...
| Name | Device Event Class ID | Описание | Уровень | Источник | Шаблон сообщения | Поля | Пример события (CEF) |
|---|---|---|---|---|---|---|---|
| CREATE_EXTERNAL_IDENTITY_SOURCE | 69 | Создан новый внешний источник идентификации | INFO | Пользователь / UI (Larus) | External source '${externalSourceName}' has been created. |
| Nov 05 11:23:03 naice-test-host CEF:1|Eltex|NAICE|1.0.0|69|CREATE_EXTERNAL_IDENTITY_SOURCE|6|src=172.16.0.2 suser=test-user-1 msg=External source 'LDAPServer-1' has been created. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1762316583809 externalSourceName=LDAPServer-1 |
| UPDATE_EXTERNAL_IDENTITY_SOURCE | 70 | Изменены параметры внешнего источника идентификации | INFO | Пользователь / UI (Larus) | External source '${externalSourceName}' has been edited. |
| Nov 05 11:23:03 naice-test-host CEF:1|Eltex|NAICE|1.0.0|70|UPDATE_EXTERNAL_IDENTITY_SOURCE|6|src=172.16.0.2 suser=test-user-1 msg=External source 'LDAPServer-1' has been edited. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1762316583810 externalSourceName=LDAPServer-1 |
| DELETE_EXTERNAL_IDENTITY_SOURCES | 71 | Удалены внешние источники идентификации | INFO | Пользователь / UI (Larus) | External sources '${externalSourcesNames}' have been deleted. |
| Nov 05 11:23:03 naice-test-host CEF:1|Eltex|NAICE|1.0.0|71|DELETE_EXTERNAL_IDENTITY_SOURCES|6|src=172.16.0.2 suser=test-user-1 msg=External sources 'LDAPServer-1, ADServer-2' have been deleted. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1762316583810 externalSourcesNames=LDAPServer-1, ADServer-2 |
| ROLLOVER_COMP_PASS_SUCCESS_EXTERNAL_IDENTITY_SOURCE | 132 | Пароль доменного компьютера успешно изменён | INFO | Сервис хранения данных (Ursus) | External source '${externalSourceName}'. Domain computer's '${externalSourceComputerName}' password has been auto-changed by system. |
| Dec 12 15:23:36 naice-test-host CEF:1|Eltex|NAICE|1.0.0|132|ROLLOVER_COMP_PASS_SUCCESS_EXTERNAL_IDENTITY_SOURCE|6|src=172.16.0.2 suser=test-user-1 msg=External source 'LDAPServer-1'. Domain computer's 'NAICE' password has been auto-changed by system. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1765527816814 hostname=naice-production-server externalSourceName=LDAPServer-1 externalSourceComputerName=NAICE |
| ROLLOVER_COMP_PASS_ERROR_EXTERNAL_IDENTITY_SOURCE | 133 | Ошибка при изменении пароля доменного компьютера | ERROR | Сервис хранения данных (Ursus) | Failed to auto-change password by system for domain computer '${externalSourceComputerName}' in external source '${externalSourceName}'. |
| Dec 12 15:23:36 naice-test-host CEF:1|Eltex|NAICE|1.0.0|133|ROLLOVER_COMP_PASS_ERROR_EXTERNAL_IDENTITY_SOURCE|10|src=172.16.0.2 suser=test-user-1 msg=Failed to auto-change password by system for domain computer 'NAICE' in external source 'LDAPServer-1'. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=ERROR start=1765527816815 hostname=naice-production-server externalSourceName=LDAPServer-1 externalSourceComputerName=NAICE |
...
| Name | Device Event Class ID | Описание | Уровень | Источник | Шаблон сообщения | Поля | Пример события (CEF) |
|---|---|---|---|---|---|---|---|
| RBAC_ADMIN_CREATED | 75 | Создан новый пользователь системы | INFO | Пользователь / UI (Larus) | Created user with login '${login}' and role '${role}'. |
| Nov 05 11:23:03 naice-test-host CEF:1|Eltex|NAICE|1.0.0|75|RBAC_ADMIN_CREATED|8|src=172.16.0.2 suser=test-user-1 msg=Created user with login 'admin-1' and role 'SUPER_ADMIN'. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1762316583811 role=Super Admin login=admin-1 |
| RBAC_ADMIN_CHANGED | 76 | Изменены данные пользователя системы | INFO | Пользователь / UI (Larus) | Created user with login '${login}' and role '${role}'. |
| Nov 05 11:23:03 naice-test-host CEF:1|Eltex|NAICE|1.0.0|76|RBAC_ADMIN_CHANGED|8|src=172.16.0.2 suser=test-user-1 msg=Changed user with login 'test-user-1' and role 'SUPER_ADMIN'. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1762316583811 role=Super Admin sourceName=Internal DB login=test-user-1 |
| RBAC_ADMINS_DELETED | 77 | Удалены пользователи системы | WARNING | Пользователь / UI (Larus) | Users '${logins}' have been deleted. |
| Nov 05 11:23:03 naice-test-host CEF:1|Eltex|NAICE|1.0.0|77|RBAC_ADMINS_DELETED|8|src=172.16.0.2 suser=test-user-1 msg=Users 'admin-1 (Internal DB), admin-2 (Internal DB)' have been deleted. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1762316583812 admins=admin-1 (Internal DB), admin-2 (Internal DB) |
| EXTERNAL_ADMINISTRATOR_SAVED | 138 | Пользователь из внешнего источника был сохранен в системе | INFO | Сервис авторизации администраторов (Lemmus) | User '${login}' from external source '${externalSourceName}' has been saved. |
| Jun 26 14:05:47 naice-test-host CEF:1|Eltex|NAICE|1.0.0|138|EXTERNAL_ADMINISTRATOR_SAVED|6|src=172.16.0.2 suser=test-user-1 msg=User 'adminLogintest-user-1' from external source 'LDAPServer-1' has been saved. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1782457547772 externalSourceName=LDAPServer-1 login=adminLogintest-user-1 |
| EXTERNAL_ADMINISTRATOR_UPDATED | 139 | Пользователь из внешнего источника был обновлен в системе | INFO | Сервис авторизации администраторов (Lemmus) | User '${login}' from external source '${externalSourceName}' has been updated. |
| Jun 26 14:05:47 naice-test-host CEF:1|Eltex|NAICE|1.0.0|139|EXTERNAL_ADMINISTRATOR_UPDATED|6|src=172.16.0.2 suser=test-user-1 msg=User 'adminLogintest-user-1' from external source 'LDAPServer-1' has been updated. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1782457547772 externalSourceName=LDAPServer-1 login=adminLogintest-user-1 |
| CREATE_ROLE | 80 | Создана новая роль RBAC | INFO | Пользователь / UI (Larus) | Role with a name: '${role}' has been created. |
| Nov 05 11:23:03 naice-test-host CEF:1|Eltex|NAICE|1.0.0|80|CREATE_ROLE|6|src=172.16.0.2 suser=test-user-1 msg=Role with a name: 'SUPER_ADMIN' has been created. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1762316583812 role=SUPER_ADMIN |
| EDIT_ROLE | 81 | Изменены параметры роли RBAC | INFO | Пользователь / UI (Larus) | Role with name '${role}' has been edited. |
| Nov 05 11:23:03 naice-test-host CEF:1|Eltex|NAICE|1.0.0|81|EDIT_ROLE|6|src=172.16.0.2 suser=test-user-1 msg=Role with name 'SUPER_ADMIN' has been edited. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1762316583813 role=SUPER_ADMIN |
| DELETE_ROLE | 82 | Удалены роли RBAC | INFO | Пользователь / UI (Larus) | Roles with names '${roles}' has been deleted. |
| Nov 05 11:23:03 naice-test-host CEF:1|Eltex|NAICE|1.0.0|82|DELETE_ROLE|6|src=172.16.0.2 suser=test-user-1 msg=Roles with names 'CustomRole-1, CustomRole-2' has been deleted. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1762316583813 roles=CustomRole-1, CustomRole-2 |
| RBAC_CURRENT_ADMIN_CHANGED | 116 | Пользователь изменил параметры своей учетной записи | INFO | Пользователь / UI (Larus) | User with login '${login}' and role '${role}' has updated his account settings. |
| Nov 05 11:23:03 naice-test-host CEF:1|Eltex|NAICE|1.0.0|116|RBAC_CURRENT_ADMIN_CHANGED|8|src=172.16.0.2 suser=test-user-1 msg=User with login 'test-user-1' and role 'SUPER_ADMIN' has updated his account settings. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1762316583824 sourceName=Internal DB role=SUPER_ADMIN login=admin-1 |
...
