TIBCO LogLogic Reports for FISMA

All TIBCO LogLogic reports can be used to monitor regular user activity, as well as the activity and results of system and network administrators. .

Serial Number TIBCO LogLogic Report Description
1 FISMA: Accepted VPN Connections - RADIUS Displays all users connected to the internal network through the RADIUS VPN.
2 FISMA: Account Activities on UNIX Servers Displays all accounts activities on UNIX servers to ensure authorized and appropriate access.
3 FISMA: Account Activities on Windows Servers Displays all accounts activities on Windows servers to ensure authorized and appropriate access.
4 FISMA: Accounts Changed on NetApp Filer Displays all accounts changed on NetApp Filer to ensure authorized and appropriate access.
5 FISMA: Accounts Changed on TIBCO Administrator Displays all accounts changed on TIBCO Administrator to ensure authorized and appropriate access.
6 FISMA: Accounts changed on TIBCO ActiveMatrix Administrator Displays all accounts changed on TIBCO ActiveMatrix Administrator to ensure authorized and appropriate access.
7 FISMA: Accounts Created on NetApp Filer Displays all accounts created on NetApp Filer to ensure authorized and appropriate access.
8 FISMA: Accounts Created on NetApp Filer Audit Displays all accounts created on NetApp Filer Audit to ensure authorized and appropriate access.
9 FISMA: Accounts Created on Sidewinder Displays all accounts created on Sidewinder to ensure authorized and appropriate access.
10 FISMA: Accounts Created on Symantec Endpoint Protection Displays all accounts created on Symantec Endpoint Protection to ensure authorized and appropriate access.
11 FISMA: Accounts Created on TIBCO Administrator Displays all accounts created on TIBCO Administrator to ensure authorized and appropriate access.
12 FISMA: Accounts Created on TIBCO ActiveMatrix Administrator Displays all accounts created on TIBCO ActiveMatrix Administrator to ensure authorized and appropriate access.
13 FISMA: Accounts Created on UNIX Servers Displays all accounts created on UNIX servers to ensure authorized and appropriate access.
14 FISMA: Accounts Created on Windows Servers Displays all accounts created on Windows servers to ensure authorized and appropriate access.
15 FISMA: Accounts Deleted on Sidewinder Displays all accounts deleted on Sidewinder to ensure authorized and appropriate access.
16 FISMA: Accounts Deleted on NetApp Filer Displays all accounts deleted on NetApp Filer to ensure authorized and appropriate access.
17 FISMA: Accounts Deleted on NetApp Filer Audit Displays all accounts deleted on NetApp Filer Audit to ensure authorized and appropriate access.
18 FISMA: Accounts Deleted on Symantec Endpoint Protection Displays all accounts deleted on Symantec Endpoint Protection to ensure authorized and appropriate access.
19 FISMA: Accounts Deleted on TIBCO Administrator Displays all accounts deleted on TIBCO Administrator to ensure authorized and appropriate access.
20 FISMA: Accounts Deleted on TIBCO ActiveMatrix Administrator Displays all accounts deleted on TIBCO ActiveMatrix Administrator to ensure authorized and appropriate access.
21 FISMA: Accounts Deleted on UNIX Servers Displays all accounts deleted on UNIX servers to ensure authorized and appropriate access.
22 FISMA: Accounts Deleted on Windows Servers Displays all accounts deleted on Windows servers to ensure authorized and appropriate access.
23 FISMA: Active Directory System Changes Displays changes made within Active Directory.
24 FISMA: Administrators Activities on Servers Displays the latest activities performed by administrators and root users to ensure appropriate access.
25 FISMA: Applications Under Attack Displays all applications under attack and the attack signatures.
26 FISMA: Applications Under Attack - Cisco IOS Displays all applications under attack and the attack signatures by Cisco IOS.
27 FISMA: Applications Under Attack - FireEye MPS Displays all applications under attack as well as the attack signatures by FireEye MPS.
28 FISMA: Applications Under Attack - ISS SiteProtector Displays all applications under attack and the attack signatures by ISS SiteProtector.
29 FISMA: Applications Under Attack - SiteProtector Displays all applications under attack and the attack signatures by SiteProtector.
30 FISMA: Applications Under Attack - Sourcefire Defense Center Displays all applications under attack and the attack signatures by Sourcefire Defense Center.
31 FISMA: Attack Origins Displays the sources that have initiated the most attacks.
32 FISMA: Attack Origins - Cisco IOS Displays the sources that have initiated the most attacks by Cisco IOS.
33 FISMA: Attack Origins - HIPS Displays the sources that have initiated the most attacks.
34 FISMA: Attack Origins - ISS SiteProtector Displays the sources that have initiated the most attacks by ISS SiteProtector.
35 FISMA: Attack Origins - SiteProtector Displays the sources that have initiated the most attacks by SiteProtector.
36 FISMA: Attack Origins - Sourcefire Defense Center Displays the sources that have initiated the most attacks by Sourcefire Defense Center.
37 FISMA: Attacks Detected Displays all IDS attacks detected against servers and applications.
38 FISMA: Attacks Detected - Cisco IOS Displays all IDS attacks detected against servers and applications by Cisco IOS.
39 FISMA: Attacks Detected - HIPS Displays all IPS attacks detected against servers and applications.
40 FISMA: Attacks Detected - ISS SiteProtector Displays all IDS attacks detected against servers and applications by ISS SiteProtector.
