OSSEC / HIDS Rule Documentation
Documentation for the OSSEC/HIDS rules previously described in the Atomicorp wiki. This is an initial selection, with more rules to follow. OSSEC rule IDs have their own namespace; the WAF rule catalog documents ModSecurity rules separately.
The definition status identifies rules found in the reviewed Atomicorp HIDS source inventory. It does not establish which rules a particular manager has enabled. Historical entries are retained for installations using older rule bundles.
| Rule ID | Definition status | Alert message / subject | Level |
|---|---|---|---|
| 11 | Historical / version-dependent | Anomalous increase in log events | |
| 501 | Present in current source | New ossec agent connected. | 3 |
| 502 | Present in current source | Ossec server started. | 3 |
| 503 | Present in current source | Ossec agent started. | 3 |
| 504 | Present in current source | Ossec agent disconnected. | 3 |
| 506 | Present in current source | Ossec agent key updated | 3 |
| 510 | Present in current source | Host-based anomaly detection event (rootcheck). | 6 |
| 512 | Present in current source | Windows Audit event. | 3 |
| 514 | Present in current source | Windows application monitor event. | 2 |
| 516 | Present in current source | System Audit event. | 3 |
| 531 | Present in current source | Partition usage reached 90%+ (disk space monitor). | 7 |
| 533 | Present in current source | Listened ports status (netstat) changed (new port opened or closed). | 7 |
| 536 | Present in current source | Partition usage reached 80%+ (disk space monitor). | 7 |
| 550 | Present in current source | Integrity checksum changed. | 7 |
| 551 | Present in current source | Integrity checksum changed again (2nd time). | 1 |
| 552 | Present in current source | Integrity checksum changed again (3rd time). | 1 |
| 553 | Present in current source | File deleted. Unable to retrieve checksum. | 7 |
| 554 | Present in current source | File added to the system. | 5 |
| 591 | Present in current source | Log file rotated. | 3 |
| 592 | Present in current source | Log file size reduced. | 8 |
| 593 | Present in current source | Microsoft Event log cleared. | 9 |
| 607 | Present in current source | Active response: $(script) - $(type) | 3 |
| 1002 | Present in current source | Unknown problem somewhere in the system. | 2 |
| 1003 | Present in current source | Non standard syslog message (size too large). | 13 |
| 1006 | Present in current source | Syslogd restarted. | 5 |
| 1007 | Present in current source | File system full. | 7 |
| 2501 | Present in current source | User authentication failure. | 5 |
| 2502 | Present in current source | User missed the password more than one time | 10 |
| 2932 | Present in current source | New Yum/DNF package installed. | 7 |
| 2933 | Present in current source | Yum/DNF package updated. | 7 |
| 2934 | Present in current source | Yum/DNF package deleted. | 7 |
| 2945 | Present in current source | rsyslog may be dropping messages due to rate-limiting. | 4 |
| 2960 | Present in current source | User added to group. | 2 |
| 3301 | Present in current source | Postfix: Message rejected by postfix configuration (554: permanent problems with the remote server). | 6 |
| 3302 | Present in current source | Postfix: Rejected by access list (Requested action not taken). | 6 |
| 3305 | Present in current source | Postfix: Recipient address must contain FQDN (504: Command parameter not implemented). | 5 |
| 3306 | Present in current source | Postfix: IP Address black-listed by anti-spam (blocked). | 6 |
| 3333 | Present in current source | Postfix stopped. | 7 |
| 3334 | Present in current source | Postfix started. | 3 |
| 3335 | Present in current source | Postfix: too many errors after RCPT from unkown | 6 |
| 3337 | Historical / version-dependent | Spamhaus blocklist event | |
| 3351 | Present in current source | Postfix: Multiple relaying attempts of spam. | 6 |
| 3355 | Present in current source | Postfix: Multiple attempts to send e-mail to invalid recipient or from unknown sender domain. | 10 |
| 3356 | Present in current source | Postfix: Multiple attempts to send e-mail from black-listed IP address (blocked). | 10 |