| Name | Device Event Class ID | Описание | Уровень | Источник | Шаблон сообщения | Поля | Пример события (CEF) |
|---|---|---|---|---|---|---|---|
| CREATE_USER_SESSION | 78 | Пользователь вошел в систему | INFO | Сервис авторизации администраторов (Lemmus) | User '${login}' sign in to system with role '${authorities}' from ip '${userIp}'. |
| Nov 05 11:23:03 naice-test-host CEF:1|Eltex|NAICE|1.0.0|78|CREATE_USER_SESSION|6|src=172.16.0.2 suser=test-user-1 msg=User 'test-user-1' sign in to system with role 'ROLE_ADMIN, ROLE_USER' from ip '192.168.1.100'. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1762316583812 userIp=192.168.1.100 login=test-user-1 authorities=ROLE_ADMIN, ROLE_USER sourceName=Internal DB |
| DESTROY_USER_SESSION | 79 | Пользователь вышел из системы | INFO | Сервис авторизации администраторов (Lemmus) | User '${login}' logout from system from ip '${userIp}'. |
| Nov 05 11:23:03 naice-test-host CEF:1|Eltex|NAICE|1.0.0|79|DESTROY_USER_SESSION|6|src=172.16.0.2 suser=test-user-1 msg=User 'test-user-1' logout from system from ip '192.168.1.100'. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1762316583812 sourceName=Internal DB login=test-user-1 userIp=192.168.1.100 |
| TERMINATED_USER_SESSION | 117 | Пользовательская сессия прервана | INFO | Сервис авторизации администраторов (Lemmus) | User session '${login}' from ip '${userIp}' is terminated. |
| Nov 05 11:23:03 naice-test-host CEF:1|Eltex|NAICE|1.0.0|117|TERMINATED_USER_SESSION|6|src=172.16.0.2 suser=test-user-1 msg=User session 'test-user-1' from ip '192.168.1.100' is terminated. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1762316583824 sourceName=Internal DB login=test-user-1 userIp=192.168.1.100 login=test-user-1 |
| EXPIRED_USER_SESSION | 118 | Пользовательская сессия истекла | INFO | Сервис авторизации администраторов (Lemmus) | User session '${login}' from ip '${userIp}' is expired. |
| Nov 05 11:23:03 naice-test-host CEF:1|Eltex|NAICE|1.0.0|118|EXPIRED_USER_SESSION|6|src=172.16.0.2 suser=test-user-1 msg=User session 'test-user-1' from ip '192.168.1.100' is expired. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1762316583825 userIp=192.168.1.100 login=test-user-1 sourceName=Internal DB |
FAILED_USER_SESSION_WRONG_USERNAME | 123 | Попытка аутентификации с неверным логином | WARNING | Сервис авторизации администраторов (Lemmus) | User failed authentication with login '${login}' through '${externalSourceName}' source from ip '${userIp}', wrong login. |
| Mar 06 15:40:07 naice-test-host CEF:1|Eltex|NAICE|1.0.0|123|FAILED_USER_SESSION_WRONG_USERNAME|6|src=172.16.0.2 suser=test-user-1 msg=User failed authentication with login 'test-user-1' through 'LDAPServer-1' source from ip '192.168.1.100', wrong login. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1772786407303 externalSourceName=LDAPServer-1 1 userIp=192.168.1.100 login=test-user-1 |
FAILED_USER_SESSION_WRONG_PASSWORD | 124 | Попытка аутентификации с неверным паролем | WARNING | Сервис авторизации администраторов (Lemmus) | User failed authentication with login '${login}' through '${externalSourceName}' source from ip '${userIp}', wrong password. |
| Mar 06 15:40:07 naice-test-host CEF:1|Eltex|NAICE|1.0.0|124|FAILED_USER_SESSION_WRONG_PASSWORD|6|src=172.16.0.2 suser=test-user-1 msg=User failed authentication with login 'test-user-1' through 'LDAPServer-1' source from ip '192.168.1.100', wrong password. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1772786407303 externalSourceName=LDAPServer-1 userIp=192.168.1.100 login=test-user-1 |
FAILED_USER_SESSION_EMPTY_USERNAME | 125 | Попытка аутентификации с пустым логином | ERROR | Сервис авторизации администраторов (Lemmus) | Authentication attempt through '${externalSourceName}' source without login from ip '${userIp}'. |
| Mar 06 15:40:07 naice-test-host CEF:1|Eltex|NAICE|1.0.0|125|FAILED_USER_SESSION_EMPTY_USERNAME|8|src=172.16.0.2 suser=test-user-1 msg=Authentication attempt through 'LDAPServer-1' source without login from ip '192.168.1.100'. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=ERROR start=1772786407303 externalSourceName=LDAPServer-1 userIp=192.168.1.100 |
FAILED_USER_SESSION_DISABLED | 126 | Попытка аутентификации с деактивированным пользователем | WARNING | Сервис авторизации администраторов (Lemmus) | User failed authentication with login '${login}' through '${externalSourceName}' source from ip '${userIp}', disabled account. |
| Mar 06 15:40:07 naice-test-host CEF:1|Eltex|NAICE|1.0.0|126|FAILED_USER_SESSION_DISABLED|6|src=172.16.0.2 suser=test-user-1 msg=User failed authentication with login 'test-user-1' through 'LDAPServer-1' source from ip '192.168.1.100', disabled account. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1772786407303 externalSourceName=LDAPServer-1 userIp=192.168.1.100 login=test-user-1 |
FAILED_USER_SESSION_EMPTY_PASSWORD | 140 | Попытка аутентификации с пустым паролем | WARNING | Сервис авторизации администраторов (Lemmus) | User failed authentication with login '${login}' through '${externalSourceName}' source from ip '${userIp}', empty password. |
| Mar 06 15:40:07 naice-test-host CEF:1|Eltex|NAICE|1.0.0|140|FAILED_USER_SESSION_EMPTY_PASSWORD|6|src=172.16.0.2 suser=test-user-1 msg=User failed authentication with login 'test-user-1' through 'LDAPServer-1' source from ip '192.168.1.100', empty password. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1772786407306 externalSourceName=LDAPServer-1 userIp=192.168.1.100 login=test-user-1 |
