TIBCO LogLogic Reports and Filter Bloks for ISO/IEC 27002

All TIBCO LogLogic reports and filter bloks can be used to monitor regular user activity and also the activity and results of system and network administrators.

# Real-time Report Name Advanced Filter Blok Name Report Description Compliance Mapping
1 Not Applicable ISO_Amazon_Cloudtrail_Successful_Logins Displays all Amazon CloudTrail successful logins. A.9.2.1, A.9.2.5, A.9.2.6, A.9.4.1, A.9.4.5, A.14.2.2, A.14.2.3, A.14.2.4, A.12.4.1, A.12.5.1, A.16.1.7
2 Not Applicable ISO_Amazon_Cloudtrail_Failed_Logins Displays all Amazon CloudTrail failed logins. A.9.2.1, A.9.2.5, A.9.4.1, A.9.4.5, A.12.4.1, A.16.1.7
3 Not Applicable ISO_Amazon_Cloudtrail_Delete_Events Displays all Amazon CloudTrail delete events. A.6.1.2, A.9.2.1, A.9.2.5, A.9.2.6, A.9.4.1, A.12.1.2, A.12.1.4, A.12.4.1, A.16.1.7
4 Not Applicable ISO_Amazon_Cloudtrail_Create_Events Displays all Amazon CloudTrail create events. A.6.1.2, A.9.2.1, A.9.2.5, A.9.4.1, A.12.1.2, A.12.1.4, A.14.2.2, A.14.2.3, A.14.2.4, A.12.4.1, A.12.5.1, A.15.2.1, A.16.1.7
5 Not Applicable ISO_Amazon_Cloudtrail_Change_Events Displays all Amazon CloudTrail change events. A.6.1.2, A.9.1.2, A.9.2.1, A.9.2.5, A.9.2.6, A.9.4.1, A.12.1.2, A.12.1.4, A.12.4.1, A.12.5.1, A.13.1.1, A.13.1.2, A.14.2.2, A.14.2.3, A.14.2.4, A.15.2.1, A.16.1.7
6 ISO: Account Activities on UNIX Servers ISO_Account_Activities_on_UNIX_Servers Displays all accounts activities on UNIX servers to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
7 ISO: Account Activities on Windows Servers ISO_Account_Activities_on_Windows_Servers Displays all accounts activities on Windows servers to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
8 ISO: Accounts Changed on NetApp Filer ISO_Accounts_Changed_on_NetApp_Filer Displays all accounts changed on NetApp Filer to ensure authorized and appropriate access. A.9.2.6, A.12.4.1, A.9.2.1
9 ISO: Accounts Changed on TIBCO Administrator ISO_Accounts_Changed_on_TIBCO_Administrator Displays all accounts changed on TIBCO Administrator to ensure authorized and appropriate access. A.9.2.6, A.12.4.1, A.9.2.1
10 ISO: Accounts Changed on TIBCO ActiveMatrix Administrator ISO_Accounts_Changed_on_TIBCO_ActiveMatrix_Administrator Displays all accounts changed on TIBCO ActiveMatrix Administrator to ensure authorized and appropriate access. A.9.2.6, A.12.4.1, A.9.2.1
11 ISO: Accounts Changed on UNIX Servers ISO_Accounts_Changed_on_UNIX_Servers Displays all accounts changed on UNIX servers to ensure authorized and appropriate access. A.9.2.6, A.12.4.1, A.9.2.1
12 ISO: Accounts Changed on Windows Servers ISO_Accounts_Changed_on_Windows_Servers Displays all accounts changed on Windows servers to ensure authorized and appropriate access. A.9.2.6, A.12.4.1, A.9.2.1
13 ISO: Accounts Created on NetApp Filer ISO_Accounts_Created_on_NetApp_Filer Displays all accounts created on NetApp Filer to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
14 ISO: Accounts Created on NetApp Filer Audit ISO_Accounts_Created_on_NetApp_Filer_Audit Displays all accounts created on NetApp Filer Audit to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
15 ISO: Accounts Created on Symantec Endpoint Protection ISO_Accounts_Created_on_Symantec_Endpoint_Protection Displays all accounts created on Symantec Endpoint Protection to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
16 ISO: Accounts Created on TIBCO Administrator ISO_Accounts_Created_on_TIBCO_Administrator Displays all accounts created on TIBCO ActiveMatrix Administrator to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
17 ISO: Accounts Created on TIBCO ActiveMatrix Administrator ISO_Accounts_Created_on_TIBCO_ActiveMatrix_Administrator Displays all accounts created on TIBCO Administrator to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
18 ISO: Accounts Created on UNIX Servers ISO_Accounts_Created_on_UNIX_Servers Displays all accounts created on UNIX servers to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
19 ISO: Accounts Created on Windows Servers ISO_Accounts_Created_on_Windows_Servers Displays all accounts created on Windows servers to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
20 ISO: Accounts Deleted on NetApp Filer ISO_Accounts_Deleted_on_NetApp_Filer Displays all accounts deleted on NetApp Filer to ensure authorized and appropriate access. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
21 ISO: Accounts Deleted on NetApp Filer Audit ISO_Accounts_Deleted_on_NetApp_Filer_Audit Displays all accounts deleted on NetApp Filer Audit to ensure authorized and appropriate access. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
22 ISO: Accounts Deleted on Symantec Endpoint Protection ISO_Accounts_Deleted_on_Symantec_Endpoint_Protection Displays all accounts deleted on Symantec Endpoint Protection to ensure authorized and appropriate access. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
23 ISO: Accounts Deleted on TIBCO Administrator ISO_Accounts_Deleted_on_TIBCO_Administrator Displays all accounts deleted on TIBCO ActiveMatrix Administrator to ensure authorized and appropriate access. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
24 ISO: Accounts Deleted on TIBCO ActiveMatrix Administrator ISO_Accounts_Deleted_on_TIBCO_ActiveMatrix_Administrator Displays all accounts deleted on TIBCO Administrator to ensure authorized and appropriate access. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
25 ISO: Accounts Deleted on UNIX Servers ISO_Accounts_Deleted_on_UNIX_Servers Displays all accounts deleted on UNIX servers to ensure authorized and appropriate access. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
26 ISO: Accounts Deleted on Windows Servers ISO_Accounts_Deleted_on_Windows_Servers Displays all accounts deleted on Windows servers to ensure authorized and appropriate access. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
27 ISO: Active Directory System Changes ISO_Active_Directory_System_Changes Displays changes made within Active Directory. A.9.2.6, A.12.1.2, A.6.1.2, A.9.2.5, A.16.1.7
28 ISO: Active VPN Connections for Cisco VPN Concentrators Not Applicable Displays all currently active VPN connections for Cisco VPN Concentrators. A.12.4.1, A.9.2.1, A.9.4.1
29 ISO: Administrators Activities on Servers Not Applicable Displays the latest activities performed by administrators and root users to ensure appropriate access. A.12.4.3
30 ISO: Applications Under Attack Not Applicable Displays all applications under attack as well as the attack signatures. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
31 ISO: Applications Under Attack - Cisco IOS ISO_Applications_Under_Attack_Cisco_IOS Displays all applications under attack as well as the attack signatures by Cisco IOS. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
32 ISO: Applications Under Attack - ISS SiteProtector ISO_Applications_Under_Attack_FireEye_MPS Displays all applications under attack as well as the attack signatures by FireEye MPS. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
33 ISO: Applications Under Attack - FireEye MPS ISO_Applications_Under_Attack_ISS_SiteProtector Displays all applications under attack as well as the attack signatures by ISS SiteProtector. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
34 ISO: Applications Under Attack - SiteProtector ISO_Applications_Under_Attack_SiteProtector Displays all applications under attack as well as the attack signatures by SiteProtector. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
35 ISO: Applications Under Attack - Sourcefire Defense Center ISO_Applications_Under_Attack_Cisco_FirePower Displays all applications under attack as well as the attack signatures by Cisco FirePower and Sourcefire Defense Center. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
