 | Archive CAB extraction success. CAB Name: %1 MDB Name: %2 |
2020 | Archive CAB integrity check process started. |
2021 | Archive CAB integrity check process completed. Total CABs Processed:%1 CABs Passed:%2 CABs Failed:%3 |
2022 | Knowledge base file for suspicious network activity downloaded succesfully. |
2023 | Failed to download knowledge base file file for suspicious network activity, due to %1. |
2024 | System running out of disk space to process Scheduled Reports. |
2025 | Collection Point Success: Issdbv3 successfully sent to Collection Master at: suppserver. |
2026 | Collection Point Error: Unable to Connect to Collection Master at: %1. Error code : 10061 OR Collection Point Error: Network Connection lost with Collection Master Ip Address %1. Error code : 0 |
2027 | Collection Master Success: Alerts Cache DB successfully received from %1 OR Collection Point Error: Network Connection lost with Collection Master Ip Address %1. Error code : 0 |
2028 | Collection Master Error: Unable to connect CollectionPointInfo.mdb Datbase. OR Collection Master Error: Socket API : send failed. Error code : 10054. OR Collection Master Error: SQL Statement %1 Error code : 0 |
2029 | Notification: Report file deletion. Following file ‘report file’ created on ‘date’ will be deleted on ‘date’ so, please take back up of the file if required. ‘Full path of report file’ |
2030 | Could not find Event Tracker Receiver configuration file Retrieved from the previous version. |
2031 | Could not find EventTracker Receiver configuration file and any of its previous versions Using default configurations |
2032 | EventTracker configurations modified on for the sections. |
2033 | Type: Backup/Restore Status: Success/Failed/Interrupted Log: Xml Format (with each backup/restore element status). |
2036 | Scheduled Report: %1. Error Code:%2 The table could not be found. EventTracker will automatically retry to generate this report. |
2037 | Detected out of ordinary activity: Event ID: %1 Number of activities in 24 hours: %2 Normal average: %3 Variation in%: %4 |
2038 | Detected out of ordinary activity: Event ID: %1 Number of activities in 24 hours: %2 Normal average: %3 Variation in%: %4 |
2039 | Successfully purged the old data. Purge Frequency in days: %1 Purged the data till: %2 |
2040 | New activity found: Event ID: %1 System: %2 Time:%3 |
2041 | This Event is logged when report breaking starts due to large data. Description : Queue Id: %1 Reort Title: Logs-Detail Original Queue Type: Queued/Schedule Original Start Time: %2 Original End Time: %3 Truncate End Time: %4 |
2042 | Agent Configuration update attempted on %1 User: Domain/Username Status: Failed/Success Reason: Descriptive msg for failure with error codes etc (applicable only for failures) |
2043 | No events received from %1 in last 24 hours |
2044 | SNMP Get failed for the server %1 |
2044 | SNMP Get Succeeded for the server <IP Address> |
2045 | Vulnerability parser source: QualysParser.exe Found host name=%1,IPAddress=%2, FQDN=%4, NetBIOS Name=, DNS name=, Vulnerability value=%5 and StartTime=%6 |
2046 | Agent DLA file receive attempt Agent: %1 File: %2 Status: %3 |
2047 | Configuration Assessment (SCAP) attempt Agent: %1 (In case of failure in forming the input file, all machine names will come here) BenchmarkTitle: %2 Status: Success/Failed Reason: Descriptive message for failure with error codes etc |
2048 | Direct log archiver (success/failed) purged the following log files: Folder Name: %1 Files: <list of files > Configured days: %3 |
2049 | Failed to import the SCAP content from . User: %1 ERROR – description of error |
2050 | EventTracker patch applied |
2050 | EventTracker patch applied |
2051 | Failed to commit CAB file on EventVault. File Name: %1 Storage Path: %2 Error Code: %3 Description: %4 |
2052 | Generated by receiver when alert suppression occurs |
2053 | scheduled Discovery Invoked. |
2054 | Scheduled Discovery Completed. |
2055 | Used for correlator script. |
2056 | Generated with EventTracker backup status |
2057 | Generated with EventTracker restore status |
2060 | Script file execution failed. |
2059 | Usage data submission requested. |
2061 | Scheduled report generated successfully |
2062 | Behavior lagging |
2063 | Agent Heath check |
2064 | License about to expire. |
2065 | EventTracker detected 212 non reporting systems with High asset value. 1) POPEYE (2015-12-09 16:40:29) 2) CASPER (2015-12-09 16:40:29) |
2066 | Collection Point Success: Successfully uploaded reports package to Collection Master. Collection Master: <Collection Master> Package Name: <Package Name> Reason: Success Report Details: Title: <Title> Type: Detail File Name: <File Name> Generated On: 2016-04-20 20:31:06 Size (KB): 38189 Status: Success |
2066 | Failed to upload reports package to Collection Master. Collection Master: <Collection Master IP Address> Package Name: <Package Name> Reason: Unable to create report files packet. Report Details: Title: <Title> Type: Detail File Name: <File Name> Generated On: 2016-04-20 20:31:06 Size (KB): 48 Status: Failed |
2067 | Collection Master Success: Successfully received reports package from Collection Point. Collection Point: <Collection Point> Package Name: lt;Package Name> Reason: Success Report files in package: All error events _CP-CM^679^1461054600.pdf Logs – Summary_CP_CM^688^1461054600.pdf Logs – Detail_xlxs^697^1461054600.xlsx Security Logon failure events^665^1461054600.pdf Disk Space Status^667^1461058200.pdf |
2067 | Failed to receive reports package from Collection Point. Collection Point: <Collection Point> Package Name: lt;Package Name> Reason: Unable to create database |
2068 | Unknown MD5 hash detected based on change audit event |
2069 | Unsafe MD5 hash detected based on change audit event. |
2070 | An unexecuted unsafe MD5 hash has been detected. Hash: <Hash> System: <System> Time: 2017-01-11 14:54:37 User: lt;User> Image File Name: lt;Image File Name> Source Event: Id: 3400 Source: EventTracker Description: File Added: <File Path> Curr Snapshot Time: 3/15/2017 10:04:31 AM Curr Size: 3253392 (Bytes) Curr Creation Time: 3/14/2017 8:04:00 PM Curr File Version: <Curr File Version> Curr Checksum (SHA1): <Curr Checksum (SHA1)> Curr Checksum (MD5): <Curr Checksum (MD5)> Curr Description: <Curr Description> Curr Product Name: <Curr Product Name> Curr Product Version: <Curr Product Version> Curr Signer: <Curr Signer> Curr Counter Signer: <Curr Counter Signer> Curr Signed On: 1/24/2017 3:20:03 AM Prev Snapshot Time: 3/14/2017 5:54:51 PM Change Type: Unauthorized |
2071 | An UnExecuted unknown MD5 hash has been detected. Hash: <Hash> System: <System> Time: 2017-03-14 17:02:31 User: <User> Image File Name: <Image File Name> File Name: <File Name> File Version: <File Version> File Description: <File Description> File Size: <File Size> Last Modified Time: 2017-03-14T11:32:30Z Product Name: <Product Name> Product Version: <Product Version> Signer: <Signer> Counter Signer: <Counter Signer> Counter Signed On: 9/2/2016 3:16:20 PM |
2074 | A new process is found by EventTracker EDR. New activity found: Hash: <Hash> Rule Name: EventTracker_EDR_Found_New_Hash System: <System> Time: 2019-02-08 02:46:40 Source Event: Id: 3517 Source: EventTracker Description: Image loaded by a process. Process Name: <Process Name> Process Image File Name: <Process Image File Name> Account Name: <Account Name> Account Domain: <Account Domain> Process ID: <rocess ID> System Name: <System Name> Image Name: <Image Name> Image File Name: <Image File Name> File Version: <File Version> File Description: <File Description> Product Name: <Product Name> Product Version: <Product Version> File Size: <File Size> Last Modified Time: 2018-03-22T13:01:02Z Signed: Yes Signer: <Signer> Signed On: 0000-00-00T00:00:00Z Counter Signed: No Counter Signer: Hash (MD5): <Hash> Status: SAFE Status Reference: VirusTotal Virustotal Link: Not Available |