FAILED_USER_SESSION_UNAVAILABLE | 141 | Недоступность внешнего источника при попытке аутентификации | WARNING | Сервис авторизации администраторов (Lemmus) | User failed authentication with login '${login}' through '${externalSourceName}' source from ip '${userIp}', external source is unavailable. |
| Mar 06 15:40:07 naice-test-host CEF:1|Eltex|NAICE|1.0.0|141|FAILED_USER_SESSION_UNAVAILABLE|6|src=172.16.0.2 suser=test-user-1 msg=User failed authentication with login 'test-user-1' through 'LDAPServer-1' source from ip '192.168.1.100', external source is unavailable. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1772786407306 externalSourceName=LDAPServer-1 userIp=192.168.1.100 login=test-user-1 |
FAILED_USER_SESSION_ROLE_NOT_FOUND | 142 | Не найдена подходящая роль при аутентификации | WARNING | Сервис авторизации администраторов (Lemmus) | User failed authentication with login '${login}' through '${externalSourceName}' source from ip '${userIp}', role not found. |
| Mar 06 15:40:07 naice-test-host CEF:1|Eltex|NAICE|1.0.0|142|FAILED_USER_SESSION_ROLE_NOT_FOUND|6|src=172.16.0.2 suser=test-user-1 msg=User failed authentication with login 'test-user-1' through 'LDAPServer-1' source from ip '192.168.1.100', role not found. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1772786407306 externalSourceName=LDAPServer-1 userIp=192.168.1.100 login=test-user-1 |
FAILED_USER_SESSION_ERROR | 143 | Остальные ошибки аутентификации | ERROR | Сервис авторизации администраторов (Lemmus) | User failed authentication with login '${login}' through '${externalSourceName}' source from ip '${userIp}', error: '${error}'. |
| Mar 06 15:40:07 naice-test-host CEF:1|Eltex|NAICE|1.0.0|143|FAILED_USER_SESSION_ERROR|8|src=172.16.0.2 suser=test-user-1 msg=User failed authentication with login 'test-user-1' through 'LDAPServer-1' source from ip '192.168.1.100', error: 'License validation failed: Invalid signature'. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=ERROR start=1772786407306 externalSourceName=LDAPServer-1 userIp=192.168.1.100 login=test-user-1 error=License validation failed: Invalid signature |
| 150 | Запрос авторизации пользователя в системе по адресу NAICE, который не входит в список разрешённых правилами доступа | WARNING | Сервис авторизации администраторов (Lemmus) | Attempted NAICE access from disallowed address '${redirectUri}' from IP-address '${userIp}'. |
| Jun 18 08:14:55 naice-docker CEF:1|Eltex|NAICE|1.2-19791|150|FAILED_USER_SESSION_REDIRECT_URI_FORBIDDEN|8|src=100.125.0.50 msg=Attempted NAICE access from disallowed address 'https://100.110.2.216/login' from IP-address '100.125.0.50'. dst=100.110.2.216 dst_host=naice-docker dpt=443 proto=HTTPS event_log_level=WARNING start=1781770495130 redirectUri=https://100.110.2.216/login error=Redirect URI is not allowed by access rules userIp=100.125.0.50 |
| FAILED_USER_SESSION_BLOCKED_BY_PASSWORD | 153 | Пользователь заблокирован политикой блокировки после неудачных попыток ввода пароля | WARNING | Сервис авторизации администраторов (Lemmus) | User failed authentication with login '${login}' through '${externalSourceName}' source from ip '${userIp}', blocked by lockout policy |
| Jun 26 14:05:47 naice-test-host CEF:1|Eltex|NAICE|1.0.0|153|FAILED_USER_SESSION_BLOCKED_BY_PASSWORD|10|src=172.16.0.2 suser=test-user-1 msg=User failed authentication with login 'test-user-1' through 'Internal DB' source from ip '192.168.1.100', wrong passwordblocked by lockout policy. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1782457547774 login=test-user-1 error=Authentication failed in 'Local DB': Password incorrect externalSourceName=Internal DB userIp=192.168.1.100 |
| FAILED_USER_SESSION_LOGIN_BLOCKED | 154 | Попытка входа заблокированного пользователя | WARNING | Сервис авторизации администраторов (Lemmus) | An attempt to log in by a blocked user with the username '${login}' via the source '${externalSourceName}' with the ip address '${userIp}' |
| Jun 26 14:05:47 naice-test-host CEF:1|Eltex|NAICE|1.0.0|154|FAILED_USER_SESSION_LOGIN_BLOCKED|10|src=172.16.0.2 suser=test-user-1 msg=An attempt to log in by a blocked user with the username 'test-user-1' via the source 'Internal DB' with the ip address '192.168.1.100' dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1782457547774 login=test-user-1 error=Identity user blocked externalSourceName=Internal DB userIp=192.168.1.100 |
| FAILED_USER_SESSION_BLOCKED_BY_TWO_FACTOR | 161 | Пользователь заблокирован политикой блокировки во время 2FA | WARNING | Сервис авторизации администраторов (Lemmus) | User failed authentication with login '${username}' through '${sourceName}' source from ip '${userIp}', 2FA failed, because he blocked by lockout policy |
| Jun 26 14:05:47 naice-test-host CEF:1|Eltex|NAICE|1.0.0|161|FAILED_USER_SESSION_BLOCKED_BY_TWO_FACTOR|10|src=172.16.0.2 suser=test-user-1 msg=User failed authentication with login 'test-user' through 'Internal DB' source from ip '192.168.1.100', 2FA failed, blocked by lockout policy dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1782457547776 userIp=192.168.1.100 sourceName=Internal DB method=EMAIL_OTP username=test-user-1 |
| USER_SESSION_SUCCESS_TWO_FA | 162 | Пользователь успешно прошёл двухфакторную аутентификацию | INFO | Сервис авторизации администраторов (Lemmus) | User with login '${username}' through '${sourceName}' source from ip '${userIp}' successfully completed 2FA |