41 FISMA: Attacks Detected - SiteProtector Displays all IDS attacks detected against servers and applications by SiteProtector.
42 FISMA: Attacks Detected - Sourcefire Defense Center Displays all IDS attacks detected against servers and applications by Sourcefire Defense Center.
43 FISMA: Check Point Configuration Changes Displays all Check Point audit events related to configuration changes.
44 FISMA: Check Point Management Station Login Displays all login events to the Check Point management station.
45 FISMA: Check Point Object Activity Displays all creation, deletion, and modification of Check Point objects.
46 FISMA: Cisco ESA: Attacks by Event ID Displays Cisco ESA attacks by Event ID.
47 FISMA: Cisco ESA: Attacks Detected Displays attacks detected by Cisco ESA.
48 FISMA: Cisco ESA: Attacks by Threat Name Displays Cisco ESA attacks by threat name.
49 FISMA: Cisco ESA: Scans Displays scans using Cisco ESA.
50 FISMA: Cisco ESA: Updated Displays updates to Cisco ESA.
51 FISMA: Cisco ISE, ACS Accounts Created Displays all accounts created on Cisco ISE and Cisco SecureACS to ensure authorized and appropriate access.
52 FISMA: Cisco ISE, ACS Accounts Removed Displays all accounts removed on Cisco ISE and Cisco SecureACS to ensure authorized and appropriate access.
53 FISMA: Cisco ISE, ACS Configuration Changes Displays Cisco ISE and Cisco SecureACS configuration changes.
54 FISMA: Cisco ISE, ACS Password Changes Displays all password change activities on Cisco ISE and Cisco SecureACS to ensure authorized and appropriate access.
55 FISMA: Cisco Line Protocol Status Changes Displays all Cisco line protocol up and down events.
56 FISMA: Cisco Link Status Changes Displays all Cisco link up and down events.
57 FISMA: Cisco Peer Reset/Reload Displays all Cisco Peer reset and reload events.
58 FISMA: Cisco Peer Supervisor Status Changes Displays all Cisco Peer Supervisor status changes.
59 FISMA: Cisco PIX, ASA, FWSM Failover 
Disabled Displays all logs related to disabling Cisco PIX, ASA, and FWSM failover capability.
60 FISMA: Cisco PIX, ASA, FWSM Failover 
Performed Displays all logs related to performing a Cisco PIX, ASA, and FWSM failover.
61 FISMA: Cisco PIX, ASA, FWSM Policy 
Changed Displays all configuration changes made to the Cisco PIX, ASA, and FWSM devices.
62 FISMA: Cisco PIX, ASA, FWSM Restarted Displays all Cisco PIX, ASA, or FWSM restart activities to detect unusual activities.
63 FISMA: Cisco PIX, ASA, FWSM Routing Failure Displays all Cisco PIX, ASA, and FWSM routing error messages.
64 FISMA: Cisco Redundancy Version Check Failed Displays all Cisco redundancy version check failures.
65 FISMA: Cisco Switch Policy Changes Displays all configuration changes to the Cisco router and switch policies.
66 FISMA: Cisco Routers and Switches Restart Displays all Cisco routers and switches restart activities to detect unusual activities.
67 FISMA: DB2 Database Backup Failed Displays all IBM DB2 Database Server backup failures.
68 FISMA: DB2 Database Failed Logins Displays all failed login attempts to review any access violations or unusual activity.
69 FISMA: DB2 Database Successful Logins Displays successful DB2 database logins.
70 FISMA: DB2 Database Restore Failed Displays all IBM DB2 Database restore failure events.
71 FISMA: DB2 Database Stop and Start Events Displays DB2 database events related to starting and stopping the database.
72 FISMA: Denied VPN Connections - RADIUS Displays all users denied access to the internal network by the RADIUS VPN.
73 FISMA: DHCP Granted/Renewed Activities on Microsoft DHCP Displays all DHCP Granted/Renewed activities on Microsoft DHCP Server.
74 FISMA: DHCP Granted/Renewed Activities on VMware vShield Displays all DHCP Granted/Renewed activities on VMware vShield Edge.
75 FISMA: DNS Server Error Displays all events when DNS Server has errors.
76 FISMA: Domain Activities on Symantec Endpoint Protection Displays all domain activities on Symantec Endpoint Protection.
77 FISMA: Escalated Privilege Activities on Servers Displays all privilege escalation activities performed on servers to ensure appropriate access.
78 FISMA: ESX Accounts Activities Displays all accounts activities on VMware ESX servers to ensure authorized and appropriate access.
79 FISMA: ESX Accounts Created Displays all accounts created on VMware ESX servers to ensure authorized and appropriate access.
80 FISMA: ESX Accounts Deleted Displays all accounts deleted on VMware ESX servers to ensure authorized and appropriate access.
81 FISMA: ESX Failed Logins Failed VMware ESX logins for known user.
82 FISMA: ESX Group Activities Displays all group activities on VMware ESX servers to ensure authorized and appropriate access.
