Use these rules to create an alarm that notifies when a health monitor rule event is generated. This list describes the health monitor rules and their signature IDs, type, device, and severity.
Rule name | Signature ID | Description | Type | Device | Severity |
|---|---|---|---|---|---|
A physical network interface connection has been made or removed | 306-50080 | Network interface settings changed, via an SSH session. | Software Monitor | Trellix ESM | Medium |
A RAID error has occurred | 306-50054 | RAID errors encountered. | Hardware Monitor | All | High |
Account disabled due to inactivity | 306-35 | User account disabled, due to inactivity. | Software Monitor | Trellix ESM | Medium |
Account disabled due to max logon failures | 306-36 | User account disabled, due to maximum logon failures. | Software Monitor | Trellix ESM | High |
Add/Edit Remote Command | 306-60 | Alarm remote command added or deleted. | Software Monitor | Trellix ESM | Low |
Advanced Syslog Parser collector state change alert | 306-50029 | ASP parser stopped or started. | Software Monitor | Receiver | Medium |
ADM distiller process | 306-50066 | ADM PDF/DOC text extraction engine stopped or started. | Software Monitor | ADM | Medium |
Archive configuration change | 306-3 | Trellix ESM archival settings changed. | Software Monitor | Trellix ESM | Low |
Archive process state change alert | 306-50051 | Receiver archiving process stopped or started. | Software Monitor | ADM/REC/DBM | Medium |
Asset vulnerable to event | 146-10, 306-10 | Vulnerability event created. | Software Monitor | Trellix ESM | Low |
Audit administrator user logon | 306-38 | UCAPL event, audit administrator logon. | Software Monitor | Trellix ESM | Low |
Backup configuration change | 306-1 | Trellix ESM backup configuration settings changed. | Software Monitor | Trellix ESM | Low |
Backup performed | 306-2 | Backup performed on the system. | Software Monitor | Trellix ESM | Low |
Blue Martini parser alert | 306-50071 | Blue Martini parser stopped or started. | Software Monitor | Receiver | Medium |
Bypass NIC state alert | 306-50001 | NIC entered or exited bypass status. | Software Monitor | IPA/ADM | Medium |
CAC cert has expired | 306-50082 | Trellix ESM CAC certificate expired. | Software Monitor | Trellix ESM | High |
CAC cert expires soon | 306-50081 | Trellix ESM CAC certificate expires soon. | Software Monitor | Trellix ESM | Medium |
Case changed | 306-70 | Case changed. | Software Monitor | Trellix ESM | Low |
Case status added/modified/deleted | 306-73 | Case status changed. | Software Monitor | Trellix ESM | Low |
Communication channel state change alert | 306-50013 | Control channel stopped or started. | Software Monitor | All | Medium |
Data allocation configuration change | 306-7 | Trellix ESM data allocation settings changed. | Software Monitor | Trellix ESM | High |
Data partitions free disk space alert | 306-50005 | Free space on each partition is low (for example, hada_hd has 10% free space). | Software Monitor | All | Medium |
Data retention configuration change | 306-6 | Trellix ESM data retention configuration changed. | Software Monitor | Trellix ESM | High |
Database detection services state alert | 306-50036 | DBM auto detection service stopped or started. | Software Monitor | All | Medium |
Deep packet inspector state change alert | 306-50008 | Deep packet inspection engine on ADM stopped or started. | Software Monitor | All | Medium |
Delete remote command | 306-61 | Alarm remote command removed. | Software Monitor | Trellix ESM | Low |
Deleted events | 306-74 | User deleted Trellix ESM events. | Software Monitor | Trellix ESM | Low |
Deleted flows | 306-75 | User deleted Trellix ESM flows. | Software Monitor | Trellix ESM | Low |
Device add | 306-18 | New device added to the system. | Software Monitor | Trellix ESM | Low |
Device delete | 306-19 | Existing device deleted from the system. | Software Monitor | Trellix ESM | Low |
Disk drive failure alert | 306-50018 | Checks and verifies integrity of all hard disks (internal or DAS). | Hardware Monitor | All | High |
ELM archive process state change alert | 306-50045 | ELM compressing engine stopped or started. | Software Monitor | ADM/REC/DBM | Medium |
ELM EDS FTP | 306-50074 | ELM SFTP program stopped or started. | Software Monitor | ELM | Medium |
ELM file process | 306-50065 | ELM reinsertion engine stopped or started. If a log fails for any reason, it tries the insert again. If the process of reinsertion fails, this rule triggers. | Software Monitor | ELM | Medium |
ELM mount point state change alert | 306-50053 | ELM remote storage (CIFS, NFS, ISCSI, SAN) stopped or started. | Software Monitor | ELM | Medium |
ELM query engine state change alert | 306-50046 | ELM Jobs process – ELM jobs, such as ELM queries and inserts, stopped or started. | Software Monitor | ELM | Medium |
ELM redundant storage | 306-50063 | ELM Mirror stopped or started. | Software Monitor | ELM | Medium |
ELM system database error | 306-50044 | ELM database stopped or started. | Software Monitor | ELM | High |