| Jun 26 14:05:47 naice-test-host CEF:1|Eltex|NAICE|1.0.0|162|USER_SESSION_SUCCESS_TWO_FA|10|src=172.16.0.2 suser=test-user-1 msg=User 'test-user-1' signed in with 2FA with role 'Super Admin' from IP '192.168.1.100' via source 'Internal DB'. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1782457547776 username=test-user-1 sourceName=Internal DB authorities=Super Admin userIp=192.168.1.100 |
| FAILED_USER_SESSION_INVALID_TWO_FA | 163 | Пользователь провалил 2FA, указан неверный код | WARNING | Сервис авторизации администраторов (Lemmus) | User with login '${username}' through '${sourceName}' source from ip '${userIp}' failed 2FA authentication, invalid '${twoFaMethod}'code |
| Jun 26 14:05:47 naice-test-host CEF:1|Eltex|NAICE|1.0.0|163|FAILED_USER_SESSION_INVALID_TWO_FA|10|src=172.16.0.2 suser=test-user-1 msg=User with login 'test-user' through 'Internal DB' source from ip '192.168.1.100' failed 2FA authentication, invalid EMAIL_OTP code. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1782457547777 userIp=192.168.1.100 twoFaMethod=EMAIL_OTP sourceName=Internal DB method=EMAIL_OTP username=test-user-1 |
| FAILED_USER_SESSION_TWO_FA_BLOCKED_BACKUP_CODE | 164 | Учетная запись пользователя заблокирована по политике блокировки в результате исчерпания лимита попыток ввода резервного кода 2FA | WARNING | Сервис авторизации администраторов (Lemmus) | User '${username}' has been blocked by lockout policy, backup code attempt limit reached |
| Jun 26 14:05:47 naice-test-host CEF:1|Eltex|NAICE|1.0.0|164|FAILED_USER_SESSION_TWO_FA_BLOCKED_BACKUP_CODE|10|src=172.16.0.2 suser=test-user-1 msg=User 'test-user' has been blocked by lockout policy, backup code attempt limit reached. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1782457547777 userIp=192.168.1.100 sourceName=Internal DB method=EMAIL_OTP username=test-user-1 |
FAILED_USER_SESSION_INVALID_BACKUP_CODE | 166 | Пользователь провалил 2FA, указан неверный резервный код | WARNING | Сервис авторизации администраторов (Lemmus) | User with login '${ |
| Jun 26 14:05:47 naice-test-host CEF:1|Eltex|NAICE|1.0.0|166|FAILED_USER_SESSION_INVALID_BACKUP_CODE|10|src=172.16.0.2 suser=test-user-1 msg=User with login 'test-user' through 'Internal DB' source from ip '192.168.1.100' failed 2FA authentication, invalid backup code. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1782457547777 userIp=192.168.1.100 sourceName=Internal DB username=test-user-1 |
...
| Name | Device Event Class ID | Описание | Уровень | Источник | Шаблон сообщения | Поля | Пример события (CEF) |
|---|---|---|---|---|---|---|---|
| EMAIL_SEND_ERROR | 134 | Ошибка отправки уведомления на почту | ERROR | Сервис взаимодействия шлюзов (Bubo) | Error while sending email to <email>: <error> |
| Jun 26 14:05:47 naice-test-host CEF:1|Eltex|NAICE|1.0.0|134|EMAIL_SEND_ERROR|10|src=172.16.0.2 suser=test-user-1 msg=Error while sending email to 'admin@example.com': 'License validation failed: Invalid signature' dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=ERROR start=1782457547771 error=License validation failed: Invalid signature email=admin@example.com |
| FAILED_USER_SESSION_TWO_FA_EMAIL_NOT_SENT | 165 | Пользователь не смог пройти 2FA, поскольку не было отправлено письмо на почту | WARNING | Сервис авторизации администраторов (Lemmus) | User <username> failed 2FA authentication with method `Email OTP`, email not sent to <email>: <error>. |
| Jun 26 14:05:47 naice-test-host CEF:1|Eltex|NAICE|1.0.0|165|FAILED_USER_SESSION_TWO_FA_EMAIL_NOT_SENT|10|src=172.16.0.2 suser=test-user-1 msg=User 'test-user' failed 2FA authentication with method `Email OTP`, email not sent to 'admin@example.com': 'License validation failed: Invalid signature'. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1782457547777 error=License validation failed: Invalid signature email=admin@example.com username=test-user-1 |
| FAILED_USER_ENROLL_TWO_FA_EMAIL_ERROR | 166167 | Пользователь не смог активировать 2FA, поскольку не было отправлено письмо на почту | WARNING | Сервис авторизации администраторов (Lemmus) | User <username> failed enroll 2FA method `Email OTP`, email not sent to <email>: <error>. |
| Jun 26 14:05:47 naice-test-host CEF:1|Eltex|NAICE|1.0.0|167|FAILED_USER_ENROLL_TWO_FA_EMAIL_ERROR|10|src=172.16.0.2 suser=test-user-1 msg=User 'test-user-1' failed enroll 2FA method `Email OTP`, email not sent to 'admin@example.com': 'License validation failed: Invalid signature'. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=WARNING start=1782457547777 error=1782457547777 sourceName=Internal DB error=License validation failed: Invalid signature email=admin@example.com username login=test-user-1 |
Обновление системных настроек
| Name | Device Event Class ID | Описание | Уровень | Источник | Шаблон сообщения | Поля | Пример события (CEF) |
|---|---|---|---|---|---|---|---|
| SERVER_CONFIG_CHANGED | 144 | Изменение настроек системы | INFO | Сервис управления конфигурацией (Phoca) | The following parameters have been applied: ${changedParams} |
| Mar 06 15:40:07 naice-test-host CEF:1|Eltex|NAICE|1.0.0|144|SERVER_CONFIG_CHANGED|10|src=172.16.0.2 suser=test-user-1 msg=The following parameters have been applied: \n • Logging level - Extended logs of RADIUS service: disabled → enabled dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1772786407307 changedParams=\n • Logging level - Extended logs of RADIUS service: disabled → enabled |