2075 | A new process is found by EventTracker EDR. New activity found: Hash: <Hash> Rule Name: EventTracker_EDR_Found_New_Hash System: <System> Time: 2019-02-08 02:46:40 Source Event: Id: 3517 Source: EventTracker Description: Image loaded by a process. Process Name: <Process Name> Process Image File Name: <Process Image File Name> Account Name: <Account Name> Account Domain: <Account Domain> Process ID: <Process ID> System Name: <System Name> Image Name: <Image Name> Image File Name: <Image File Name> File Version: <File Version> File Description: <File Description> Product Name: <Product Name> Product Version: <Product Version> File Size: <File Size> Last Modified Time: 2018-03-22T13:01:02Z Signed: Yes Signer: <Signer> Signed On: 0000-00-00T00:00:00Z Counter Signed: No Counter Signer: Hash (MD5): <Hash> Status: UNKNOWN Status Reference: VirusTotal Virustotal Link: Not Available |
2076 | A new process, which is not available in safe list, has been terminated by EventTracker. Hash (MD5): <Hash> Process Name: <Process Name> Image File Name: <Image File Name> Account Name: <Account Name> Account Domain: <Account Domain> Process ID: <rocess ID> Creator Process ID: <Creator Process ID> Creator Process Name: <Creator Process Name> Creator Image File Name: <Creator Image File Name> System Name: <System Name> FFile Version: <File Version> File Description: Run-Time ID: 48 Product Name: <Product Name> Product Version: <Product Version> Signed: No Signer: N/A Signed On: N/A Counter Signed: No Counter Signer: N/A Counter Signed On: N/A Session ID: 5 Process Command Line: <Process Command Line> Status: SAFE/UNSAFE/UNKNOWN Status Reference: VirusTotal/NSRL/NA Virustotal Link: |
2077 | No alert received from system systemname in last 7 Days. System Details: System Name: <System Name> IP Address: <IP Address> Asset Value: Low System Type: <System Type> Syslog Relay: <Syslog Relay> Agent Type:<Agent Type> Port: <Port> Group(s): Default, <Group> Last event received time: 2019-04-05 13:31:45 |
2078 | No alert received from group domainname in last 7 Days. |
2080 | Description: { Hash status check against VirusTotal failed. Hash: <Hash> File Name: <File Name> Error: You don’t have access to the service. Make sure your API key is working correctly } |
2100 | A category group was created in the EventTracker application User Information Account Name : <read from session> Account Domain: <Current Domain> Network Information Client Address: <IP Address> Client Browser :< browser from which app is run> Configuration Information Name : <Value> Parent: <Value> |
2101 | A category group was modified in the EventTracker application User Information Account Name : <read from session> Account Domain: <Current Domain> Network Information Client Address: <IP Address> Client Browser :<browser from which app is run> Configuration Information Old value Name : <Value> New value Name : <Value> |
2102 | A category group was deleted in the EventTracker application User Information Account Name : <read from session> Account Domain: <Current Domain> Network Information Client Address: <IP Address> Client Browser :< browser from which app is run> Configuration Information Name : <Value> |
2103 | A category group was moved in the EventTracker application User Information Account Name : <read from session> Account Domain: <Current Domain> Network Information Client Address: <IP Address> Client Browser :< browser from which app is run> Configuration Information Name : <Value> Old value Parent: <Value> New value Parent : <Value> |
2104 | A category was created in the EventTracker application User Information Account Name : <read from session> Account Domain: <Current Domain> Network Information Client Address: <IP Address> Client Browser :< browser from which app is run> Configuration Information Name : <Value> Parent: <Value> Description: <Value> Event Details: Rule <1> <event information here. > |
2105 | A category was modified in the EventTracker application User Information Account Name : <read from session> Account Domain: <Current Domain> Network Information Client Address: <IP Address> Client Browser :< browser from which app is run> Configuration Information Name : <Value> Parent: <Value> Old value Description: <Value> Event Details: Rule <1> <event information here.> New value Description: <Value> Event Details: Rule <1> <event information here. > |
2106 | A category was deleted in the EventTracker application User Information Account Name : <read from session> Account Domain: <Current Domain> Network Information Client Address: <IP Address> Client Browser :< browser from which app is run> Configuration Information Name : <Value> |
2111 | A behavior rule was added in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Rule Name: <Rule Name> Show For:<Value> Breakup Column Name: <Value> Breakup Display Name: <Value> Breakup Seperator: <Value> Breakup Terminator: <Value> Process Rule <Rule Number> Process Column Name: <Value> Process Display Name:<Value> Seperator: <Value> Terminator: <Value> Event Rule <Rule Number> Log Type: <Value> Event Type: <Value> Category: <Value> Event ID:<Value> Source: <Value> User: <Value> Description: <Value> Description Exception:<Value> |
2112 | A BehaviorRule was InActivated in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Old value Rule Name: <Value> Active: <Value> New value Rule Name: <Value> Active: <Value> |
2113 | Modified the behavior settings configuration information in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Old value User Event Threshold : <Value> Purge user data older than : <Value> Behaviour Event Threshold : <Value> Behaviour Correlation Threshold : <Value> Behaviour Learning Period Value : <Value> Top activities displayed : <Value> Enterprise activity interval : <Value> DNS Url : <Value> ProcessLib : <Value> Monitor enterprise activity : Yes/No Select Purge user data older than : <Value> User Behaviour Correlation Monitoring : Yes/No Behaviour Learning Period : <Value> Select DNS : <Value> Select Process : <Value> New value User Event Threshold : <Value> Purge user data older than : <Value> Behaviour Event Threshold : <Value> Behaviour Correlation Threshold : <Value> Behaviour Learning Period Value : <Value> Top activities displayed : <Value> Enterprise activity interval : <Value> DNS Url : <Value> ProcessLib : <Value> Monitor enterprise activity : Yes/No Select Purge user data older than : <Value> User Behaviour Correlation Monitoring : Yes/No Behaviour Learning Period : <Value> Select DNS : <Value> Select Process : <Value> |
2114 | IP lookup reputation website added. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Display Name:<Value> Url:<Value> |
2115 | IP lookup reputation website updated. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Display Name:<Value> Url:<Value> |
2116 | IP lookup reputation website deleted. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Display Name:<Value> Url:<Value> |
2117 | IP lookup reputation website Deactivated. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Display Name: <Value> Url: <Value> |
2118 | A behavior rule was deleted in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Rule Name: <Value> |
2119 | Existing baseline of behavior learning reset User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Behaviour baseline: Reset |
2121 | Weightage was added for a <category/Event Type/Log Type/Keyword/Event ID/Event Source/User> in EventTracker application User Information: Account Name: <Value> Account Domain: <Value>Network Information: Client Address: <Value> Client Browser Version: <Value>Configuration Information Name : <Value> Weightage: <Value> |
2122 | Weightage was modified for a <category/Event Type/Log Type/Keyword/Event ID/Event Source/User> in EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Old Value Name : <Value> Weightage: <Value> New Value Name : <Value> Weightage:<Value> |
2123 | Weightage was deleted for a <Keyword/Event ID/Event Source/User> in EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Name : <Value> Weightage: <Value> |
2131 | Modified the EventVault configuration information in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Old value ArchiveFrequency: <Value> ArchivePath: <Value> ArchivePurgeFrequency: <Value> New value ArchiveFrequency: <Value> ArchivePath: <Value> ArchivePurgeFrequency: <Value> |
2136 | A eventvault explorer configuration was modified in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Old configuration: SQL Server Enterprise: <Value> Max history count: <Value> New configuration: SQL Server Enterprise: <Value> Max history count: <Value> |
2137 | Persisted data was purged from EventTracker. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Report name: <Value> Purge From Datetime: <Value> Purge To Datetime: <Value> |