36 ISO: Attack Origins Not Applicable Displays the sources that have initiated the most attacks. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
37 ISO: Attack Origins - Cisco IOS ISO_Attack_Origins_Cisco_IOS Displays the sources that have initiated the most attacks by Cisco IOS. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
38 ISO: Attack Origins - McAfee HIPS ISO_Attack_Origins_McAfee_HIPS Displays the sources that have initiated the most attacks by McAfee HIPS. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
39 ISO: Attack Origins - ISS SiteProtector ISO_Attack_Origins_ISS_SiteProtector Displays the sources that have initiated the most attacks by ISS SiteProtector. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
40 ISO: Attack Origins - SiteProtector ISO_Attack_Origins_SiteProtector Displays the sources that have initiated the most attacks by SiteProtector. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
41 ISO: Attack Origins - Sourcefire Defense Center Not Applicable Displays the sources that have initiated the most attacks by Sourcefire Defense Center. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
42 ISO: Attacks Detected Not Applicable Displays all IDS attacks detected to servers and applications. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
43 ISO: Attacks Detected - Cisco IOS ISO_Attacks_Detected_Cisco_IOS Displays all IDS attacks detected to servers and applications by Cisco IOS. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
44 ISO: Attacks Detected - McAfee HIPS ISO_Attacks_Detected_McAfee_HIPS Displays all IPS attacks detected to servers and applications by McAfee HIPS. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
45 ISO: Attacks Detected - ISS SiteProtector ISO_Attacks_Detected_ISS_SiteProtector Displays all IDS attacks detected to servers and applications by ISS SiteProtector. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
46 ISO: Attacks Detected - SiteProtector ISO_Attacks_Detected_SiteProtector Displays all IDS attacks detected to servers and applications by SiteProtector. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
47 ISO: Attacks Detected - Sourcefire Defense Center ISO_Attacks_Detected_Cisco_FirePower Displays all applications under attack as well as the attack signatures by Cisco FirePower and Sourcefire Defense Center. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
48 ISO: Check Point Configuration Changes ISO_Check_Point_Configuration_Changes Displays all Check Point audit events related to configuration changes. A.12.1.2, A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
49 ISO: Check Point Management Station Login ISO_Check_Point_Management_Station_Login Displays all login events to the Check Point management station. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
50 ISO: Check Point Object Activity ISO_Check_Point_Object_Activity Displays all creation, deletion, and modification of Check Point objects. A.12.1.2, A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
51 ISO: Cisco ESA: Attacks by Event ID ISO_Cisco_ESA_Attacks_by_Event_ID Displays Cisco ESA attacks by Event ID. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
52 ISO: Cisco ESA: Attacks Detected ISO_Cisco_ESA_Attacks_Detected Displays Cisco ESA attacks by threat name. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
53 ISO: Cisco ESA: Attacks by Threat Name ISO_Cisco_ESA_Attacks_by_Threat_Name Displays attacks detected by Cisco ESA. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
54 ISO: Cisco ESA: Scans ISO_Cisco_ESA_Scans Displays scans using Cisco ESA. A.12.2.1, A.12.2.1
55 ISO: Cisco ESA: Updated ISO_Cisco_ESA_Updated Displays updates to Cisco ESA. A.12.2.1, A.12.2.1, A.13.1.1, A.13.1.2, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
56 ISO: Cisco Line Protocol Status Changes ISO_Cisco_Line_Protocol_Status_Changes Displays all Cisco line protocol up and down events. A.15.2.1, A.12.4.1
57 ISO: Cisco Link Status Changes ISO_Cisco_Link_Status_Changes Displays all Cisco link up and down events. A.15.2.1, A.12.4.1
58 ISO: Cisco ISE, ACS Accounts Created ISO_Cisco_ISE_ACS_Accounts_Created Displays all accounts created on Cisco ISE and Cisco SecureACS to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
59 ISO: Cisco ISE, ACS Accounts Removed ISO_Cisco_ISE_ACS_Accounts_Removed Displays all accounts removed on Cisco ISE and Cisco SecureACS to ensure authorized and appropriate access. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
60 ISO: Cisco ISE, ACS Configuration Changes ISO_Cisco_ISE_ACS_Configuration_Changes Displays Cisco ISE and Cisco SecureACS configuration changes. A.12.1.2, A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
61 ISO: Cisco ISE, ACS Password Changes ISO_Cisco_ISE_ACS_Password_Changes Displays all password change activities on Cisco ISE and Cisco SecureACS to ensure authorized and appropriate access. A.6.1.2, A.9.2.4, A.9.3.1, A.9.2.5, A.9.4.3
62 ISO: Cisco Peer Reset/Reload ISO_Cisco_Peer_Reset_Reload Displays all Cisco Peer reset and reload events. A.12.4.1
63 ISO: Cisco Peer Supervisor Status Changes ISO_Cisco_Peer_Supervisor_Status_Changes Displays all Cisco Peer Supervisor status changes. A.12.4.1
64 ISO: Cisco ASA, FWSM Failover Disabled ISO_Cisco_ASA_FWSM_Failover_Disabled Displays all logs related to disabling Cisco ASA, and FWSM failover capability. A.12.1.2, A.15.2.1, A.12.4.1, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
65 ISO: Cisco ASA, FWSM Failover Performed ISO_Cisco_ASA_FWSM_Failover_Performed Displays all logs related to performing a Cisco ASA, and FWSM failover. A.12.1.2, A.15.2.1, A.12.4.1, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
66 ISO: Cisco ASA, FWSM Policy Changed ISO_Cisco_ASA_FWSM_Policy_Changed Displays all configuration changes made to the Cisco ASA, and FWSM devices. A.12.1.2, A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
67 ISO: Cisco ASA, FWSM Restarted ISO_Cisco_ASA_FWSM_Restarted Displays all Cisco ASA, or FWSM restart activities to detect unusual activities. A.12.4.1
68 ISO: Cisco ASA, FWSM Routing Failure ISO_CIsco_ASA_FWSM_Routing_Failure Displays all Cisco ASA, and FWSM routing error messages. A.15.2.1, A.12.4.1, A.14.2.3
69 ISO: Cisco Redundancy Version Check Failed ISO_Cisco_Redundancy_Version_Check_Failed Displays all Cisco redundancy version check failures. A.12.4.1
70 ISO: Cisco Switch Policy Changes ISO_Cisco_Switch_Policy_Changes Displays all Cisco routers and switches restart activities to detect unusual activities. A.12.1.2, A.12.1.4, A.13.1.1,A.13.1.2, A.9.1.2, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
71 ISO: Cisco Routers and Switches Restart ISO_Cisco_Routers_and_Switches_Restart Displays all configuration changes to the Cisco router and switch policies. A.12.4.1
72 ISO: Creation and Deletion of System Level Objects: Windows ISO_Creation_and_Deletion_of_System_Level_Objects_Windows Displays all Windows events related to creation and deletion of system-level objects. A.16.1.7
73 ISO: CVS Source Code Repository Failed Access ISO_CVS_Source_Code_Repository_Failed_Access Displays all failed logins to the CVS source code repository. A.9.4.5
74 ISO: CVS Source Code Repository Successful Access ISO_CVS_Source_Code_Repository_Successful_Access Displays all successful logins to the CVS source code repository. A.9.4.5
75 ISO: DB2 Database Failed Logins ISO_DB2_Database_Failed_Logins Displays all failed login attempts to review any access violations or unusual activity. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