| DOCKER_CONFIG_APPLY_REQUEST | 145 | Запрос на изменение конфигурации контейнера | INFO | Сервис управления конфигурацией (Phoca) | A request was made to change the configuration of containers: ${containers} |
| Mar 06 15:40:07 naice-test-host CEF:1|Eltex|NAICE|1.0.0|145|DOCKER_CONFIG_APPLY_REQUEST|10|src=172.16.0.2 suser=test-user-1 msg=A request was made to change the configuration of containers: \n • naice-radius dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=DEBUG start=1772786407307 hostname=default containers=\n • naice-radius |
| DOCKER_CONFIG_APPLY_SUCCESS | 146 | Успешное изменение конфигурации контейнера | INFO | Сервис управления конфигурацией (Phoca) | Configuration applied for container ${containerName}. |
| Mar 06 15:40:07 naice-test-host CEF:1|Eltex|NAICE|1.0.0|146|DOCKER_CONFIG_APPLY_SUCCESS|10|src=172.16.0.2 suser=test-user-1 msg=Configuration applied for container naice-radius. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1772786407307 containerName=naice-radius |
SPRING_CONFIG_APPLY_REQUEST | 147 | Отправлен запрос на применение конфигураций к spring сервису | DEBUG | Сервис управления конфигурацией (Phoca) | A request was made to change the configuration of services: ${services}. |
| Jun 18 07:43:17 naice-docker CEF:1|Eltex|NAICE|1.2-19791|147|SPRING_CONFIG_APPLY_REQUEST|8|src=172.20.8.4 suser=system msg=A request was made to change the configuration of services: \n • gavia\n • bubo\n • mustela\n • ursus\n • lemmus. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=DEBUG start=1785751170593 hostname=default services=\n • gavia\n • bubo\n • mustela\n • ursus\n • lemmus |
| SPRING_CONFIG_APPLY_SUCCESS | 148 | Успешное изменение конфигурации сервиса | INFO | Сервис управления конфигурацией (Phoca) | Configuration applied for service ${serviceName}. |
| Mar 06 15:40:07 naice-test-host CEF:1|Eltex|NAICE|1.0.0|148|SPRING_CONFIG_APPLY_SUCCESS|8|src=172.16.0.2 suser=test-user-1 msg=Configuration applied for service ursus. dst=172.20.0.1 dst_host=naice-destination-host-1 dpt=443 proto=HTTPS event_log_level=INFO start=1772786407307 serviceName=ursus |
...
| Name | Device Event Class ID | Описание | Уровень | Источник | Шаблон сообщения | Поля | Пример события (CEF) |
|---|---|---|---|---|---|---|---|
| TACACS_AUTHENTICATION_ACCESS_START | 103 | Пользователь начал аутентификацию доступа через TACACS+ | INFO | Сервис Tacacs+ (Aquila) | User '${tacacsUsername}' start authentication via '${authenProtocol}'. | Указаны над таблицей. | Feb 25 10:00:51 naice-test-host CEF:1|Eltex|NAICE|1.0.0|103|TACACS_AUTHENTICATION_ACCESS_START|3|src=10.0.0.2 suser=test-user-1 msg=User 'tacacs-user-1' start authentication via 'SSH'. dst=192.168.10.1 dst_host=naice-destination-host-1 dpt=49 proto=TACACS event_log_level=INFO start=1771988451906 profileName=Profile-1 deviceIp=192.168.10.1 requestArguments=arg2\=val2 authorizationPolicyName=Default Authorize Policy acctEventType=LOGIN creationTime=1771988451807 authenticationPolicyName=Default Auth Policy attemptUserCount=1 authenMethod=TACACS identitySourceName=msad.eltex.loc deviceName=Device-1 commandSetName=Default Command Set deviceProfile=Eltex ESR authenProtocol=SSH hostname=naice-production-server tacacsUsername=testtacacs-user-1 failReason=N/A attemptPasswordCount=0 privilegeLvl=15 remoteAddress=10.0.0.2 authenticationStatus=START packetType=AUTHEN deviceType=Router tacacsCommand=show running-config policySetName=Default Policy Set authenService=LOGIN userInternalGroups=admins;auditors userExternalGroups=Domain Admins replyArguments=arg1\=val1 port=SSH service=naice-service identitySourceType=LDAP deviceModel=ESR1000 status=START deviceLocation=Data Center A |
| TACACS_AUTHENTICATION_ACCESS_SUCCESS | 104 | Пользователь успешно прошел аутентификацию доступа через TACACS+ | INFO | Сервис Tacacs+ (Aquila) | User '${tacacsUsername}' successfully authenticate via '${authenProtocol}'. | Указаны над таблицей. | Feb 25 10:00:51 naice-test-host CEF:1|Eltex|NAICE|1.0.0|104|TACACS_AUTHENTICATION_ACCESS_SUCCESS|6|src=10.0.0.2 suser=test-user-1 msg=User 'tacacs-user-1' successfully authenticate via 'SSH'. dst=192.168.10.1 dst_host=naice-destination-host-1 dpt=49 proto=TACACS event_log_level=INFO start=1771988451906 profileName=Profile-1 deviceIp=192.168.10.1 requestArguments=arg2\=val2 authorizationPolicyName=Default Authorize Policy acctEventType=LOGIN creationTime=1771988451807 authenticationPolicyName=Default Auth Policy attemptUserCount=1 authenMethod=TACACS identitySourceName=msad.eltex.loc deviceName=Device-1 commandSetName=Default Command Set deviceProfile=Eltex ESR authenProtocol=SSH hostname=naice-production-server tacacsUsername=testtacacs-user-1 failReason=N/A attemptPasswordCount=0 privilegeLvl=15 remoteAddress=10.0.0.2 authenticationStatus=PASS packetType=AUTHEN deviceType=Router tacacsCommand=show running-config policySetName=Default Policy Set authenService=LOGIN userInternalGroups=admins;auditors userExternalGroups=Domain Admins replyArguments=arg1\=val1 port=SSH service=naice-service identitySourceType=LDAP deviceModel=ESR1000 status=PASS deviceLocation=Data Center A |