2141 | A Collection Master was added in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: New value Destination Name:<Value> PortNo:<Value> Description: Active: <Value> QueueCabs: <Value> Encrypt Data: <Value> |
2142 | A Collection Master was modified in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Old value: Destination Name: <Value> PortNo: <Value> Description:: Active: <Value> Encrypt Data: <Value> New value Destination Name:<Value> PortNo:<Value> Description: Active: <Value> QueueCabs: <Value> Encrypt Data: <Value> |
2143 | A Collection Master was deleted in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Collection Master:<Value> |
2147 | Collection Point deleted successfully. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Collection Point Name: <Value> Collection Point Display Name: <Value> |
2148 | A Collection Master CAB was deleted in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Cab Name:<Value> |
2149 | A collection point configured for elasticsearch Site name: <Site name> Status: Connected/Not-connected Added by: <Account Name> |
2150 | A collection point removed from elasticsearch Site name: <Site name> Removed by: <Account Name> |
2151 | A Behavior filter list was added in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: New value Behavior Type:<Value> Behavior Filter:<Value> |
2152 | A Behavior filter list was modified in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Old value Behavior Type:<Value> Behavior Filter:<Value> New value Behavior Type:<Value> Behavior Filter:<Value> |
2153 | A Behavior filter list was deleted in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Behavior Type:<Value> Behavior filter:<Value> |
2161 | A new entry has been added in Dla configuration by the EventTracker application. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Configuration name: <Value> Field seperator: <Value> Logfile extension: <Value> Logfile folder: <Value> Log type: <Value> |
2162 | An entry has been modified in Dla configuration by the EventTracker application. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Configuration name Old value: <Value> New value: <Value> |
2163 | Dla entry(s) has been deleted in Manager configuration by EventTracker application. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Configuration name: <Value> Field seperator: <Value> Logfile extension: <Value> Logfile folder: <Value> Log type: <Value> |
2164 | Port information was added in Netflow Receiver by EventTracker application. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Port number: <Value> Drop rate: <Value> Decode packet: <Value> Record binary: <Value> |
2165 | Port information was modified in Netflow Receiver by EventTracker application. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Old Value Port number: <Value> Drop rate: <Value> Decode packet: <Value> Record binary: <Value> New Value Port number: <Value> Drop rate: <Value> Decode packet: <Value> Record binary: <Value> |
2166 | Port was deleted from Netflow Receiver in EventTracker application. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Deleted Port details Port number: <Value> Drop Rate: <Value> Decode Packet: <Value> Record Binary: <Value> |
2167 | Syslog port has been added in EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: A new syslog port is added Receiver port number: <Value> Description: <Value> Cache path: <Value> Override archive purge frequency: <Value> |
2168 | Syslog port has been modified in EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Old value Receiver port number: <Value> Description: <Value> Cache path: <Value> Override archive purge frequency: <Value> New value Receiver port number: <Value> Description: <Value> Cache path: <Value> Override archive purge frequency: <Value> Archive purge frequency: <Value> |
2169 | Syslog port has been deleted in EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Deleted syslog port details Receiver port number: <Value> Description: <Value> Cache path: <Value> Override archive purge frequency: <Value> Archive purge frequency: <Value> |
2170 | VCP port has been added in EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: A new VCP port is added Port number: <Value> Description: <Value> Cache path: <Value> Override archive purge frequency: <Value> Archive purge frequency: <Value> |
2171 | VCP port has been added in EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: A new VCP port is added Port number: <Value> Description: <Value> Cache path: <Value> Override archive purge frequency: <Value> Archive purge frequency: <Value> |
2172 | VCP port has been deleted in EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Deleted VCP port details Port number: <Value> Description: <Value> Cache path: <Value> Override archive purge frequency: <Value> Archive purge frequency: <Value> |
2173 | Manager configuration information has been modified in EventTracker application. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Netflow receiver Old value: <Value> New value: <Value> |
2174 | Email configuration has been modified in EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: SMTP Server Old value: <Value> New value: <Value> |
2181 | Report settings have been modified in EventTracker application. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information: Report header Old value: <Value> New value: <Value> |
2191 | A system group was added in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Name : <Value> Description: <Value> Group with Systems based on <System Type:/IP Subnet:/Selected Systems:> <values here> |
2192 | A system group was deleted in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Name : <Value> |
2193 | A system group was modified in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Name : <Value> Old value Description: <Value> Systems: <Value> New value Description: <Value> Systems: <Value> |
2194 | A system was assigned an asset value in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Name : <Value> Old value Asset value: <Value> New value Asset value: <Value> |
2196 | A system was deleted in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Name : <Value> |
2197 | A system’s agent components were removed in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Name : <Value> |
2198 | Systems were moved in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Address (IPv6): <Client Address (IPv6)> Client Browser Version: InternetExplorer v 11.0 Configuration Information: Systems: <Systems> Old value: Group: Default New value: Group: <Group Name> |
2221 | A generated Config Assessment policy was deleted in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Name: MS-SCM win 8 Domain |
2231 | A scheduled Change Audit policy was added in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Title: <Title> Policy Name: <Policy Name> Systems: <Systems> Start from: 7/22/2015 2:51:22 AM Frequency: Daily |
2232 | A scheduled Change Audit policy was modified in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Old value Title: <Title> Policy Name: <Policy Name> Systems: <Systems> Start from: 7/22/2015 2:51:22 AM Frequency: Daily New value Title: <Title> Policy Name: <Policy Name> Systems: <Systems> Start from: 7/22/2015 2:51:22 AM Frequency: Daily |
2233 | A scheduled Change Audit policy was deleted in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Name: SampleCriticPol |
2209 | An incident was acknowledged in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Incident Name: <Value> Event ID:<Value> Event Time:<Value> Event Source:<Value> Log Type:<Value> Event Type: <Value> User:<Value> Description:<Value> Risk Value:<Value> Risk Description:<Value> |
2210 | An incident was un-acknowledged in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Incident Name: <Value> Event ID:<Value> Event Time:<Value> Event Source:<Value> Log Type:<Value> Event Type: <Value> User:<Value> Description:<Value> Risk Value:<Value> Risk Description:<Value> |