76 ISO: DB2 Database Successful Logins ISO_DB2_Database_Successful_Logins Displays successful DB2 database logins. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
77 ISO: DHCP Granted/Renewed Activities on Microsoft DHCP ISO_DHCP_Granted_Renewed_Activities_on_Microsoft_DHCP Displays all DHCP Granted/Renewed activities on Microsoft DHCP Server. A.9.2.1
78 ISO: DNS Server Error ISO_DNS_Server_Error Displays all events when DNS Server has errors. A.12.4.1, A.18.2.3, A.12.7.1
79 ISO: Domain activities on Symantec Endpoint Protection ISO_Domain_activities_on_Symantec_Endpoint_Protection Displays all domain activities on Symantec Endpoint Protection. A.12.1.2
80 ISO: Domains Sending the Most Email - Exchange 2000/2003 Not Applicable Displays the top domains sending email A.13.2.3
81 ISO: Email Domains Experiencing Delay - Exchange 2000/2003 Not Applicable Displays the recipient domains that have experienced the most delivery delays A.13.2.3
82 ISO: Email Recipients Receiving the Most Emails by Count - Exchange 2000/2003 Not Applicable Displays the email recipients who receiving the most emails by count A.13.2.3
83 ISO: Email Recipients Receiving the Most Emails by Count - Exchange 2007/10 Not Applicable Displays the email recipients who receiving the most emails by count A.13.2.3
84 ISO: Email Sender and Recipients Exchanging the Most Emails - Exchange 2007/10 Not Applicable Displays the top email sender and recipient combinations A.13.2.3
85 ISO: Email Senders Sending the Most Emails by Count - Exchange 2000/2003 Not Applicable Displays the email senders who sent the most emails by count A.13.2.3
86 ISO: Email Senders Sending the Most Emails by Count - Exchange 2007/10 Not Applicable Displays the email senders who sent the most emails by count A.13.2.3
87 ISO: Email Source IP Sending To Most Recipients Not Applicable Displays IP addresses that are sending to the most recipients using Exchange A.13.2.3
88 ISO: Escalated Privilege Activities on Servers Not Applicable Displays all privilege escalation activities performed on servers to ensure appropriate access. A.12.4.1, A.12.4.3, A.9.2.1
89 ISO: ESX Accounts Activities ISO_ESX_Accounts_Activities Displays all accounts activities on VMware ESX servers to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
90 ISO: ESX Accounts Created ISO_ESX_Accounts_Created Displays all accounts created on VMware ESX servers to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
91 ISO: ESX Accounts Deleted ISO_ESX_Accounts_Deleted Displays all accounts deleted on VMware ESX servers to ensure authorized and appropriate access. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
92 ISO: ESX Failed Logins Not Applicable Failed VMware ESX logins for known user. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
93 ISO: ESX Group Activities ISO_ESX_Group_Activities Displays all group activities on VMware ESX servers to ensure authorized and appropriate access. A.6.1.2, A.12.4.1, A.9.2.5
94 ISO: ESX Kernel log daemon terminating ISO_ESX_Kernel_log_daemon_terminating Displays all VMware ESX Kernel log daemon terminating. A.15.2.1
95 ISO: ESX Kernel logging Stop ISO_ESX_Kernel_logging_Stop Displays all VMware ESX Kernel logging stops. A.15.2.1
96 ISO: ESX Logins Succeeded ISO_ESX_Logins_Succeeded Failed VMware ESX logins for unknown user. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
97 ISO: ESX Logins Failed Unknown User ISO_ESX_Logins_Failed_Unknown_User Displays successful logins to VMware ESX to ensure only authorized personnel have access. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
98 ISO: ESX Syslogd Restart ISO_ESX_Syslogd_Restart Displays all VMware ESX syslogd restarts. A.15.2.1
99 ISO: F5 BIG-IP TMOS Login Failed ISO_F5_BIG-IP_TMOS_Login_Failed Displays all F5 BIG-IP TMOS login events which have failed. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
100 ISO: F5 BIG-IP TMOS Login Successful ISO_F5_BIG-IP_TMOS_Login_Successful Displays all F5 BIG-IP TMOS login events which have succeeded. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
101 ISO: F5 BIG-IP TMOS Password Changes ISO_F5_BIG-IP_TMOS_Password_Changes Displays all password change activities on F5 BIG-IP TMOS to ensure authorized and appropriate access. A.6.1.2, A.9.2.4, A.9.3.1, A.9.2.5, A.9.4.3
102 ISO: F5 BIG-IP TMOS Restarted ISO_F5_BIG-IP_TMOS_Restarted Displays all events when the F5 BIG-IP TMOS has been restarted. A.15.2.1, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
103 ISO: Files Accessed on NetApp Filer Audit ISO_Files_Accessed_on_NetApp_Filer_Audit Displays all files accessed on NetApp Filer Audit to ensure appropriate access. A.12.4.1, A.9.2.1, A.9.4.1
104 ISO: Files Accessed on Servers Not Applicable Displays all files accessed on servers to ensure appropriate access. A.12.4.1, A.9.2.1, A.9.4.1
105 ISO: Failed Logins Not Applicable Displays all failed login attempts to review any access violations or unusual activity. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
106 ISO: Files Accessed through Juniper SSL VPN (Secure Access) ISO_Files_Accessed_through_Juniper_SSL_VPN_Secure_Access Displays all files accessed through Juniper SSL VPN (Secure Access). A.12.4.1, A.9.2.1, A.9.4.1
107 ISO: Files Accessed through PANOS ISO_Files_Accessed_through_PANOS Displays all files accessed through Palo Alto Networks. A.12.4.1, A.9.2.1, A.9.4.1
108 ISO: Files Accessed Through Pulse Connect Secure ISO_Files_Accessed_through_Pulse_Connect_Secure Displays all files accessed through Pulse Connect Secure. A.12.4.1, A.9.2.1, A.9.4.1
109 ISO: FireEye MPS: Attacks by Event ID ISO_FireEye_MPS_Attacks_by_Event_ID Displays FireEye MPS attacks by Event ID. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
110 ISO: FireEye MPS: Attacks by Threat Name ISO_FireEye_MPS_Attacks_by_Threat_Name Displays FireEye MPS attacks by threat name. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
111 ISO: FireEye MPS: Attacks Detected ISO_FireEye_MPS_Attacks_Detected Displays attacks detected by FireEye MPS. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
112 ISO: Firewall Connections Accepted - Check Point ISO_Firewall_Connections_Accepted_Check_Point Displays all traffic passing through the Check Point firewall. A.13.1.1, A.13.1.2
113 ISO: Firewall Connections Accepted - Cisco ASA ISO_Firewall_Connections_Accepted_Cisco_ASA Displays all traffic passing through the Cisco ASA firewall. A.13.1.1, A.13.1.2
114 ISO: Firewall Connections Accepted - Cisco FWSM ISO_Firewall_Connections_Accepted_Cisco_FWSM Displays all traffic passing through the Cisco FWSM firewall. A.13.1.1, A.13.1.2
115 ISO: Firewall Connections Accepted - Cisco IOS ISO_Firewall_Connections_Accepted_Cisco_IOS Displays all traffic passing through the Cisco IOS firewall. A.13.1.1, A.13.1.2
116 ISO: Firewall Connections Accepted - Cisco Netflow ISO_Firewall_Connections_Accepted_Cisco_Netflow Displays all traffic passing through the Cisco Netflow. A.13.1.1, A.13.1.2
117 ISO: Firewall Connections Accepted - Cisco NXOS ISO_Firewall_Connections_Accepted_Cisco_NXOS Displays all traffic passing through the Cisco NXOS device. A.13.1.1, A.13.1.2
118 ISO: Firewall Connections Accepted - F5 BIG-IP TMOS ISO_Firewall_Connections_Accepted_F5_BIG-IP_TMOS Displays all traffic passing through the F5 BIG-IP TMOS device. A.13.1.1, A.13.1.2
119 ISO: Firewall Connections Accepted - Fortinet ISO_Firewall_Connections_Accepted_Fortinet Displays all traffic passing through the Fortinet firewall. A.13.1.1, A.13.1.2
120 ISO: Firewall Connections Accepted - Juniper JunOS ISO_Firewall_Connections_Accepted_Juniper_JunOS Displays all traffic passing through the Juniper JunOS firewall. A.13.1.1, A.13.1.2