| TACACS_AUTHENTICATION_ACCESS_FAILED | 105 | Пользователь не прошел аутентификацию доступа через TACACS+ | INFO | Сервис Tacacs+ (Aquila) | User '${tacacsUsername}' failed authentication via '${authenProtocol}'. | Указаны над таблицей. | Feb 25 10:00:51 naice-test-host CEF:1|Eltex|NAICE|1.0.0|105|TACACS_AUTHENTICATION_ACCESS_FAILED|8|src=10.0.0.2 suser=test-user-1 msg=User 'tacacs-user-1' failed authentication via 'SSH'. dst=192.168.10.1 dst_host=naice-destination-host-1 dpt=49 proto=TACACS event_log_level=INFO start=1771988451907 profileName=Profile-1 deviceIp=192.168.10.1 requestArguments=arg2\=val2 authorizationPolicyName=Default Authorize Policy acctEventType=LOGIN creationTime=1771988451807 authenticationPolicyName=Default Auth Policy attemptUserCount=1 authenMethod=TACACS identitySourceName=msad.eltex.loc deviceName=Device-1 commandSetName=Default Command Set deviceProfile=Eltex ESR authenProtocol=SSH hostname=naice-production-server tacacsUsername=testtacacs-user-1 failReason=N/A attemptPasswordCount=0 privilegeLvl=15 remoteAddress=10.0.0.2 authenticationStatus=FAIL packetType=AUTHEN deviceType=Router tacacsCommand=show running-config policySetName=Default Policy Set authenService=LOGIN userInternalGroups=admins;auditors userExternalGroups=Domain Admins replyArguments=arg1\=val1 port=SSH service=naice-service identitySourceType=LDAP deviceModel=ESR1000 status=FAIL deviceLocation=Data Center A |
| TACACS_AUTHENTICATION_ENABLE_START | 106 | Пользователь начал аутентификацию для изменения уровня привилегий | INFO | Сервис Tacacs+ (Aquila) | User '${tacacsUsername}' start to change privilege level to '${privilegeLvl}' via '${authenProtocol}'. | Указаны над таблицей. | Feb 25 10:00:51 naice-test-host CEF:1|Eltex|NAICE|1.0.0|106|TACACS_AUTHENTICATION_ENABLE_START|3|src=10.0.0.2 suser=test-user-1 msg=User 'tacacs-user-1' start to change privilege level to '15' via 'SSH'. dst=192.168.10.1 dst_host=naice-destination-host-1 dpt=49 proto=TACACS event_log_level=INFO start=1771988451907 profileName=Profile-1 deviceIp=192.168.10.1 requestArguments=arg2\=val2 authorizationPolicyName=Default Authorize Policy acctEventType=LOGIN creationTime=1771988451807 authenticationPolicyName=Default Auth Policy attemptUserCount=1 authenMethod=TACACS identitySourceName=msad.eltex.loc deviceName=Device-1 commandSetName=Default Command Set deviceProfile=Eltex ESR authenProtocol=SSH hostname=naice-production-server tacacsUsername=testtacacs-user-1 failReason=N/A attemptPasswordCount=0 privilegeLvl=15 remoteAddress=10.0.0.2 authenticationStatus=START packetType=AUTHEN deviceType=Router tacacsCommand=show running-config policySetName=Default Policy Set authenService=LOGIN userInternalGroups=admins;auditors userExternalGroups=Domain Admins replyArguments=arg1\=val1 port=SSH service=naice-service identitySourceType=LDAP deviceModel=ESR1000 status=START deviceLocation=Data Center A |
| TACACS_AUTHENTICATION_ENABLE_SUCCESS | 107 | Пользователь успешно изменил уровень привилегий | INFO | Сервис Tacacs+ (Aquila) | User '${tacacsUsername}' successfully changed privilege level to '${privilegeLvl}' via '${authenProtocol}'. | Указаны над таблицей. | Feb 25 10:00:51 naice-test-host CEF:1|Eltex|NAICE|1.0.0|107|TACACS_AUTHENTICATION_ENABLE_SUCCESS|6|src=10.0.0.2 suser=test-user-1 msg=User 'tacacs-user-1' successfully changed privilege level to '15' via 'SSH'. dst=192.168.10.1 dst_host=naice-destination-host-1 dpt=49 proto=TACACS event_log_level=INFO start=1771988451907 profileName=Profile-1 deviceIp=192.168.10.1 requestArguments=arg2\=val2 authorizationPolicyName=Default Authorize Policy acctEventType=LOGIN creationTime=1771988451807 authenticationPolicyName=Default Auth Policy attemptUserCount=1 authenMethod=TACACS identitySourceName=msad.eltex.loc deviceName=Device-1 commandSetName=Default Command Set deviceProfile=Eltex ESR authenProtocol=SSH hostname=naice-production-server tacacsUsername=testtacacs-user-1 failReason=N/A attemptPasswordCount=0 privilegeLvl=15 remoteAddress=10.0.0.2 authenticationStatus=PASS packetType=AUTHEN deviceType=Router tacacsCommand=show running-config policySetName=Default Policy Set authenService=LOGIN userInternalGroups=admins;auditors userExternalGroups=Domain Admins replyArguments=arg1\=val1 port=SSH service=naice-service identitySourceType=LDAP deviceModel=ESR1000 status=PASS deviceLocation=Data Center A |
| TACACS_AUTHENTICATION_ENABLE_FAILED | 108 | Пользователь не смог изменить уровень привилегий | INFO | Сервис Tacacs+ (Aquila) | User '${tacacsUsername}' failed to change privilege level to '${privilegeLvl}' via '${authenProtocol}'. | Указаны над таблицей. | Feb 25 10:00:51 naice-test-host CEF:1|Eltex|NAICE|1.0.0|108|TACACS_AUTHENTICATION_ENABLE_FAILED|8|src=10.0.0.2 suser=test-user-1 msg=User 'tacacs-user-1' failed to change privilege level to '15' via 'SSH'. dst=192.168.10.1 dst_host=naice-destination-host-1 dpt=49 proto=TACACS event_log_level=INFO start=1771988451908 profileName=Profile-1 deviceIp=192.168.10.1 requestArguments=arg2\=val2 authorizationPolicyName=Default Authorize Policy acctEventType=LOGIN creationTime=1771988451807 authenticationPolicyName=Default Auth Policy attemptUserCount=1 authenMethod=TACACS identitySourceName=msad.eltex.loc deviceName=Device-1 commandSetName=Default Command Set deviceProfile=Eltex ESR authenProtocol=SSH hostname=naice-production-server tacacsUsername=testtacacs-user-1 failReason=N/A attemptPasswordCount=0 privilegeLvl=15 remoteAddress=10.0.0.2 authenticationStatus=FAIL packetType=AUTHEN deviceType=Router tacacsCommand=show running-config policySetName=Default Policy Set authenService=LOGIN userInternalGroups=admins;auditors userExternalGroups=Domain Admins replyArguments=arg1\=val1 port=SSH service=naice-service identitySourceType=LDAP deviceModel=ESR1000 status=FAIL deviceLocation=Data Center A |
...
