2. HAWK ID Descriptions¶
2.1. Default Message¶
HAWK ID |
Description |
|---|---|
HID0000 |
Firewall Default Message - Cisco |
HID0000 |
Firewall Default Message - Checkpoint |
HID0000 |
McAfee ePO Default Trap |
HID0000 |
Operating System Default Message |
2.2. Antivirus¶
HAWK ID |
Description |
|---|---|
HID1001 |
Antivirus Detected Virus |
HID1002 |
Antivirus Detected Phishing/Trojan Activity |
HID1003 |
Antivirus Detected Exploit Activity |
HID1004 |
Antivirus Detected Worm/Virus Activity |
HID1005 |
Antivirus Detected Adware Activity |
HID1006 |
Antivirus Detected Linux Virus Activity |
HID1100 |
Antivirus Detected Error Notification |
HID1101 |
Antivirus Received Information Message |
HID1102 |
Antivirus Received Warning Notification |
HID1200 |
Antivirus Ran Out of Disk Space |
HID1200 |
Antivirus Shutdown Agent |
HID1201 |
Antivirus Quarantined Detected Virus |
HID1201 |
Antivirus Started Agent |
HID1202 |
Antivirus Cleaned Virus Infection |
HID1203 |
Antivirus Started Central Quarantine Service |
HID1203 |
Antivirus Stopped Agent |
HID1300 |
Antivirus Approved E-Mail As Clean |
HID1301 |
Antivirus Detected Malicious/SPAM E-Mail |
HID1302 |
Antivirus Failed Decoding of File |
HID1303 |
Antivirus Detected Default Message |
HID1304 |
Antivirus Blocked Remote File |
HID1305 |
Antivirus Detected Potential Malware Activity - Quarantined |
HID1306 |
Antivirus Disinfected Malware Activity |
2.3. Application Control¶
HAWK ID |
Description |
|---|---|
HID1500 |
Application Control Permitted on Specified Service |
HID1500 |
Application Control Permitted on Specified Service - HAWK Agent |
HID1501 |
Application Control Denied on Specified Service |
HID1502 |
Application Control Default Alert |
2.4. Firewall¶
HAWK ID |
Description |
|---|---|
HID2000 |
Firewall Successfully Established TCP Connection |
HID2001 |
Firewall Successfully Established UDP Connection |
HID2002 |
Firewall Permitted ICMP Request |
HID2003 |
Firewall Permitted TCP Request |
HID2004 |
Firewall Permitted UDP Request |
HID2005 |
Firewall Denied TCP Request |
HID2006 |
Firewall Denied ICMP Request |
HID2007 |
Firewall Denied UDP Request |
HID2011 |
Firewall Command Authentication Failure |
HID2013 |
Firewall Attempted Authentication via PPP |
HID2014 |
Firewall Manager Attempted Authentication Success |
HID2017 |
Firewall SSH Authenticated Session Closed Successfully |
HID2017 |
Firewall SSH Session Closed Successfully |
HID2018 |
Firewall User Administration Privilege Change Success |
HID2019 |
Firewall User Session Closed Successfully |
HID2020 |
Firewall Detected Auto Update Failure |
HID2021 |
Firewall Detected OSPF Route Table Change |
HID2022 |
Firewall Detected Severe Network Bandwidth Limitations |
HID2023 |
Firewall Closed Existing Network Session |
HID2024 |
Firewall Closed Existing TCP Network Session |
HID2025 |
Firewall Closed Existing TCP Proxy Session |
HID2026 |
Firewall Created Dynamic UDP Translation |
HID2027 |
Firewall Created Dynamic TCP Translation |
HID2028 |
Firewall Permitted Inbound TCP Request |
HID2029 |
Firewall Detected Valid HTTP Web Request |
HID2030 |
Firewall Denied Remote HTTP Web Request |
HID2031 |
Firewall Configuration Change Successful |
HID2032 |
Firewall Permitted Outbound TCP Request |
HID2033 |
Firewall Permitted Outbound UDP Request |
HID2034 |
Firewall Detected Potential IP Fragmentation Attack |
HID2035 |
Firewall Failed to Detected Translation Group |
HID2036 |
Firewall Detected Malicious Network Activity - Potential Attack |
HID2037 |
Firewall Detected FTP Port Forwarding Request |
HID2038 |
Firewall Denied Inbound ICMP Request |
HID2039 |
Firewall Denied Inbound TCP Request |
HID2040 |
Firewall Denied Inbound UDP Request |
HID2041 |
Firewall Denied IP Request |
HID2042 |
Firewall Denied Inbound UDP Request - Access Control List Prevention |
HID2043 |
Firewall Potentially Malicious UDP Network Request |
HID2044 |
Firewall Detected Administrative Session Hijack Attempt |
HID2045 |
Firewall Detected ICMP Invalid Destination Error |
HID2046 |
Firewall Detected IPSec Identity Verification Failure |
HID2047 |
Firewall Detected Invalid OSPF Routing Packet |
HID2048 |
Firewall Detected Malicious SNMP Request |
HID2049 |
Firewall Detected Peer Router Sharing Same ID |
HID2050 |
Firewall Detected Potential ARP Poisoning Attack |
HID2051 |
Firewall Detected RIP Routing Table Request Failure |
HID2052 |
Firewall Detected Split DNS Anomaly |
HID2053 |
Firewall Detected Spoofed PPTP Packet |
HID2054 |
Firewall Detected Malicious PPTP Synchronization Packets |
HID2055 |
Firewall NTP Checksum Failure |
HID2056 |
Firewall NTP Message Request Denied |
HID2057 |
Firewall Reached Maximum Network IP Table Size Limit |
HID2058 |
Firewall Closed Existing UDP Network Session |
HID2059 |
Firewall Detected Failed Portmap Translation |
HID2060 |
Firewall Detected Malicious DNS Network Request |
HID2061 |
Firewall Detected Replay Rollover Attack |
HID2062 |
Firewall Discarded Network IP Fragment |
HID2063 |
Firewall Reached 100% CPU Utilization |
HID2064 |
Firewall Reached Maximum Tracked Deny Flows |
HID2065 |
Firewall URL Server Is Responding - Filtering HTTP Traffic |
HID2066 |
Firewall Denied HTTP URL Request |
HID2067 |
Firewall URL Server Is Not Responding - Not Filtering HTTP Traffic |
HID2068 |
Firewall User Privilege Configuration Successful |
HID2069 |
Firewall Detected SSH Internal Error |
HID2070 |
Firewall Detected SSH Session Closed - User Timeout |
HID2071 |
Firewall Denied Inbound Protocol Session |
HID2071 |
Firewall Denied Inbound Network Request |
HID2072 |
Firewall Failed Detecting Route to Remote Host |
HID2073 |
Firewall Failed ICMP Regular Translation |
HID2074 |
Firewall Failed TCP Regular Translation |
HID2075 |
Firewall Pre-allocated TCP Backconnection |
HID2076 |
Firewall Pre-allocated UDP Backconnection |
HID2077 |
Firewall Received Message Status Prior to Setup |
HID2078 |
Firewall Detected Network Route Establishment Failure |
HID2078 |
Firewall Detected Potential FTP Port Scanning |
HID2079 |
Firewall Allowed Inbound Network Request - Access Control List Permitted |
HID2080 |
Firewall Allowed Network Activity via Third Party Network |
HID2081 |
Firewall Closed ICMP Network Connection |
HID2082 |
Firewall Closed Static Network Session |
HID2082 |
Firewall Created Dynamic ICMP Network Translation |
HID2082 |
Firewall Created Dynamic ICMP Translation |
HID2083 |
Firewall Created Dynamic Network Translation |
HID2084 |
Firewall Created UDP Network Session |
HID2085 |
Firewall Created ICMP Network Connection |
HID2086 |
Firewall Created Inbound UDP Network Session |
HID2086 |
Firewall Permitted Inbound UDP Request |
HID2087 |
Firewall Created Network Address Translation Entry |
HID2088 |
Firewall Created Network Protocol Connection |
HID2089 |
Firewall Created Session to Local Host |
HID2090 |
Firewall Detected File Upload Success |
HID2091 |
Firewall Detected IPSec IKE Malformed Message Request |
HID2092 |
Firewall Detected MAC Address Moved |
HID2093 |
Firewall Detected Pre-Allocated RTP Session Notification |
HID2094 |
Firewall Established Remote H245 Connection |
HID2095 |
Firewall Closed Remote TCP Network Session |
HID2095 |
Firewall Established Remote TCP Network Session |