121 ISO: Firewall Connections Accepted - Nortel Not Applicable Displays all traffic passing through the Nortel firewall. A.13.1.1, A.13.1.2
122 ISO: Firewall Connections Accepted - PANOS ISO_Firewall_Connections_Accepted_PANOS Displays all traffic passing through the Palo Alto Networks firewall. A.13.1.1, A.13.1.2
123 ISO: Firewall Connections Denied - Check Point ISO_Firewall_Connections_Denied_Check_Point Displays the applications that have been denied access the most by the Check Point devices. A.12.2.1, A.12.2.1, A.13.1.1, A.13.1.2
124 ISO: Firewall Connections Denied - Cisco ASA ISO_Firewall_Connections_Denied_Cisco_ASA Displays the applications that have been denied access the most by the Cisco ASA devices. A.12.2.1, A.12.2.1, A.13.1.1, A.13.1.2
125 ISO: Firewall Connections Denied - Cisco FWSM ISO_Firewall_Connections_Denied_Cisco_FWSM Displays the applications that have been denied access the most by the Cisco FWSM devices. A.12.2.1, A.12.2.1, A.13.1.1, A.13.1.2
126 ISO: Firewall Connections Denied - Cisco IOS ISO_Firewall_Connections_Denied_Cisco_IOS Displays the applications that have been denied access the most by the Cisco IOS. A.12.2.1, A.12.2.1, A.13.1.1, A.13.1.2
127 ISO: Firewall Connections Denied - Cisco NXOS ISO_Firewall_Connections_Denied_Cisco_NXOS Displays the applications that have been denied access the most by the Cisco NXOS devices. A.12.2.1, A.12.2.1, A.13.1.1, A.13.1.2
128 ISO: Firewall Connections Denied - Cisco Router Not Applicable Displays the applications that have been denied access the most by the Cisco Router. A.12.2.1, A.12.2.1, A.13.1.1, A.13.1.2
129 ISO: Firewall Connections Denied - F5 BIG-IP TMOS ISO_Firewall_Connections_Denied_F5_BIG-IP_TMOS Displays the applications that have been denied access the most by the F5 BIG-IP TMOS. A.12.2.1, A.12.2.1, A.13.1.1, A.13.1.2
130 ISO: Firewall Connections Denied - Fortinet ISO_Firewall_Connections_Denied_Fortinet Displays the applications that have been denied access the most by the Fortinet devices. A.12.2.1, A.12.2.1, A.13.1.1, A.13.1.2
131 ISO: Firewall Connections Denied - Juniper JunOS ISO_Firewall_Connections_Denied_Juniper_JunOS Displays the applications that have been denied access the most by the Juniper JunOS. A.12.2.1, A.12.2.1, A.13.1.1, A.13.1.2
132 ISO: Firewall Connections Denied - Nortel Not Applicable Displays the applications that have been denied access the most by the Nortel devices. A.12.2.1, A.12.2.1, A.13.1.1, A.13.1.2
133 ISO: Firewall Connections Denied - PANOS ISO_Firewall_Connections_Denied_PANOS Displays the applications that have been denied access the most by the Palo Alto Networks devices. A.12.2.1, A.12.2.1, A.13.1.1, A.13.1.2
134 ISO: Firewall Traffic Besides SSL and SSH - Check Point Not Applicable Displays all traffic passing through the Check Point that is not SSL and SSH. A.9.1.2, A.9.4.2
135 ISO: Firewall Traffic Besides SSL and SSH - Cisco ASA ISO_Firewall_Traffic_Besides_SSL_and_SSH_Cisco_ASA Displays all traffic passing through the Cisco ASA that is not SSL and SSH. A.9.1.2, A.9.4.2
136 ISO: Firewall Traffic Besides SSL and SSH - Cisco FWSM ISO_Firewall_Traffic_Besides_SSL_and_SSH_Cisco_FWSM Displays all traffic passing through the Cisco FWSM that is not SSL and SSH. A.9.1.2, A.9.4.2
137 ISO: Firewall Traffic Besides SSL and SSH - Cisco IOS ISO_Firewall_Traffic_Besides_SSL_and_SSH_Cisco_IOS Displays all traffic passing through the Cisco IOS that is not SSL and SSH. A.9.1.2, A.9.4.2
138 ISO: Firewall Traffic Besides SSL and SSH - Cisco Netflow ISO_Firewall_Traffic_Besides_SSL_and_SSH_Cisco_Netflow Displays all traffic passing through the Cisco Netflow that is not SSL and SSH. A.9.1.2, A.9.4.2
139 ISO: Firewall Traffic Besides SSL and SSH - F5 BIG-IP TMOS ISO_Firewall_Traffic_Besides_SSL_and_SSH_F5_BIG-IP_TMOS Displays all traffic passing through the F5 BIG-IP TMOS that is not SSL and SSH. A.9.1.2, A.9.4.2
140 ISO: Firewall Traffic Besides SSL and SSH - Fortinet ISO_Firewall_Traffic_Besides_SSL_and_SSH_Fortinet Displays all traffic passing through the Fortinet that is not SSL and SSH. A.9.1.2, A.9.4.2
141 ISO: Firewall Traffic Besides SSL and SSH - Juniper JunOS ISO_Firewall_Traffic_Besides_SSL_and_SSH_Juniper_JunOS Displays all traffic passing through the Juniper JunOS that is not SSL and SSH. A.9.1.2, A.9.4.2
142 ISO: Firewall Traffic Besides SSL and SSH - Nortel Not Applicable Displays all traffic passing through the Nortel that is not SSL and SSH. A.9.1.2, A.9.4.2
143 ISO: Firewall Traffic Besides SSL and SSH - PANOS ISO_Firewall_Traffic_Besides_SSL_and_SSH_PANOS Displays all traffic passing through the Palo Alto Networks that is not SSL and SSH. A.9.1.2, A.9.4.2
144 ISO: Firewall Traffic Considered Risky - Check Point Not Applicable Displays Check Point allowed firewall traffic that is considered risky. A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2
145 ISO: Firewall Traffic Considered Risky - Cisco ASA ISO_Firewall_Traffic_Considered_Risky_Cisco_ASA Displays Cisco ASA allowed firewall traffic that is considered risky. A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2
146 ISO: Firewall Traffic Considered Risky - Cisco FWSM ISO_Firewall_Traffic_Considered_Risky_Cisco_FWSM Displays Cisco FWSM allowed firewall traffic that is considered risky. A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2
147 ISO: Firewall Traffic Considered Risky - Cisco IOS ISO_Firewall_Traffic_Considered_Risky_Cisco_IOS Displays Cisco IOS allowed firewall traffic that is considered risky. A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2
148 ISO: Firewall Traffic Considered Risky - Cisco Netflow ISO_Firewall_Traffic_Considered_Risky_Cisco_Netflow Displays Cisco Netflow allowed firewall traffic that is considered risky. A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2
149 ISO: Firewall Traffic Considered Risky - F5 BIG-IP TMOS ISO_Firewall_Traffic_Considered_Risky_F5_BIG-IP_TMOS Displays F5 BIG-IP TMOS allowed firewall traffic that is considered risky. A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2
150 ISO: Firewall Traffic Considered Risky - Fortinet ISO_Firewall_Traffic_Considered_Risky_Fortinet Displays Fortinet allowed firewall traffic that is considered risky. A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2
151 ISO: Firewall Traffic Considered Risky - Juniper JunOS ISO_Firewall_Traffic_Considered_Risky_Juniper_JunOS Displays Juniper JunOS allowed firewall traffic that is considered risky. A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2
152 ISO: Firewall Traffic Considered Risky - Nortel Not Applicable Displays Nortel allowed firewall traffic that is considered risky. A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2
153 ISO: Firewall Traffic Considered Risky - PANOS ISO_Firewall_Traffic_Considered_Risky_PANOS Displays Palo Alto Networks allowed firewall traffic that is considered risky. A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2
154 ISO: FortiOS: Attacks by Event ID ISO_FortiOS_Attacks_by_Event_ID Displays all DLP attacks detected by FortiOS. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
155 ISO: FortiOS: Attacks by Threat Name ISO_FortiOS_Attacks_by_Threat_Name Displays FortiOS attacks by Event ID. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
156 ISO: FortiOS: Attacks Detected ISO_FortiOS_Attacks_Detected Displays FortiOS attacks by threat name. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
157 ISO: FortiOS DLP Attacks Detected ISO_FortiOS_DLP_Attacks_Detected Displays attacks detected by FortiOS. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