| Name | Device Event Class ID | Описание | Уровень | Источник | Шаблон сообщения | Поля | Пример события (CEF) |
|---|---|---|---|---|---|---|---|
| TACACS_AUTHORIZATION_ACCESS_SUCCESS | 99 | Пользователь успешно прошел авторизацию доступа | INFO | Сервис Tacacs+ (Aquila) | User '${tacacsUsername}' successfully authorized via TACACS. | Указаны над таблицей. | Feb 25 10:00:51 naice-test-host CEF:1|Eltex|NAICE|1.0.0|99|TACACS_AUTHORIZATION_ACCESS_SUCCESS|6|src=10.0.0.2 suser=test-user-1 msg=User 'tacacs-user-1' successfully authorized via TACACS. dst=192.168.10.1 dst_host=naice-destination-host-1 dpt=49 proto=TACACS event_log_level=INFO start=1771988451904 profileName=Profile-1 deviceIp=192.168.10.1 requestArguments=arg2\=val2 authorizationPolicyName=Default Authorize Policy acctEventType=LOGIN creationTime=1771988451807 authenticationPolicyName=Default Auth Policy attemptUserCount=1 authenMethod=TACACS identitySourceName=msad.eltex.loc deviceName=Device-1 commandSetName=Default Command Set deviceProfile=Eltex ESR authenProtocol=SSH hostname=naice-production-server tacacsUsername=testtacacs-user-1 failReason=N/A attemptPasswordCount=0 privilegeLvl=15 remoteAddress=10.0.0.2 authenticationStatus=PASS packetType=AUTHEN deviceType=Router tacacsCommand=show running-config policySetName=Default Policy Set authenService=LOGIN userInternalGroups=admins;auditors userExternalGroups=Domain Admins replyArguments=arg1\=val1 port=SSH service=naice-service identitySourceType=LDAP deviceModel=ESR1000 status=PASS deviceLocation=Data Center A |
| TACACS_AUTHORIZATION_ACCESS_FAILED | 100 | Пользователь не прошел авторизацию доступа | INFO | Сервис Tacacs+ (Aquila) | User '${tacacsUsername}' failed authorization via TACACS. | Указаны над таблицей. | Feb 25 10:00:51 naice-test-host CEF:1|Eltex|NAICE|1.0.0|100|TACACS_AUTHORIZATION_ACCESS_FAILED|8|src=10.0.0.2 suser=test-user-1 msg=User 'tacacs-user-1' failed authorization via TACACS. dst=192.168.10.1 dst_host=naice-destination-host-1 dpt=49 proto=TACACS event_log_level=INFO start=1771988451905 profileName=Profile-1 deviceIp=192.168.10.1 requestArguments=arg2\=val2 authorizationPolicyName=Default Authorize Policy acctEventType=LOGIN creationTime=1771988451807 authenticationPolicyName=Default Auth Policy attemptUserCount=1 authenMethod=TACACS identitySourceName=msad.eltex.loc deviceName=Device-1 commandSetName=Default Command Set deviceProfile=Eltex ESR authenProtocol=SSH hostname=naice-production-server tacacsUsername=testtacacs-user-1 failReason=N/A attemptPasswordCount=0 privilegeLvl=15 remoteAddress=10.0.0.2 authenticationStatus=FAIL packetType=AUTHEN deviceType=Router tacacsCommand=show running-config policySetName=Default Policy Set authenService=LOGIN userInternalGroups=admins;auditors userExternalGroups=Domain Admins replyArguments=arg1\=val1 port=SSH service=naice-service identitySourceType=LDAP deviceModel=ESR1000 status=FAIL deviceLocation=Data Center A |
| TACACS_AUTHORIZATION_CMD_SUCCESS | 101 | Пользователь авторизован для выполнения команды | INFO | Сервис Tacacs+ (Aquila) | User '${tacacsUsername}' authorized to execute command '${tacacsCommand}' | Указаны над таблицей. | Feb 25 10:00:51 naice-test-host CEF:1|Eltex|NAICE|1.0.0|101|TACACS_AUTHORIZATION_CMD_SUCCESS|6|src=10.0.0.2 suser=test-user-1 msg=User 'tacacs-user-1' authorized to execute command 'show running-config'. dst=192.168.10.1 dst_host=naice-destination-host-1 dpt=49 proto=TACACS event_log_level=INFO start=1771988451905 profileName=Profile-1 deviceIp=192.168.10.1 requestArguments=arg2\=val2 authorizationPolicyName=Default Authorize Policy acctEventType=LOGIN creationTime=1771988451807 authenticationPolicyName=Default Auth Policy attemptUserCount=1 authenMethod=TACACS identitySourceName=msad.eltex.loc deviceName=Device-1 commandSetName=Default Command Set deviceProfile=Eltex ESR authenProtocol=SSH hostname=naice-production-server tacacsUsername=testtacacs-user-1 failReason=N/A attemptPasswordCount=0 privilegeLvl=15 remoteAddress=10.0.0.2 authenticationStatus=PASS packetType=AUTHEN deviceType=Router tacacsCommand=show running-config policySetName=Default Policy Set authenService=LOGIN userInternalGroups=admins;auditors userExternalGroups=Domain Admins replyArguments=arg1\=val1 port=SSH service=naice-service identitySourceType=LDAP deviceModel=ESR1000 status=PASS deviceLocation=Data Center A |
| TACACS_AUTHORIZATION_CMD_FAILED | 102 | Пользователь не авторизован для выполнения команды | INFO | Сервис Tacacs+ (Aquila) | User '${tacacsUsername}' failed authorization to execute command '${tacacsCommand}'. | Указаны над таблицей. | Feb 25 10:00:51 naice-test-host CEF:1|Eltex|NAICE|1.0.0|102|TACACS_AUTHORIZATION_CMD_FAILED|8|src=10.0.0.2 suser=test-user-1 msg=User 'tacacs-user-1' failed authorization to execute command 'show running-config'. dst=192.168.10.1 dst_host=naice-destination-host-1 dpt=49 proto=TACACS event_log_level=INFO start=1771988451905 profileName=Profile-1 deviceIp=192.168.10.1 requestArguments=arg2\=val2 authorizationPolicyName=Default Authorize Policy acctEventType=LOGIN creationTime=1771988451807 authenticationPolicyName=Default Auth Policy attemptUserCount=1 authenMethod=TACACS identitySourceName=msad.eltex.loc deviceName=Device-1 commandSetName=Default Command Set deviceProfile=Eltex ESR authenProtocol=SSH hostname=naice-production-server tacacsUsername=testtacacs-user-1 failReason=N/A attemptPasswordCount=0 privilegeLvl=15 remoteAddress=10.0.0.2 authenticationStatus=FAIL packetType=AUTHEN deviceType=Router tacacsCommand=show running-config policySetName=Default Policy Set authenService=LOGIN userInternalGroups=admins;auditors userExternalGroups=Domain Admins replyArguments=arg1\=val1 port=SSH service=naice-service identitySourceType=LDAP deviceModel=ESR1000 status=FAIL deviceLocation=Data Center A |
...
