Authorization Alert Action

Common Event Grammar › System Access Category › Authorization Activity Class › Authorization Alert Action

Authorization Alert Action

The Authorization Alert action expresses information about alert conditions raised during an authorization activity. Authorization activity includes setting up permission on objects, systems, applications for subjects like user or system accounts, hosts, and so forth. Any type of alert about the Authorization can be mapped to this action. If this is an error condition and does not warrant immediate attention, then map to the Authorization Error action.

Information	Level
Source - User Information	Secondary
Source - Host Information	Secondary
Source - Object Information	Tertiary
Source - Process Information	Tertiary
Source - Group Information	Tertiary
Dest - User Information	Primary
Dest - Host Information	Primary
Dest - Object Information	Tertiary
Dest - Group Information	Tertiary
Agent - Information	Primary
Agent - Host Information	Primary
Event Source - Host Information	Primary
Event Source - Information	Tertiary
Event - Information	Primary
Result - Information	Primary

Result	event_result	event_severity
Success	n/a	n/a
Failure	F	6