| 3357 | Present in current source | Multiple rapid SASL authentication failures. | 10 |
| 3358 | Present in current source | Multiple SASL authentication failures. | 10 |
| 3359 | Present in current source | Multiple SASL authentication failures. | 10 |
| 3360 | Present in current source | Multiple SASL authentication failures. | 10 |
| 3379 | Present in current source | Postfix: (Fast 5/10s) Multiple attempts to send e-mail with EHLO failure | 6 |
| 3381 | Present in current source | Postfix: (Medium 5/60s) Multiple attempts to send e-mail with EHLO failure | 6 |
| 3396 | Present in current source | Postfix: hostname verification failed | 3 |
| 3398 | Present in current source | Postfix: Illegal address from unknown sender | 6 |
| 3901 | Present in current source | New courier (imap/pop3) connection. | 3 |
| 3910 | Present in current source | Courier brute force (multiple failed logins from the same IP). | 10 |
| 3911 | Present in current source | Multiple connection attempts to courier from same source. | 10 |
| 3912 | Present in current source | Multiple failed logins, 6 failures in 60 seconds from the same IP. | 10 |
| 3913 | Present in current source | Multiple failed logins, 10 failures in 1 hour from the same IP. | 10 |
| 4103 | Historical / version-dependent | Advanced portscan event | |
| 4151 | Present in current source | Firewall: Multiple drop events from same source. | 7 |
| 5108 | Present in current source | System running out of memory. Availability of the system is in risk. | 12 |
| 5114 | Present in current source | Error inserting module. | 7 |
| 5302 | Present in current source | User missed the password to change UID to root. | 9 |
| 5402 | Present in current source | Successful sudo to ROOT executed | 4 |
| 5405 | Present in current source | Unauthorized user attempted to use sudo. | 5 |
| 5501 | Present in current source | Login session opened. | 3 |
| 5502 | Present in current source | Login session closed. | 3 |
| 5503 | Present in current source | User login failed. | 5 |
| 5551 | Present in current source | Multiple failed logins in a small period of time. | 10 |
| 5555 | Present in current source | User changed password. | 3 |
| 5556 | Present in current source | Multiple failed logins in a long period of time. | 10 |
| 5559 | Present in current source | Password check failed. | 5 |
| 5701 | Present in current source | Possible attack on the ssh server (or version gathering). | 8 |
| 5702 | Present in current source | Reverse lookup error (bad ISP or attack). | 5 |
| 5703 | Present in current source | Possible breakin attempt (high number of reverse lookup errors). | 10 |
| 5706 | Present in current source | SSH insecure connection attempt (scan). | 5 |
| 5710 | Present in current source | Attempt to login using a non-existent user | 5 |
| 5712 | Present in current source | SSHD brute force trying to get access to the system. | 10 |
| 5715 | Present in current source | SSHD authentication success. | 3 |
| 5716 | Present in current source | SSHD authentication failed. | 5 |
| 5719 | Present in current source | Multiple access attempts using a denied user. | 10 |
| 5720 | Present in current source | Multiple SSHD authentication failures. | 10 |
| 5758 | Present in current source | SSH: Maximum authentication attempts exceeded. | 6 |
| 5905 | Present in current source | Failed adding user to the system | 8 |
| 7501 | Present in current source | McAfee Windows AV informational event. | 2 |
| 9701 | Present in current source | Dovecot Authentication Success. | 3 |
| 9705 | Present in current source | Dovecot Invalid User Login Attempt. | 5 |
| 9707 | Present in current source | Dovecot Aborted Login. | 5 |
| 9951 | Present in current source | vpopmail: brute force (multiple failed logins). | 10 |
| 9952 | Present in current source | vpopmail: brute force (email harvesting). | 10 |
| 9953 | Present in current source | vpopmail: brute force (empty password). | 10 |
| 11203 | Present in current source | proftpd: Attempt to login using a non-existent user. | 5 |
| 11209 | Present in current source | proftpd: Attempt to bypass firewall that can't adequately keep state of FTP traffic. | 14 |