HID2096 |
Firewall Closed Remote UDP Network Session |
HID2096 |
Firewall Established Remote UDP Network Session |
HID2097 |
Firewall Granted Remote DHCP Request |
HID2098 |
Firewall Permitted UDP Network Request from an Untrusted Host |
HID2099 |
Firewall Denied Network Address - Shunned Packet |
HID2100 |
Firewall Logged TCP Session Count Currently In Use |
HID2101 |
Firewall Allowed TCP Network Session |
HID2102 |
Firewall Allowed UDP Network Session |
HID2103 |
Firewall Detected ICMP Echo Request |
HID2104 |
Firewall Detected ICMP Timestamp Exceeded |
HID2105 |
Firewall Detected IPSec IKE Mode Failure |
HID2106 |
Firewall Detected Malicious PPTP Synchronization Packets |
HID2107 |
Firewall Detected Split DNS Anomaly |
HID2108 |
Firewall Denied Access Due To IP Land Attack |
HID2109 |
Firewall Denied Inbound TCP Request - Access Control List Prevention |
HID2110 |
Firewall Denied Network Protocol Connection |
HID2111 |
Firewall Denied Network Request - Access Control List Prevention |
HID2112 |
Firewall Detected Potentially Spoofed Network Address |
HID2113 |
Firewall Denied ICMP Echo Network Request |
HID2114 |
Firewall Detected DNS Zone Transfer Request |
HID2115 |
Firewall Denied Inbound ICMP Network Request |
HID2116 |
Firewall Denied Network Request |
HID2117 |
Firewall Denied Invalid IP Options During Connection Request |
HID2118 |
Firewall Denied IP Network Request |
HID2119 |
Firewall Default Event Message |
HID2120 |
Firewall Rejected Invalid IKE Packet |
HID2121 |
Firewall Default IKE Message |
HID2122 |
Firewall Permitted Network Request |
HID2123 |
Firewall Denied Host SMTP Mail Request |
HID2124 |
Firewall Detected HTTP CGI Activity |
HID2125 |
Firewall Denied HTTP Network Response |
HID2126 |
Firewall Denied SMTP Relay Request |
HID2127 |
Firewall Added Host to Blocked Site List |
HID2128 |
Firewall Denied IGMP Network Request |
HID2129 |
Firewall VPN Closed Remote Connection |
HID2130 |
Firewall VPN Established Remote Connection |
HID2131 |
Firewall VPN Attempted Authentication Failure |
HID2132 |
Firewall VPN Attempted Authentication Success |
HID2133 |
Firewall Temporarily Blocking Host |
HID2134 |
Firewall Reset TCP Connection |
HID2135 |
Firewall Reset UDP Connection |
HID2136 |
Firewall Detected TCP Connection Timeout |
HID2137 |
Firewall Detected UDP Connection Timeout |
HID2138 |
Firewall SMTP-Proxy Default Event Message |
HID2139 |
Firewall VPN Default Event Message |
HID2140 |
Firewall HTTP-Proxy Default Event Message |
HID2141 |
Firewall Permitted SSL Web Request |
HID2142 |
Firewall Permitted Web Request |
HID2143 |
Firewall Default URL Alert |
HID2144 |
Firewall Permitted Outbound TCP Traffic |
HID2145 |
Firewall Permitted Outbound UDP Traffic |
HID2146 |
Firewall Attempted SSL Negotiation Failed |
HID2147 |
Firewall Detected DNS Protocol Error |
HID2148 |
Firewall Priority 2 System Event Notification |
HID2149 |
Firewall Priority 3 System Event Notification |
HID2150 |
Firewall Priority 1 System Event Notification |
HID2151 |
Firewall Denied Network Request - Not on Common Subnet |
HID2152 |
Firewall Detected IPv6 Encapsulation |
HID2160 |
Firewall Detected Network Interface Down |
HID2161 |
Firewall Detected Network Interface Up |
HID2170 |
Firewall Detected Completed SSL Handshake |
HID2171 |
Firewall Detected Host Down |
HID2172 |
Firewall Detected SSL Handshake |
HID2177 |
Firewall Drop Rate Exceeded |
HID2178 |
Firewall Error Recovery |
HID2179 |
Firewall General Error |
HID2180 |
Firewall General Message |
HID2181 |
Firewall Failover Cable OK |
HID2182 |
Firewall Failover Cable Error |
HID2183 |
Firewall Failover Enabled |
HID2184 |
Firewall Failover Disabled |
HID2185 |
Firewall Failover Interface Up |
HID2186 |
Firewall Failover Interface Down |
HID2187 |
Firewall Failover Communications Error |
HID2188 |
Firewall Failover Incompatible |
HID2189 |
Firewall Peer Incompatible |
HID2190 |
Firewall Peer Not Identical |
HID2191 |
Firewall Status Active/OK |
HID2192 |
Firewall Status Standby |
HID2193 |
Firewall Testing Network Interface |
HID2194 |
Firewall Network Interface Test Passed |
HID2195 |
Firewall Network Interface Test Failed |
HID2196 |
Firewall Configuration Replication/Sync Started |
HID2197 |
Firewall Configuration Replication/Sync Completed |
HID2198 |
Firewall Configuration Replication/Sync Error |
HID2199 |
Firewall Detected Potentially Spoofed Connection |
HID2200 |
Firewall Detected IPSec Negotiation |
HID2200 |
Firewall Detected Security Negotiation Complete |
HID2200 |
Firewall Detected Security Negotiation Message |
HID2201 |
Firewall SSM Card Error |
HID2202 |
Firewall SSM Card 4GE Initialization Started |
HID2203 |
Firewall SSM Card 4GE Initialization Completed |
HID2204 |
Firewall SSM Card 4GE Initialization Error |
HID2205 |
Firewall SSM Card 4GE Access Error |
HID2206 |
Firewall SSM Card AIP Virtual Sensor Added |
HID2207 |
Firewall SSM Card AIP Virtual Sensor Deleted |
HID2208 |
Firewall Reached Maximum Memory Limit |
HID2209 |
Firewall Module Up |
HID2210 |
Firewall Module Down |
HID2211 |
Firewall Module Change |
HID2212 |
Firewall Module Error |
HID2213 |
Firewall Fiber Scheduler Error |
HID2214 |
Firewall OCAM Error |
HID2215 |
Firewall CA Server Event |
HID2216 |
Firewall CA Server Error |
HID2217 |
Firewall Fan/Temp OK |
HID2218 |
Firewall Fan/Temp Error |
HID2219 |
Firewall Power/Voltage OK |
HID2220 |
Firewall Power/Voltage Error |
HID2221 |
Firewall Backplane OK |
HID2222 |
Firewall Backplane Error |
HID2223 |
Firewall Permitted Inbound Network Request |
HID2224 |
Firewall Permitted Inbound ICMP Request |
HID2225 |
Firewall Permitted Outbound Network Request |
HID2226 |
Firewall Permitted Outbound ICMP Request |
HID2227 |
Firewall Denied Outbound Network Request |
HID2228 |
Firewall Denied Outbound ICMP Request |
HID2229 |
Firewall Denied Outbound TCP Request |
HID2230 |
Firewall Denied Outbound UDP Request |
HID2231 |
Firewall Reached Maximum Access List Memory Limit |
HID2232 |
Firewall SMTP String Replacement |
HID2233 |
Firewall Denied SMTP Request |
HID2234 |
Firewall Manager Authentication Attempt Started |
HID2235 |
Firewall Manager Authentication Attempt Failed |
HID2236 |
Firewall Manager Authorization Attempt Success |
HID2237 |
Firewall Manager Authorization Attempt Failed |
HID2238 |
Firewall AAA Server Change |
HID2239 |
Firewall AAA Server Error |
HID2240 |
Firewall Syslog Error |
HID2241 |
Firewall Memory Threshold Warning |
HID2242 |
Firewall Network Request Exhaustion |
HID2243 |
Firewall TCP Request Exhaustion |
HID2244 |
Firewall UDP Request Exhaustion |
HID2245 |
Firewall CPU Utilization Warning |
HID2246 |
Firewall DNS Identifier Mismatched |
HID2247 |
Firewall License Active |
HID2248 |
Firewall License Warning |
HID2249 |
Firewall License Error |
HID2250 |
Firewall Fiber Library Error |
HID2251 |
Firewall Storage Error |
HID2252 |
Firewall Clustering Error |
HID2253 |
Firewall Tunnel Manager Error |
HID2254 |
Firewall ScanSafe Event |
HID2255 |
Firewall ScanSafe Redirect |
HID2256 |
Firewall ScanSafe Error |
HID2257 |
Firewall Memory Error |
HID2258 |
Firewall Permitted IPSEC Request |
HID2259 |
Firewall Denied IPSEC Request |
HID2260 |