2211 | An Alert was added in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value>Network Information: Client Address: <Value> Client Browser Version: <Value>Configuration Information Name : <Value> Thread level: <Value> Threshold level: <Value> Status: <Active/Inactive>Event Details: Rule <Number> <event information here. Repeat for as many entered.>Event Filters: Rule <Number> <event information here. Repeat for as many entered.>Custom Details: <custom information here>Groups/Systems: <Groups/systems selected here> Actions: E-mail <details here> RSS: <details here> Beep: <details here> Net Message: <details here> SNMP: <details here> Syslog: <details here> Agent Remedial Action: <details here> Console Remedial Action: <details here> |
2212 | An alert was deleted in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Name : <Value> |
2213 | An alert was <Activated/Inactivated> in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Name : <Value> Status: Active/Inactive |
2214 | An action was modified for an alert in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Name : <Value> Old Value Actions: <E-mail:/RSS:/Beep:Net Message:/SNMP:/Syslog:/Agent Remedial Action:/Console Remedial Action:> <details here> New value <E-mail:/RSS:/Beep:Net Message:/SNMP:/Syslog:/Agent Remedial Action:/Console Remedial Action:> <details here> |
2215 | An alert was <Activated/Inactivated> in the EventTracker application An Alert was modified in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Old Value Name : <Value> Thread level: <Value> Threshold level: <Value> Status: <Active/Inactive> Event Details: Rule <Number> <event information here. Repeat for as many entered.> Event Filters: Rule <Number> <event information here. Repeat for as many entered.> Custom Details: <custom information here> Groups/Systems: <Groups/systems selected here> Actions: E-mail <details here> RSS: <details here> Beep: <details here> Net Message: <details here> SNMP: <details here> Syslog: <details here> Agent Remedial Action: <details here> Console Remedial Action: <details here> New value Name : <Value> Thread level: <Value> Threshold level: <Value> Status: <Active/Inactive> Event Details: Rule <Number> <event information here. Repeat for as many entered.> Event Filters: Rule <Number> <event information here. Repeat for as many entered.> Custom Details: <custom information here> Groups/Systems: <Groups/systems selected here> Actions: E-mail <details here> RSS: <details here> Beep: <details here> Net Message: <details here> SNMP: <details here> Syslog: <details here> Agent Remedial Action: <details here> Console Remedial Action: <details here></td> </tr> |
2222 | A deviation was added for a benchmark rule in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Title: <Title> Benchmark Name: <Benchmark Name> Deviation Rationale: deviation added Plan of Action and Milestones (POAM) Planned: False Deviation for this valuation only: True |
2224 | A deviation declared for a benchmark rule was deleted in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Title: <Title> Benchmark Name: <Benchmark Name> |
2225 | A deviation was modified for a benchmark rule in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Title: <Title> Benchmark Name: <Benchmark Name> Old value Deviation Rationale: deviation added Plan of Action and Milestones (POAM) Planned: False Deviation for this valuation only: True New value Deviation Rationale: deviation added. Edited to add new info Plan of Action and Milestones (POAM) Planned: False Deviation for this valuation only: True |
2226 | A deviation declared for a benchmark rule was deleted in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Title: <Title> Benchmark Name: <Benchmark Name> |
2245 | An Event Filter was added in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Name : <Value> Description: <Value> Status: <Status> Filter Details: Rule <1> Filter Exceptions: Rule <1> Groups/Systems: |
2246 | An Event Filter was modified in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Old value Name : <Value> Description: <Value> Status: <Active/Inactive> Filter Details: Rule <1> Filter Exceptions: Rule <1> Groups/Systems: New value Name : <Value> Description: <Value> Status: <Active/Inactive> Filter Details: Rule <1> Filter Exceptions: Rule <1> Groups/Systems: |
2247 | An Event Filter was deleted in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Name : <Value> Status: <Active/Inactive> |
2248 | An Event Filter was in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Name : <Value> Status: <Active/Inactive> |
2257 | Resource status changed. Resource Type: System Resource: <Resource Name> Status: Down |
2290 | Patterns was added in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Number of patterns: <Client Address> Class name: <IP Address> Group name: <Group name> File type:<File type> File name: <File name> Separator: \n Terminator: \n Data index: 0 Description index: 0 Skip Header Rows: 0 Added by: <Account Name> |
2291 | Entity was updated in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: IE v 90 Configuration Information: Entity pattern : <processnames.exe> Class name : <Processes> Updated by : <Account Name> |
2292 | Entitiy was deleted from EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: IE v 90 Configuration Information: Entities : 1 Updated by : <Account Name> |
2293 | Class was added in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Class name: <HashValues> Selected rules: <Unique process hash,> Validation type: String |
2294 | Class was updated in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Old values: Class name: <HashValues> Selected rules: <Unique process hash,> Validation type: String New values: Class name: <HashValues> Selected rules: <Unique process hash,> Validation type: String |
2295 | Class was deleted from EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Class name: <HashValues> |
3000 | Logbook configuration modified User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Column name: <Column name> Display name: <Display name> |
3001 | Logbook entry added. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Logbook Number: <Logbook Number> Logbook Title: <Logbook Title> Reason: verify Tag Criticality: 1 Added By:<Account Name> Added On: 7/23/2015 5:22:44 AM |
3002 | Logbook entry edited. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Logbook Number: <Logbook Number> Logbook Title: <Logbook Title> Reason: verify Tag Criticality: 3 Added By: <Account Name> Added On: 7/23/2015 5:25:19 AM |
3003 | Logbook activity added. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Logbook Number: <Logbook Number> Logbook Title: <Logbook Title> Activity Added By Activity Added On: 7/23/2015 5:27:54 AM |
3004 | Logbook activity added. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Logbook Number: <Logbook Number> Logbook Title: <Logbook Title> Activity Added By Activity Added On: 7/23/2015 5:27:54 AM |
3005 | Logbook attachment added. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Logbook Number: <Logbook Number> Logbook Title: <Logbook Title> Filename: <Filename> |
3006 | Logbook attachment deleted. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Logbook Number: <Logbook Number> Logbook Title: <Logbook Title> |
3007 | Logbook reference added. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Logbook Number: <Logbook Number> Logbook Title: <Logbook Title> |
3008 | Logbook reference deleted. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Logbook Number: <Logbook Number> Logbook Title: <Logbook Title> |
3009 | Logbook referenced attachment deleted. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Logbook Number: <Logbook Number> Logbook Title: <Logbook Title> |
3010 | Logbook investigation Completed. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Logbook Number: <Logbook Number> Logbook Title: <Logbook Title> Reason: verify |
3011 | Logbook reopened. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Chrome v 430 Configuration Information: Logbook Number: <Logbook Number> Logbook Title: <Logbook Title> Reason: verify |
3012 | Logbook email sent. User Information: Account Name: <Value> Account Domain: <Value> Configuration Information: Logbook Number: <Logbook Number> Logbook Title: <Logbook Title> Email Address: <Email Address> |
3021 | Knowledge object added. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: InternetExplorer v 110 Configuration Information: Object name: <Object name> Applies to: eventtracker 7.6 Description: <Description> Enabled: True |