| 11252 | Present in current source | proftpd: Multiple connection attempts from same source. | 10 |
| 11255 | Present in current source | proftpd: Attempt to log in to a forbidden account. | 7 |
| 11257 | Present in current source | proftpd: cannot connect to the clamd daemon. (Daemon not running?) | 7 |
| 11306 | Present in current source | pure-ftpd: FTP brute force (multiple failed logins). | 10 |
| 12145 | Present in current source | zone transfer denied | 1 |
| 12149 | Present in current source | Bind: Multiple query (cache) failures. | 6 |
| 12150 | Present in current source | Bind DoS attack. (CVE-2011-4313) | 12 |
| 17505 | Present in current source | Plesk console login failure | 5 |
| 18100 | Present in current source | Group of windows rules. | 0 |
| 18103 | Present in current source | Windows error event. | 5 |
| 18105 | Present in current source | Windows audit failure event. | 4 |
| 18130 | Present in current source | Windows: Logon Failure - Unknown user or bad password. | 5 |
| 18141 | Present in current source | Unexpected Windows shutdown. | 7 |
| 18145 | Present in current source | Windows: Service startup type was changed. | 3 |
| 18146 | Present in current source | Windows: Application Uninstalled. | 5 |
| 18147 | Present in current source | Windows: Application Installed. | 5 |
| 18149 | Present in current source | Windows User Logoff. | 3 |
| 18152 | Present in current source | Multiple Windows Logon Failures. | 10 |
| 18153 | Present in current source | Multiple Windows audit failure events. | 10 |
| 18154 | Present in current source | Multiple Windows error events. | 10 |
| 18161 | Present in current source | Windows Filtering Platform has blocked a connection | 2 |
| 18162 | Present in current source | Windows Filtering Platform has blocked a connection multiple times (Standard: 60/10) | 6 |
| 18180 | Present in current source | MS SQL Server Logon Failure. | 5 |
| 18183 | Present in current source | Microsoft: Multiple MS SQL Server Logon Failures from the same source. | 10 |
| 18258 | Present in current source | Windows: TS Gateway login failure. | 5 |
| 18259 | Present in current source | Windows: TS Gateway user disconnected. | 3 |
| 18301 | Present in current source | Windows Application Event (455): Error writing to EDB log file. | 4 |
| 18303 | Present in current source | Windows Application Event (82): The RPC server is unavailable. | 4 |
| 18305 | Present in current source | Windows Application Event (1002): Application Hang. | 5 |
| 18306 | Present in current source | Windows Application Event (1002): Application Hang occurred 7 or more times within 24 hrs - Check application. | 9 |
| 18600 | Present in current source | Windows System Rules Group. | 0 |
| 18601 | Present in current source | Windows System Event (7038): A service was unable to log on with the currently configured password. Check the health and configurations of the service. | 5 |
| 18602 | Present in current source | Windows System Event (7038): A service was unable to log on with the currently configured password MULTIPLE TIMES. Check the health and configurations of the service. | 7 |
| 19002 | Present in current source | SCA summary: $(sca.policy): Score less than 90% ($(sca.score)) | 4 |
| 19003 | Present in current source | SCA summary: $(sca.policy): Score less than 80% ($(sca.score)) | 5 |
| 19004 | Present in current source | SCA summary: $(sca.policy): Score less than 50% ($(sca.score)) | 7 |
| 19005 | Present in current source | SCA summary: $(sca.policy): Score less than 30% ($(sca.score)) | 9 |
| 19007 | Present in current source | $(sca.policy): $(sca.check.title) | 7 |
| 19008 | Present in current source | $(sca.policy): $(sca.check.title) | 3 |
| 19009 | Present in current source | $(sca.policy): $(sca.check.title) | 3 |
| 19010 | Present in current source | $(sca.policy): $(sca.check.title): Status changed from failed to passed | 3 |
| 19011 | Present in current source | $(sca.policy): $(sca.check.title): Status changed from passed to failed | 9 |
| 19012 | Present in current source | $(sca.policy): $(sca.check.title): Status changed from passed to 'not applicable' | 5 |
