vuln.rapid7.insightvm.audit

Overview

The tags beginning with vuln.rapid7 identity events generated by Rapid7.

Tag structure

The full tag may have up to 4 levels. The first two are fixed as vuln.rapid7. The third level identifies the type of events sent, and the fourth level indicates the event subtype

Technology	Brand	Type	Subtype
vuln	rapid7	insightvm	audit

These are the valid tags and corresponding data tables that will receive the parsers' data:

Tag	Data table
vuln.rapid7.insightvm.audit	vuln.rapid7.insightvm.audit

Field transformation

Field	Type	Extra Label
eventdate	`timestamp`	-
hostname	`str`	-
server_time	`timestamp`	-
log_level	`str`	-
thread	`str`	-
silo_id	`str`	-
user	`str`	-
user_id	`str`	-
performed_by	`str`	-
action	`str`	-
silo	`str`	-
role	`str`	-
change	`str`	-
unknown	`str`	-
hostchain	`str`	✓
tag	`str`	✓
rawMessage	`str`	✓