83 FISMA: ESX Kernel log daemon terminating Displays all VMware ESX Kernel log daemon terminating.
84 FISMA: ESX Kernel logging Stop Displays all VMware ESX Kernel logging stops.
85 FISMA: ESX Logins Failed Unknown User Failed VMware ESX logins for unknown user.
86 FISMA: ESX Logins Succeeded Displays successful logins to VMware ESX to ensure only authorized personnel have access.
87 FISMA: ESX Syslogd Restart Displays all VMware ESX syslogd restarts.
88 FISMA: F5 BIG-IP TMOS Login Failed Displays all F5 BIG-IP TMOS login events which have failed.
89 FISMA: F5 BIG-IP TMOS Login Successful Displays all F5 BIG-IP TMOS login events which have succeeded.
90 FISMA: F5 BIG-IP TMOS Password Changes Displays all password change activities on F5 BIG-IP TMOS to ensure authorized and appropriate access.
91 FISMA: F5 BIG-IP TMOS Restarted Displays all events when the F5 BIG-IP TMOS has been restarted.
92 FISMA: Files Accessed on NetApp Filer Audit Displays all files accessed on NetApp Filer Audit to ensure appropriate access.
93 FISMA: Files Accessed through Pulse Connect Secure Displays all files accessed through Pulse Connect Secure.
94 FISMA: Files Accessed on Servers Displays all files accessed on servers to ensure appropriate access.
95 FISMA: Files Accessed through Juniper SSL VPN (Secure Access) Displays all files accessed through Juniper SSL VPN (Secure Access).
96 FISMA: Files Accessed through PANOS Displays all files accessed through Palo Alto Networks.
97 FISMA: FireEye MPS: Attacks by Event ID Displays FireEye MPS attacks by Event ID.
98 FISMA: FireEye MPS: Attacks by Threat Name Displays FireEye MPS attacks by threat name.
99 FISMA: FireEye MPS: Attacks Detected Displays attacks detected by FireEye MPS.
100 FISMA: Firewall Connections Accepted - Check Point Displays all traffic passing through the Check Point firewall.
101 FISMA: Firewall Connections Accepted - Cisco ASA Displays all traffic passing through the Cisco ASA firewall.
102 FISMA: Firewall Connections Accepted - Cisco FWSM Displays all traffic passing through the Cisco FWSM firewall.
103 FISMA: Firewall Connections Accepted - Cisco IOS Displays all traffic passing through the Cisco IOS firewall.
104 FISMA: Firewall Connections Accepted - Cisco Netflow Displays all traffic passing through the Cisco Netflow.
105 FISMA: Firewall Connections Accepted - Cisco NXOS Displays all traffic passing through the Cisco NXOS device.
106 FISMA: Firewall Connections Accepted - Cisco PIX Displays all traffic passing through the Cisco PIX firewall.
107 FISMA: Firewall Connections Accepted - F5 BIG-IP TMOS Displays all traffic passing through the F5 BIG-IP TMOS device.
108 FISMA: Firewall Connections Accepted - Fortinet Displays all traffic passing through the Fortinet firewall.
109 FISMA: Firewall Connections Accepted - Juniper Firewall Displays all traffic passing through the Juniper firewall.
110 FISMA: Firewall Connections Accepted - Juniper JunOS Displays all traffic passing through the Juniper JunOS firewall.
111 FISMA: Firewall Connections Accepted - Juniper RT Flow Displays all traffic passing through the Juniper RT Flow.
112 FISMA: Firewall Connections Accepted - Nortel Displays all traffic passing through the Nortel firewall.
113 FISMA: Firewall Connections Accepted - PANOS Displays all traffic passing through the Palo Alto Networks firewall.
114 FISMA: Firewall Connections Accepted - Sidewinder Displays all traffic passing through the Sidewinder firewall.
115 FISMA: Firewall Connections Accepted - VMware vShield Displays all traffic passing through the VMware vShield device.
116 FISMA: Firewall Connections Denied - Check Point Displays the applications that have been denied access the most by the Check Point devices.
117 FISMA: Firewall Connections Denied - Cisco ASA Displays the applications that have been denied access the most by the Cisco ASA devices.
118 FISMA: Firewall Connections Denied - Cisco FWSM Displays the applications that have been denied access the most by the Cisco FWSM devices.
119 FISMA: Firewall Connections Denied - Cisco IOS Displays the applications that have been denied access the most by the Cisco IOS.
120 FISMA: Firewall Connections Denied - Cisco NXOS Displays the applications that have been denied access the most by the Cisco NXOS devices.
121 FISMA: Firewall Connections Denied - Cisco PIX Displays the applications that have been denied access the most by the Cisco PIX devices.
122 FISMA: Firewall Connections Denied - Cisco Router Displays the applications that have been denied access the most by the Cisco Router.
123 FISMA: Firewall Connections Denied - F5 BIG-IP TMOS Displays the applications that have been denied access the most by the F5 BIG-IP TMOS.
124 FISMA: Firewall Connections Denied - Fortinet Displays the applications that have been denied access the most by the Fortinet devices.
125 FISMA: Firewall Connections Denied - Juniper Firewall Displays the applications that have been denied access the most by the Juniper firewall.
126 FISMA: Firewall Connections Denied - Juniper JunOS Displays the applications that have been denied access the most by the Juniper JunOS.
127 FISMA: Firewall Connections Denied - Juniper RT Flow Displays the applications that have been denied access the most by the Juniper RT Flow.
