The below table shows how Graylog is mapping gim_event_type_code, created in a pipeline, to a normalized category in Illuminate content. Normalized categories allow for dashboards, searches, and alert rules to use a common name across all device types utilizing this format. An example of this line in lookup tables is:

"100000","|authentication|","|logon|","logon"

The code 100000 is attached to the log in the processing pipeline and allows for the lookup function to attach a category, sub category, and event type further down the processing chain.

The category in the above case is |authentication|, where many types of events can fall. Log on, log off and, session disconnect all fall under authentication for easy grouping on dashboards. A subcategory of |logon| is applied as well to this log to signify this is happening during the log on process. There can be many under log on, like log on success and log on failure. Finally, the event type is added as logon for further granularity of what this event was processed as.

Hint: This document is a work in progress, and fields will be added as content is developed. If you have suggestions for changes or additions, please open a GitHub issue here.

 

gim_event_type_code gim_event_class gim_event_category gim_event_subcategory gim_event_type
000000   message message.log_message message
100000   authentication authentication.logon logon
100003   authentication authentication.logon logon with alternate credentials
100004   authentication authentication.logon session reconnect
100500   authentication authentication.credential validation credential validation
100501   authentication authentication.credential validation error
100502   authentication authentication.credential validation mfa
100503   authentication authentication.credential validation sms_send_message
100504   authentication authentication.credential validation voice_call
101000   authentication authentication.access notice special logon
101001   authentication authentication.access notice error
101500   authentication authentication.access policy access policy violation
101501   authentication authentication.access policy device policy violation
101502   authentication authentication.access policy account policy violation
102000   authentication authentication.kerberos request service ticket renewed
102001   authentication authentication.kerberos request service ticket requested
102002   authentication authentication.kerberos request tgt request
102003   authentication authentication.kerberos request error
102500   authentication authentication.logoff logoff
102501   authentication authentication.logoff session disconnect
109999   authentication authentication.default authentication message
110000   iam iam.object create account created
110001   iam iam.object create error
110002   iam iam.object create group created
110500   iam iam.object delete account deleted
110501   iam iam.object delete group deleted
111000   iam iam.object modify account modified
111001   iam iam.object modify privileges assigned
111002   iam iam.object modify privileges removed
111003   iam iam.object modify account renamed
111004   iam iam.object modify password change
111005   iam iam.object modify administrative password reset
111006   iam iam.object modify error
111007   iam iam.object modify group member added
111008   iam iam.object modify group member removed
111009   iam iam.object modify group properties modified
111500   iam iam.object disable account locked
111501   iam iam.object disable account disabled
112000   iam iam.object enable account unlocked
112001   iam iam.object enable account enabled
112002   iam iam.object enable error
119500   iam iam.information group membership enumerated
119999   iam iam.default iam message
120000   network network.network connection network connection
120100   network network.routing network routing
120200   network network.open network connection initiated
120300   network network.close network connection ended
120500   network network.flow flow record
120600   network network.icmp_request icmp_request
120700   network network.icmp_reply icmp_reply
129999   network network.default network message
130000   messaging messaging.email email sent
130500   messaging messaging.email email blocked
131000   messaging messaging.email email rejected
131500   messaging messaging.email email quarantined
132000   messaging messaging.email email deleted
139999   messaging messaging.default message
140000 protocol name resolution name resolution.dns request dns query
140200 protocol name resolution name resolution.dns answer dns response
140300 protocol name resolution name resolution.error dns error
140500 protocol name resolution name resolution.ddns update ddns update
149999 protocol name resolution name resolution.default dns message
150000   database database.query database query
150500   database database.update update rows
151000   database database.add insert rows