Firewall VPN Denied New Tunnel |
HID2261 |
Firewall Detected Potentially Spoofed MAC Address |
HID2262 |
Firewall Syslog Active |
HID2263 |
Firewall SCEP Error |
HID2264 |
Firewall Permitted VPN Request |
HID2265 |
Firewall Denied VPN Request |
HID2266 |
Firewall Denied CoA Request - NON-HTTP |
HID2267 |
Firewall Host Limit Reached |
HID2268 |
Firewall Detected Potentially Spoofed Handshake |
HID2269 |
Firewall Fail-Close Event |
HID2270 |
Firewall TLS Limit Reached |
HID2271 |
Firewall Denied TLS Request |
HID2272 |
Firewall Denied SRTP Request |
HID2400 |
Firewall Audit General Message |
HID2401 |
Firewall Audit Object Created |
HID2402 |
Firewall Audit Object Deleted |
HID2403 |
Firewall Audit Object Modifed |
2.5. IPS/IDS/HIDS¶
HAWK ID |
Description |
|---|---|
HID3000 |
IPS Detected and Prevented Suspicious Activity |
HID3001 |
HIDS Detected Disk Space Utilization Error |
HID3002 |
HIDS Detected High CPU Utilization Error |
HID3003 |
HIDS Detected Memory Utilization Error |
HID3004 |
HIDS Detected File Deletion |
HID3005 |
HIDS Detected File Modification |
HID3006 |
HIDS Detected File Creation |
HID3007 |
IPS Detected CTS Flood |
HID3008 |
IPS Detected RF Jamming Attack |
HID3009 |
AirMagnet Wireless IPS Detected Wireless Bandwidth Exceeded |
HID3010 |
IPS Detected Channel with High Noise Level |
HID3011 |
IPS Detected Unencrypted WLAN Traffic |
HID3012 |
IPS Detected Ad-hoc Mode Station |
HID3013 |
IPS Detected Channel with Overloaded APs |
HID3014 |
IDS Default ICMP Security Event |
HID3015 |
IDS Default TCP Security Event |
HID3016 |
IDS Default UDP Security Event |
HID3017 |
IPS Successfully Closed TCP Session |
HID3018 |
IPS Successfully Closed UDP Session |
HID3019 |
IDS Trap Event |
HID3019 |
IDS ICMP Trap Event |
HID3020 |
IDS TCP Trap Event |
HID3021 |
IDS UDP Trap Event |
HID3022 |
IDS General Trap Event |
HID3023 |
IDS IP Trap Event |
HID3024 |
IDS PIM Trap Event |
HID3024 |
IDS Unknown Trap Event |
HID3030 |
HIDS Detected Warning Message |
HID3031 |
HIDS Detected Session Connection Error |
HID3032 |
HIDS Sensor Update File Integrity Database |
HID3033 |
HIDS Detected File Integrity Verification Failure |
2.6. Spam Filter¶
HAWK ID |
Description |
|---|---|
HID3100 |
Spam Filter Blocked Identified Virus Infected E-Mail Message |
HID3101 |
Spam Filter Blocked Identified E-Mail Message |
HID3102 |
Spam Filter Blocked Identified Recipient E-Mail Address |
HID3103 |
Spam Filter Blocked Identified Sender E-Mail Address |
HID3104 |
Spam Filter Blocked Identified Spam E-Mail Message |
HID3105 |
Spam Filter Blocked Remote Client Request |
2.7. Router¶
HAWK ID |
Description |
|---|---|
HID4000 |
Router Administrative SNMP Probe Failure |
HID4002 |
Router Attempted RSHELL Authentication Request |
HID4003 |
Router Administrative SNMP Configuration Change |
HID4005 |
Router Administrative Configuration Change |
HID4006 |
Router Reached Network Rate Limit - Dropping Packets |
HID4007 |
Router Determined Line Entered the ‘DOWN’ State |
HID4008 |
Router Determined Line Entered the ‘UP’ State |
HID4009 |
Router VLAN Activation Notification |
HID4010 |
Router Allowed GRE Network Traffic |
HID4011 |
Router Allowed ICMP Network Message |
HID4012 |
Router Allowed Request from Network Address |
HID4013 |
Router Allowed TCP Network Request |
HID4014 |
Router Allowed UDP Network Request |
HID4015 |
Router Denied ICMP Network Request |
HID4016 |
Router Denied Network Address |
HID4017 |
Router Denied TCP Connection Request |
HID4018 |
Router Denied UDP Connection Request |
HID4019 |
Router Received Unexpected IPsec VPN Traffic |
HID4020 |
Router Detected WEP Authentication Failure |
HID4021 |
Router Detected Client Association |
HID4022 |
Router Detected Remote Host De-Authentication |
HID4023 |
Router Detected Remote Host Re-Association |
HID4024 |
Router Remote Host Connection Failure |
HID4025 |
Router Restart Successful |
HID4026 |
Router Rotated Encryption Keys |
HID4027 |
Router Detected Attack |
HID4028 |
Router DHCP Network Address Acknowledgment |
HID4029 |
Router Offered DHCP Network Address |
HID4030 |
Router Soft Reboot - Event Trace Change |
HID4031 |
Router Soft Reboot - Factory Reset |
HID4032 |
Router Soft Reboot - Firmware Upgrade |
HID4033 |
Router Soft Reboot - MAC Address Reset |
HID4034 |
Router Soft Reboot - New Interface |
HID4035 |
Router Detected Encrypted Host Transmitting Unencrypted Information |
HID4036 |
Router Detected NULL MAC Address |
HID4037 |
Router Detected NULL Network Address |
HID4038 |
Router Detected Rogue Access Point |
HID4039 |
Router Detected Rogue Host Hijacking Local AP MAC Address |
HID4040 |
Router Detected Rogue Host Transmitting Malformed Association Frames |
HID4041 |
Router Detected Rogue Host Transmitting Malformed Frames |
HID4042 |
Router Detected Rogue Host Transmitting Malformed Management Frames |
HID4043 |
Router Detected SSH CRC32 Attack |
HID4044 |
Router Exceeded Maximum Memory Limit |
HID4045 |
Router Temporarily Suspended DNS Lookups |
HID4046 |
Router Detected Malformed Control Request |
HID4047 |
Router Detected Malformed Management Request |
HID4048 |
Router Failed to Create Forwarding Table Entry |
HID4049 |
Router Remote User Attemptd Network Address Assignment |
HID4050 |
Router Denied Association - Invalid MAC Address |
HID4051 |
Router Detected Duplicate Network Address |
HID4052 |
Router Detected WEP Encryption Failure |
HID4053 |
Router Soft Reboot - Exceeded Maximum Memory Limit |
HID4054 |
Router Detected Fan Failure |
HID4055 |
Router Detected VLAN Mismatch |
HID4060 |
Router Created TCP Session |
HID4061 |
Router Closed TCP Session |
HID4062 |
Router Detected Failed Health Probe |
HID4063 |
Router Detected Power On |
HID4064 |
Router Created UDP Session |
HID4065 |
Router Closed UDP Session |
HID4066 |
Router Created ICMP Session |
HID4067 |
Router Closed ICMP Session |
HID4068 |
Router Detected Duplex Mismatch |
HID4069 |
Router Failed to Parse Configuration File |
HID4070 |
Router Detected Port Flapping |
HID4071 |
Router Detected VPN Certificate Expired |
HID4072 |
Router General Message |
HID4073 |
Router Denied Network Request |
HID4074 |
Router Detected Interface Down |
HID4075 |
Router Detected Interface Up |
HID4076 |
Router Detected Host Down |
2.8. Switch¶
HAWK ID |
Description |
|---|---|
HID4100 |
Switch Detected Interface Changed State to Down |
HID4101 |
Switch Detected Interface Changed State to Up |
HID4102 |
Switch Detected VLAN/Interface Changed State to Forwarding |
HID4300 |
Switch General Message |
HID4301 |
Switch Detected Interface Changed State to Down |
HID4302 |
Switch Detected Interface Changed State to Up |
HID4303 |
Switch Detected VLAN/Interface Changed State to Forwarding |
HID4304 |
Switch Attempted Authentication via local |
HID4305 |
Switch User Created/modified |
HID4306 |
Switch User Deleted |
2.9. VPN¶
HAWK ID |
Description |
|---|---|
HID4200 |
VPN Privileged Attempted Authentication Failure |
HID4201 |
VPN Attempted Authentication Success |
HID4202 |
VPN Non-Privileged Attempted Authentication Failure |
HID4203 |
VPN Non-Privileged Attempted Authentication Request |
HID4204 |
VPN Privileged Attempted Authentication Success |
HID4205 |
VPN Deleted IKE With Reason |
HID4206 |