Email collector state change alert | 306-50040 | Cisco MARS collector stopped or started. | Software Monitor | Receiver | Medium |
EPO tags applied | 306-28 | ePO - On-prem tags applied. | Software Monitor | Trellix ESM | Low |
Error communicating with ELM | 306-50047 | Communication with ELM failed. | Software Monitor | ADM/REC/DBM | High |
Error in SSH communication | 306-50077 | Device issues such as version difference, change in key. | Software Monitor | All | High |
Trellix ESM reboot | 306-32 | Trellix ESM rebooted. | Software Monitor | Trellix ESM | Medium |
Trellix ESM shutdown | 306-33 | Trellix ESM shut down. | Software Monitor | Trellix ESM | Medium |
eStreamer Collector alert | 306-50070 | eStreamer Collector stopped or started. | Software Monitor | Receiver | Medium |
eStreamer Collector state change alert | 306-50041 | eStreamer Collector stopped or started. | Software Monitor | Receiver | Medium |
Execute remote command | 306-62 | Alarm remote command executed. | Software Monitor | Trellix ESM | Low |
Failed logon due to maximum concurrent sessions reached | 306-37 | User failed to log on because the maximum concurrent sessions were reached. | Software Monitor | Trellix ESM | High |
Failed to format SAN device | 306-50057 | SAN on ELM failed to format; user must retry. | Hardware Monitor | Trellix ESM | High |
Failed user logon | 306-31 | User failed to log on. | Software Monitor | Trellix ESM | Medium |
File collector state change alert | 306-50049 | Mountcollector program stopped or started. | Software Monitor | Receiver | Medium |
File deleted | 306-50 | Any file that can be added or removed | Software Monitor | Trellix ESM | Low |
Filter process state change alert | 306-50050 | Filter program on the device stopped or started (filter rules). | Software Monitor | Receiver | Medium |
Firewall alert aggregator state change alert | 306-50009 | Firewall aggregator on the ADM stopped or started. | Software Monitor | ADM | Medium |
Get VA data failure | 306-52 | Trellix ESM failed to obtain VA data. | Software Monitor | Trellix ESM | Medium |
Get VA data success | 306-51 | Trellix ESM obtained VA data. | Software Monitor | Trellix ESM | Low |
Health monitor internal alert | 306-50027 | Health monitor process stopped or started. | Software Monitor | All | Medium |
HTTP collector state change alert | 306-50039 | HTTP collector stopped or started. | Software Monitor | Receiver | Medium |
Indexing configuration change | 306-8 | Trellix ESM indexing settings changed. | Software Monitor | Trellix ESM | Medium |
Invalid SSH key | 306-50075 | Device issues communicating with ELM, such as version differences, change in key. | Software Monitor | All | High |
IPFIX collector state change alert | 306-50055 | IPFIX (flow) collector stopped or started. | Software Monitor | Receiver | Medium |
Key and certificate administrator user logon | 306-39 | UCAPL event, Crypto administrator logon. | Software Monitor | Trellix ESM | Low |
Log partitions free disk space alert | 306-50004 | Log partition (/var) is low on free space. | Software Monitor | All | Medium |
Trellix EDB database server state change alert | 306-50010 | Database stopped or started. | Software Monitor | All | Medium |
ePO - On-prem collector alert | 306-50069 | ePO - On-prem collector stopped or started. | Software Monitor | Receiver | Medium |
Trellix Event Format state change alert | 306-50031 | Trellix Event Format collector stopped or started. | Software Monitor | Receiver | Medium |
Trellix SIEM device communication failure | 306-26 | Trellix ESM cannot communicate with another device. | Software Monitor | Trellix ESM | High |
Microsoft Forefront Threat Management Gateway alert | 306-50068 | Forefront Threat Management Gateway collector stopped or started. | Software Monitor | Receiver | Medium |
MS-SQL retriever state change alert | 306-50035 | Microsoft SQL collector stopped or started (any data source for Microsoft SQL). | Software Monitor | Receiver | Medium |
Multi-event log alert | 306-50062 | jEMAIL collector stopped or started. | Software Monitor | Receiver | Medium |
MVM scan initiated | 306-27 | MVM scan started. | Software Monitor | Trellix ESM | Low |
NetFlow collector state change alert | 306-50024 | NetFlow (flow) collector stopped or started. | Software Monitor | Receiver | Medium |
New user account | 306-13 | New user added to the system. | Software Monitor | Trellix ESM | Low |
NFS/CIFS collector state change alert | 306-50048 | Remote mount for NFS or CIFS stopped or started. | Software Monitor | Receiver | Medium |
NitroFlow collector state change alert | 306-50026 | NitroFlow (flows on device) stopped or started. | Software Monitor | Receiver | Medium |
No SSH key found | 306-50076 | Device issues communicating with the ELM, such as version differences, change in key. | Software Monitor | All | High |
NSM add/edit Block list | 306-29 | NSM Block list entry added or edited. | Software Monitor | Trellix ESM | Low |
NSM delete Block list | 306-30 | NSM Block list entry deleted. | Software Monitor | Trellix ESM | Low |