151001   database database.add add table
151002   database database.add create database
151500   database database.delete delete rows
151501   database database.delete drop table
151502   database database.delete drop database
159999   database database.default database message
170000   alert alert.network alert ids alert
170001   alert alert.network alert network alert
170002   alert alert.network alert network dlp alert
171000   alert alert.host alert malware alert
171001   alert alert.host alert host dlp alert
171002   alert alert.host alert hips alert
171003   alert alert.host alert fim alert
179999   alert alert.default alert message
180000 protocol http http.default http message
180100 protocol http http.request http request
180200 protocol http http.communication http communication
180300 protocol http http.proxied http proxied communication
190000 endpoint process process.execute process started
190100 endpoint process process.end process stopped
190500 endpoint process process.interaction process accessed
190501 endpoint process process.interaction remote thread created
191000 endpoint process process.action process altered
191001 endpoint process process.action image loaded
199990 endpoint process process.default process message
200000 endpoint file file.create file created
200100 endpoint file file.delete file deleted
201000 endpoint file file.modify file modified
201001 endpoint file file.modify file timestamp modified
201002 endpoint file file.modify file stream created
201500 endpoint file file.access file accessed
201501 endpoint file file.access raw file access
202000 endpoint file file.integrity file signature invalid
202001 endpoint file file.integrity file integrity notice
209999 endpoint file file.default file event
210000 endpoint service service.start service started
210100 endpoint service service.stop service stopped
211000 endpoint service service.configuration service configuration change
211500 endpoint service service.state service installed
211501 endpoint service service.state service removed
211502 endpoint service service.state service enabled
211503 endpoint service service.state service disabled
211504 endpoint service service.state service error
219999 endpoint service service.default service event
220000 endpoint audit audit.integrity audit log cleared
220100 endpoint audit audit.state audit service started
220101 endpoint audit audit.state audit service stopped
220102 endpoint audit audit.state audit error
220500 endpoint audit audit.policy audit policy changed
229999 endpoint audit audit.default audit event
230000 endpoint pipe pipe.add pipe created
230100 endpoint pipe pipe.remove pipe deleted
230500 endpoint pipe pipe.state pipe connected
239999 endpoint pipe pipe.default pipe event
240000 endpoint wmi wmi.filter wmi filter created
240001 endpoint wmi wmi.filter wmi filter removed
240500 endpoint wmi wmi.consumer wmi consumer created
240501 endpoint wmi wmi.consumer wmi consumer removed
241000 endpoint wmi wmi.binding wmi binding created
249999 endpoint wmi wmi.default wmi event
250000 endpoint registry registry.value_change registry value set
250001 endpoint registry registry.value_change registry value added
250002 endpoint registry registry.value_change registry value deleted
250003 endpoint registry registry.value_change registry value modified
250500 endpoint registry registry.key_change registry key added
250501 endpoint registry registry.key_change registry key deleted
250502 endpoint registry registry.key_change registry key renamed
251000 endpoint registry registry.object_renamed registry object renamed
259999 endpoint registry registry.default registry event
260000 endpoint system_time system_time.time_change system time changed
269999 endpoint system_time system_time.default system time event
270000 endpoint driver driver.loaded system driver loaded
270100 endpoint driver driver.unloaded system driver unloaded
279999 endpoint driver driver.default system driver event
280000 endpoint agent agent.activity agent activity
280001 endpoint agent agent.activity antivirus and malware scan
280100 endpoint agent agent.update agent update
280200 endpoint agent agent.status agent status
289999 endpoint agent agent.default agent default
290000 protocol dhcp dhcp.request dhcp request
290100 protocol dhcp dhcp.offer dhcp offer
290200 protocol dhcp dhcp.discovery dhcp discovery
290300 protocol dhcp dhcp.acknowledgement dhcp acknowledgement
299999 protocol dhcp dhcp.default dhcp default event
300000   detection detection.network_detection ids_detection
300001   detection detection.network_detection network_detection
300002   detection detection.network_detection network_dlp_detection
301000   detection detection.host_detection host_malware_detection
301001   detection detection.host_detection host_dlp_detection
301002   detection detection.host_detection hips_detection
301003   detection detection.host_detection fim_detection
309999   detection detection.default detection_message