Previous Topic: Types of Events

Next Topic: Type 2: Remote Event

Type 1: Local Event

The first type of event is the local event. This type of event has a local perspective involving a single entity. This entity represents the source, destination, event source and agent expressed in the event. Type 1 events normally contain very little information expressed in the event and the information provided must be duplicated to be expressed correctly in CEG format.

An example of this event is a login through the console recorded on the same host with an agent installed locally.

Source

Destination

Event Source

Agent

Host A

Host A

Host A

Host A