OPSEC retriever state change alert | 306-50034 | OPSEC (Check Point) collector stopped or started. | Software Monitor | Receiver | Medium |
Oracle IDM collector alert | 306-50072 | Oracle IDM collector stopped or started. | Software Monitor | Receiver | Medium |
Oversubscription alert | 306-50012 | ADM entered or exited oversubscription mode. | Software Monitor | ADM | Medium |
Plug-in Collector/Parser alert | 306-50073 | Plug-in collector/parser stopped or started. | Software Monitor | Receiver | Medium |
Policy add | 306-15 | Policy added to the system. | Software Monitor | Trellix ESM | Low |
Policy delete | 306-17 | Policy deleted from the system. | Software Monitor | Trellix ESM | Low |
Policy change | 306-16 | Policy changed in the system. | Software Monitor | Trellix ESM | Low |
Receiver HA | 306-50058 | Any HA process stopped or started (Corosync, HA Control script). | Software Monitor | Receiver | Medium |
Receiver HA Opsec configuration | 306-50059 | Not in use. | Software Monitor | Receiver | Low |
Remote NFS mount point state change alert | 306-50020 | NFS ELM mount stopped or started. | Software Monitor | ELM | Medium |
Remote share/mount point free disk space alert | 306-50021 | Free space on remote mount point is low. | Software Monitor | Trellix ESM | Medium |
Remote SMB/CIFS share state change alert | 306-50019 | Remote SMB/CIFS mount point stopped or started. | Software Monitor | Receiver | Medium |
Risk Correlation state change alert | 306-50061 | Risk Correlation engine stopped or started. | Software Monitor | ACE | Medium |
Root partitions free disk space alert | 307-50002 | Free space on the root partitions is low. | Software Monitor | All | Medium |
Rule add | 306-20 | Rule added to the system, such as ASP, filter, or correlation. | Software Monitor | Trellix ESM | Low |
Rule delete | 306-22 | Rule deleted from the system. | Software Monitor | Trellix ESM | Low |
Rule change | 306-21 | Rule changed in the system. | Software Monitor | Trellix ESM | Low |
Rule update failure | 306-9 | Trellix ESM rule update failed. | Software Monitor | Trellix ESM | Medium |
SDEE retriever state change alert | 306-50033 | SDEE collector stopped or started. | Software Monitor | Receiver | Medium |
sFlow collector state change alert | 306-50025 | sFlow (flow) collector stopped or started. | Software Monitor | Receiver | Medium |
SNMP collector state change alert | 306-50023 | SNMP collector stopped or started. | Software Monitor | Receiver | Medium |
SQL collector state change alert | 306-50038 | SQL collector (old NFX) stopped or started. | Software Monitor | Receiver | Medium |
Symantec AV collector state change alert | 306-50056 | Symantec AV collector stopped or started. | Software Monitor | Receiver | Medium |
Syslog Collector state change alert | 306-50037 | Syslog collector stopped or started. | Software Monitor | Receiver | Medium |
System admin user logon | 306-40 | System administrator logged on to the system. | Software Monitor | Trellix ESM | Low |
System integrity check failure | 306-50085 | Non-ISO foreign program or process running on the system is flagged. | Software Monitor | All | High |
System logger state change alert | 306-50014 | System logging process stopped or started. | Software Monitor | All | Medium |
Task (query) closed | 306-54 | Task manager task closed. | Software Monitor | Trellix ESM | Low |
Temporary partitions free disk space alert | 306-50003 | Temporary (/tmp) partition low on disk space. | Software Monitor | All | Medium |
Text log parser state change alert | 306-50052 | Text parser process stopped or started. | Software Monitor | Receiver | Medium |
User account change | 306-14 | User account changed. | Software Monitor | Trellix ESM | Low |
User device failed logon | 306-50079 | SSH user failed to log on. | Software Monitor | Trellix ESM | Low |
User device logon | 306-50017 | Not used in system. | Software Monitor | Trellix ESM | Low |
User device logout | 306-50078 | SSH user logged out. | Software Monitor | Trellix ESM | Low |
User logon | 306-11 | User logged on to the system. | Software Monitor | Trellix ESM | Low |
User logout | 306-12 | User logged out of the system. | Software Monitor | Trellix ESM | Low |
VA Data Engine status alert | 306-50043 | VA (vaded.pl) engine stopped or started. | Software Monitor | Receiver | Medium |
Variable add | 306-23 | Policy variable added. | Software Monitor | Trellix ESM | Low |
Variable delete | 306-25 | Policy variable deleted. | Software Monitor | Trellix ESM | Low |
Variable change | 306-24 | Policy variable changed. | Software Monitor | Trellix ESM | Low |
Web Server cert has expired | 306-50084 |
| Software Monitor | Trellix ESM | High |
Web Server cert will expire soon | 306-50083 |
| Software Monitor | Trellix ESM | Medium |
Websense collector alert | 306-50067 | Websense collector stopped or started. | Software Monitor | Receiver | Medium |
WMI Event Log collector state change alert | 306-50030 | WMI collector stopped or started. | Software Monitor | Receiver | Medium |