VPN NTP Time Synchronization Failure |
HID4207 |
VPN Configured Remote IKE Peer |
HID4208 |
VPN IKE Lost Contact with Remote Peer |
HID4209 |
VPN Overriding IPSec ReKeying Duration |
HID4210 |
VPN Received Client Connection Request |
HID4211 |
VPN Received Local Proxy Subnet Information |
HID4212 |
VPN Received Remote Proxy Host Information |
HID4213 |
VPN Received Unencrypted Traffic Within Encrypted Session |
HID4214 |
VPN Successfully Completed Phase 1 |
HID4215 |
VPN Successfully Created Connection |
HID4216 |
VPN Terminated Peer Connection |
HID4217 |
VPN Terminated User Session |
HID4218 |
VPN Received IKE Peer Notification |
HID4403 |
SSL VPN Connection Shutdown Detected |
HID4403 |
Remote VPN Session Ended |
HID4403 |
Remote VPN Session Terminated |
HID4500 |
IPSec Deleted Phase-2 SA |
HID4501 |
IPSec Successfully Negotiated Phase-2 |
HID4502 |
IPSec Successfully Installed SA |
HID4600 |
Remote VPN Address for User Changed |
HID4600 |
Remote VPN Certificate Realm Restrictions Passed |
HID4600 |
Remote VPN Misc Login Information |
HID4601 |
Mobile VPN Session Started |
HID4601 |
Remote VPN Connected via Tunnel |
HID4601 |
Remote VPN Session Connected |
HID4601 |
Remote VPN Session Started |
HID4601 |
VPN Established Remote Connection |
HID4602 |
Mobile VPN Session Ended |
HID4602 |
Remote VPN Closed Tunnel Connection |
HID4602 |
VPN Closed Remote Connection |
HID4603 |
Remote VPN Administrator Login |
HID4603 |
Remote VPN Authentication Successful |
HID4603 |
Remote VPN Login Successful |
HID4603 |
Remote VPN Web SSO Authentication Successful |
HID4604 |
Remote VPN Administrator Failed Login |
HID4604 |
Remote VPN Failed Authentication |
HID4604 |
Remote VPN Failed Login No Roles |
HID4605 |
Remote VPN Administrator Logout |
HID4605 |
Remote VPN Logged Out |
HID4605 |
Remote VPN Logged Out Started New Session |
HID4605 |
VPN User Authentication Logout Success |
HID4606 |
Remote VPN Requesting Confirm Invalid SSL Site |
HID4606 |
Remote VPN User Confirmed Invalid SSL Site |
HID4607 |
Remote VPN Web Access Blocked |
HID4608 |
Remote VPN SSL Negotiation Failed |
HID4609 |
Remote VPN Client Certificate Expired |
HID4610 |
Remote VPN Host Checker Timed Out |
HID4610 |
Remote VPN Session Timed Out |
HID4611 |
Mobile VPN ACLs Applied |
HID4612 |
Remote VPN User Successful WebRequest |
HID4612 |
Remote VPN User WebRequest |
HID4613 |
Remote VPN Host Checker Policy Passed |
HID4614 |
Remote VPN Host Checker Policy Failed |
2.10. ActiveSync¶
HAWK ID |
Description |
|---|---|
HID4650 |
Mobile ActiveSync Traffic Unauthorized |
HID5651 |
Mobile ActiveSync Traffic Forbidden |
HID4652 |
Mobile ActiveSync Traffic Fetching Elements |
HID4653 |
Mobile ActiveSync Traffic Successful Element Retrieval |
HID4654 |
Mobile ActiveSync Session Timed Out |
2.11. FTP¶
HAWK ID |
Description |
|---|---|
HID7001 |
FTP Daemon Detect Create Directory Success |
HID7001 |
Attempted Authentication Failure - FTP |
HID7002 |
FTP Daemon Detected Anonymous Authentication |
HID7002 |
FTP Service Anonymous Authentication Success |
HID7003 |
FTP Daemon Attempted Authentication Success |
HID7003 |
Attempted Authentication Success - FTP |
HID7004 |
FTP Daemon User Session Opened |
HID7005 |
FTP Daemon Detected FTP Bounce Attack |
HID7006 |
FTP Daemon User Authentication Logout Success |
HID7007 |
FTP Daemon Detected Network Request |
HID7008 |
FTP Daemon Denied User File or Directory Access Request |
HID7009 |
FTP Daemon Denied Attempted Authentication Request |
HID70093 |
Attempted Authentication Failure - SSH |
HID7010 |
FTP Daemon Detected Refused Request |
HID7011 |
FTP Daemon Detected Uncontrolled Process Crash - Segmentation Fault |
HID7012 |
FTP Daemon Detected Directory Creation Failure |
HID7013 |
FTP Daemon File Upload Request |
HID7014 |
FTP Daemon Identified Open Connection |
HID7015 |
Attempted Authentication Failure - Invalid Username |
HID7015 |
FTP Daemon Detected User Directory Change Failure |
HID7016 |
FTP Daemon Closed Remote Session |
HID7017 |
FTP Daemon Detected Successful File Deletion |
HID7018 |
FTP Daemon Detected User Directory Change |
HID7019 |
FTP Daemon Renamed Remote File Successfully |
HID7550 |
FTP Daemon Successfully Created Remote File |
HID7551 |
FTP Daemon Successfully Deleted Existing Directory |
HID7552 |
FTP Daemon Successfully Retrieved Requested File |
HID7553 |
FTP Daemon Detected Potentially Copyrighted Content |
HID7554 |
FTP Daemon Failed to Create Remote File |
HID7555 |
FTP Daemon Failed to Retrieve Requested File |
2.12. Operating System¶
HAWK ID |
Description |
|---|---|
HID7020 |
Attempted Administrative Authentication Attempt - Console Login |
HID7021 |
Attempted Non-Administrative Authentication Attempt - Console Login |
HID7022 |
Attempted Authentication Failure |
HID7023 |
Attempted Authentication Failure - Invalid Password |
HID7025 |
Operating System User Administration - New User Added |
HID7026 |
Operating System Group Administration - New Group Added |
HID7027 |
Operating System Limited TCP Bandwidth |
HID7028 |
Operating System Reached ICMP Bandwidth Limit |
HID7029 |
Operating System Reached TCP Bandwidth Limit |
HID7030 |
Operating System Reached Maximum Memory Limit |
HID7031 |
DHCP Client Unable to Identify DHCP Offer |
HID7032 |
GNU/Linux Glibc Corruption Detected |
HID7033 |
GNU/Linux Glibc Double Free Heap Corruption Detected |
HID7034 |
DNS Daemon Exited - Fatal Error |
HID7035 |
DNS Daemon Cache Query Denied |
HID7036 |
DNS Daemon Configuration Failure |
HID7037 |
SE Linux Granted AVC Access |
HID7037 |
SE Linux Denied AVC Access |
HID7038 |
Operating System CD-ROM Drive Error |
HID7039 |
crashdump Process Crashed |
HID7040 |
Operating System Detected Insufficient Space on Disk Device |
HID7041 |
Operating System Detected Process Exited on Signal |
HID7042 |
Operating System Reached Maximum Swap Memory Limit |
HID7043 |
Operating System Reboot |
HID7044 |
Operating System Logged calife Service Request |
HID7045 |
Operating System Logged Failed calife Service Request |
HID7046 |
Operating System Received ATA Disk Reset Notification |
HID7047 |
Operating System Received Disk Read Error - Command Timeout |
HID7048 |
Syslog Daemon Discarded Log Packets |
HID7049 |
Syslog Daemon Exited - System Logging Service is Unavailable |
HID7050 |
Syslog Daemon Restart Notification |
HID7051 |
Unix System nfs Mount Error |
HID7052 |
UUCP Daemon Denied Incoming Connection |
HID7053 |
UUCP Daemon Denied Incoming User Message |
HID7054 |
UUCP Daemon Received Incoming Connection |
HID7055 |
DNS Daemon Denied Query |
HID7056 |
DNS Daemon Host Information Update Failed |
HID7057 |
DNS Daemon Received Incorrect Response to Information Query |
HID7057 |
DNS Daemon Incorrectly Responded to Information Query |
HID7058 |
DNS Daemon Started Successfully |
HID7059 |
DNS Daemon Stopped Successfully |
HID7060 |
DNS Daemon Zone Transfer Query |
HID7061 |
DHCP Client Received DHCP Network Offer |
HID7062 |
DHCP Service Detected Client DHCP Request |
HID7063 |
DHCP Service Detected Client DHCPINFORM |
HID7064 |
Finger Daemon Rejected Connected Request |
HID7065 |
DHCP Service Detected Client DHCPACK |
HID7066 |
Operating System Detected Excessive xinetd Session Requests |