158 ISO: Group Activities on NetApp Filer Audit ISO_Group_Activities_on_NetApp_Filer_Audit Displays all group activities on NetApp Filer Audit to ensure authorized and appropriate access. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1,A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
159 ISO: Group Activities on Symantec Endpoint Protection ISO_Group_Activities_on_Symantec_Endpoint_Protection Displays all group activities on Symantec Endpoint Protection to ensure authorized and appropriate access. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
160 ISO: Group Activities on TIBCO ActiveMatrix Administrator ISO_Group_Activities_on_TIBCO_ActiveMatrix_Administrator Displays all group activities on TIBCO ActiveMatrix Administrator to ensure authorized and appropriate access. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
161 Not Applicable ISO_Group_Activities_on_TIBCO_Spotfire Displays all accounts added to groups to ensure appropriate access. No Compliance Mapping
162 ISO: Group Activities on UNIX Servers ISO_Group_Activities_on_UNIX_Servers Displays all group activities on UNIX servers to ensure authorized and appropriate access. A.9.2.6,A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
163 ISO: Group Activities on Windows Servers ISO_Group_Activities_on_Windows_Servers Displays all group activities on Windows servers to ensure authorized and appropriate access. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
164 ISO: Guardium SQL Guard Audit Logins ISO_Guardium_SQL_Guard_Audit_Logins Displays all login attempts to the Guardium SQL Server Audit database. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
165 ISO: Guardium SQL Guard Logins ISO_Guardium_SQL_Guard_Logins Displays all login attempts to the Guardium SQL Server database. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
166 ISO: HP NonStop Audit Configuration Changes ISO_HP_NonStop_Audit_Configuration_Changes Displays all audit configuration changes on HP NonStop. A.12.1.2, A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
167 ISO: HP NonStop Audit Login Failed ISO_HP_NonStop_Audit_Login_Failed Displays all HP NonStop Audit login events which have failed. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
168 ISO: HP NonStop Audit Login Successful ISO_HP_NonStop_Audit_Login_Successful Displays all HP NonStop Audit login events which have succeeded. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
169 ISO: HP NonStop Audit Object Changes ISO_HP_NonStop_Audit_Object_Changes Displays HP NonStop Audit events related to object changes. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
170 ISO: HP NonStop Audit Permissions Changed ISO_HP_NonStop_Audit_Permissions_Changed Displays all permission modification activities on HP NonStop Audit to ensure authorized access. A.9.2.6, A.12.1.2, A.6.1.2, A.9.2.5, A.16.1.7
171 ISO: i5/OS DST Password Reset ISO_i5_OS_DST_Password_Reset Displays i5/OS events related to the reset of the DST (Dedicated Service Tools) password. A.12.1.2, A.6.1.2, A.9.2.4, A.9.2.5, A.9.3.1, A.9.4.3
172 ISO: i5/OS Files Accessed ISO_i5_OS_Files_Accessed Lists all events when a user gains access an i5/OS file. A.12.4.1, A.9.2.1
173 ISO: i5/OS Network User Login Failed ISO_i5_OS_Network_User_Login_Failed Lists all events when a network user was denied access into the i5/OS. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
174 ISO: i5/OS Network User Login Successful ISO_i5_OS_Network_User_Login_Successful Lists all events when a network user successfully logs into the i5/OS. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
175 ISO: i5/OS Network User Profile Creation ISO_i5_OS_Network_User_Profile_Creation Displays i5/OS events when a network user profile has been created. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
176 ISO: i5/OS Network User Profile Deletion ISO_i5_OS_Network_User_Profile_Deletion Displays i5/OS events when a network user profile has been deleted. A.9.2.6
177 ISO: i5/OS Object Permissions Modified ISO_i5_OS_Object_Permissions_Modified Displays all permission modification activities on i5/OS to ensure authorized access. A.9.2.6, A.12.1.2, A.6.1.2, A.9.2.5, A.16.1.7
178 ISO: i5/OS Restarted ISO_i5_OS_Restarted Lists all events when the i5/OS has been restarted. A.15.2.1, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
179 ISO: i5/OS Service Started ISO_i5_OS_Service_Started Lists all events when a user starts a service on the i5/OS. A.12.4.1, A.9.2.1, A.9.4.4, A.9.4.1
180 ISO: i5/OS User Login Failed ISO_i5_OS_User_Login_Failed Lists all events when a user was denied access into the i5/OS. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
181 ISO: i5/OS User Login Successful ISO_i5_OS_User_Login_Successful Lists all events when a user successfully logs into the i5/OS. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
182 ISO: i5/OS User Profile Creation ISO_i5_OS_User_Profile_Creation Displays i5/OS events when a user profile has been created. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
183 ISO: Juniper SSL VPN (Secure Access) Policy Changed ISO_Juniper_SSL_VPN_Secure_Access_Policy_Changed Displays all configuration changes to the Juniper SSL VPN (Secure Access) policies. A.12.1.2, A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
184 ISO: Juniper SSL VPN (Secure Access) Successful Logins ISO_Juniper_SSL_VPN_Secure_Access_Successful_Logins Displays all successful logins through the Juniper SSL VPN (Secure Access). A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
185 ISO: Juniper SSL VPN Successful Logins Not Applicable Displays successful connections through the Juniper SSL VPN. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
186 ISO: Last Activities Performed by Administrators Not Applicable Displays the latest activities performed by administrators and root users to ensure appropriate access. A.12.4.3
187 ISO: Logins by Authentication Type Not Applicable Displays all logins categorized by the authentication type. A.9.4.2
188 ISO: LogLogic Disk Full ISO_Loglogic_Disk_Full Displays events that indicate the LogLogic appliance's disk is near full. A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.1, A.18.2.3, A.12.7.1
189 ISO: LogLogic File Retrieval Errors ISO_LogLogic_File_Retrieval_Errors Displays all errors while retrieving log files from devices, servers and applications. A.12.4.1, A.12.4.2, A.18.2.3, A.12.7.1
190 ISO: LogLogic HA State Changed ISO_LogLogic_HA_State_Changed Displays all LogLogic appliance failover state change events. A.12.4.1
191 ISO: LogLogic Management Center Account Activities ISO_LogLogic_Management_Center_Account_Activities Displays all accounts activities on LogLogic management center to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
192 ISO: LogLogic Management Center Login ISO_LogLogic_Management_Center_Login Displays all login events to the LogLogic management center. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
193 ISO: LogLogic Management Center Password Changes ISO_LogLogic_Management_Center_Password_Changes Displays all password change activities on LogLogic management center to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.9.2.4, A.9.2.5, A.9.3.1, A.9.4.3
194 ISO: LogLogic Management Center Upgrade Success ISO_LogLogic_Management_Center_Upgrade_Success Displays all successful events related to the system's upgrade. A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
195 ISO: LogLogic Message Routing Errors ISO_LogLogic_Message_Routing_Errors Displays all log forwarding errors on the LogLogic appliance to ensure all logs are archived properly. A.12.4.1, A.12.4.2, A.18.2.3, A.12.7.1
196 ISO: LogLogic NTP Service Stopped ISO_LogLogic_NTP_Service_Stopped Displays events that indicate the NTP engine on the LogLogic appliance has stopped. A.12.4.4