3022 | Knowledge object modified. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: InternetExplorer v 110 Configuration Information: Object name: <Object name> Applies to: eventtracker 7.6 Description: <Description> Enabled: True |
3023 | Knowledge object deleted. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: InternetExplorer v 110 Configuration Information: Object name: <Object name> |
3030 | EventTracker Agent Configuration template is modified. Template Name: <Template Name> Agent Version: <Agent Version> User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Browser Version: Firefox v 24.0 Configuration Information: File Transfer: File transfer frequency: 11 Purge days: 3 Max retries: 5 Retry interval: 15 Generate event for each attempt: False |
3060 | An Unknown process filter was added in EventTracker application. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Address (IPv6): <Client Address (IPv6)> Client Browser Version: InternetExplorer v 11.0 Configuration Information: Rule Name: <Rule Name> Rule Description: <Rule Description> Group Name:<Group Name> Publisher: <Publisher> Publisher Operator: Contains Signed: Yes Product Name: <Product Name> Product Name Operator: Equals Product Version: <Product Version> Product Version Operator: Contains File Name: <File Name> File Name Operator: Regular Expression Image File Path: <Image File Path> Image File Path Operator: Equals Parent Process Name: <Parent Process Name> Parent Process Name Operator: Equals Parent Image File Path:<Parent Image File Path> Parent Image File Path Operator: Regular Expression File Version: <File Version> File Version Operator: Contains Type: Safe Active: True |
3061 | An Unknown process filter was modified in Event Tracker application. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Address (IPv6): <Client Address (IPv6)> Client Browser Version: InternetExplorer v 11.0 Configuration Information: Old value Rule Name: <Rule Name> Rule Description: <Rule Description> Group Name: <Group Name> Publisher: <Publisher> Publisher Operator: Equals Signed: Yes Product Name: <Product Name> Product Name Operator: Equals Product Version: <Product Version> Product Version Operator: Contains File Name: <File Name> File Name Operator: Regular Expression Image File Path: <Image File Path> Image File Path Operator: Equals Parent Process Name: <Parent Process Name> Parent Process Name Operator: Equals Parent Image File Path:<Parent Image File Path> Parent Image File Path Operator: Regular Expression File Version: <File Version> File Version Operator: Contains Type: Safe Active: True New value Rule Name: <Rule Name> Rule Description: <Rule Description> Group Name: <Group Name> Publisher: <Publisher> Publisher Operator: Equals Signed: Yes Product Name: <Product Name> Product Name Operator: Equals Product Version: <Product Version> Product Version Operator: Contains File Name: <File Name> File Name Operator: Regular Expression Image File Path: <Image File Path> Image File Path Operator: Equals Parent Process Name: <Parent Process Name> Parent Process Name Operator: Equals Parent Image File Path:<Parent Image File Path> Parent Image File Path Operator: Regular Expression File Version: <File Version> File Version Operator: Contains Type: Safe Active: False |
3062 | An Unknown process filter(s) was deleted in Event Tracker application. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Address (IPv6): <Client Address (IPv6)> Client Browser Version: InternetExplorer v 11.0 Configuration Information: Rule Name(s): Unknown process filter test rule for testing, Test rule1, Test rule2 |
3063 | An Unknown process filter was activated in the Event Tracker application. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Address (IPv6): <Client Address (IPv6)> Client Browser Version: InternetExplorer v 11.0 Configuration Information: Rule Name: <Rule Name> |
3064 | An Unknown process filter was deactivated in the Event Tracker application. User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Client Address> Client Address (IPv6): <Client Address (IPv6)> Client Browser Version: InternetExplorer v 11.0 Configuration Information: Rule Name: <Rule Name> |
3075 | User e-mail id not valid for resetting password Invalid e-mail id : <E-mail Address> |
3201 | Detected free space in drive <drive:> is less than N percent. Disk Size: X MB, Free: Y MB |
3202 | Detected Service <Service Name> is not running. |
3203 | Detected Service <Service Name> was restarted successfully. |
3204 | Detected Service <Service Name> could not be restarted. |
3206 | Detected High Memory Usage. More than N percent in use for last X seconds. Peak Memory: Q percent. Total Physical: Y MB, Total Paging: Z MB, Avail Physical: B MB, Avail Paging: C MB. |
3207 | Detected High CPU Usage. More than N percent in use for last X seconds. |
3208 | Detected software <Some S/W> has been installed on this system. |
3209 | Detected software <Some S/W> has been uninstalled from this system. |
3210 | <Some Log> Event Log is near to its maximum log size. Take administrative actions. Maximum Log Size : X Kilobytes, Current Log Size : Y Kilobytes. |
3211 | <Some Log> Event Log has already reached its maximum log size. New events cannot be logged. Take administrative actions. Maximum Log Size : X Kilobytes. |
3212 | <Some Log> Event Log has reached its maximum size. EventTracker has backed up to <Backup File> and reset the event log. |
3213 | Detected disk usage for drive X: is back to below configured threshold limit. Disk Size: Y MB, Free: Z MB |
3214 | Detected Service <Service Name> is now running. |
3215 | Detected Memory usage is back to below configured threshold limit. Peak Memory: N percent. Total Physical: W MB, Total Paging: X MB, Avail Physical: Y MB, Avail Paging: Z MB. |
3216 | Detected CPU usage is back to below configured threshold limit. Current CPU usage is N percent. |
3217 | Process <Process Name> has crossed the memory usage limit of N megabytes. Actual Use: M Megabytes |
3218 | Process <Process Name> has crossed the CPU usage limit of X%. Actual Use: Y% |
3219 | The memory usage by process <Process Name> is now normal and below the usage limit of X megabytes. Actual Use: Y Megabytes |
3220 | The CPU usage by process <Process Name> is now normal and below the usage limit of X%. Actual Use: Y% |
3221 | App Open: Exe: <Exe Name> Name: <App Name> Description: <App Description> Version: <App Version> Vendor: <App Vendor> PID: <Process ID> |
3222 | App Close: Exe: <Exe Name> Name: <App Name> PID: <Process ID> |
3223 | TCP connection ESTABLISHED Type: TCP Status: New Local Address: <Local Addr> Local Port: <Local Port> Remote Address: <Remote Address> Remote Port: <Remote Port> Connection State: <State> Process Name: <Process Name> |
3224 | TCP connection MODIFIED Type: TCP Status: Changed Local Address: <Local Address> Local Port: <Local Port> Remote Address: <Remote Address> Remote Port: <Remote Port> New Connection States: <State> Old Connection States: <State> Process Name: <Process Name> |
3225 | TCP connection DISCONNECTED Type: TCP Status: Deleted Local Address: <Local Address> Local Port: <Local Port> Remote Address: <Remote Address> Remote Port: <Remote Port> Connection active time: %<N> secs Last know Connection State: <State> Process Name: <Process Name> |
3226 | UDP connection ESTABLISHED Type: UDP Status: New Local Address: <Local Address> Local Port: <Local Port> Process Name: <Process Name> |
3227 | UDP connection DISCONNECTED Type: UDP Status: Deleted Local Address: <Local Address> Local Port: <Local Port> Connection active time: %<N> secs Process Name: <Process Name> |
3228 | Detected new drive <H:> Volume Label: Volume Serial No: 553439901 Volume ID: \\?\Volume{a6f19931-6ce9-11dd-8f6f-0013d38afad4}\ Type: Removable File System: FAT32 Network Volume: No Description: Change affects physical device or drive. |
3229 | Drive <H:> removed. Network Volume: No Description: Change affects physical device or drive. |
3229 | Events generated by solaris agent. |
3230 | Descr : FILE: <File Name> \r\n TYPE: <File Type> \r\n FIELD: <Search String> \r\n ENTRY: <Record Found> \r\n |
3231 | The agent less client <%s> could not be accessed for the last %d poll attempts. Please take administrative action. |
3232 | Disk space availability Drive C:, Disk Size: 20000 MB, Free: 10980 MB, Free(in percent): 54 Drive D:, Disk Size: 76316 MB, Free: 58921 MB, Free(in percent): 77 Drive E:, Disk Size: 18161 MB, Free: 5109 MB, Free(in percent): 28 Drive G:, Disk Size: 38475 MB, Free: 3482 MB, Free(in percent): 9 Drive H:, Disk Size: 199996 MB, Free: 7782 MB, Free(in percent): 3 |