HID7067 |
Operating System Logged Remote xinetd Connection |
HID7068 |
Operating System User Administration - Account Already Exists |
HID7069 |
Operating System User Administration - User Deleted |
HID7070 |
Operating System Administration - User Password Change |
HID7070 |
Operating System Administration - User Password Reset |
HID7071 |
Operating System Application Manager Installed/Upgraded Packages |
HID7072 |
Ident Daemon Logged Connection Request |
HID7073 |
Ident Daemon Looked up Username |
HID7074 |
Inet Daemon Received cvspserver Connection Request |
HID7075 |
Operating System Completed Application Installation/Upgrade |
HID7076 |
Operating System Identified Network Transition |
HID7077 |
Operating System Logged Portmap Service Request |
HID7078 |
Mail Service Refused Connection |
HID7079 |
Telnet Daemon Logged Incoming Connection |
HID7080 |
Telnet Daemon Refused Incoming Connection |
HID7081 |
Operating System mountd Export Request |
HID7082 |
Operating System mountd Export Request Failure |
HID7083 |
Operating System Logged rpc.cmsd Service Request |
HID7084 |
Operating System Logged rpc.statd Service Request |
HID7085 |
Operating System Logged Unsanitized Process Exit |
HID7086 |
Operating System Network Interface Detected Address Conflict |
HID7089 |
Operating System Network Interface Entered Promiscious Mode |
HID7090 |
Operating System Network Interface Exited Promiscious Mode |
HID7091 |
Operating System Multiple Administrative Attempted Authentication Failures |
HID7092 |
Operating System Multiple Non-Administrative Attempted Authentication Failures |
HID7093 |
Attempted Authentication Failure - SSH |
HID7094 |
Attempted Authentication Failure - Empty SSH Password |
HID7095 |
Attempted Authentication Failure - Expired Account (SSH) |
HID7096 |
Attempted Authentication Failure - Illegal Username (SSH) |
HID7097 |
Attempted Authentication Failure - Invalid Username (SSH) |
HID7098 |
Attempted Authentication Failure - Not in AllowUsers (SSH) |
HID7099 |
Attempted Authentication Failure - Invalid Password (SSH) |
HID7100 |
Multiple Attempted Authentication Failures - SSH |
HID7101 |
Attempted Authentication Failure - PAM |
HID7102 |
Attempted Authentication Failure - PAM_LDAP |
HID7103 |
Attempted Authentication Failure - FTP |
HID7104 |
Attempted Authentication Failure - FTP Invalid Username |
HID7105 |
Attempted Authentication Failure - Invalid Username |
HID7106 |
Attempted Administrative Authentication Failure |
HID7107 |
Operating System Administrative User Command Failure |
HID7108 |
Attempted Authentication Failure - rsh |
HID7109 |
Accepted RSA Key Authentication - SSH |
HID7110 |
Attempted Authentication Success - SSH |
HID7111 |
Attempted Authentication Success - Accepted Public Key (SSH) |
HID7112 |
Attempted Authentication Request - SSH |
HID7113 |
Valid User Session Closed - SSH |
HID7115 |
Received Session Disconnect - SSH |
HID7116 |
Restricted User Authentication - SSH |
HID7117 |
Attempted Authentication Success |
HID7118 |
Attempted Administrative Authentication Success |
HID7119 |
Administrative User Session Closed |
HID7120 |
Administrative User Session Opened |
HID7121 |
Detected SFTP Subsystem Request - SSH |
HID7122 |
Closed Remote Connection - SSH |
HID7123 |
Detected Invalid Executable Shell - SSH |
HID7124 |
Operating System Received Time Adjustment Notification |
HID7125 |
Invalid Protocol for SSH Session |
HID7126 |
OpenSSH Daemon Received Missing Identification String |
HID7126 |
DNS Daemon Remote Version Query |
HID7127 |
Operating System Password Read Timeout |
HID7127 |
DNS Daemon Denied Unapproved Update of New Host Information |
HID7128 |
DNS Daemon Received Response from Unexpected Source |
HID7128 |
OpenSSH Daemon Exited - Fatal Error |
HID7128 |
DNS Daemon Exited - Segmentation Fault |
HID7129 |
Attempted Authentication Success - splat |
HID7129 |
OpenSSH Daemon Failed Reverse Mapping Checking (getaddrinfo) |
HID7129 |
DNS Daemon Received Malformed Request |
HID7130 |
Operating System Received Connection From Illegal Port |
HID7130 |
Splat Default Message |
HID7130 |
DNS Daemon Zone Transfer Success |
HID7131 |
Remote Shell Service Error |
HID7131 |
Service Detected a Network Attack - SSH |
HID7132 |
Operating System Telnet Peer Session Died |
HID7132 |
Service Received Corrupted Check Bytes - SSH |
HID7133 |
DNS Daemon Denied Query - Invalid Packet |
HID7134 |
DNS Daemon Denied Query - Invalid Socket |
HID7135 |
DNS Daemon Denied Recursive Query of Existing DNS Host Information |
HID7136 |
DNS Daemon Received Response from Unexpected Source |
HID7137 |
OpenSSH Daemon Exited - Fatal Error |
HID7138 |
OpenSSH Daemon Failed Reverse Mapping Checking (getaddrinfo) |
HID7139 |
Operating System Received Connection From Illegal Port |
HID7140 |
Remote Shell Service Error |
HID7141 |
Operating System Telnet Peer Session Died |
HID7142 |
OpenSSH Daemon Received Missing Identification String |
HID7143 |
Operating System Password Read Timeout |
HID7144 |
Attempted Authentication Success - splat |
HID7147 |
Operating System Printer Publishing |
HID7148 |
Operating System Print Queue Status |
HID7149 |
Operating System Basic Service Operations |
HID7150 |
Attempted Authentication Failure - Account Activity During Unauthorized Hours |
HID7151 |
Attempted Authentication Failure - Expired Password |
HID7152 |
Attempted Authentication Failure - Invalid Logon Type |
HID7153 |
Attempted Authentication Failure - Locked Account |
HID7154 |
Attempted Authentication Failure - Unauthorized Remote Host |
HID7155 |
Attempted Pre-Authentication Failure |
HID7156 |
Service Ticket Request Failed |
HID7157 |
Authentication Logoff Successful |
HID7158 |
User Authentication Encountered Error |
HID7159 |
Attempted Authentication Failure - Account Expired |
HID7160 |
Attempted Authentication Failure - Account Disabled |
HID7161 |
Authenticated User Session Closed |
HID7162 |
Operating System Loaded a Security Package |
HID7163 |
Operating System Security Authentication Ticket Granted |
HID7164 |
Operating System Security Authentication Ticket Request Failed |
HID7165 |
Operating System Account Login Detected |
HID7166 |
Operating System Detected Domain Restore Mode Password Changed |
HID7167 |
Operating System Firewall Failed to Start |
HID7168 |
Attempted Authentication Success - Network |
HID7169 |
Operating System Basic Service Operations |
HID7169 |
Attempted Authentication Success - Interactive |
HID7170 |
Operating System Print Queue Status |
HID7170 |
Attempted Authentication Success - Unlock |
HID7171 |
Operating System Printer Publishing |
HID7171 |
Attempted Authentication Success - Remote Interactive |
HID7172 |
Operating System User Administration - User Added To Group |
HID7173 |
Operating System User Administration - User Deleted From Group |
HID7174 |
Operating System Firewall Start |
HID7175 |
Operating System Firewall Settings Information |
HID7176 |
Operating System Firewall Configuration Modified |
HID7177 |
Operating System Firewall Policy Change |
HID7178 |
Operating System Firewall Rule Ignored |
HID7179 |
Operating System Firewall Stop |
HID7180 |
Operating System Firewall Service Start |
HID7181 |
Operating System Firewall Service Error |