| 19013 | Present in current source | $(sca.policy): $(sca.check.title): Status changed from failed to 'not applicable' | 5 |
| 19014 | Present in current source | $(sca.policy): $(sca.check.title): Status changed from 'not applicable' to failed | 9 |
| 19015 | Present in current source | $(sca.policy): $(sca.check.title): Status changed from 'not applicable' to passed | 3 |
| 20100 | Present in current source | First time this IDS alert is generated. | 8 |
| 20101 | Present in current source | IDS event. | 7 |
| 20151 | Present in current source | Multiple IDS events from same source ip. | 10 |
| 20152 | Present in current source | Multiple IDS alerts for same id. | 10 |
| 20162 | Present in current source | Multiple IDS alerts for same id (ignoring now this id). | 11 |
| 23503 | Present in current source | $(vulnerability.cve) affects $(vulnerability.package.name) | 5 |
| 23504 | Present in current source | $(vulnerability.cve) affects $(vulnerability.package.name) | 7 |
| 23505 | Present in current source | $(vulnerability.cve) affects $(vulnerability.package.name) | 10 |
| 23506 | Present in current source | $(vulnerability.cve) affects $(vulnerability.package.name) | 13 |
| 30104 | Present in current source | Apache: segmentation fault. | 12 |
| 30105 | Present in current source | Apache: Attempt to access forbidden file or directory. | 5 |
| 30112 | Present in current source | Apache: Attempt to access an non-existent file (those are reported on the access.log). | 0 |
| 30113 | Present in current source | Invalid method in request | 7 |
| 30114 | Present in current source | mod_qos invalid request detected | 6 |
| 30117 | Present in current source | Apache: Invalid URI, file name too long. | 10 |
| 30122 | Present in current source | Multiple Invalid method requests from the same IP | 10 |
| 30155 | Present in current source | Multiple attempts to access a non-existent file. | 10 |
| 30195 | Present in current source | Multiple access forbidden file or directory events from the same IP. | 10 |
| 30220 | Present in current source | Invalid Apache connection attempt - Possible Apache DOS attack | 10 |
| 30221 | Present in current source | Multiple invalid Apache connection attempts - Possible DOS attack | 12 |
| 30302 | Present in current source | Self Healing: Critical vulnerability in PHP detected, attempting to remove dangerous exec stack bits from PHP modules. | 8 |
| 30618 | Present in current source | Apache: PHP Notice in Apache log | 1 |
| 31102 | Present in current source | Possible DoS Consumption Attack | 10 |
| 31151 | Historical / version-dependent | Multiple web server 4xx errors | |
| 38001 | Present in current source | Failed mail authenticatication attempt | 5 |
| 40106 | Present in current source | Buffer overflow attempt (probably on yppasswd). | 12 |
| 40111 | Present in current source | Multiple authentication failures. | 10 |
| 40112 | Present in current source | Multiple authentication failures followed by a success. | 12 |
| 40114 | Present in current source | Multiple authentication failures. (Slow Brute Force) | 10 |
| 40703 | Present in current source | Systemd: Service has entered a failed state, and likely has not started. | 5 |
| 50106 | Present in current source | MySQL: authentication failure. | 9 |
| 50180 | Present in current source | MySQL: Multiple errors. | 10 |
| 52502 | Present in current source | ClamAV: Virus detected | 8 |
| 52504 | Present in current source | Clamd: Warning | 7 |
| 52506 | Present in current source | Clamd database updated | 3 |
| 52507 | Present in current source | ClamAV database update | 3 |
| 52508 | Present in current source | ClamAV database updated | 1 |
| 52510 | Present in current source | Connection to update server refused | 1 |
| 52511 | Present in current source | Real-Time Anti-virus | 1 |
| 57390 | Present in current source | SSH: Multiple successful ssh logins from same user and different ip. | 6 |
| 59202 | Present in current source | Windows Security error event | 5 |
| 59203 | Present in current source | Windows audit success event | 0 |
| 59204 | Present in current source | Windows audit failure event | 3 |
| 59205 | Present in current source | Windows Logon Failure | 3 |