3233 | action: monitor orig: i/f_dir: inbound i/f_name: RTL8023xp7 uuid: <00000000,00000000,00000000,00000000> product: SmartDefense __policy_id_tag: product=VPN-1 & FireWall-1[db_tag={A46E46F9-5E4A-4D14-B716-84ED6CB4D88B};mgmt=123-mar_mgmt;date=1180443405;policy_name=Standard] Attack Info: Non MD5-authenticated RIP Protocol Detected on Connection attack: RIP Enforcement Violation SmartDefense profile: Default_Protection src: 192.164.1.1 s_port: rip dst: 192.164.1.255 service: rip proto: udp |
3234 | Received Remedial action request for <Action Type> action. |
3235 | Agent <Agent System Name> : Successfully initiated <Action Type> action. |
3236 | Agent <Agent System Name> : Failed to initiate <Action Type> Remedial action. |
3237 | Agent <Agent System Name> : Remedial action is disabled at the agent side. Ignoring the request. Remedial Action: Restart Service (1) action. |
3238 | Matched Remedial action on Manager. |
3239 | USB Monitoring started for H:\ Volume Label: Volume Serial No: 553439901 Volume ID: \\?\Volume{a6f19931-6ce9-11dd-8f6f-0013d38afad4}\ Type: Removable File System: FAT32 Network Volume: No Description: Change affects physical device or drive. Console User: Active Users: |
3240 | USB Monitoring stopped for H:\ Volume Label: Volume Serial No: 1918040687 Volume ID: \\?\Volume{bf4b109d-44f2-11dd-b2fb-00148549755f}\ Type: Removable File System: FAT32 Network Volume: No Description: Change affects physical device or drive. Console User: Active Users: No files added or modified or deleted. |
3241 | EventTracker has backed up the log file :Security: because its offset has been lost. The backed up file is stored in the following directory F:\Program Files\Prism Microsystems\EventTracker\Agent\SPIDER\Eventlog_1217928508.evt for further analysis. For EventTracker to continue the main log file will be cleared. |
3242 | Media drive <H:> is disabled by EventTracker. Please contact your system administrator. Volume Label: Volume Serial No: 553439901 Volume ID: \\?\Volume{a6f19931-6ce9-11dd-8f6f-0013d38afad4}\ Type: Removable File System: FAT32 Network Volume: No Description: Change affects physical device or drive. |
3243 | Error ejecting removable device F: |
3244 | Direct log archiver started processing. |
3245 | Direct log archiver successfully processed the following files: C:\LogFiles\W3SVC1\ex070709.log C:\LogFiles\W3SVC1\ex070710.log C:\LogFiles\W3SVC1\ex070712.log |
3246 | Direct log archiver stopped processing. Total number of files processed: No files are available for processing. OR Direct log archiver stopped processing. Total number of files processed: 3 |
3247 | Direct log archiver failed to process the following files: C:\LogFiles\W3SVC1\ex070622.log C:\LogFiles\W3SVC1\ex070626.log C:\LogFiles\W3SVC1\ex070628.log |
3248 | Detected following windows updates are installed on this system: 1) KB902848 Title: Outlook Live 2003 Service Pack 2 Date: Wednesday, February 22, 2006 2) KB887619 Title: OneNote 2003 Service Pack 2 Date: Wednesday, February 22, 2006 3) KB887620 Title: Project 2003 Service Pack 2 Date: Wednesday, February 22, 2006 4) KB829019 Title: Microsoft .NET Framework 2.0: x86 (KB829019) Date: Tuesday, January 24, 2006 5) KB887618 Title: Office 2003 Service Pack 2 for Proofing Tools Date: Tuesday, February 21, 2006 |
3249 | EventTracker Agent Configuration Modified Version: 6.3 – Build 41 Agent System Name: <System Name> Managers: No change Event Filters: Enable High Performance mode: enabled. System Monitor: No change Monitor Apps: No change Services: No change Log Backup: No change Processes: No change Network Connection Monitor: No change Logfile Monitor: No change |
3250 | Critical Network alarm – Several systems are not reachable \N\NNumber of ping failure in your enterprise have crossed defined limit.\N\NPlease generate a report on event id 2008 to verify that which system are not reachable. |
3251 | Critical alert- Intrusion detected.\N\N\NAn unauthorized and repeated logon request from $IntrEvt1.Description&Client Address: &13.\N\NIt may be due to sophisticated hacking attempt. Please investigate and if required block the IP address on the firewall |
3252 | Critical security alarm – Intrusion is detected – Excessive logon failures \N\N number of log failures in your enterprise have crossed the limit. \NPlease generate a report on event id 676 to verify that which system and user is trying responsible for intrusion. |
3253 | Intrusion is detected – Excessive logon failures due to bad password \N\N Number of log failures in your enterprise have crossed the limit. \N\NPlease generate a report on event id 675 to verify that which system and user is trying responsible for intrusion. |
3254 | DLA File not found for processing in last 24 hour |
3256 | Intrusion Detection: Excessive network logon in your enterprise: \N\NFor more information about this condition\NGenerate a report on event ID 540 using EventTracker – Log Search |
3257 | Intrusion Detection: Excessive network user lockout in your enterprise: \N\NFor more information about this condition\NGenerate a report on event ID 644 using EventTracker – Log Search |
3258 | Intrusion Detection: Excessive user lockout in your enterprise: \N\NFor more information about this condition\NGenerate a report on event ID 539 using EventTracker – Log Search |
3259 | Intrusion Detection: Excessive network logon on computer $ExcessiveC540.ComputerName \N\NFor more information about this condition.\NGenerate a report on event ID 540 using EventTracker – Log Search |
3260 | Intrusion Detection: Excessive Authentication in your enterprise. \N\NFor more information about this condition.\NGenerate a report on event ID 672 using EventTracker – Log Search |
3261 | Intrusion Detection: Excessive network logon on computer $ExcessiveC672.ComputerName \N\NFor more information about this condition.\NGenerate a report on event ID=672 using EventTracker – Log Search |
3262 | Critical security alarm – excessive amount of resource access failures on $ExcessiveC560.ComputerName. \NIt is highly possible that user is persistently trying to access files and operation is not allowed. \N \NGenerate a report for event id 560 by selecting the involved computer names. Examine the origin of the traffic including the user. |
3263 | Intrusion detected\N\NUnauthorized excessive file access failure on $ExcessiveF560.&Object Name:&&New Handle ID:&. \NIt is highly possible that user is persistently trying to access file and operation is not allowed. \N\NGenerate a report for event id 560 by selecting the involved computer names. Examine the origin of the traffic including the user. |
3264 | Intrusion detected:\N\NUnauthorized user $ExcessiveU560.User is persistently attempting to access resources which not permitted. \NIt is highly possible that user is persistently trying to access file and operation is not allowed. \N \NGenerate a report for event id 560 by selecting the involved computer names. Examine the origin of the traffic including the user. |
3265 | High Security Alert:\N\NToo many files are being deleted from $ExcessiveD560.ComputerName \NIt may be a normal deletes. \N\NGenerate a report for event id 560 by selecting the involved computer names. Examine the origin of the traffic including the user. |
3266 | Critical Security alarm: Excessive logon on computer $ExcessiveC528.ComputerName \N\NFor more information about this condition.\NGenerate a report on event ID=528 using EventTracker – Log Search |
3267 | Critical Security alarm: Excessive logon on computer $ExcessiveC529.ComputerName \N\NFor more information about this condition\NGenerate a report on event ID=529 using EventTracker – Log Search |
3268 | Critical Security alarm: Excessive logon on domain $Excessive529.Domain \N\NFor more information about this condition.\NGenerate a report on event ID=529 using EventTracker – Log Search |
3271 | This event indicates that the user has initially logged onto the network. $InitEvt3.Description |
3272 | EventTracker Diagnostics found.Status: Normal |
3272 | EventTracker Diagnostics found few issues. Services Stopped: Service: <Service Name> Service: <Service Name> |