197 ISO: LogLogic Universal Collector Configuration Changes ISO_LogLogic_Universal_Collector_Configuration_Changes Displays LogLogic universal collector configuration changes. A.12.1.2, A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
198 ISO: McAfee AntiVirus: Attacks by Event ID ISO_McAfee_AntiVirus_Attacks_by_Event_ID Displays McAfee AntiVirus attacks by Event ID. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
199 ISO: McAfee AntiVirus: Attacks by Threat Name ISO_McAfee_AntiVirus_Attacks_by_Threat_Name Displays McAfee AntiVirus attacks by threat name. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
200 ISO: McAfee AntiVirus: Attacks Detected ISO_McAfee_AntiVirus_Attacks_Detected Displays attacks detected by McAfee AntiVirus. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
201 ISO: Microsoft Operations Manager - Windows Accounts Activities ISO_Microsoft_Operations_Manager_Windows_Accounts_Activities Displays all accounts activities on Windows servers to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
202 ISO: Microsoft Operations Manager - Windows Accounts Created ISO_Microsoft_Operations_Manager_Windows_Accounts_Created Displays all accounts created on Windows servers to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
203 ISO: Microsoft Operations Manager - Windows Accounts Enabled ISO_Microsoft_Operations_Manager_Windows_Accounts_Enabled Displays all accounts enabled on Windows servers to ensure authorized and appropriate access. A.9.2.1, A.9.2.1
204 ISO: Microsoft Operations Manager - Windows Password Changes ISO_Microsoft_Operations_Manager_Windows_Password_Changes Displays all password change activities on Windows servers to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.9.2.4, A.9.2.5, A.9.3.1, A.9.4.3
205 ISO: Microsoft Operations Manager - Windows Permissions Modified ISO_Microsoft_Operations_Manager_Windows_Permissions_Modified Displays all permission modification activities on Windows servers to ensure authorized access. A.9.2.6, A.12.1.2, A.6.1.2, A.9.2.5, A.16.1.7
206 ISO: Microsoft Operations Manager - Windows Policies Modified ISO_Microsoft_Operations_Manager_Windows_Policies_Modified Displays all policy modification activities on Windows servers to ensure authorized and appropriate access. A.12.1.2, A.9.2.5
207 ISO: Microsoft Operations Manager - Windows Servers Restarted ISO_Microsoft_Operations_Manager_Windows_Servers_Restarted Displays all Windows server restart activities to detect unusual activities. A.15.2.1
208 ISO: Microsoft Sharepoint Permissions Changed ISO_Microsoft_Sharepoint_Permissions_Changed Displays all user/group permission events to Microsoft Sharepoint. A.9.2.6, A.12.1.2, A.6.1.2, A.9.2.5, A.16.1.7
209 ISO: Microsoft Sharepoint Policy Add, Remove, or Modify ISO_Microsoft_Sharepoint_Policy_Add_Remove_or_Modify Displays all events when a Microsoft Sharepoint policy is added, removed, or modified. A.12.1.2, A.9.2.5
210 ISO: Microsoft SQL Server Database Failed Logins ISO_Microsoft_SQL_Server_Database_Failed_Logins Displays failed Microsoft SQL Server database logins. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
211 ISO: Microsoft SQL Server Database Successful Logins ISO_Microsoft_SQL_Server_Database_Successful_Logins Displays successful Microsoft SQL Server database logins. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
212 ISO: Most Active Ports Through Firewall - Check Point Not Applicable Displays the most active ports used through the Check Point firewall. A.13.1.1, A.13.1.2
213 ISO: Most Active Ports Through Firewall - Cisco ASA Not Applicable Displays the most active ports used through the Cisco ASA firewall. A.13.1.1, A.13.1.2
214 ISO: Most Active Ports Through Firewall - Cisco FWSM Not Applicable Displays the most active ports used through the Cisco FWSM firewall. A.13.1.1, A.13.1.2
215 ISO: Most Active Ports Through Firewall - Fortinet Not Applicable Displays the most active ports used through the Fortinet firewall. A.13.1.1, A.13.1.2
216 ISO: Most Active Ports Through Firewall - Nortel Not Applicable Displays the most active ports used through the Nortel firewall. A.13.1.1, A.13.1.2
217 ISO: NetApp Filer Accounts Locked ISO_NetApp_Filer_Accounts_Locked Displays all accounts locked out of NetApp Filer to detect access violations or unusual activities. A.9.2.6
218 ISO: NetApp Filer Audit Accounts Enabled ISO_NetApp_Filer_Audit_Accounts_Enabled Displays all accounts enabled on NetApp Filer Audit to ensure authorized and appropriate access. A.9.2.1, A.9.2.1
219 ISO: NetApp Filer Audit Group Members Added ISO_NetApp_Filer_Audit_Group_Members_Added Displays all accounts added to groups on the NetApp Filer Audit to ensure appropriate access. No Compliance Mapping
220 ISO: NetApp Filer Audit Group Members Deleted ISO_NetApp_Filer_Audit_Group_Members_Deleted Displays all accounts removed from groups on the NetApp Filer Audit to ensure appropriate access. No Compliance Mapping
221 ISO: NetApp Filer Audit Logs Cleared ISO_NetApp_Filer_Audit_Logs_Cleared Displays all audit logs clearing activities on NetApp Filer Audit to detect access violations or unusual activity. A.12.4.1, A.12.4.2, A.18.2.3, A.12.7.1
222 ISO: NetApp Filer Audit Login Failed ISO_NetApp_Filer_Audit_Login_Failed Displays all NetApp Filer Audit login events which have failed. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
223 ISO: NetApp Filer Audit Login Successful ISO_NetApp_Filer_Audit_Login_Successful Displays all NetApp Filer Audit login events which have succeeded. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
224 ISO: NetApp Filer Audit Policies Modified ISO_NetApp_Filer_Audit_Policies_Modified Displays all policy modification activities on NetApp Filer Audit to ensure authorized and appropriate access. A.12.1.2, A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
225 ISO: NetApp Filer Disk Failure ISO_NetApp_Filer_Disk_Failure Displays all disk failure events on the NetApp Filer servers. A.12.3.1, A.12.4.1
226 ISO: NetApp Filer Disk Missing ISO_NetApp_Filer_Disk_Missing Displays events that indicate disk missing on the NetApp Filer servers. A.12.3.1, A.12.4.1
227 ISO: NetApp Filer File Activity ISO_NetApp_Filer_File_Activity Displays all file activities on NetApp Filer. A.12.4.1, A.9.2.1, A.9.4.1
228 ISO: NetApp Filer File System Full ISO_NetApp_Filer_File_System_Full Displays events that indicate the NetApp Filer's disk is near full. A.12.1.3, A.12.3.1, A.12.4.1
229 ISO: NetApp Filer Login Failed ISO_NetApp_Filer_Login_Failed Displays all NetApp Filer login events which have failed. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
230 ISO: NetApp Filer Login Successful ISO_NetApp_Filer_Login_Successful Displays all NetApp Filer login events which have succeeded. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
231 ISO: NetApp Filer Password Changes ISO_NetApp_Filer_Password_Changes Displays all password change activities on NetApp Filer to ensure authorized and appropriate access. A.6.1.2, A.9.2.4, A.9.3.1, A.9.2.5, A.9.4.3
232 ISO: NetApp Filer Snapshot Error ISO_NetApp_Filer_Snapshot_Error Displays events that indicate backup on the NetApp Filer has failed. A.12.3.1
233 ISO: NTP Clock Synchronized ISO_NTP_Clock_Synchronized Displays events that indicate NTP has successfully synchronized the clock. A.12.4.4
234 ISO: NTP Daemon Exited ISO_NTP_Daemon_Exited Displays events that indicate the NTP service has stopped. A.12.4.4
235 ISO: NTP Server Unreachable ISO_NTP_Server_Unreachable Displays events that indicate the remote NTP server is not reachable. A.12.4.4
236 ISO: PANOS: Attacks by Event ID ISO_PANOS_Attacks_by_Event_ID Displays Palo Alto Networks attacks by Event ID. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