128 FISMA: Firewall Connections Denied - Nortel Displays the applications that have been denied access the most by the Nortel devices.
129 FISMA: Firewall Connections Denied - PANOS Displays the applications that have been denied access the most by the Palo Alto Networks devices.
130 FISMA: Firewall Connections Denied - 
Sidewinder Displays the applications that have been denied access the most by the Sidewinder.
131 FISMA: Firewall Connections Denied - VMware vShield Displays the applications that have been denied access the most by the VMware vShield.
132 FISMA: Firewall Traffic Considered Risky - Check Point Displays Check Point allowed firewall traffic that is considered risky.
133 FISMA: Firewall Traffic Considered Risky - Cisco ASA Displays Cisco ASA allowed firewall traffic that is considered risky.
134 FISMA: Firewall Traffic Considered Risky - Cisco FWSM Displays Cisco FWSM allowed firewall traffic that is considered risky.
135 FISMA: Firewall Traffic Considered Risky - Cisco IOS Displays Cisco IOS allowed firewall traffic that is considered risky.
136 FISMA: Firewall Traffic Considered Risky - Cisco Netflow Displays Cisco Netflow allowed firewall traffic that is considered risky.
137 FISMA: Firewall Traffic Considered Risky - F5 BIG-IP TMOS Displays F5 BIG-IP TMOS allowed firewall traffic that is considered risky.
138 FISMA: Firewall Traffic Considered Risky - Cisco PIX Displays Cisco PIX allowed firewall traffic that is considered risky.
139 FISMA: Firewall Traffic Considered Risky - Fortinet Displays Fortinet allowed firewall traffic that is considered risky.
140 FISMA: Firewall Traffic Considered Risky - Juniper Firewall Displays Juniper firewall allowed firewall traffic that is considered risky.
141 FISMA: Firewall Traffic Considered Risky - Juniper JunOS Displays Juniper JunOS allowed firewall traffic that is considered risky.
142 FISMA: Firewall Traffic Considered Risky - Juniper RT Flow Displays Juniper RT Flow allowed firewall traffic that is considered risky.
143 FISMA: Firewall Traffic Considered Risky - Nortel Displays Nortel allowed firewall traffic that is considered risky.
144 FISMA: Firewall Traffic Considered Risky - PANOS Displays Palo Alto Networks allowed firewall traffic that is considered risky.
145 FISMA: Firewall Traffic Considered Risky - Sidewinder Displays Sidewinder allowed firewall traffic that is considered risky.
146 FISMA: Firewall Traffic Considered Risky - VMware vShield Displays VMware vShield Edge allowed firewall traffic that is considered risky.
147 FISMA: FortiOS: Attacks by Event ID Displays FortiOS attacks by Event ID.
148 FISMA: FortiOS: Attacks by Threat Name Displays FortiOS attacks by threat name.
149 FISMA: FortiOS: Attacks Detected Displays attacks detected by FortiOS.
150 FISMA: FortiOS DLP Attacks Detected Displays all DLP attacks detected by FortiOS.
151 FISMA: Guardium SQL Guard Audit Logins Displays all login attempts to the Guardium SQL Server Audit database.
152 FISMA: Guardium SQL Guard Audit Startup or Shutdown Displays all startup and shutdown events on Guardium SQL Audit Server.
153 FISMA: Guardium SQL Guard Logins Displays all login attempts to the Guardium SQL Server database.
154 FISMA: Guardium SQL Guard Startup or Shutdown Displays all startup and shutdown events on Guardium SQL Server.
155 FISMA: Group Activities on NetApp Filer Audit Displays all group activities on NetApp Filer Audit to ensure authorized and appropriate access.
156 FISMA: Group Activities on Symantec Endpoint Protection Displays all group activities on Symantec Endpoint Protection to ensure authorized and appropriate access.
157 FISMA: Group Activities on TIBCO ActiveMatrix Administrator Displays all group activities on TIBCO ActiveMatrix Administrator to ensure authorized and appropriate access.
158 FISMA: Group Activities on UNIX Servers Displays all group activities on UNIX Servers to ensure authorized and appropriate access.
159 FISMA: Group Activities on Windows Servers Displays all group activities on Windows Server to ensure authorized and appropriate access.
160 FISMA: HP NonStop Audit Configuration Changes Displays all audit configuration changes on HP NonStop.
161 FISMA: HP NonStop Audit Login Failed Displays all HP NonStop Audit login events which have failed.
162 FISMA: HP NonStop Audit Login Successful Displays all HP NonStop Audit login events which have succeeded.
163 FISMA: HP NonStop Audit Object Changes Displays HP NonStop Audit events related to object changes.
164 FISMA: HP NonStop Audit Permissions Changed Displays all permission modification activities on HP NonStop Audit to ensure authorized access.
165 FISMA: i5/OS DST Password Reset Displays i5/OS events related to the reset of the DST (Dedicated Service Tools) password.
166 FISMA: i5/OS Files Accessed Lists all events when a user gains access an i5/OS file.
167 FISMA: i5/OS Network User Login Failed Lists all events when a network user was denied access into the i5/OS.
168 FISMA: i5/OS Network User Login 
Successful Lists all events when a network user successfully logs into the i5/OS.
169 FISMA: i5/OS Network User Profile 
Creation Displays i5/OS events when a network user profile has been created.