| 59207 | Present in current source | Microsoft: Failed attempt to perform a privileged service. | 0 |
| 59208 | Present in current source | Session reconnected/disconnected to winstation | 3 |
| 59209 | Present in current source | User account enabled or created | 8 |
| 59210 | Present in current source | User account changed | 5 |
| 59211 | Present in current source | User account disabled or deleted | 8 |
| 59213 | Present in current source | Group Account Changed | 5 |
| 59215 | Present in current source | User account locked out (multiple login errors) | 9 |
| 59221 | Present in current source | Computer account added/changed/deleted | 5 |
| 59222 | Present in current source | Windows: Remote Logon Failure - Unknown user or bad password | 5 |
| 59223 | Present in current source | Logon Failure - Account logon time restriction violation | 5 |
| 59224 | Present in current source | Logon Failure - Account currently disabled | 5 |
| 59225 | Present in current source | Logon Failure - Specified account expired | 5 |
| 59226 | Present in current source | Logon Failure - User not allowed to login at this computer | 7 |
| 59227 | Present in current source | Logon Failure - User not granted logon type | 5 |
| 59228 | Present in current source | Logon Failure - Account's password expired | 5 |
| 59229 | Present in current source | Logon Failure - Internal error | 5 |
| 59230 | Present in current source | Logon Failure - Account locked out | 7 |
| 59233 | Present in current source | User account unlocked | 5 |
| 59238 | Present in current source | Group Account Created | 5 |
| 59239 | Present in current source | Group Account Deleted | 5 |
| 59240 | Present in current source | Security Enabled Global Group Created | 5 |
| 59241 | Present in current source | Security Enabled Global Group Member Added $(win.eventdata.memberSid) | 5 |
| 59242 | Present in current source | Security Enabled Global Group Member Removed $(win.eventdata.memberSid) | 5 |
| 59243 | Present in current source | Security Enabled Local Group Created $(win.eventdata.memberSid) | 5 |
| 59244 | Present in current source | Security Enabled Local Group Member Added $(win.eventdata.memberSid) | 5 |
| 59245 | Present in current source | Security Enabled Local Group Member Removed $(win.eventdata.memberSid) | 5 |
| 59246 | Present in current source | Security Enabled Local Group Deleted | 5 |
| 59247 | Present in current source | Security Enabled Local Group Changed | 5 |
| 59248 | Present in current source | Security Enabled Global Group Changed | 5 |
| 59249 | Present in current source | Security Enabled Universal Group Created | 5 |
| 59250 | Present in current source | Security Enabled Universal Group Changed | 5 |
| 59251 | Present in current source | Security Enabled Universal Group Member Added | 5 |
| 59252 | Present in current source | Security Enabled Universal Group Member Removed | 5 |
| 59300 | Present in current source | IIS NetworkCleartext Logon Success | 3 |
| 59302 | Present in current source | Security Enabled Global Group Deleted $(win.eventdata.memberSid) | 5 |
| 59304 | Present in current source | Multiple Windows Logon Failures | 8 |
| 59306 | Present in current source | Multiple Windows error Security events | 10 |
| 59309 | Present in current source | An IPsec Main Mode negotiation failed | 8 |
| 59326 | Present in current source | Windows: Local Logon Failure - Unknown user or bad password | 5 |
| 59327 | Present in current source | Windows: Network Logon Failure | 4 |
| 59328 | Present in current source | Windows: Network Logon Failure - User does not exist | 5 |
| 59330 | Present in current source | Windows: Network Logon Failure - Password expired | 5 |
| 59334 | Present in current source | Windows: Auditing, multiple attempts to access an audited object by the same user (8/240) | 7 |
| 59335 | Present in current source | Windows: Code Integrity determined that the page hashes of an image file are not valid | 6 |
| 60026 | Present in current source | Trusted Path Execution policy violation. An untrusted user attempted to execute an untrusted application. | 8 |