3273 | Used for vmware logs by EventTracker Agent. Also for Succesful creation of manual collection point |
3274 | Used for vmware logs by EventTracker Agent. Event Source will be VMWARE Also for Successful creation of manual collection point. Event Source will be EventTracker |
3275 | Collection Point: <CP Name> deleted successfully Drop Data: <True/False> |
3276 | A system’s type was modified in the EventTracker application User Information: Account Name: <Value> Account Domain: <Value> Network Information: Client Address: <Value> Client Browser Version: <Value> Configuration Information Name : <Value> Old value Type: <Value> New value Type: <Value> |
3277 | Agent Installation Status : <Install / Upgrade> Agent version on system Agent Systemname : < Agent version > OS Type : <OS Type > File Versions : etagent.exe <Version / Tme stamp > etagent.dll <Version / Tme stamp > etaconfig.exe <Version / Tme stamp > etaconfig.ini <Tme stamp> |
3278 | EventTracker Agent Configuration Modified Version:<EvenTracker Build Number> Agent <System Name>Managers: No change Event Filters: No change System Monitor: No change Monitor Apps: No change Services: No change Log Backup: No change Processes: No change Network Connection Monitor: No change Logfile Monitor: No changeSystem(s) requested for configuration changes: <system names> |
3279 | Agent DLA file send attempt Manager: <system names> File: <EC file name> Status: Success/Failed Reason: Descriptive message for failure with error codes etc (applicable only for failures) |
3280 | An account was successfully logged on to EventLogCentralNew Logon: Account Name: <User Name> Account Domain: <Domain name> Network Information: Client Network Address: <Network Address> Client Browser Version: Gecko v1.0. |
3281 | An account failed to log on to EventLogCentralAccount For Which Logon Failed: Account Name: <User Name> Account Domain: <Domain name> Failure Information: Failure Reason: Invalid username or password Network Information: Client Network Address: <Network Address> Client Browser Version: Gecko v1.0. |
3282 | An account was logged off from EventLogCentral.Subject: Account Name: <User name> Account Domain: <Domain name> Network Information: Client Network Address: <Network Address> Client Browser Version: IE v7. |
3283 | A scheduled analysis was added from EventTracker User Information Account Name: <User name> Account Domain: <Domain name> Configuration Information: Analysis title: Logs – Detail Analysis type: Logs – Detail Categories: ***ALERTS*** Schedule Freq: Daily Schedule Time: 12:00:00 AM Systems: <System1:System2: . .> System Groups: <Group1:Group2: . .> Sites: <Site Name> Sort by: Log Time Export type: PDF File (*.pdf) Analysis Header: Analysis Footer: |
3284 | A scheduled analysis was modified from EventLogCentralUser Information: Account Name: <User name> Account Domain: <Domain name>Network Information:Client Address: <Client Address> Client Browser Version: IE v7.0Configuration Information:Analysis Name: alerts analysis Old Value: Description: Analysis type:Logs Schedule frequency:Daily Schedule start time:12:00:00 AM Schedule, first run:1/29/2009 12:00:00 AM Email: Systems: Site:ETSERVER, Groups:DLA, Systems:attacktestRefine User: Refine Desc: Filter User: Filter Desc: Sort by:Computer Export type:PDF file RSS feed:None Report Header:EventLogCentral Report Footer:New Value: Description: Analysis type:Logs Schedule frequency:Daily Schedule start time:12:00:00 AM Schedule, first run:1/29/2009 12:00:00 AM Email: Systems: Site:ETSERVER, Groups:DLA, Systems:attacktest Refine User: Refine Desc: Filter User: Filter Desc: Sort by:Computer Export type:PDF file RSS feed:None Report Header:EventLogCentral Report Footer: |
3285 | A scheduled report was deleted from EventTracker User Information Account Name: <User name> Account Domain: <Domain name> Configuration Information: Report title: Daily USER Logon Schedule Freq: Daily Schedule Time: 2/11/2009 11:59:59 PM |
3286 | A custom column was added from EventTracker User Information Account Name: <User name> Account Domain: <Domain name> Configuration Information: Column Name: EmpLogoffTime Column Key: LogOffTime Key Value Splitter: : Key Value Terminator: ; Custom Resolution: |
3287 | A custom column was modified from EventTracker User Information Account Name: <User name> Account Domain: <Domain name> Configuration Information: Old Values: Column Name: EmpName Column Key: UserName Key Value Splitter: : Key Value Terminator: ; Custom Resolution: New Values: Column Name: Column Key: Key Value Splitter: : Key Value Terminator: ; Custom Resolution: |
3288 | A custom column was deleted from EventTracker User Information Account Name: <User name> Account Domain: <Domain name> Configuration Information: Column Name: U Name Column Key: UNa |
3289 | A report Configuration was modified from EventTracker User Information Account Name: <User name> Account Domain: <Domain name> Configuration Information: Option screen: E-mail Configuration Old Values: Authentication: False Username: New Values: Authentication: True Username: |
3290 | A role was added from EventLogCentralUser Information: Account Name: <User name> Account Domain: <Domain name>Network Information: Client Address: <Client Address> Client Browser Version: IE v7.0Configuration Information: Role Name: Testrol |
3291 | A role was modified from EventLogCentralUser Information: Account Name: <Account name> Account Domain: <Domain name>Network Information: Client Address: <Client Address> Client Browser Version: IE v7.0Configuration Information: Role Name: Testrole Old Value:Home Alerts,New Value:Home,Alerts,Advanced,Advanced Compliance,Advanced Security,Advanced Operations,On Demand,Advanced Scheduled Report,Defined Report,Exception,Dashboard,Configuration |
3292 | A role was deleted from EventLogCentralUser Information: Account Name: <User Name> Account Domain: <Domain name>Network Information: Client Address: <Client address> Client Browser Version: IE v7.0 Configuration Information:Role Name: ETREPORT Admin |
3293 | (Asked by UserA for UserB) |
3294 | Token template Added |
3295 | Token template Modified |
3296 | Token template deleted |
3297 | Token template Activated/In Activated. |
3298 | “Access denied. You do not have permission to view this page. URL: http://somedomain/page” |
3500 | EventTracker Agent has successfully received and processed the file <File Name> Contents that are read. InputDir = OutputDir = Schema Path = C:\Program Files\Prism Microsystems\EventTracker\Agent\xml OVALDefXslValid = 0 OVALDefXslFile = oval-definitions-schematron.xsl XCCDFXsdValid = 1 XCCDFXsdFile = xccdf-1.1.4.xsd OVALResultApplyXSL = 1 OVALResultXSLFile = results_to_html.xsl OVALSysCharFile = OVALSysChar.xml OVALTransFile = OVALResults.html XCCDFResultFile = XCCDFResults.xml XCCDFResultApplyXSL = 0 XCCDFResultXSLFile = xccdf_to_docx.xsl XCCDFTransFile = XCCDFResults.docx InputFolderName = C:\Program Files\Prism Microsystems\EventTracker\Agent\SCAP\NEMO\Input1270544121516 OutputFolderName = C:\Program Files\Prism Microsystems\EventTracker\Agent\SCAP\NEMO\Output1270544121516 BenchmarkProfile = DISA-Gold BenchmarkId = 55 SchedulesId = 4 |
3501 | EventTracker Agent has successfully generated the XCCDF result file.List of files that are generated. OVALTransFilePath = C:\Program Files\Prism Microsystems\EventTracker\Agent\SCAP\NEMO\Output1270543003612\OVALResults.html, OVALResultPath = C:\Program Files\Prism Microsystems\EventTracker\Agent\SCAP\NEMO\Output1270543003612\OVAL_Result.xml, OVALSysCharPath = C:\Program Files\Prism Microsystems\EventTracker\Agent\SCAP\NEMO\Output1270543003612\OVALSysChar.xml, XCCDFResultPath = C:\Program Files\Prism Microsystems\EventTracker\Agent\SCAP\NEMO\Output1270543003612\XCCDFResults.xml. |
3502 | Agent FDCC process attempt Manager: <System Name > Status: Success |
3503 | Agent FDCC process attempt Manager: <System Name > Status: Failed/Success Reason: Descriptive message for failure with error codes etc (applicable only for failures) |
3505 | [Info/Error] License Data receive failed |
3506 | [Info/Error] EventTracker Agent Configuration update requested from Manager |
3507 | [Info/Error] EventTracker Agent Script File Execution success/Failure |
3508 | [Warning] System Handle crossed the threshold limit. |
3508 | [Info] System Handle Usage is normal and below the usage limit. |