170 FISMA: i5/OS Network User Profile Deletion Displays i5/OS events when a network user profile has been deleted.
171 FISMA: i5/OS Network User Profile 
Modified Displays i5/OS events when a network user profile has been modified.
172 FISMA: i5/OS Object Permissions Modified Displays all permission modification activities on i5/OS to ensure authorized access.
173 FISMA: i5/OS Restarted Lists all events when the i5/OS has been restarted.
174 FISMA: i5/OS Service Started Lists all events when a user starts a service on the i5/OS.
175 FISMA: i5/OS User Login Failed Lists all events when a user was denied access into the i5/OS.
176 FISMA: i5/OS User Login Successful Lists all events when a user successfully logs into the i5/OS.
177 FISMA: i5/OS User Profile Creation Displays i5/OS events when a user profile has been created.
178 FISMA: i5/OS User Profile Modifications Displays i5/OS events when a user profile has been modified.
179 FISMA: Juniper Firewall HA State Changed Displays all Juniper firewall fail-over state change events.
180 FISMA: Juniper Firewall Policy Changes Displays all configuration changes to the Juniper firewall policies.
181 FISMA: Juniper Firewall Policy Out of Sync Displays events that indicate the Juniper firewall’s HA policies are out of sync.
182 FISMA: Juniper Firewall Reset Accepted Displays events that indicate the Juniper firewall has been reset to its factory default state.
183 FISMA: Juniper Firewall Reset Imminent Displays events that indicate the Juniper firewall is reset to its factory default state.
184 FISMA: Juniper Firewall Restarted Displays all Juniper firewall restart events.
185 FISMA: Juniper SSL VPN (Secure Access) Failed Logins Displays a report of all failed logins at the Juniper SSL VPN (Secure Access).
186 FISMA: Juniper SSL VPN (Secure Access) Failed Logins by User Displays all failed Juniper SSL VPN (Secure Access) logins based on user.
187 FISMA: Juniper SSL VPN (Secure Access) Policy Changed Displays all configuration changes to the Juniper SSL VPN (Secure Access) policies.
188 FISMA: Juniper SSL VPN (Secure Access) Successful Logins Displays all successful logins through the Juniper SSL VPN (Secure Access).
189 FISMA: Juniper SSL VPN (Secure Access) Successful Logins by User Displays all successful Juniper SSL VPN (Secure Access) logins based on user.
190 FISMA: Juniper SSL VPN Failed Logins Displays a report of all failed logins at the Juniper SSL VPN.
191 FISMA: Juniper SSL VPN Failed Logins by User Displays all failed logins per user at the Juniper SSL VPN.
192 FISMA: Juniper SSL VPN Successful Logins Displays successful connections through the Juniper SSL VPN.
193 FISMA: Juniper SSL VPN Successful Logins by User Displays all successful Juniper SSL VPN logins based on user.
194 FISMA: Failed Logins Displays all failed login attempts to review any access violations or unusual activity.
195 FISMA: Successful Logins Displays successful logins to ensure only authorized personnel have access.
196 FISMA: LogLogic Disk Full Displays events that indicate the LogLogic appliance’s disk is near full.
197 FISMA: LogLogic DSM Logins Displays all login attempts to the LogLogic DSM database.
198 FISMA: LogLogic DSM Startup or Shutdown Displays all startup and shutdown events on LogLogic DSM database.
199 FISMA: LogLogic File Retrieval Errors Displays all errors while retrieving log files from devices, servers and applications.
200 FISMA: LogLogic HA State Changed Displays all LogLogic appliance failover state change events.
201 FISMA: LogLogic Management Center Account Activities Displays all accounts activities on LogLogic management center to ensure authorized and appropriate access.
202 FISMA: LogLogic Management Center Backup Activities Displays all backup activities on LogLogic management center.
203 FISMA: LogLogic Management Center Login Displays all login events to the LogLogic management center.
204 FISMA: LogLogic Management Center Password Changes Displays all password change activities on LogLogic management center to ensure authorized and appropriate access.
205 FISMA: LogLogic Management Center Restore Activities Displays all restore activities on LogLogic management center.
206 FISMA: LogLogic Management Center Upgrade Success Displays all successful events related to the system's upgrade.
207 FISMA: LogLogic Message Routing Errors Displays all log forwarding errors on the LogLogic appliance to ensure all logs are archived properly.
208 FISMA: LogLogic NTP Service Stopped
 Displays events that indicate the NTP engine on the LogLogic appliance has stopped.
209 FISMA: LogLogic Universal Collector Configuration Changes Displays LogLogic universal collector configuration changes.
210 FISMA: McAfee AntiVirus: Attacks by Event ID Displays McAfee AntiVirus attacks by Event ID.
211 FISMA: McAfee AntiVirus: Attacks by Threat Name Displays McAfee AntiVirus attacks by threat name.
212 FISMA: McAfee AntiVirus: Attacks Detected Displays attacks detected by McAfee AntiVirus.
213 FISMA: Microsoft Operations Manager - Windows Accounts Activities Displays all accounts activities on Windows servers to ensure authorized and appropriate access.
214 FISMA: Microsoft Operations Manager - Windows Accounts Created Displays all accounts created on Windows servers to ensure authorized and appropriate access.