HID7182 |
Operating System Firewall Service Stop |
HID7183 |
Operating System Firewall Driver Start |
HID7184 |
Operating System Firewall Driver Error |
HID7185 |
Operating System Firewall Driver Stop |
HID7186 |
Attempted Authentication Success - Batch |
HID7187 |
Attempted Authentication Success - Service |
HID7188 |
Attempted Authentication Success - Network Clear Text |
HID7189 |
Attempted Authentication Success - New Credentials |
HID7190 |
Attempted Authentication Success - Cached Interactive |
HID7191 |
Attempted Authentication Success - Explicit Credentials |
HID7192 |
Attempted Administrative Authentication Success - Explicit Credentials |
HID7500 |
Attempted Authentication Failure - WinVNC |
HID7501 |
Attempted Authentication Success - WinVNC |
HID7502 |
Operating System Denied Remote Connection Request - WinVNC |
HID7503 |
Operating System Closed Connection - WinVNC |
HID7504 |
Operating System Detected Application Installation Error |
HID7505 |
Operating System Detected Application Installation Failure |
HID7506 |
Operating System Detected Application Installation Warning |
HID7507 |
Operating System Detected Successful Application Configuration |
HID7508 |
Operating System Detected Successful Application Removal |
HID7509 |
Operating System Detected Application Installation Information Notification |
HID7510 |
Operating System Detected Critical System Failure - Reboot Required |
HID7511 |
Operating System Applied Group Policy Objects Successfully |
HID7512 |
Operating System Detected Failed Application |
HID7513 |
Operating System Detected Non-Responsive Application |
HID7514 |
Operating System Application Error Notification |
HID7515 |
Operating System Application Warning Notification |
HID7516 |
Operating System Application Information Notification |
HID7517 |
Operating System DHCP Client Lost DHCP Lease |
HID7518 |
Operating System Service Installation Failure |
HID7519 |
Operating System Allowed Application Network Socket Activity |
HID7520 |
Operating System Detected Directory Replication Agent Activity |
HID7521 |
Operating System Detected Kerberos Policy Configuration |
HID7522 |
Operating System Detected Open Object |
HID7523 |
Operating System Detected Privileged Object Operation |
HID7524 |
Operating System Detected Privileged Service Activity |
HID7525 |
Operating System Detected Security Enabled Global Group Member Configuration |
HID7526 |
Operating System Shutting Down |
HID7527 |
Operating System Re-Established Existing Session |
HID7528 |
Operating System Detected Account Configuration Change |
HID7529 |
Operating System Assigned Process Token |
HID7530 |
Operating System Audit Log Cleared |
HID7531 |
Operating System Policy Configuration Change |
HID7532 |
Operating System Detected Existing Process Exited |
HID7533 |
Operating System Detected Local Time Change |
HID7534 |
Operating System Detected New Process Creation |
HID7535 |
Operating System Firewall Configuration Change |
HID7536 |
Operating System Detected Global Group Configuration Change |
HID7537 |
Operating System Granted System Access |
HID7538 |
Operating System Granted Ticket Renewed |
HID7539 |
Operating System Detected Local Group Configuration Change |
HID7540 |
Operating System Detected Security Object Access Request |
HID7541 |
Operating System Detected Security Object Creation Failure |
HID7542 |
Operating System Security Object Operation Detected |
HID7543 |
Operating System Security Object Privileges Modification |
HID7544 |
Operating System Security Password Policy Verification |
HID7545 |
Operating System Security Privileged Object Operation Failure |
HID7546 |
Operating System Security Privileges Assigned Successfully |
HID7547 |
Operating System Security Service Ticket Granted |
HID7548 |
Operating System Security Enabled Universal Group Changed |
HID7549 |
Operating System User Access Granted |
HID7556 |
Operating System User Account Activated |
HID7557 |
Operating System User Account Expired |
HID7558 |
Operating System User Account Lock Out |
HID7559 |
Operating System User Account Name Changed |
HID7560 |
Operating System User Account Privilege Configuration Change |
HID7561 |
Operating System Security User Audit Policy Refresh |
HID7562 |
Operating System User Password Expired |
HID7563 |
Operating System User Password Change Attempt |
HID7564 |
Operating System User Account Disabled |
HID7565 |
Operating System Security Audit Success Notification |
HID7566 |
Operating System Security Audit Failure Notification |
HID7567 |
Operating System Startup Success |
HID7568 |
Operating System Received Handle Close Notification |
HID7569 |
Operating System Security Disabled Universal Group Changed |
HID7570 |
Attempted Authentication Failure - Interactive |
HID7571 |
Attempted Authentication Failure - Network |
HID7572 |
Attempted Authentication Failure - Batch |
HID7573 |
Attempted Authentication Failure - Service |
HID7574 |
Attempted Authentication Failure - Unlock |
HID7575 |
Attempted Authentication Failure - Network Clear Text |
HID7576 |
Attempted Authentication Failure - New Credentials |
HID7577 |
Attempted Authentication Failure - Remote Interactive |
HID7578 |
Attempted Authentication Failure - Cached Interactive |
HID7579 |
Attempted Authentication Failure - NetLogon Service Inactive |
HID7580 |
Operating System Blocked Application Network Socket Activity |
HID7581 |
Operating System WFP Blocked Packet |
HID7582 |
Operating System WFP DoS Attack Detected |
HID7583 |
Operating System WFP DoS Attack Subsided |
HID7584 |
Operating System WFP Settings Information |
HID7585 |
Operating System WFP Configuration Modified |
HID7586 |
Operating System Blocked Application Network Socket Activity - TCP |
HID7587 |
Operating System Blocked Application Network Socket Activity - UDP |
HID7588 |
Operating System Security Audit Failure Notification |
HID7589 |
Operating System Audit Log Dropped |
HID7590 |
Operating System Audit Log Dropped/Improper Shutdown |
HID7591 |
Operating System Loaded a Notificaiton Package |
HID7592 |
Operating System Loaded a Security Package |
HID7593 |
Operating System User Account Unlock |
HID7594 |
Operating System User Administration - Computer Account Created |
HID7595 |
Operating System User Administration - Computer Account Changed |
HID7596 |
Operating System User Administration - Computer Account Deleted |
HID7597 |
Operating System Password Accessed |
HID7598 |
Operating System Audit Policy Configuration Change |
HID7599 |
Operating System Security User Audit Policy Change |
HID7600 |
Operating System Audit Policy ACL Change |
HID7601 |
Operating System Certificate Authority Audit Policy Change |
HID7602 |
Operating System Security User Audit Policy Table Created |
HID7603 |
Operating System CrashOnAuditFail Enabled |
HID7604 |
Operating System CrashOnAuditFail Disabled |
HID7605 |
Operating System Crash - CrashOnAuditFail |
HID7606 |
Operating System Recovery - CrashOnAuditFail |
HID7607 |
Operating System Security Enabled Local Group Created |
HID7608 |
Operating System Security Enabled Local Group Member Changed |
HID7609 |
Operating System Security Enabled Local Group Deleted |
HID7610 |
