Security Compliance

SEM event groups and Event types

This article lists all event groups and available subfields (column headers) that you can use for filters, nDepth searches (queries), and rules. Also included is a list of all the event types.

First published date

5/10/2019 5:08 PM

Last published date

7/12/2023 2:16 PM

Overview

This article lists all event groups and available subfields (column headers) that you can use for filters, nDepth searches (queries), and rules in Security Event Manager (formerly Log & Event Manager).

See About the event types for descriptions of all event types. 
 

Product section

Security Event Manager

Resolution

Any Alert 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo














 

Asset Scan Result Alerts 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
RiskFactor
Description
SuggestedSolution
Port
Protocol
References
Service
Machine
ApplicationName
ApplicationVersion
SourceAccount
TargetMachineList
ScanMessage
IsThreat
 

Auditable Domain Events 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
SourceAccount
SourceDomain
SourceLogonID
DestinationAccount
DestinationDomain
DestinationAccountType
SourceMachine
DestinationMachine
PrivilegesExercised
DestinationDomainType
IsThreat



 

Auditable Events (All) 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
SourceAccount
SourceDomain
SourceLogonID
DestinationDomain
DestinationLogonID
DestinationAccountType
SourceMachine
DestinationMachine
PrivilegesExercised
IsThreat


 

Auditable Group Events 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
SourceAccount
SourceDomain
SourceLogonID
DestinationAccount
DestinationDomain
DestinationLogonID
DestinationAccountType
SourceMachine
DestinationMachine
PrivilegesExercised
GroupName
GroupType
IsThreat

Auditable Machine Account Events 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
SourceAccount
SourceDomain
SourceLogonID
DestinationAccount
DestinationDomain
DestinationLogonID
DestinationAccountType
SourceMachine
DestinationMachine
PrivilegesExercised
IsThreat

 

Auditable User Events 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
SourceAccount
SourceDomain
SourceLogonID
DestinationAccount
DestinationDomain
DestinationLogonID
DestinationAccountType
SourceMachine
DestinationMachine
PrivilegesExercised
IsThreat
 

Auth Audit Alerts 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
SourceAccount
SourceDomain
SourceLogonID
DestinationAccount
DestinationDomain
DestinationLogonID
DestinationAccountType
SourceMachine
DestinationMachine
PrivilegesExercised
IsThreat
 

Auth Suspicious Alerts 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
SourceAccount
SourceMachine
DestinationMatchine
IsThreat







 

Change Management Events 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
 

File Audit Alerts 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
 

Machine Audit Alerts 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
 

Network Attack Alerts 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
SourceMachine
DestinationMachine
SourcePort
DestinationPort
AlertActivityType
Protocol
Interface
SourceMACAddress
DestinationMACAddress
IsThreat

Network Audit Alerts 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
SourceMachine
DestinationMachine
SourcePort
DestinationPort
AlertActivityType
Protocol
Interface
SourceMACAddress
DestinationMACAddress
IsThreat

Network Suspicious Alerts 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
SourceMachine
DestinationMachine
SourcePort
DestinationPort
AlertActivityType
Protocol
Interface
SourceMACAddress
DestinationMACAddress
IsThreat

Policy Access Alerts 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
DestinationDomain
SourceAccount
SourceDomain
SourceLogonID
DestinationDomainID
SourceMachine
IsThreat
 

Process Audit Alerts 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
ProcessID
SourceAccount
SourceDomain
SourceLogonID



 

Process Start/Stop 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
ProcessID
SourceAccount
SourceDomain
SourceLogonID



 

Security Alert 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo


 

Service Audit Alerts 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
ServiceName
SourceAccount
SourceDomain

Service Process Attack Alerts 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo


 

Trigeo Alerts 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
 

Virus/Scanner Events 

EventInfo
InsertionIP
Manager
DetectionIP
InsertionTime
DetectionTime
Severity
ToolAlias
InferenceRule
ProviderSID
ExtraneousInfo
 

 


All SEM Event Types:
 

