Connection Rebuild Action

Common Event Grammar › Network Security Category › Connection Activity Class › Connection Rebuild Action

Connection Rebuild Action

The Connection Rebuild action deals with the expression of event information pertaining to the rebuilding of a connection between two network entities as recorded by a given host. There are two possible results for this action: S for a successful rebuild and F for a failed rebuild. Rebuilding a connection often occurs when portions of the host information is changing such as a NAT scenario.

Information	Level
Source - User Information	Tertiary
Source - Host Information	Primary
Source - Object Information	Tertiary
Source - Process Information	Tertiary
Source - Group Information	Tertiary
Dest - User Information	Secondary
Dest - Host Information	Primary
Dest - Object Information	Tertiary
Dest - Process Information	Tertiary
Dest - Group Information	Tertiary
Agent - Information	Primary
Agent - Host Information	Primary
Event Source - Host Information	Primary
Event Source - Information	Tertiary
Event - Information	Primary
Result - Information	Primary

The important information for this action is which host is attempting to connect to which host when the connection is rebuilt. The event information was expressed on which host and recorded by which agent on which host.

Result	event_result	event_severity
Success	S	2
Failure	F	3