Log Inspection Rules

Controls whether to raise an alert when a LogInspectionRule logs an event. Use true to raise an alert. Searchable as Boolean.

Severity level that will trigger an alert. Ignored unless ruleXML contains multiple rules with different severities, and so you must indicate which severity level to use. Searchable as Numeric.

Indicates if a dependant rule or dependency group is set or not. If set, the LogInspectionRule will only log an event if the dependency is triggered. Available for user-defined rules.

If dependency is configured, the dependancy groups that this rule is dependant on.

If dependency is configured, the ID of the rule that this rule is dependant on. Ignored if the rule is from Trend Micro, which uses dependsOnRuleIDs instead.

Description of the LogInspectionRule that appears in search results, and on the General tab in the Deep Security Manager user interface. Searchable as String.

Number of times the dependant rule has to match within a specific time frame before the rule is triggered.

Groups that the LogInspectionRule is assigned to, separated by commas. Useful when dependency is used as it's possible to create a LogInspectionRule that fires when another LogInspectionRule belonging to a specific group fires.

Indentifier of the LogInspectionRule used in the Deep Security Manager user interface. Searchable as String.

Update timestamp of the LogInspectionRule, measured in milliseconds since epoch. Searchable as Date.

Log level of the LogInspectionRule indicates severity of attack. Level 0 is the least severe and will not log an event. Level 15 is the most severe.

Minimum Deep Security Agent version required by the LogInspectionRule. Searchable as String.

Minimumn Deep Security Manager version required by the LogInspectionRule. Searchable as String.

Name of the LogInspectionRule. Searchable as String.

Creation timestamp of the LogInspectionRule, measured in milliseconds since epoch. Searchable as Date.

Regular expression pattern the LogInspectionRule will look for in the logs. The rule will be triggered on a match. Open Source HIDS SEcurity (OSSEC) regular expression syntax is supported, see http://www.ossec.net/docs/syntax/regex.html.

Pattern the LogInspectionRule will look for in the logs. The string matching pattern is faster than the regex pattern.

Indicates whether recommendation scans consider the LogInspectionRule. Can be set to enabled or ignored. Custom rules cannot be recommended. Searchable as Choice.

Description of the LogInspectionRule that appears on events and the Content tab in the Deep Security Manager user interface. Alternatively, you can configure this by inserting a description in 'ruleXML'.

ID of the LogInspectionRule sent to the Deep Security Agent. The values 100000 - 109999 are reserved for user-definded rules.

LogInspectionRule in an XML format. For information on the XML format, see http://ossec-docs.readthedocs.io/en/latest/syntax/head_rules.html

Order in which LogInspectionRules are sent to the Deep Security Agent. Log inspeciton rules are sent in ascending order. Valid values are between 10000 and 20000.

Template used to create this rule.

Time period for the frequency of LogInspectionRule triggers that will generate an event, in seconds.

Controls whether to raise an alert when a LogInspectionRule logs an event. Use true to raise an alert. Searchable as Boolean.

Severity level that will trigger an alert. Ignored unless ruleXML contains multiple rules with different severities, and so you must indicate which severity level to use. Searchable as Numeric.

Indicates if a dependant rule or dependency group is set or not. If set, the LogInspectionRule will only log an event if the dependency is triggered. Available for user-defined rules.

If dependency is configured, the dependancy groups that this rule is dependant on.

If dependency is configured, the ID of the rule that this rule is dependant on. Ignored if the rule is from Trend Micro, which uses dependsOnRuleIDs instead.

Description of the LogInspectionRule that appears in search results, and on the General tab in the Deep Security Manager user interface. Searchable as String.

Number of times the dependant rule has to match within a specific time frame before the rule is triggered.

Groups that the LogInspectionRule is assigned to, separated by commas. Useful when dependency is used as it's possible to create a LogInspectionRule that fires when another LogInspectionRule belonging to a specific group fires.

Indentifier of the LogInspectionRule used in the Deep Security Manager user interface. Searchable as String.

Update timestamp of the LogInspectionRule, measured in milliseconds since epoch. Searchable as Date.

Log level of the LogInspectionRule indicates severity of attack. Level 0 is the least severe and will not log an event. Level 15 is the most severe.

Minimum Deep Security Agent version required by the LogInspectionRule. Searchable as String.

Minimumn Deep Security Manager version required by the LogInspectionRule. Searchable as String.

Name of the LogInspectionRule. Searchable as String.

Creation timestamp of the LogInspectionRule, measured in milliseconds since epoch. Searchable as Date.

Regular expression pattern the LogInspectionRule will look for in the logs. The rule will be triggered on a match. Open Source HIDS SEcurity (OSSEC) regular expression syntax is supported, see http://www.ossec.net/docs/syntax/regex.html.

Pattern the LogInspectionRule will look for in the logs. The string matching pattern is faster than the regex pattern.

Indicates whether recommendation scans consider the LogInspectionRule. Can be set to enabled or ignored. Custom rules cannot be recommended. Searchable as Choice.

Description of the LogInspectionRule that appears on events and the Content tab in the Deep Security Manager user interface. Alternatively, you can configure this by inserting a description in 'ruleXML'.

ID of the LogInspectionRule sent to the Deep Security Agent. The values 100000 - 109999 are reserved for user-definded rules.

LogInspectionRule in an XML format. For information on the XML format, see http://ossec-docs.readthedocs.io/en/latest/syntax/head_rules.html

Order in which LogInspectionRules are sent to the Deep Security Agent. Log inspeciton rules are sent in ascending order. Valid values are between 10000 and 20000.

Template used to create this rule.

Time period for the frequency of LogInspectionRule triggers that will generate an event, in seconds.

Limits the number of objects returned. Default 5000.

Array of search critiera used to filter objects. Searching with multiple criteria returns results that satisfy all of the criteria. Searching with no criteria returns all objects.