  1. Access

  2. ApplicationAccess

  3. ApplicationDenial

  4. ApplicationEnumerate

  5. ApplicationTrafficAudit

  6. Asset

  7. AssetManagement

  8. AssetScanResult

  9. AttackBehavior

  10. AuditAlert

  11. AuthAudit

  12. AuthSuspicious

  13. BannerGrabbinEnumerate

  14. ChangeDomainAttribute

  15. ChangeDomainMember

  16. ChangeGroupAttribute

  17. ChargenDenial

  18. ConfigurationTrafficAudit

  19. CoreAccess

  20. CoreDenial

  21. CoreScan

  22. CoreTrafficAudit

  23. DataBaseAccess

  24. DDOSToolRelay

  25. DeleteDomain

  26. DeleteDomainMember

  27. DeleteGroup

  28. DeleteGroupMember

  29. Denial

  30. DialupConnection

  31. DNSRequestFootprint

  32. DomainAuthAudit

  33. DomainMemberAlias

  34. DomainPolicyModify

  35. EncryptedTraffic

  36. EncryptedTrafficError

  37. Enumerate

  38. ExposureFound

  39. FailedAuthentication

  40. FileAttributeChange

  41. FileAudit

  42. FileAuditFailure

  43. FileCreate

  44. FileDataRead

  45. FIleDataWrite

  46. FileDelete

  47. FileExecute

  48. FileHandleAudit

  49. FileHandleClose

  50. FileHandleCopy

  51. FileHandleOpen

  52. FileLink

  53. FileMove

  54. FileRead

  55. FileSystemAccess

  56. FileSystemAudit

  57. FileSystemDenial

  58. FileSystemTrafficAudit

  59. FileTransferAccess

  60. FileTransferDenial

  61. FileTransferEnumerate

  62. FileTransferRelay

  63. FileTransferTrafficAudit

  64. FileWrite

  65. FireWalkingFootPrint

  66. FootPrint

  67. FradulentCertificateAccess

  68. FTPBounce

  69. FTPCommandAccess

  70. FTPCommandEnumerate

  71. FTPFileAccess

  72. FTPInvalidFormatAccess

  73. GeneralAsset

  74. GeneralAudit

  75. GeneralSecurity

  76. GenericAlert

  77. GroupAssetAdded

  78. GroupAssetMemberAdded

  79. GroupAssetMemberRemoved

  80. GroupAssetRemoved

  81. GroupAssetUpdated

  82. GroupAudit

  83. GroupPolicyModify

  84. GuestLogin

  85. HostIncident

  86. HostScan

  87. HTTPAdministrationAccess

  88. HTTPApplicationAccess

  89. HTTPClientAccess

  90. HTTPDynamicContentAccess

  91. HTTPFileRequestAccess

  92. HTTPInvalidFormatAccess

  93. HTTPServerAccess

  94. HTTPServiceAccess

  95. HybridIncident

  96. ICMPFloodDenial

  97. ICMPFragmentationDenial

  98. ICMPPingSweep

  99. ICMPQuery

  100. ICMPRedirectAccess

  101. ICMPSourceQuenchDenial

  102. ICMPStackFingerPrint

  103. ICMPTrafficAudit

  104. Incident

  105. InferredAttack

  106. InferredSuspicious

  107. InternalAgentFastPack

  108. InternalAgentOffline

  109. InternalAgentOnline

  110. InternalAgentToolCommand

  111. InternalAlert

  112. InternalAudit

  113. InternalAuditFailure

  114. InternalAuditSuccess

  115. InternalCommands

  116. InternalDuplicationConnection

  117. InternalError

  118. InternalException

  119. InternalFailure

  120. InternalGeneralAlert

  121. InternalInfo

  122. InternalInvalidConnection

  123. InternalInvalidInstallation

  124. InternalLicenseMaximum

  125. InternalNewToolData

  126. InternalPolicy

  127. InternalPolicyConfiguration

  128. InternalRuleFired

  129. InternalTestRule

  130. InternalToolOffline

  131. InternalToolOnline

  132. InternalUnknownAgent

  133. InternalUnsupportedAgent

  134. InternalUserLogoff

  135. InternalUserLogon

  136. InternalUserLogonFailure

  137. InternalUserUpdate

  138. InternalWarning

  139. IPFloodDenial

  140. IPFragmentationAccess

  141. IPFragmentationDenial

  142. IPSecTrafficAudit

  143. IPSourceRouteAccess

  144. IPSpoofAccess

  145. IPTrafficAudit

  146. LANConnection

  147. LandAttackDenial

  148. LinkControlAccess

  149. LinkControlDenial

  150. LinkControlTrafficAudit

  151. MachineAsset

  152. MachineAssetAdded

  153. MachineAssetRemoved

  154. MachineAssetupdated

  155. MachineAudit

  156. MachineAuthAudit

  157. MachineAuthTicket

  158. MachineAuthTicketFailure

  159. MachineDisable

  160. MachineEnable

  161. MachineLogOff

  162. MachineLogOn

  163. MachineLogOnFailure