215 FISMA: Microsoft Operations Manager - Windows Accounts Enabled Displays all accounts enabled on Windows servers to ensure authorized and appropriate access.
216 FISMA: Microsoft Operations Manager - Windows Events by Users Displays a summary of access-related Windows events by source and target users.
217 FISMA: Microsoft Operations Manager - Windows Password Changes Displays all password change activities on Windows servers to ensure authorized and appropriate access.
218 FISMA: Microsoft Operations Manager - Windows Permissions Modified Displays all permission modification activities on Windows servers to ensure authorized access.
219 FISMA: Microsoft Operations Manager - Windows Policies Modified Displays all policy modification activities on Windows servers to ensure authorized and appropriate access.
220 FISMA: Microsoft Operations Manager - Windows Servers Restarted Displays all Windows server restart activities to detect unusual activities.
221 FISMA: Microsoft Sharepoint Content Deleted Displays all events when content has been deleted from Microsoft Sharepoint.
222 FISMA: Microsoft Sharepoint Content Updates Displays all events when content is updated within Microsoft Sharepoint.
223 FISMA: Microsoft Sharepoint Permissions Changed Displays all user/group permission events to Microsoft Sharepoint.
224 FISMA: Microsoft Sharepoint Policy Add, Remove, or Modify Displays all events when a Microsoft Sharepoint policy is added, removed, or modified.
225 FISMA: Microsoft SQL Server Database Failed Logins Displays failed Microsoft SQL Server database logins.
226 FISMA: Microsoft SQL Server Database Successful Logins Displays successful Microsoft SQL Server database logins.
227 FISMA: Microsoft SQL Server Backup Failed Displays all Microsoft SQL Server backup failures.
228 FISMA: Microsoft SQL Server Restore Failed Displays all Microsoft SQL Server restore failure events.
229 FISMA: NetApp Filer Accounts Locked Displays all accounts locked out of NetApp Filer to detect access violations or unusual activities.
230 FISMA: NetApp Filer Audit Accounts Enabled Displays all accounts enabled on NetApp Filer Audit to ensure authorized and appropriate access.
231 FISMA: NetApp Filer Audit Group Members Added Displays all accounts added to groups on the NetApp Filer Audit to ensure appropriate access.
232 FISMA: NetApp Filer Audit Group Members Deleted Displays all accounts removed from groups on the NetApp Filer Audit to ensure appropriate access.
233 FISMA: NetApp Filer Audit Login Failed Displays all NetApp Filer Audit login events which have failed.
234 FISMA: NetApp Filer Audit Login Successful Displays all NetApp Filer Audit login events which have succeeded.
235 FISMA: NetApp Filer Audit Logs Cleared Displays all audit logs clearing activities on NetApp Filer Audit to detect access violations or unusual activity.
236 FISMA: NetApp Filer Audit Policies Modified Displays all policy modification activities on NetApp Filer Audit to ensure authorized and appropriate access.
237 FISMA: NetApp Filer Disk Failure Displays all disk failure events on the NetApp Filer servers.
238 FISMA: NetApp Filer Disk Missing Displays events that indicate disk missing on the NetApp Filer servers.
239 FISMA: NetApp Filer File Activity Displays all file activities on NetApp Filer.
240 FISMA: NetApp Filer File System Full Displays events that indicate the NetApp Filer’s disk is near full.
241 FISMA: NetApp Filer Login Failed Displays all NetApp Filer Login events which have failed.
242 FISMA: NetApp Filer Login Successful Displays all NetApp Filer Login events which have succeeded.
243 FISMA: NetApp Filer Password Changes Displays all password change activities on NetApp Filer to ensure authorized and appropriate access.
244 FISMA: NetApp Filer Snapshot Error Displays events that indicate backup on the NetApp Filer has failed.
245 FISMA: NTP Clock Synchronized Displays events that indicate NTP has successfully synchronized the clock.
246 FISMA: NTP Daemon Exited Displays events that indicate the NTP service has stopped.
247 FISMA: NTP Server Unreachable Displays events that indicate the remote NTP server is not reachable.
248 FISMA: Oracle Database Successful Logins Displays successful Oracle database logins.
249 FISMA: Oracle Database Shutdown Displays Oracle database events related to shutting down the server.
250 FISMA: Oracle Database Failed Logins Displays all failed login attempts to the Oracle database.
251 FISMA: PANOS: Attacks by Event ID Displays Palo Alto Networks attacks by Event ID.
252 FISMA: PANOS: Attacks by Threat Name Displays Palo Alto Networks attacks by threat name.
253 FISMA: PANOS: Attacks Detected Displays attacks detected by Palo Alto Networks.
254 FISMA: Password Changes on Windows Servers Displays all password change activities on Windows servers to ensure authorized and appropriate access.
255 FISMA: Periodic Review of Log Reports Displays all review activities performed by administrators to ensure review for any access violations.
256 FISMA: Periodic Review of User Access Logs Displays all review activities performed by administrators to ensure review for any access violations.
257 FISMA: Permissions Modified on Windows Servers Displays all permission modification activities on Windows servers to ensure authorized access.
258 FISMA: Policies Modified on Windows Servers Displays all policy modification activities on Windows servers to ensure authorized and appropriate access.