| 60027 | Present in current source | Denied a RWX mmap event. An application just attmpted to use the mprotect function to bypass memory protection functions in the kernel. | 8 |
| 60032 | Present in current source | Place holder for all grsec generic events | 0 |
| 60034 | Present in current source | Operating System denied resource overstep | 7 |
| 60035 | Present in current source | Grsecurity has detected a segmentation fault on the system. | 5 |
| 60056 | Present in current source | Atomicorp: IP found on Threat Category 1 Atomicorp RBL - DOS bots | 7 |
| 60057 | Present in current source | Atomicorp: IP found on Threat Category 2 Atomicorp RBL - Spammers | 7 |
| 60058 | Present in current source | Atomicorp: IP found on Threat Category 3 Atomicorp RBL - Brute Force attackers | 7 |
| 60059 | Present in current source | Atomicorp: IP found on Threat Category 4 Atomicorp RBL - Known Attackers | 7 |
| 60117 | Present in current source | Access attempt blocked by Mod Security RBL. | 6 |
| 60118 | Present in current source | Access attempt blocked by Mod Security. | 5 |
| 60119 | Present in current source | Multiple attempts blocked by Mod Security. | 7 |
| 60126 | Present in current source | HTTP Authorization failed | 5 |
| 60128 | Present in current source | HTTP 403 Forbidden. This is not a WAF event, the web server has refused to complete the transaction | 5 |
| 60138 | Present in current source | Request Entity Too Large | 5 |
| 60141 | Present in current source | Requested range not satisfied | 5 |
| 60158 | Present in current source | Wordpress Login attempt failure | 5 |
| 60159 | Present in current source | Wordpress brute force (fast) login failures | 8 |
| 60167 | Present in current source | Drupal Login attempt failure | 5 |
| 60205 | Present in current source | Possible DoS attack - Configured thresholds exceeded | 7 |
| 60227 | Historical / version-dependent | Denied memory-protection operation | |
| 60249 | Present in current source | Connection dropped by apache due to slow connection | 5 |
| 60313 | Present in current source | PHPBB Login attempt failure - invalid username | 5 |
| 60334 | Present in current source | PaX: Crashing bruteforce prevention initiated | 11 |
| 60602 | Present in current source | Windows Application error event | 9 |
| 60608 | Present in current source | Summary event of the report's signatures | 4 |
| 60610 | Present in current source | Windows Installer began an installation process | 3 |
| 60612 | Present in current source | Application Installed $(win.eventdata.data) | 3 |
| 60635 | Present in current source | Windows installer reconfigured the product | 3 |
| 60642 | Present in current source | Software Protection service scheduled successfully | 3 |
| 60702 | Present in current source | The VSS service is shutting down due to idle timeout | 5 |
| 60790 | Present in current source | The registry file is still in use by other applications or services | 4 |
| 60798 | Present in current source | The database engine attached a database | 3 |
| 60805 | Present in current source | The database engine is starting a new instance | 3 |
| 60807 | Present in current source | The database engine is initiating recovery steps | 3 |
| 60808 | Present in current source | The database engine is replaying log file | 3 |
| 60809 | Present in current source | The database engine has completed recovery steps | 3 |
| 60816 | Present in current source | An attempt to open the file for read only access failed with system error | 5 |
| 60817 | Present in current source | Index cleanup of database initiated | 3 |
| 60819 | Present in current source | The version store for this instance has reached its maximum size | 5 |
| 60902 | Present in current source | Failed to start MS DTC via the MS DTC Proxy DLL | 5 |
| 60904 | Present in current source | MS DTC TIP Gateway illegal transition | 8 |
| 60905 | Present in current source | MS DTC TIP Gateway invalid value | 5 |
| 60906 | Present in current source | MS DTC TIP Gateway encountered error calling CoCreateInstance | 5 |
| 60910 | Present in current source | Very Slow Wordpress brute force login failures from same IP source. | 10 |