  164. MachineModifyAttribute

  165. MachineModifyPrivileges

  166. MailAccess

  167. MailDeliveryAccess

  168. MailDenial

  169. MailEnumerate

  170. MailServiceAccess

  171. MailServiceDenial

  172. MailSpamDenial

  173. MailTrafficAudit

  174. MailTransferAccess

  175. MajordomoAccess

  176. MalformedRIPAccess

  177. MountFileSystem

  178. MSNetworkingEnumerate

  179. NamingAccess

  180. NamingTrafficAudit

  181. NetworkAttack

  182. NetworkAudit

  183. NetworkConnectionAudit

  184. NetworkIncident

  185. NetworkSuspicious

  186. NewAuthPolicy

  187. NewDomain

  188. NewDomainMember

  189. NewGroup

  190. NewGroupMemeber

  191. NewsAccess

  192. NFSAccess

  193. NTPTrafficAudit

  194. ObjectAudit

  195. ObjectAuditFailure

  196. ObjectDelete

  197. ObjectLink

  198. PingOfDeathDenial

  199. PingSweep

  200. PointToPointAccess

  201. PointToPointTrafficAudit

  202. PolicyAccess

  203. PolicyAudit

  204. PolicyModiy

  205. PolicyScopeChanges

  206. PortScan

  207. PPTPSpoof

  208. PPTPTrafficAudit

  209. PrinterAccess

  210. ProcessAudit

  211. ProcessInfo

  212. ProcessStart

  213. ProcessStop

  214. ProcessWarning

  215. ProhibitedHTTPControlAccess

  216. Recon

  217. RegistryAttributeChange

  218. RegistryAudit

  219. RegistryAduitFailure

  220. RegistryCreate

  221. RegistryDataRead

  222. RegistryDataWrite

  223. RegistryDelete

  224. RegistryExecute

  225. RegistryLink

  226. RegistryMove

  227. RegistryRead

  228. RegistryWrite

  229. Relay

  230. RemoteConsoleAccess

  231. RemoteProcedureAccess

  232. RemoteProcedureDenial

  233. RemoteProcedureEnumerate

  234. RemoteProcedureTrafficAudit

  235. ResourceAttack

  236. ResourceAudit

  237. ResourceSuspicious

  238. RestrictedInformatioAttempt

  239. RestrictedServiceAttempt

  240. RIPTrafficAudit

  241. RoutingAccess

  242. RoutingDenial

  243. RoutingTrafficAudit

  244. RPCPortmapperAccess

  245. RCPPortMapperDenial

  246. RPCPortmapperEnumerate

  247. RPCPortScanEnumerate

  248. RPCTrafficAudit

  249. Scan

  250. SecurityAlert

  251. ServiceAudit

  252. ServiceInfo

  253. ServiceProcessAttack

  254. ServiceStart

  255. ServiceStop

  256. ServiceWarning

  257. SmailAcess

  258. SMBAccess

  259. SMTPCommandAccess

  260. SMTPCommaneEnumerate

  261. SMTPInvalidFormatAccess

  262. SmurfDenial

  263. SnorkDenial

  264. SoftwareAsset

  265. SoftwareAssetAdded

  266. SoftwareAssetpatched

  267. SoftwareAssetPatchFailed

  268. SoftwareAssetRemoved

  269. SoftwareAssetUpdated

  270. SoftwareAssetVersionAdded

  271. SofwareInstall

  272. SoftwareUpdate

  273. StackFingerprint

  274. SuspiciousBehavior

  275. SYNFloodDenial

  276. SystemReboot

  277. SystemScan

  278. SystemScanInfo

  279. SystemScanStart

  280. SystemScanStop

  281. SystemScabWarning

  282. SysyemShutdown

  283. SystemStatus

  284. TCPHijackAccess

  285. TCPPingSweep

  286. TCPPortScan

  287. TCPStackFingerprint

  288. TCPTrafficAudit

  289. TCPtunnelingAccess

  290. TeardropDenial

  291. TimeAccess

  292. TimeTrafficAudit

  293. TraceRouteFootprint

  294. TrojanCommandAccess

  295. TrojanInfectionAccess

  296. TrojanScanner

  297. TrojanTrafficDenial

  298. UDPBombDenial

  299. UDPPortScan

  300. UDPTrafficAudit

  301. UnmountFileSystem

  302. UnsualICMPTraffic

  303. UnsualIPTraffic

  304. UnsualIPProtocol

  305. UnsualTCPTraffic

  306. UnusualTraffic

  307. UnsualUDPTraffic

  308. UserAsset

  309. UserAssetAdded

  310. UserAssetRemoved

  311. UserAssetUpdated

  312. UserAuthAudit

  313. UserAuthTicket

  314. UserAuthTicketFailure

  315. UserDisable

  316. UserEnable

  317. UserLogoff

  318. UserLogon

  319. UserLogonFailure

  320. UserModifyAttribute

  321. UserModifyPrivileges

  322. VirusAttack

  323. VirusSummaryAttack

  324. VirusTrafficAccess

  325. VPNconnection

  326. VulnerabilityFound

  327. WebAccess

  328. WebDenial

  329. WebEnumerate

  330. WebTrafficAudit