Operating System Security Enabled Global Group Created |
HID7611 |
Operating System Security Enabled Global Group Deleted |
HID7612 |
Operating System Security Enabled Universal Group Created |
HID7613 |
Operating System Security Enabled Universal Group Member Changed |
HID7614 |
Operating System Security Enabled Universal Group Deleted |
HID7615 |
Operating System Security Disabled Local Group Created |
HID7616 |
Operating System Security Disabled Local Group Changed |
HID7617 |
Operating System Security Disabled Local Group Member Changed |
HID7618 |
Operating System Security Disabled Local Group Deleted |
HID7619 |
Operating System Security Disabled Global Group Created |
HID7620 |
Operating System Security Disabled Global Group Changed |
HID7621 |
Operating System Security Disabled Global Group Member Changed |
HID7622 |
Operating System Security Disabled Global Group Deleted |
HID7623 |
Operating System Security Disabled Universal Group Created |
HID7624 |
Operating System Security Disabled Universal Group Member Changed |
HID7625 |
Operating System Security Disabled Universal Group Deleted |
HID7626 |
Operating System Group Type Changed |
HID7627 |
Operating System Administrator Group ACL Set |
HID7628 |
Operating System Application Group Created |
HID7629 |
Operating System Application Group Changed |
HID7630 |
Operating System Application Group Member Changed |
HID7631 |
Operating System Application Group Non-Member Changed |
HID7632 |
Operating System Application Group Deleted |
HID7633 |
Operating System LDAP Query Group Created |
HID7634 |
Operating System LDAP Query Group Changed |
HID7635 |
Operating System LDAP Query Group Deleted |
HID7636 |
Operating System Special Groups Logon Table Changed |
HID7637 |
Attempted Authentication Success - Special Groups |
HID7639 |
Operating System Audit Log Service Stopped |
HID7640 |
Operating System Audit Log is Full |
HID7641 |
Operating System Audit Log Automatic Backup |
HID7642 |
Operating System Audit Log Service Error |
HID7643 |
Operating System Scheduled Task Created |
HID7644 |
Operating System Scheduled Task Changed |
HID7645 |
Operating System Scheduled Task Deleted |
HID7646 |
Operating System Service Installation - Kernel Driver |
HID7647 |
Operating System Service Installation - File System Driver |
HID7648 |
Operating System Service Installation - Adapter |
HID7649 |
Operating System Service Installation - Recognizer Driver |
HID7650 |
Operating System Service Installation - Dedicated Service |
HID7651 |
Operating System Service Installation - Shared Service |
HID7652 |
Operating System Service Installation - Dedicated Service Interactive |
HID7653 |
Operating System Service Installation - Shared Service Interactive |
HID7654 |
Operating System Console Locked |
HID7655 |
Operating System Console Unlocked |
HID7656 |
Operating System Screen Saver Started |
HID7657 |
Operating System Screen Saver Stopped |
HID7658 |
Operating System Domain Trust Created |
HID7659 |
Operating System Domain Trust Changed |
HID7660 |
Operating System Domain Trust Deleted |
HID7661 |
Operating System Forest Trust Created |
HID7662 |
Operating System Forest Trust Changed |
HID7663 |
Operating System Forest Trust Deleted |
HID7664 |
Operating System Detected Account with No Password Expiration |
2.13. Mail¶
HAWK ID |
Description |
|---|---|
HID7200 |
Mail Service Attempted Authentication Failure |
HID7200 |
Mail Service E-Mail Delivery Attempted Authentiation Failure |
HID7201 |
Mail Service Denied Attempted E-Mail Relay Request |
HID7202 |
Mail Service Denied Attempted E-Mail Relay Request - Blacklisted Recipient |
HID7203 |
Mail Service Denied E-Mail Delivery Request |
HID7204 |
Mail Service Detected Malformed Recipient E-Mail Address |
HID7205 |
Mail Service Detected Open Mail Relay |
HID7206 |
Mail Service Detected Potential Binary Executable Within Attachment |
HID7207 |
Mail Service Deferred Delivery |
HID7208 |
SASL SMTP Authentication Failure |
HID7209 |
Mail Service Accepted Connection Request |
HID7210 |
Mail Service Detected Hostname Mismatch |
HID7211 |
Mail Service Disconnected Remote Host |
HID7212 |
Mail Service Negotiated E-mail Delivery from Sender |
HID7213 |
Mail Service Received E-Mail Message for Delivery |
HID7214 |
Mail Service Successfully Delivered E-Mail Message |
HID7215 |
Mail Service Detected Host Scanning for Relay |
HID7216 |
Mail Service Rejected Message - Invalid Recipient |
HID7217 |
Mail Service Denied E-Mail Delivery - Invalid Domain |
HID7218 |
Mail Service Denied E-Mail Delivery - Potential SPAM |
HID7220 |
Mail Service Default Message |
HID7221 |
Mail Service Attempted Authentication Success |
HID7222 |
Mail Service Authenticated Session Log Off |
HID7223 |
Mail Service Established Remote Connection Request |
HID7224 |
Mail Service Encountered Malformed Request |
HID7225 |
Mail Service Exited Uncleanly |
HID7226 |
Mail Service Version/Header Request |
HID7227 |
Mail Service Attempted to Deliver E-Mail to Application |
HID7228 |
Mail Service Denied Authenticated E-Mail Access from Remote User |
HID7229 |
Mail Service Detected Full E-Mail Address Probe |
HID7229 |
Mail Service Detected Successful EHLO Command Code 250 |
HID7230 |
Mail Service Detected Invalid Sender Address |
HID7230 |
Mail Service Detected Successful HELO Command Code 250 |
HID7231 |
Mail Service Detected Legacy E-Mail Attack |
HID7231 |
Mail Service Detected EHLO Error Command Code 501 |
HID7232 |
Mail Service Detected MIME Buffer Overflow Attempt |
HID7232 |
Mail Service Detected EHLO Error Command Code 500 |
HID7233 |
Mail Service Detected Potential SMTP RFC Probe |
HID7233 |
Mail Service Detected EHLO Error Command Code 504 |
HID7234 |
Mail Service Rejected E-Mail Message as Potential Spam |
HID7234 |
Mail Service Detected EHLO Error Refused Mail Code 521 |
HID7235 |
Mail Service Rejected E-Mail Message for Unknown User |
HID7235 |
Mail Service Detected EHLO Error Service Not Available Code 421 |
HID7236 |
Mail Service Accepted E-Mail for Relay |
HID7236 |
Mail Service Accepted E-Mail Message for Relay |
HID7236 |
Mail Service Detected Successful RCPT Code 251 |
HID7237 |
Mail Service Accepted E-Mail Message for Delivery |
HID7237 |
Mail Service Detected Successful MAIL Code 250 |
HID7238 |
Mail Service Detected Disk Space Utilization Error - Out of Space |
HID7238 |
Mail Service Detected Aborted MAIL Storage Exceeded Code 552 |
HID7239 |
Mail Service Detected E-Mail Relay Request Without Proper Authorization |
HID7239 |
Mail Service Detected Error MAIL Code 451 |
HID7240 |
Mail Service Detected Error During E-Mail Message Relay |
HID7240 |
Mail Service Detected Error MAIL Code 452 |
HID7241 |
Mail Service Detected Invalid MAIL/EXPN/VRFY/ETRN Command |
HID7241 |
Mail Service Detected Error Mail Code 421 |
HID7242 |
Mail Service Received SYSERR Read Timeout |
HID7242 |
Mail Service Detected Error MAIL Code 500 |
HID7243 |
Mail Service Terminated Remote Host Connection |
HID7243 |
Mail Service Detected Error MAIL Code 501 |
HID7244 |
Mail Service Detected Blocked Potentially Malicious E-mail |
HID7244 |
Mail Service Detected Successful RCPT Code 250 |
HID7245 |
Mail Service Detected Potential DNS Name Buffer Overflow Attack |
HID7245 |