237 ISO: PANOS: Attacks by Threat Name ISO_PANOS_Attacks_by_Threat_Name Displays Palo Alto Networks attacks by threat name. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
238 ISO: PANOS: Attacks Detected ISO_PANOS_Attacks_Detected Displays attacks detected by Palo Alto Networks. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
239 ISO: Password Changes on Windows Servers ISO_Password_Changes_on_Windows_Servers Displays all password change activities on Windows servers to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.9.2.4, A.9.2.5, A.9.3.1, A.9.4.3
240 ISO: Permissions Modified on Windows Servers ISO_Permissions_Modified_on_Windows_Servers Displays all review activities performed by administrators to ensure review for any access violations. A.9.2.6, A.12.1.2, A.6.1.2, A.9.2.5, A.16.1.7
241 ISO: Policies Modified on Windows Servers ISO_Policies_Modified_on_Windows_Servers Displays all review activities performed by administrators to ensure review for any access violations. A.12.1.2, A.9.2.5
242 ISO: Oracle Database Failed Logins ISO_Oracle_Database_Failed_Logins Displays all failed login attempts to the Oracle database. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
243 ISO: Oracle Database Successful Logins ISO_Oracle_Database_Successful_Logins Displays successful Oracle database logins. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
244 ISO: Periodic Review of Log Reports ISO_Periodic_Review_of_Log_Reports Displays all permission modification activities on Windows Servers to ensure authorized access. A.15.2.1, A.12.4.2, A.18.2.3, A.12.7.1
245 ISO: Periodic Review of User Access Logs ISO_Periodic_Review_of_User_Access_Logs Displays all policy modification activities on Windows servers to ensure authorized and appropriate access. A.15.2.1, A.12.4.2, A.18.2.3, A.12.7.1
246 ISO: Pulse Connect Secure Policy Change ISO_Pulse_Connect_Secure_Policy_Change Displays all configuration changes to the Pulse Connect Secure policies. A.12.1.2, A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
247 ISO: Pulse Connect Secure Successful Logins ISO_Pulse_Connect_Secure_Successful_Logins Displays all successful logins through the Pulse Connect Secure. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
248 ISO: RACF Accounts Created ISO_RACF_Accounts_Created Displays all accounts created on RACF servers to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
249 ISO: RACF Accounts Deleted ISO_RACF_Accounts_Deleted Displays all accounts deleted on RACF servers to ensure authorized and appropriate access. A.9.2.6, A.12.1.2, A.6.1.2, A.12.4.1, A.9.2.1, A.9.2.5, A.9.4.1, A.16.1.7
250 ISO: RACF Failed Logins ISO_RACF_Failed_Logins Displays all failed login attempts to review any access violations or unusual activity. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
251 ISO: RACF Files Accessed ISO_RACF_Files_Accessed Displays all files accessed on RACF servers to ensure appropriate access. A.12.4.1, A.9.2.1
252 ISO: RACF Password Changed ISO_RACF_Password_Changed Displays all password change activities on RACF servers to ensure authorized and appropriate access. A.12.1.2, A.6.1.2, A.9.2.4, A.9.2.5, A.9.3.1, A.9.4.3
253 ISO: RACF Permissions Changed ISO_RACF_Permissions_Changed Displays all permission modification activities on RACF to ensure authorized access. A.9.2.6, A.12.1.2, A.6.1.2, A.9.2.5, A.16.1.7
254 ISO: RACF Process Started ISO_RACF_Process_Started Displays all processes started on the RACF servers. A.12.4.1, A.9.2.1, A.9.4.4, A.9.4.1
255 ISO: RACF Successful Logins ISO_RACF_Successful_Logins Displays successful logins to ensure only authorized personnel have access. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
256 ISO: Sender and Recipients Exchanging the Most Emails - Exchange 2000/2003 Not Applicable Displays the top email sender and recipient combinations A.13.2.3
257 ISO: Software Update Successes on i5/OS ISO_Software_Update_Successes_on_i5_OS Displays all i5/OS successful events related to the system's software or patch update. A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
258 ISO: Source IP Sending To Most Recipients - Exchange 2000/2003 Not Applicable Displays IP addresses that are sending to the most recipients using Exchange A.13.2.3
259 ISO: Successful Logins Not Applicable Displays successful logins to ensure only authorized personnel have access. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
260 ISO: Sybase ASE Failed Logins ISO_Sybase_ASE_Failed_Logins Displays failed Sybase ASE database logins. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
261 ISO: Sybase ASE Successful Logins ISO_Sybase_ASE_Successful_Logins Displays successful Sybase ASE database logins. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
262 ISO: Symantec Endpoint Protection: Attacks by Threat Name ISO_Symantec_Endpoint_Protection_Attacks_by_Threat_Name Displays Symantec Endpoint Protection attacks by threat name. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
263 ISO: Symantec Endpoint Protection: Attacks Detected ISO_Symantec_Endpoint_Protection_Attacks_Detected Displays attacks detected by Symantec Endpoint Protection. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
264 ISO: Symantec Endpoint Protection: Scans ISO_Symantec_Endpoint_Protection_Scans Displays scans using Symantec Endpoint Protection. A.12.2.1, A.12.2.1
265 ISO: Symantec Endpoint Protection: Updated ISO_Symantec_Endpoint_Protection_Updated Displays updates to Symantec Endpoint Protection. A.12.2.1, A.12.2.1, A.13.1.1, A.13.1.2, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
266 ISO: Symantec Endpoint Protection Configuration Changes ISO_Symantec_Endpoint_Protection_Configuration_Changes Displays Symantec Endpoint Protection configuration changes. A.12.1.2, A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
267 ISO: Symantec Endpoint Protection Password Changes ISO_Symantec_Endpoint_Protection_Password_Changes Displays all password change activities on Symantec Endpoint Protection to ensure authorized and appropriate access. A.6.1.2, A.9.2.4, A.9.3.1, A.9.2.5, A.9.4.3
268 ISO: Symantec Endpoint Protection Policy Add, Remove, or Modify ISO_Symantec_Endpoint_Protection_Policy_Add_Remove_or_Modify Displays all events when a Symantec Endpoint Protection policy is added, removed, or modified. A.12.1.2, A.12.1.4, A.13.1.1, A.13.1.2, A.9.1.2, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
269 ISO: System Restarted Not Applicable Displays all logs related to system restarts. A.12.2.1, A.12.2.1, A.15.2.1, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
270 ISO: TIBCO Administrator Password Changes ISO_TIBCO_Administrator_Password_Changes Displays all password change activities on TIBCO Administrator to ensure authorized and appropriate access. A.6.1.2, A.9.2.4, A.9.3.1, A.9.2.5, A.9.4.3
271 ISO: TIBCO Administrator Permission Changes ISO_TIBCO_Administrator_Permission_Changes Displays events related to TIBCO Administrator permission modifications. A.9.2.6, A.12.1.2, A.6.1.2, A.9.2.5, A.16.1.7
272 ISO: TIBCO ActiveMatrix Administrator Failed Logins ISO_TIBCO_ActiveMatrix_Administrator_Failed_Logins Displays all TIBCO ActiveMatrix Administrator login events which have failed. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
273 ISO: TIBCO ActiveMatrix Administrator Permission Changes ISO_TIBCO_ActiveMatrix_Administrator_Permission_Changes Displays events related to TIBCO ActiveMatrix Administrator permission modifications. A.9.2.6, A.12.1.2, A.6.1.2, A.9.2.5, A.16.1.7