259 FISMA: Pulse Connect Secure Failed Logins Displays a report of all failed logins at the Pulse Connect Secure.
260 FISMA: Pulse Connect Secure Failed Logins by User Displays all failed Pulse Connect Secure logins based on user.
261 FISMA: Pulse Connect Secure Policy Changed Displays all configuration changes to the Pulse Connect Secure policies.
262 FISMA: Pulse Connect Secure Successful Logins Displays all successful logins through the Pulse Connect Secure.
263 FISMA: Pulse Connect Secure Successful Logins by User Displays all successful Pulse Connect Secure logins based on user.
264 FISMA: RACF Accounts Created Displays all accounts created on RACF servers to ensure authorized and appropriate access.
265 FISMA: RACF Accounts Deleted Displays all accounts deleted on RACF servers to ensure authorized and appropriate access.
266 FISMA: RACF Accounts Modified Displays all events when a network user profile has been modified.
267 FISMA: RACF Failed Logins Displays all failed login attempts to review any access violations or unusual activity.
268 FISMA: RACF Files Accessed Displays all files accessed on RACF servers to ensure appropriate access.
269 FISMA: RACF Password Changed Displays all password change activities on RACF servers to ensure authorized and appropriate access.
270 FISMA: RACF Permissions Changed Displays all permission modification activities on RACF to ensure authorized access.
271 FISMA: RACF Process Started Displays all processes started on the RACF servers.
272 FISMA: RACF Successful Logins Displays successful logins to ensure only authorized personnel have access.
273 FISMA: Sidewinder Configuration Changes Displays Sidewinder configuration changes.
274 FISMA: Software Update Successes on i5/OS Displays all i5/OS successful events related to the system’s software or patch update.
275 FISMA: Sybase ASE Database Backup and Restoration Displays Sybase ASE DUMP and LOAD events.
276 FISMA: Sybase ASE Database Startup or Shutdown Displays all startup and shutdown events for the Sybase database.
277 FISMA: Sybase ASE Failed Logins Displays failed Sybase ASE database logins.
278 FISMA: Sybase ASE Successful Logins Displays successful Sybase ASE database logins.
279 FISMA: Symantec AntiVirus: Attacks by Threat Name Displays Symantec AntiVirus attacks by threat name.
280 FISMA: Symantec AntiVirus: Attacks Detected Displays attacks detected by Symantec AntiVirus.
281 FISMA: Symantec AntiVirus: Scans Displays scans using Symantec AntiVirus.
282 FISMA: Symantec AntiVirus: Updated Displays updates to Symantec AntiVirus.
283 FISMA: Symantec Endpoint Protection: Attacks by Threat Name Displays Symantec Endpoint Protection attacks by threat name.
284 FISMA: Symantec Endpoint Protection: Attacks Detected Displays attacks detected by Symantec Endpoint Protection.
285 FISMA: Symantec Endpoint Protection Configuration Changes Displays Symantec Endpoint Protection configuration changes.
286 FISMA: Symantec Endpoint Protection Password Changes Displays all password change activities on Symantec Endpoint Protection to ensure authorized and appropriate access.
287 FISMA: Symantec Endpoint Protection Policy Add, Remove, or Modify Displays all events when a Symantec Endpoint Protection policy is added, removed, or modified.
288 FISMA: Symantec Endpoint Protection: Scans Displays scans using Symantec Endpoint Protection.
289 FISMA: Symantec Endpoint Protection: Updated Displays updates to Symantec Endpoint Protection.
290 FISMA: System Restarted Displays all logs related to system restarts.
291 FISMA: TIBCO ActiveMatrix Administrator Failed Logins Displays all TIBCO ActiveMatrix Administrator login events which have failed.
292 FISMA: TIBCO ActiveMatrix Administrator Permission Changes Displays events related to TIBCO ActiveMatrix Administrator permission modifications.
293 FISMA: TIBCO ActiveMatrix Administrator Successful Logins Displays successful logins to TIBCO ActiveMatrix Administrator to ensure only authorized personnel have access.
294 FISMA: TIBCO Administrator Password Changes Displays all password change activities on TIBCO Administrator to ensure authorized and appropriate access.
295 FISMA: TIBCO Administrator Permission Changes Displays events related to TIBCO Administrator permission modifications.
296 FISMA: TrendMicro Control Manager: Attacks Detected Displays attacks detected by TrendMicro Control Manager.
297 FISMA: TrendMicro Control Manager: Attacks Detected by Threat Name Displays attacks detected by TrendMicro Control Manager by threat name.
298 FISMA: TrendMicro OfficeScan: Attacks Detected Displays attacks detected by TrendMicro OfficeScan.
299 FISMA: TrendMicro OfficeScan: Attacks Detected by Threat Name Displays attacks detected by TrendMicro OfficeScan by threat name.
300 FISMA: UNIX Failed Logins Displays failed UNIX logins for known and unknown users.
301 FISMA: vCenter Change Attributes Modification of VMware vCenter and VMware ESX properties.
302 FISMA: vCenter Data Move Entity has been moved within the VMware vCenter infrastructure.
303 FISMA: vCenter Datastore Events Displays create, modify, and delete datastore events on VMware vCenter.
304 FISMA: vCenter Failed Logins Failed logins to the VMware vCenter console.
305 FISMA: vCenter Modify Firewall Policy Displays changes to the VMware ESX allowed services firewall policy.
306 FISMA: vCenter Orchestrator Change Attributes Modification of VMware vCenter Orchestrator properties.
307 FISMA: vCenter Orchestrator Datastore Events Displays create, modify, and delete datastore events on VMware vCenter Orchestrator.
