Previous Topic: Event Result

Next Topic: Event Severity

Event Result Mapping Example

Consider the following example: who created which account on which host and on which host was this account expressed for event action Account Creation, information is classified as primary, secondary or tertiary.

To begin, review the table of the Account Creation Action in the Account Management Class in the Identity Management Category:

Information

Level

Source - User Information

Primary (Who created)

Source - Host Information

Secondary

Source - Object Information

Tertiary

Source - Process Information

Tertiary

Source - Group Information

Tertiary

Dest - User Information

Primary (Which account)

Dest - Host Information

Primary (Which host)

Dest - Object Information

Secondary

Dest - Process Information

Tertiary

Dest - Group Information

Tertiary

Agent - Information

Primary

Agent - Host Information

Primary

Event Source - Host Information

Primary (Which host expressed)

Event Source - Information

Tertiary

Event - Information

Primary

Result - Information

Primary