3509 | [Warning] System Thread crossed the threshold limit. |
3509 | [Info] System Thread Usage is normal and below the usage limit. |
3510 | [Warning] Process Handle crossed the threshold limit. |
3510 | [Info] Process Handle Usage is normal and below the usage limit. |
3511 | [Warning] Process Thread crossed the threshold limit. |
3511 | [Info] Process Thread Usage is normal and below the usage limit. |
3512 | [Info] Network connection opened: Type: TCP IP Version: 4 Local Address: <Local IP Address > Local Hostname: <Local Hostname > Local Port: <Port No> Remote Address: <Remote IP Address > Remote Hostname: <Remote Hostname > Remote Port: <Port No > Direction: Inbound User: <Username > Process ID: <Process ID > Process Name: <Process Name > Image File Name: <Image File Name > Services registered in this process: MSSQLSERVER(SQL Server (MSSQLSERVER)) |
3513 | [Info] Network connection opened: Type: TCP IP Version: 4 Local Address: <Local IP Address > Local Hostname: <Local Hostname > Local Port: <Port No> Remote Address: <Remote IP Address > Remote Hostname: <Remote Hostname > Remote Port: <Port No > Direction: Outbound User: <Username > rocess ID: <Process ID > Process Name: <Process Name > Image File Name: <Image File Name > |
3514 | [Info] Network connection opened: Type: TCP IP Version: 4 Local Address: <Local IP Address > Local Hostname: <Local Hostname > Local Port: <Port No> Remote Address: <Remote IP Address > Remote Hostname: <Remote Hostname > Remote Port: <Port No > Direction: Outbound User: <Username > rocess ID: <Process ID > Process Name: <Process Name > Image File Name: <Image File Name > |
3515 | [Info] UDP operation detected: Type: UDP IP Version: 4 Local Address: <Local IP Address > Local Hostname: <Local Hostname > Local Port: <Port No> Remote Address: <Remote IP Address > Remote Hostname: <Remote Hostname > Remote Port: <Port No > Operation: Send Bytes: 659 User: <Username > rocess ID: <Process ID > Process Name: <Process Name > Image File Name: <Image File Name > Services registered in this process: EventTracker Agent(EventTracker Agent) |
3516 | [Info] UDP operation detected: Type: UDP IP Version: 4 Local Address: <Local IP Address > Local Hostname: <Local Hostname > Local Port: <Port No> Remote Address: <Remote IP Address > Remote Hostname: <Remote Hostname > Remote Port: <Port No > Operation: Receive Bytes: 659 User: <Username > Process ID: <Process ID > Process Name: <Process Name > Image File Name: <Image File Name > Services registered in this process: EventTracker Receiver(EventTracker Receiver) |
3517 | DLL load |
3518 | DLL unload |
3519 | [Info]A Suspicious process has been terminated by EventTracker. Process Name: <Process Name > Image File Name: <Image File Name > Account Name: <Account name> Account Domain: <Domain name> New Process ID: <New Process ID > Creator Process ID: <Creator Process ID > Creator Process Name: <Creator Process Name > Creator Image File Name: <Creator Image File Name > System Name: <System Name > File Version: <File Version > File Description: <File Description > Product Name: <Product Name > Product Version: 6.1.7600.16385 Process Command Line: <Process Command Line > File Size: <File Size > Last Modified Time: 2010-11-20T21:29:39Z Signed: No Signer: N/A Signed On: N/A Counter Signed: No Counter Signer: N/A Counter Signed On: N/A Session ID: 5 UserSid: S-1-5-21-903365541-1942580562-2730907773-1497 Token Elevation Type: TokenElevationTypeDefault(1) LogonId: 0x1d2195f Token Integrity Level: High Hash (MD5): 60b7c0fead45f2066e5b805a91f4f0fc |
3520 | EventTracker Monitoring Daemon: EventTracker Agent scheduled restart success. EventTracker Monitoring Daemon: EventTracker Agent Forced restart success. |
3520 | EventTracker Monitoring Daemon: Memory threshold crossed the limit and Memory Usage: 1024 MB, PeakMemoryUsage: 1300 MB of the RAM, restarting the service. EventTracker Monitoring Daemon: CPU usage threshold crossed the limit of 00:01:04:9870 min, restarting the service. EventTracker Monitoring Daemon: Handle threshold crossed the limit of <>, restarting the service. EventTracker Monitoring Daemon: EventTracker Agent Forced restart failure. Current State: 02 Exit Code: 06 Check Point: 00 Wait Hint: 1000 |
3521 | Used for events generated by NCM when new ports starts listening for connection |
3522 | New process hash detected |
3523 | New remote IP detected |
3524 | [Info]A new process, which is communicating to an external IP address, has been detected by EventTracker. Hash (MD5): c5c785497a57fc48ab3d11245b90ed09 Process Name: <Process Name > Image File Name: <Image File Name > Local Address: <Local IP Address > Local Port: <Port No> Remote Address: <Remote IP Address > Remote Port: <Remote Port > Direction: Outbound Account Name: <User name> Account Domain: <Domain name> Process ID: <Process ID> Creator Process ID: <Creator Process ID> Creator Process Name: <Creator Process Name> Creator Image File Name: <Creator Image File Name> System Name: <System Name> File Version: <File Version> File Description: <File Description> Product Name: <Product Name> Product Version: <Product Version> Signed: Yes Signer: Grammarly, Inc. Signed On: 0000-00-00T00:00:00Z Counter Signed: No Counter Signer: Counter Signed On: 0000-00-00T00:00:00Z Session ID: 7 Process Command Line: N/A |
3525 | Configuration File Missing: EventTracker agent will not terminate suspicious process because WHT_HLST.safe file is not available. |
3526 | SQL service MSSQL$SQLEXPRESS has crossed the configured threshold value of 2048 MB. Current memory usage is 2058 MB. EventTracker agent is restarting the SQL instance. Instance name: MSSQL$SQLEXPRESS Memory Threshold: 2048 MB Current value: 2050 MB |
3529 | Event Type: warning Description: EventTracker Agent had detected anomalous login attempt from IP address 178.1.10.26, act of prevention created the firewall rule EventTrackerRDPProtectRule_178.1.10.26 in windows firewall. Event Type: Information Description: EventTracker Agent added anomalous login rule has crossed the rule expire time. Rule EventTrackerRDPProtectRule_178.1.10.26 will be removed from windows firewall. |
3530 | Event Type: warning Description: EventTracker Agent had detected anomalous login attempt from IP address 1.2.3.4, act of prevention adding the IP address to the EventTracker block list Event Type: Information Description: EventTracker Agent added anomalous login for IP address has crossed the rule expire time. IP address 1.2.4.4 will be removed from EventTracker block list. |
3531 | Event Type: warning Description: EventTracker Agent had attempt to connect URL https://registrationapi.eventtracker.com/ip2geo.php Failed Error message : Information Description: EventTracker Agent had attempt to connect URL https://registrationapi.eventtracker.com/ip2geo.php Success : collected Geo Information code:200, message:success ip:IP Address country_code:IN country_name:India sub_div_name:Karnataka sub_div_code:KA city:Bengaluru postal_code:560049 latitude:12.9833 longitude:77.5833 time_zone:Asia\/Kolkata |
4015 | “A new ticket has been created in PSA tool from the EventTracker application Tool Name: <Tool Name> Case id: <Case id> Ticket id: <Ticket id> Title: <Title> Added by: <Added by>” |
4016 | “A ticket in PSA tool has been modified from the EventTracker application Tool Name: <Tool Name> Case id: <Case id> Ticket id: <Ticket id> Modified by: <Modified by> Notes: ECC observed multiple attacks (Cross-Site Scripting, SQL Injection, and Remote code execution with Directory traversal) on the URL https://www.aarete.com/resources/css/styles.css?, from the bad reputed (Ukraine) which is involved in BOTS activity. and the attack status code is 200(Successful). Criticality: Medium Status: New” |
4017 | ConnectWise ticket delete |
4018 | log event when there is a failure to map EventTracker group to ConnectWise Manage company |
4019 | log event when there is a failure to map EventTracker system to ConnectWise Manage configuration |
4021 | “A report has been published to RMM Tool from EventTracker application. Tool Name: <Tool Name> Report Name: <Report Name> Report Status : No Record Found Group: <Group>” |
4022 | “A report has failed to publish to RMM Tool from EventTracker application. Tool Name: <Tool Name> Report Name: <Report Name> Report Status : <Report Status> Group: <Group>” |
8011 | Unsafe MD5 detected |