For Unix and Windows systems, the LCE will summarize and report all process crashes which happened during the past 24 hours. For a more detailed report of actual crash times, please review the realtime logs under the 'process' event type for this system.

For Unix and Windows systems, the LCE will summarize and report all users who executed commands in the past 24 hours. For a more detailed report of actual command execution and their times, please review the realtime logs under the 'process' event type for this system.

For Unix and Windows systems, the LCE will summarize and report all command names executed in the past 24 hours. For a more detailed report of actual command execution and their times, please review the realtime logs under the 'process' event type for this system.

The Windows system is running a Log Correlation Engine client and has reported CPU usage.

The LCE observed a log from the nightly cleanup messages from a Tenable SecurityCenter.

The LCE observed a log which indicates that this system is a Windows operating system and is running the Windows Defender service.

The Puppet system is used for configuration managment of Unix and Windows hosts. The puppet-master daemon is used for controlling the puppet clients on remote managed systems.

Based on the heartbeat message, the system is running an LCE tail client, a network monitoring agent, a netflow agent or another type of LCE client.

The LCE has observed a system log which indicates that the OS X desktop has been configured for remote network sharing and viewing.

The LCE has stored the most recent OS X system update log which can be used to determine the patch level of the Apple system.

The LCE observed a log which indicates available disk space on a hard drive.

The LCE observed a log which indicates that this version of Clam Anti-Virus is outdated and should be updated.

The LCE observed a log which indicates that this system is a Windows operating system and is running the AntiMalware service.

The LCE observed a log which indicates that this system is a Windows operating system and has bound to a specific port.

The LCE observed a log which indicates that this system is an OS X system running an application firewall which has allowed a running process to open a socket and listen for connections.

The LCE observed a log which indicates that this system is running the IIS FTP service.

The LCE observed a log which indicates that this device is a Palo Alto firewall appliance.

The LCE observed a log which indicates the client type and client application in use to establish the VPN tunnel.

The LCE observed a daily system log generated by a Fortigate appliance when it updates its signature database.

The LCE observed a log which indicates this system is a Cisco ASA firewall.

The LCE observed a log which indicates this system is a Cisco router or switch.

The LCE observed a log which indicates this system is a Cisco ACS device.

The LCE observed a log which indicates this system is a Citrix VPN Gateway device.

The LCE observed an Exchange log which indicates this device is running Microsoft Exchange software.

The LCE observed a log which indicates this device is an F5 Big IP Network Manager.

The version of the Tenable Nessus Vulnerability Scanner was identified from the starting log message.

The host is running the SNMP EMANATE/Lite Agent, a SNMP Agent for Embedded Devices from SNMP Research International, Inc.

The host is running the Snort intrusion detection system.

The remote host is running ClamAV AntiVirus.

The Log Correlation Engine has detected continuous DNS failures.  This activity may be suspicious and could possibly indicate botnet activity, depending on if this is unexpected. This could also indicate a network error.

The Log Correlation Engine has detected continuous threatlist activity from a host. Hosts which communicate with IP addresses that have been threatlisted for long periods of time should be investigated to see if they are part of a botnet.

The Log Correlation Engine has detected an IP address that has been the source of IDS events continuously for more than 20 minutes in a row. If the attacker is outside of your network, this could indicate a probe. If the IP address is inside your network, this could indicate a compromised host. In either case, you should look at all available logs and events concerning this IP address.

The Log Correlation Engine has detected multiple error logs occurring over a long period of time. This could indicate a problem with your server which requires attention.

The LCE observed a log which indicates that an application was reconfigured.

The LCE observed a log which indicates that an application was updated.

The LCE observed a log which indicates that an application was installed.

The LCE observed a plugin reload log from Tenable Nessus.

Based on the system log, this host is an authenticated wireless access point.

For VPN users, the LCE maintains a list of the first few IPs from which the user connects, and considers these normal.  A connection from the user outside of the normal list will be reported as an unusual VPN connection.  For a more detailed report, please review the realtime logs under the 'login' event type for this system.

For Unix and Windows systems, the LCE will summarize and report all new usb devices appearing on the network in the past 21 days. For a more detailed report of device detection, please review the realtime logs under the 'detected-change' event type for this system.

ID	Name	Severity
800537	Daily Crashed Summary	info
800536	Daily User Summary	info
800535	Daily Command Summary	info
800533	Tenable Windows Log Correlation Engine Client	info
800532	Tenable SecurityCenter	info
800531	Windows Defender Service	info
800530	Puppet Management Server	info
800528	Tenable Log Correlation Engine Client	info
800527	OS X Screen Sharing	info
800526	OS X System Update	info
800525	OS X Disk Space	info
800524	ClamAV Engine Outdated	info
800523	Windows AntiMalware Service	info
800522	Windows Listening Service	info
800520	OS X Listening Application	info
800519	IIS FTP Server	info
800518	PaloAlto Firewall Appliance	info
800517	Cisco AnyConnect VPN Client Software	info
800510	Fortigate IPS Detected	info
800508	Cisco ASA VPN Client Software	info
800507	Cisco ASA Firewall	info
800506	Cisco Device	info
800505	Cisco ACS	info
800504	Citrix VPN	info
800503	Exchange Server	info
800499	F5 Big IP Network Manager	info
800140	Tenable Nessus Version Detection	info
800139	NET-SNMP Agent Detection	info
800138	SNMP EMANATE/Lite Agent Detection	info
800137	Snort Detection	info
800130	SELinux Running	info
800128	ClamAV Running	info
800127	Long Term DNS Failures	low
800126	Long Term Threatlist Activity	low
800125	Long Term Intrusion Activity	low
800124	Long Term Error Activity	low
800121	Windows Installer Application Reconfigured	info
800120	Windows Installer Application Updated	info
800119	Windows Installer Application Installation	info
800115	Tenable Nessus	info
800104	Wireless Access Point Authenticated	info
800043	Unusual VPN Activity	info
800042	USB Device Summary	info
800041	User Source Summary	info
800040	Malware Host Summary	high
800039	Indicator Statistics	info
800038	Other Statistics	info
800037	Unnormalized Statistics	info
800036	Web Error Statistics	info
800035	Web Access Statistics	info

Detections

Analytics

Generic Family for Log Correlation Engine

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

low

low

low

low

info

info

info

info

info

info

info

info

high

info

info

info

info

info