| Name | Device Event Class ID | Описание | Уровень | Источник | Шаблон сообщения | Поля | Пример события (CEF) |
|---|---|---|---|---|---|---|---|
| TACACS_ACCOUNTING_LOGIN | 109 | Пользователь успешно прошел авторизацию доступа | INFO | Сервис TACACS+ (Aquila) | User '${tacacsUsername}' login. | Указаны над таблицей. | Feb 25 10:00:51 naice-test-host CEF:1|Eltex|NAICE|1.0.0|109|TACACS_ACCOUNTING_LOGIN|6|src=10.0.0.2 suser=test-user-1 msg=User 'tacacs-user-1' login. dst=192.168.10.1 dst_host=naice-destination-host-1 dpt=49 proto=TACACS event_log_level=INFO start=1771988451908 profileName=Profile-1 deviceIp=192.168.10.1 requestArguments=arg2\=val2 authorizationPolicyName=Default Authorize Policy acctEventType=LOGIN creationTime=1771988451807 authenticationPolicyName=Default Auth Policy attemptUserCount=1 authenMethod=TACACS identitySourceName=msad.eltex.loc deviceName=Device-1 commandSetName=Default Command Set deviceProfile=Eltex ESR authenProtocol=SSH hostname=naice-production-server tacacsUsername=testtacacs-user-1 failReason=N/A attemptPasswordCount=0 privilegeLvl=15 remoteAddress=10.0.0.2 authenticationStatus=INFO packetType=AUTHEN deviceType=Router tacacsCommand=show running-config policySetName=Default Policy Set authenService=LOGIN userInternalGroups=admins;auditors userExternalGroups=Domain Admins replyArguments=arg1\=val1 port=SSH service=naice-service identitySourceType=LDAP deviceModel=ESR1000 status=INFO deviceLocation=Data Center A |
| TACACS_ACCOUNTING_LOGOUT | 110 | Пользователь не прошел авторизацию доступа | INFO | Сервис TACACS+ (Aquila) | User '${tacacsUsername}' logout. | Указаны над таблицей. | Feb 25 10:00:51 naice-test-host CEF:1|Eltex|NAICE|1.0.0|110|TACACS_ACCOUNTING_LOGOUT|6|src=10.0.0.2 suser=test-user-1 msg=User 'tacacs-user-1' logout. dst=192.168.10.1 dst_host=naice-destination-host-1 dpt=49 proto=TACACS event_log_level=INFO start=1771988451909 profileName=Profile-1 deviceIp=192.168.10.1 requestArguments=arg2\=val2 authorizationPolicyName=Default Authorize Policy acctEventType=LOGIN creationTime=1771988451807 authenticationPolicyName=Default Auth Policy attemptUserCount=1 authenMethod=TACACS identitySourceName=msad.eltex.loc deviceName=Device-1 commandSetName=Default Command Set deviceProfile=Eltex ESR authenProtocol=SSH hostname=naice-production-server tacacsUsername=testtacacs-user-1 failReason=N/A attemptPasswordCount=0 privilegeLvl=15 remoteAddress=10.0.0.2 authenticationStatus=INFO packetType=AUTHEN deviceType=Router tacacsCommand=show running-config policySetName=Default Policy Set authenService=LOGIN userInternalGroups=admins;auditors userExternalGroups=Domain Admins replyArguments=arg1\=val1 port=SSH service=naice-service identitySourceType=LDAP deviceModel=ESR1000 status=INFO deviceLocation=Data Center A |
| TACACS_ACCOUNTING_CMD | 111 | Пользователь авторизован для выполнения команды | INFO | Сервис TACACS+ (Aquila) | User '${tacacsUsername}' execute command '${tacacsCommand}'. | Указаны над таблицей. | Feb 25 10:00:51 naice-test-host CEF:1|Eltex|NAICE|1.0.0|111|TACACS_ACCOUNTING_CMD|6|src=10.0.0.2 suser=test-user-1 msg=User 'tacacs-user-1' execute command 'show running-config'. dst=192.168.10.1 dst_host=naice-destination-host-1 dpt=49 proto=TACACS event_log_level=INFO start=1771988451909 profileName=Profile-1 deviceIp=192.168.10.1 requestArguments=arg2\=val2 authorizationPolicyName=Default Authorize Policy acctEventType=LOGIN creationTime=1771988451807 authenticationPolicyName=Default Auth Policy attemptUserCount=1 authenMethod=TACACS identitySourceName=msad.eltex.loc deviceName=Device-1 commandSetName=Default Command Set deviceProfile=Eltex ESR authenProtocol=SSH hostname=naice-production-server tacacsUsername=testtacacs-user-1 failReason=N/A attemptPasswordCount=0 privilegeLvl=15 remoteAddress=10.0.0.2 authenticationStatus=INFO packetType=AUTHEN deviceType=Router tacacsCommand=show running-config policySetName=Default Policy Set authenService=LOGIN userInternalGroups=admins;auditors userExternalGroups=Domain Admins replyArguments=arg1\=val1 port=SSH service=naice-service identitySourceType=LDAP deviceModel=ESR1000 status=INFO deviceLocation=Data Center A |
| TACACS_ACCOUNTING_UNKNOWN | 112 | Пользователь не авторизован для выполнения команды | INFO | Сервис TACACS+ (Aquila) | Unknown accounting event for user '${tacacsUsername}' | Указаны над таблицей. | Feb 25 10:00:51 naice-test-host CEF:1|Eltex|NAICE|1.0.0|112|TACACS_ACCOUNTING_UNKNOWN|8|src=10.0.0.2 suser=test-user-1 msg=Unknown accounting event for user tacacs-user-1'. dst=192.168.10.1 dst_host=naice-destination-host-1 dpt=49 proto=TACACS event_log_level=INFO start=1771988451909 profileName=Profile-1 deviceIp=192.168.10.1 requestArguments=arg2\=val2 authorizationPolicyName=Default Authorize Policy acctEventType=LOGIN creationTime=1771988451807 authenticationPolicyName=Default Auth Policy attemptUserCount=1 authenMethod=TACACS identitySourceName=msad.eltex.loc deviceName=Device-1 commandSetName=Default Command Set deviceProfile=Eltex ESR authenProtocol=SSH hostname=naice-production-server tacacsUsername=testtacacs-user-1 failReason=N/A attemptPasswordCount=0 privilegeLvl=15 remoteAddress=10.0.0.2 authenticationStatus=INFO packetType=AUTHEN deviceType=Router tacacsCommand=show running-config policySetName=Default Policy Set authenService=LOGIN userInternalGroups=admins;auditors userExternalGroups=Domain Admins replyArguments=arg1\=val1 port=SSH service=naice-service identitySourceType=LDAP deviceModel=ESR1000 status=INFO deviceLocation=Data Center A |
...