274 ISO: TIBCO ActiveMatrix Administrator Successful Logins ISO_TIBCO_ActiveMatrix_Administrator_Successful_Logins Displays successful logins to TIBCO ActiveMatrix Administrator to ensure only authorized personnel have access. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
275 Not Applicable ISO_TIBCO_Spotfire_Failed_Logins Failed logins to the TIBCO Spotfire. No Compliance Mapping
276 Not Applicable ISO_TIBCO_Spotfire_Group_Members_Deleted Displays all accounts deleted to groups to ensure appropriate access. No Compliance Mapping
277 Not Applicable ISO_TIBCO_Spotfire_Password_Changes Displays all password change activities on TIBCO Spotfire to ensure authorized and appropriate access. No Compliance Mapping
278 Not Applicable ISO_TIBCO_Spotfire_Successful_Logins Successful logins to the TIBCO Spotfire. No Compliance Mapping
279 Not Applicable ISO_TIBCO_Spotfire_User_Permission_Change A permission role has been added, changed, removed, or applied to a user on TIBCO Spotfire server. No Compliance Mapping
280 ISO: TrendMicro Control Manager: Attacks Detected ISO_TrendMicro_Control_Manager_Attacks_Detected Displays attacks detected by TrendMicro Control Manager. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
281 ISO: TrendMicro Control Manager: Attacks Detected by Threat Name ISO_TrendMicro_Control_Manager_Attacks_Detected_by_Threat_Name Displays attacks detected by TrendMicro Control Manager by threat name. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
282 ISO: TrendMicro OfficeScan: Attacks Detected ISO_TrendMicro_OfficeScan_Attacks_Detected Displays attacks detected by TrendMicro OfficeScan. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
283 ISO: TrendMicro OfficeScan: Attacks Detected by Threat Name ISO_TrendMicro_OfficeScan_Attacks_Detected_by_Threat_Name Displays attacks detected by TrendMicro OfficeScan by threat name. A.12.2.1, A.12.2.1, A.12.6.1, A.16.1.2, A.16.1.3
284 ISO: UNIX Failed Logins ISO_UNIX_Failed_Logins Displays failed UNIX logins for known and unknown users. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
285 ISO: vCenter Change Attributes ISO_vCenter_Change_Attributes Modification of VMware vCenter and VMware ESX properties. A.12.1.2, A.14.2.4
286 ISO: vCenter Datastore Events ISO_vCenter_Datastore_Events Displays create, modify, and delete datastore events on VMware vCenter. A.12.4.1, A.9.2.1
287 ISO: vCenter Data Move ISO_vCenter_Data_Move Entity has been moved within the VMware vCenter infrastructure. A.12.4.1, A.9.2.1
288 ISO: vCenter Failed Logins ISO_vCenter_Failed_Logins Failed logins to the VMware vCenter console. A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
289 ISO: vCenter Modify Firewall Policy ISO_vCenter_Modify_Firewall_Policy Displays changes to the VMware ESX allowed services firewall policy. A.12.1.2, A.9.1.2, A.14.2.4
290 ISO: vCenter Restart ESX Services ISO_vCenter_Restart_ESX_Services VMware vCenter restarted services running on VMware ESX Server. A.15.2.1
291 ISO: vCenter Resource Usage Change ISO_vCenter_Resource_Usage_Change Resources have changed on VMware vCenter. A.12.1.2, A.14.2.4
292 ISO: vCenter Shutdown or Restart of ESX Server ISO_vCenter_Shutdown_or_Restart_of_ESX_Server VMware ESX Server is shutdown or restarted from VMware vCenter console. A.15.2.1, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
293 ISO: vCenter Successful Logins ISO_vCenter_Successful_Logins Successful logins to the VMware vCenter console. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1, A.16.1.7
294 ISO: vCenter User Permission Change ISO_vCenter_User_Permission_Change A permission role has been added, changed, removed, or applied to a user on VMware vCenter server. A.9.2.6, A.12.1.2, A.6.1.2, A.9.2.5, A.16.1.7
295 ISO: vCenter Virtual Machine Created ISO_vCenter_Virtual_Machine_Created Virtual machine has been created from VMware vCenter console. A.12.1.2
296 ISO: vCenter Virtual Machine Deleted ISO_vCenter_Virtual_Machine_Deleted Virtual machine has been deleted or removed from VMware vCenter console. A.12.1.2, A.14.2.4
297 ISO: vCenter Virtual Machine Shutdown ISO_vCenter_Virtual_Machine_Shutdown Virtual machine has been shutdown or paused from VMware vCenter console. A.15.2.1, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
298 ISO: vCenter Virtual Machine Started ISO_vCenter_Virtual_Machine_Started Virtual machine has been started or resumed from VMware vCenter console. A.15.2.1, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
299 ISO: vCenter vSwitch Added, Changed or Removed ISO_vCenter_vSwitch_Added_Changed_or_Removed vSwitch on VMware ESX server has been added, modified or removed from the VMware vCenter console. A.12.1.2, A.14.2.4
300 ISO: VPN Connection Disconnect Reasons Not Applicable Displays the disconnect reasons for VPN connections. A.15.2.1, A.12.4.1
301 ISO: VPN Connections by Users Not Applicable Displays users who are made the most connections. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1
302 ISO: VPN Denied Connections by Users Not Applicable Displays users with the most denied connections. A.9.2.6
303 ISO: VPN Sessions by Users Not Applicable Displays all VPN sessions categorized by authenticated users. A.12.4.1, A.9.2.1, A.9.4.1
304 ISO: VPN Users Accessing Corporate Network Not Applicable Displays all users logging into the corporate network via Virtual Private Network to ensure appropriate access. A.9.2.6, A.12.4.1, A.9.2.1, A.9.2.1, A.9.2.5, A.9.2.1, A.9.4.1
305 ISO: Windows Accounts Enabled ISO_Windows_Accounts_Enabled Displays all accounts enabled on Windows servers to ensure authorized and appropriate access. A.9.2.1, A.9.2.1
306 ISO: Windows Accounts Locked ISO_Windows_Accounts_Locked Displays all accounts locked out of Windows servers to detect access violations or unusual activities. A.9.2.6
307 ISO: Windows Audit Logs Cleared ISO_Windows_Audit_Logs_Cleared Displays all audit logs clearing activities on Windows servers to detect access violations or unusual activity. A.12.4.1, A.12.4.2, A.18.2.3, A.12.7.1
308 ISO: Windows Domain Activities ISO_Windows_Domain_Activities Displays all trusted domains created or deleted on Windows servers to ensure authorized and appropriate access. A.12.1.2
309 ISO: Windows Group Members Added ISO_Windows_Group_Members_Added Displays all accounts added to groups on the Windows servers to ensure appropriate access. No Compliance Mapping
310 ISO: Windows Group Members Deleted ISO_Windows_Group_Members_Deleted Displays all accounts removed from groups on the Windows servers to ensure appropriate access. No Compliance Mapping
311 ISO: Windows New Services Installed ISO_Windows_New_Services_Installed Displays a list of new services installed on Windows servers to ensure authorized access. A.12.1.2, A.12.2.1, A.12.2.1, A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
312 ISO: Windows Programs Accessed ISO_Windows_Programs_Accessed Displays all programs started and stopped on servers to ensure appropriate access. A.12.4.1, A.9.2.1, A.9.4.4, A.9.4.1
313 ISO: Windows Servers Restarted ISO_Windows_Servers_Restarted Displays all Windows server restart activities to detect unusual activities. A.15.2.1
314 ISO: Windows Software Update Activities ISO_Windows_Software_Update_Activities Displays all events related to the system's software or patch update. A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
315 ISO: Windows Software Update Failures ISO_Windows_Software_Update_Failures Displays all failed events related to the system's software or patch update. A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4
316 ISO: Windows Software Update Successes ISO_Windows_Software_Update_Successes Displays all successful events related to the system's software or patch update. A.12.5.1, A.14.2.2, A.14.2.3, A.14.2.4