Unknown Action Action

The Unknown Action action is used to map all events that cannot be classified as a specific action in CEG.

Information	Level
Source - User Information	Primary
Source - Host Information	Secondary
Source - Object Information	Tertiary
Source - Process Information	Tertiary
Source - Group Information	Tertiary
Dest - User Information	Tertiary
Dest - Host Information	Primary
Dest - Object Information	Secondary
Dest - Process Information	Tertiary
Dest - Group Information	Tertiary
Agent - Information	Primary
Agent - Host Information	Primary
Event Source - Host Information	Primary
Event Source - Information	Tertiary
Event - Information	Tertiary
Result - Information	Tertiary

Result	event_result	event_severity
Unknown	U	0