Page Comparison

Table of Contents

maxLevel	2
type	flat

...

The full tag must have three levels. The first two are fixed as uba.varonis. The third level identifies the technology type and it can be dataalert (events generated by datAlert) or alerts (events generated by DatAdvantage).

...

Anchor

	uba.varonis.dataalert
	uba.varonis.dataalert

uba.varonis.dataalert

Field	Type	Extra Label
eventdate	`timestamp`	-
host	`str`	-
RuleName	`str`	-
AlertTime	`str`	-
EventTime	`str`	-
ActingObject	`str`	-
EventType	`str`	-
FileServerDomain	`str`	-
Path	`str`	-
AffectedObject	`str`	-
IPAddressHost	`ip4`	-
AdditionalData	`str`	-
AlertDescription	`str`	-
ChangedPermissions	`str`	-
PermissionsBeforeChange	`str`	-
PermissionsAfterChange	`str`	-
rawMessage	`str`	-
hostchain	`str`	✓
tag	`str`	✓

Anchor

	uba.varonis.alerts
	uba.varonis.alerts

uba.varonis.alerts

Field	Type	Extra Label
eventdate	`timestamp`	-
host	`str`	-
hostchain	`str`	✓
cefVersion	`str`	-
embDeviceVendor	`str`	-
embDeviceProduct	`str`	-
deviceVersion	`str`	-
signatureID	`str`	-
name	`str`	-
severity	`str`	-
_cefVer	`str`	-
act	`str`	-
cat	`str`	-
ruleID	`int8`	-
mailRecipient	`str`	-
ruleName	`str`	-
attachmentName	`str`	-
clientAccessType	`str`	-
mailboxAccessType	`str`	-
changedPermissions	`str`	-
cnt	`int4`	-
deviceCustomDate1Label	`str`	-
deviceCustomDate1	`timestamp`	-
dhost	`str`	-
dpriv	`str`	-
duser	`str`	-
dvchost	`str`	-
end	`timestamp`	-
filePath	`str`	-
filePermission	`str`	-
fileType	`str`	-
fname	`str`	-
msg	`str`	-
oldFilePermission	`str`	-
outcome	`str`	-
rt	`timestamp`	-
start	`timestamp`	-
rawMessage	`str`	✓

Anchor

	uba.varonis.audit
	uba.varonis.audit

uba.varonis.audit

Field	Type	Extra Label
eventdate	`timestamp`	-
host	`str`	-
rawMessage	`str`	✓
RuleID	`str`	-
RuleName	`str`	-
AlertTime	`str`	-
EventTime	`str`	-
ActingObject	`str`	-
EventType	`str`	-
FileServerDomain	`str`	-
Path	`str`	-
AffectedObject	`str`	-
IPAddressHost	`str`	-
AdditionalData	`str`	-
Severity	`str`	-
Threshold	`str`	-
FirstEventTime	`str`	-
EventStatus	`str`	-
ActingObjectSAMAccountName	`str`	-
hostchain	`str`	✓
tag	`str`	✓

Varonis configuration

To set up message forwarding, you will need to take the following steps in the DatAlert area of the DatAdvantage management tool:

...

Source Port → 13076
Target Tag → uba.varonis.dataalert
Select both Stop Processing and Sent without syslog tag

...

Rule 2 - datAdvantage events

Source Port → 13076
Target Tag → uba.varonis.alerts
Select both Stop Processing and Sent without syslog tag

...

Versions Compared

Old Version 6

New Version 7

Key

uba.varonis.dataalert

uba.varonis.alerts

uba.varonis.audit

Varonis configuration

Rule 2 - datAdvantage events