308 FISMA: vCenter Orchestrator Data Move Entity has been moved within the VMware vCenter Orchestrator infrastructure.
309 FISMA: vCenter Orchestrator Failed Logins Displays all failed logins for VMware vCenter Orchestrator.
310 FISMA: vCenter Orchestrator Virtual Machine Created Virtual machine has been created from VMware vCenter Orchestrator.
311 FISMA: vCenter Orchestrator Virtual Machine Deleted Virtual machine has been deleted from VMware vCenter Orchestrator.
312 FISMA: vCenter Orchestrator Virtual Machine Shutdown Virtual machine has been shutdown or paused from VMware vCenter Orchestrator console.
313 FISMA: vCenter Orchestrator Virtual Machine Started Virtual machine has been started or resumed from VMware vCenter Orchestrator console.
314 FISMA: vCenter Orchestrator vSwitch Added, Changed or Removed vSwitch has been added, modified or removed from VMware vCenter Orchestrator console.
315 FISMA: vCenter Resource Usage Change Resources have changed on VMware vCenter.
316 FISMA: vCenter Restart ESX Services VMware vCenter restarted services running on VMware ESX Server.
317 FISMA: vCenter Shutdown or Restart of ESX Server VMware ESX Server is shutdown or restarted from VMware vCenter console.
318 FISMA: vCenter Successful Logins Successful logins to the VMware vCenter console.
319 FISMA: vCenter User Permission Change A permission role has been added, changed, removed, or applied to a user on VMware vCenter server.
320 FISMA: vCenter Virtual Machine Created Virtual machine has been created from VMware vCenter console.
321 FISMA: vCenter Virtual Machine Deleted Virtual machine has been deleted or removed from VMware vCenter console.
322 FISMA: vCenter Virtual Machine Shutdown Virtual machine has been shutdown or paused from VMware vCenter console.
323 FISMA: vCenter Virtual Machine Started Virtual machine has been started or resumed from VMware vCenter console.
324 FISMA: vCenter vSwitch Added, Changed or Removed vSwitch on VMware ESX server has been added, modified or removed from the VMware vCenter console.
325 FISMA: vCloud Failed Logins Failed logins to the VMware vCloud Director console.
326 FISMA: vCloud Organization Created Vmware vCloud Director organization created events.
327 FISMA: vCloud Organization Deleted VMware vCloud Director organization deleted events.
328 FISMA: vCloud Organization Modified VMware vCloud Director organization modified events.
329 FISMA: vCloud Successful Logins Successful logins to the VMware vCloud Director console.
330 FISMA: vCloud User Created VMware vCloud Director user created events.
331 FISMA: vCloud User Deleted or Removed VMware vCloud Director users have been deleted or removed from the system.
332 FISMA: vCloud vApp Created, Modified, or Deleted VMware vCloud Director vApp created, deleted, and modified events.
333 FISMA: vCloud vDC Created, Modified, or Deleted VMware vCloud Director virtual datacenter created, modified, or deleted events.
334 FISMA: Active VPN Connections for Cisco VPN Concentrators Displays all currently active VPN connections for Cisco VPN Concentrators.
335 FISMA: VPN Connection Disconnect Reasons Displays the disconnect reasons for VPN connections.
336 FISMA: VPN Connections by Users Displays users who are made the most connections.
337 FISMA: VPN Denied Connections by Users Displays users with the most denied connections.
338 FISMA: VPN Sessions by Users Displays all VPN sessions categorized by authenticated users.
339 FISMA: VPN Users Accessing Corporate 
Network Displays all users logging into the corporate network through Virtual Private Network to ensure appropriate access.
340 FISMA: vShield Edge Configuration Changes Displays changes to VMware vShield Edge policies.
341 FISMA: Windows Accounts Enabled Displays all accounts enabled on Windows servers to ensure authorized and appropriate access.
342 FISMA: Windows Accounts Locked Displays all accounts locked out of Windows servers to detect access violations or unusual activities.
343 FISMA: Windows Audit Logs Cleared Displays all audit logs clearing activities on Windows servers to detect access violations or unusual activity.
344 FISMA: Windows Domain Activities Displays all trusted domains created or deleted on Windows servers to ensure authorized and appropriate access.
345 FISMA: Windows Events by Users Displays a summary of access-related Windows events by source and target users.
346 FISMA: Windows Group Members Added Displays all accounts added to groups on the Windows servers to ensure appropriate access.
347 FISMA: Windows Group Members Deleted Displays all accounts removed from groups on the Windows servers to ensure appropriate access.
348 FISMA: Windows New Services Installed Displays a list of new services installed on Windows servers to ensure authorized access.
349 FISMA: Windows Programs Accessed Displays all programs started and stopped on servers to ensure appropriate access.
350 FISMA: Windows Servers Restarted Displays all Windows server restart activities to detect unusual activities.
351 FISMA: Windows Software Update Activities Displays all events related to the system’s software or patch update.
352 FISMA: Windows Software Update Failures Displays all failed events related to the system’s software or patch update.
353 FISMA: Windows Software Update Successes Displays all successful events related to the system’s software or patch update.