| 61026 | Present in current source | An application has attempted to set the stack executable, this is either an attack or a very vulnerable application. | 8 |
| 61027 | Present in current source | Denied a RWX mprotect event. An application just attmpted to use the mprotect function to bypass memory protection functions in the kernel. | 8 |
| 61028 | Present in current source | Denied an untrusted non system library binary from hooking an application. | 7 |
| 61060 | Present in current source | The Open Procedure for service Remote Access failed | 5 |
| 61102 | Present in current source | Windows System error event | 5 |
| 61104 | Present in current source | Service startup type was changed | 3 |
| 61110 | Present in current source | Multiple System error events | 10 |
| 61129 | Present in current source | The browser was unable to retrieve a list of domains from the browser master on the network | 5 |
| 61130 | Present in current source | The value for the parameter to the browser service was illegal | 8 |
| 61138 | Present in current source | New Windows Service Created | 5 |
| 62816 | Present in current source | Internal Server Error. The server encountered an unexpected condition which prevented it from fulfilling the request. | 5 |
| 62818 | Present in current source | Bad Gateway. The server, while acting as a gateway or proxy, received an invalid response from the upstream server it accessed in attempting to fulfill the request. | 5 |
| 62819 | Present in current source | Service Unavailable. The server is currently unable to handle the request due to a temporary overloading or maintenance of the server. | 5 |
| 63317 | Present in current source | Cpanel WHM root Login success | 6 |
| 64210 | Present in current source | Suspicious activity detected - HTTP Request Missing a Host Header | 7 |
| 67128 | Present in current source | XML parser error: Possible XML attack | 11 |
| 80701 | Present in current source | Auditd: Start / Resume | 1 |
| 80703 | Present in current source | Auditd: End | 10 |
| 80705 | Present in current source | Auditd: Configuration changed | 3 |
| 80711 | Present in current source | Auditd: process ended abnormally | 10 |
| 80717 | Present in current source | Auditd: Role-Based Access Control (RBAC) failure detected. | 8 |
| 80730 | Present in current source | Auditd: SELinux permission check | 3 |
| 81101 | Present in current source | Attached USB Storage | 3 |
| 81521 | Present in current source | OpenSCAP: $(oscap.check.title) (passed) | 1 |
| 81522 | Present in current source | OpenSCAP: $(oscap.check.title) (not checked) | 1 |
| 81528 | Present in current source | OpenSCAP: $(oscap.check.title) (not selected) | 1 |
| 81529 | Present in current source | OpenSCAP: $(oscap.check.title) (not passed) | 5 |
| 81530 | Present in current source | OpenSCAP: $(oscap.check.title) (not passed) | 5 |
| 81531 | Present in current source | OpenSCAP: $(oscap.check.title) (not passed) | 7 |
| 81541 | Present in current source | OpenSCAP Report overview: Score less than 90 | 4 |
| 81542 | Present in current source | OpenSCAP Report overview: Score less than 80 | 5 |
| 81543 | Present in current source | OpenSCAP Report overview: Score less than 50 | 5 |
| 81544 | Present in current source | OpenSCAP Report overview: Score less than 30 | 7 |
| 83200 | Present in current source | The audit log was cleared | 5 |
| 83201 | Present in current source | The Internet Explorer log file was cleared | 5 |
| 171002 | Present in current source | Exim authentication failure. | 5 |
| 171003 | Present in current source | Multiple rapid Exim authentication failures. | 10 |
| 171004 | Present in current source | Multiple rapid Exim authentication failures. | 10 |
| 171005 | Present in current source | Multiple rapid Exim authentication failures. | 10 |
| 171006 | Present in current source | Multiple rapid Exim authentication failures. | 10 |
| 171010 | Present in current source | Multiple Rejected MAIL: Access Denied in 30 seconds from the same source. | 7 |
| 171011 | Present in current source | SMTP Server rejected RCPT | 3 |
| 171303 | Present in current source | Known brute force attacker. | 12 |
| 300061 | Historical / version-dependent | WAF anti-spam log integration |