Mail Service Detected Error RCPT Code 421 |
HID7246 |
Mail Service Detected Potential EXPN Attack |
HID7246 |
Mail Service Detected Error RCPT Code 450 |
HID7247 |
Mail Service Detected Potential qf Attack |
HID7247 |
Mail Service Detected Error RCPT Code 451 |
HID7248 |
Mail Service Rejected E-Mail - Detected Within Blacklist Relay |
HID7248 |
Mail Service Detected Error RCPT Code 452 |
HID7249 |
Mail Service Rejected E-Mail - Matched Milter Filter |
HID7249 |
Mail Service Detected Error RCPT Code 500 |
HID7250 |
Mail Service Detected gethost Error - DNS Lookup Failed |
HID7250 |
Mail Service Detected Error RCPT Code 501 |
HID7251 |
Mail Service Detected IMAP Attempted Authentication Success |
HID7251 |
Mail Service Detected Error RCPT Code 503 |
HID7252 |
Mail Service Detected Session Closed Successfully |
HID7252 |
Mail Service Detected Error RCPT Code 521 |
HID7253 |
Mail Service Detected POP3 Attempted Authentication Success |
HID7253 |
Mail Service Detected Error RCPT Code 550 |
HID7254 |
Mail Service Detected LDAP Attempted Authentication Failure |
HID7254 |
Mail Service Detected Error RCPT Code 551 |
HID7255 |
Mail Service Detected Error RCPT Code 552 |
HID7256 |
Mail Service Detected Error RCPT Code 553 |
HID7257 |
Mail Service Detected HELO Error Command Code 500 |
HID7258 |
Mail Service Detected HELO Error Command Code 501 |
HID7259 |
Mail Service Detected HELO Error Command Code 504 |
HID7260 |
Mail Service Detected HELO Error Refused Mail Code 521 |
HID7261 |
Mail Service Detected HELO Error Service Not Available Code 421 |
2.14. Database¶
HAWK ID |
Description |
|---|---|
HID7300 |
Attempted Authentication Failure - Database |
HID7301 |
Database Server Revoked Attempted Authentication Request |
HID7302 |
Database Server Revoked Attempted Authentication Request Failure |
HID7303 |
Attempted Authentication Success - Database |
HID7304 |
Database Server Trapped Error |
HID7305 |
Database Server Trapped Warning |
HID7306 |
Database Server Received Pause Notification |
HID7307 |
Database Server Received Service Stop Notification |
HID7308 |
Database Server Shutdown Successfully |
HID7309 |
Database Detected Syntax Error |
HID7310 |
Attempted Authentication Success - Radius IAS |
HID7310 |
Database Detected Relation Error |
HID7311 |
Database Accepted Connection Request |
HID7312 |
Database Closed Remote Connection |
HID7313 |
Database Successfully Started Service |
HID7314 |
Database Rejected Connection Request |
HID7315 |
Database Server Successfully Analyzed Database |
HID7316 |
Database Server Successfully Checked Database |
HID7317 |
Database Server Successfully Completed Backup |
HID7318 |
Database Server Successfully Restored Database |
HID7319 |
Database Server Successfully Started Trace |
HID7320 |
Database Server Trapped Information |
HID7321 |
Database Server Encountered an Error |
2.15. Web Server¶
HAWK ID |
Description |
|---|---|
HID8000 |
Web Server Detected GET Request Bad Response Code 400 |
HID8001 |
Web Server Detected GET Request Code 302 |
HID8001 |
Web Server Detected GET Request Redirected Code 302 |
HID8002 |
Web Server Detected GET Request Code 304 |
HID8002 |
Web Server Detected GET Request Not Modified Code 304 |
HID8003 |
Web Server Detected GET Request Error Code 500 |
HID8004 |
Web Server Detected GET Request Error Code 501 |
HID8005 |
Web Server Detected GET Request Forbidden Response Code 403 |
HID8006 |
Web Server Detected GET Request No Response Code 204 |
HID8007 |
Web Server Detected GET Request Not Found Code 404 |
HID8008 |
Web Server Detected GET Request Payment Required Response Code 402 |
HID8009 |
Web Server Detected GET Request Server Overload Code 502 |
HID8010 |
Web Server Detected GET Request Unauthorized Response Code 401 |
HID8011 |
Web Server Detected GET Request Gateway Timeoute Code 503 |
HID8012 |
Web Server Detected Partial GET Request |
HID8013 |
Web Server Detected Successful GET Request |
HID8014 |
Web Server Detected Valid GET Request |
HID8015 |
Web Server Detected HEAD Request Bad Code 400 |
HID8016 |
Web Server Detected HEAD Request Unsupported Error Code 501 |
HID8017 |
Web Server Detected HEAD Request Forbidden Code 403 |
HID8018 |
Web Server Detected HEAD Request Gateway Timeout 503 |
HID8019 |
Web Server Detected HEAD Request No Response Code 204 |
HID8020 |
Web Server Detected HEAD Request Not Found Code 404 |
HID8021 |
Web Server Detected HEAD Request Payment Required Code 402 |
HID8022 |
Web Server Detected HEAD Request Server Overload Code 502 |
HID8023 |
Web Server Detected HEAD Request Unauthorized Code 401 |
HID8024 |
Web Server Detected Partial HEAD Request |
HID8025 |
Web Server Detected POST Request Error Code 500 |
HID8026 |
Web Server Detected Valid HEAD Request |
HID8027 |
Web Server Detected Valid HEAD Request |
HID8028 |
Web Server Detected POST Request Bad Code 400 |
HID8029 |
Web Server Detected POST Request Error Code 500 |
HID8030 |
Web Server Detected POST Request Error Code 501 |
HID8031 |
Web Server Detected POST Request Forbidden Code 403 |
HID8032 |
Web Server Detected POST Request Gateway Timeout Code 503 |
HID8033 |
Web Server Detected POST Request Not Found Code 404 |
HID8034 |
Web Server Detected POST Request Server Overload Code 502 |
HID8035 |
Web Server Detected POST Request Unauthorized Code 401 |
HID8036 |
Web Server Detected POST Request No Response Code 204 |
HID8037 |
Web Server Detected POST Request Payment Required Code 402 |
HID8038 |
Web Server Detected Partial POST Request |
HID8039 |
Web Server Detected Successful POST Request |
HID8040 |
Web Server Detected Valid POST Request |
HID8041 |
Web Server Detected GET Request 301 |
HID8042 |
Web Server Detected POST Request 301 |
HID8043 |
Web Server Detected Cached GET Request |
HID8044 |
Web Server Detected Cached HEAD Request |
HID8045 |
Web Server Detected Cached POST Request |
HID8046 |
Web Server Detected CHECKOUT Request |
HID8047 |
Web Server Detected DELETE Request |
HID8048 |
Web Server Detected MERGE Request |
HID8049 |
Web Server Detected MKACTIVITY Request |
HID8050 |
Web Server Detected POST Request Not Modified Code 304 |
HID8051 |
Web Server Detected OPTIONS Request |
HID8052 |
Web Server Detected PROPFIND Request |
HID8053 |
Web Server Detected PROPPATCH Request |
HID8054 |
Web Server Detected PUT Request |
HID8055 |
Web Server Detected TRACE Request |
HID8056 |
Web Server Detected TRACK Request |
HID8057 |
Web Server Detected POST Request Redirected Code 302 |
HID8058 |
Web Server Detected Invalid GET Request - Attempted Directory Traversal |
HID8059 |
Web Server Detected HEAD Request Unauthorized Code 401 |
HID8060 |
Web Server Detected HEAD Request Error Code 500 |
HID8061 |
Web Server Detected HEAD Request Gateway Timeoute Code 503 |
HID8062 |
Web Server Detected Invalid GET Request Code 400 |
HID8063 |
Web Server Detected Invalid HEAD Request Code 400 |
HID8064 |
Web Server Detected Invalid POST Request Code 400 |
HID8065 |
Web Server Detected Unknown GET Request |
HID8066 |
Web Server Detected Unknown HEAD Request |
HID8067 |
Web Server Detected Unknown POST Request |
HID8068 |
Web Server Detected Unknown Invalid Request |
HID8200 |
Web Proxy Detected Cache Hit |
HID8201 |
Web Proxy Detected Cache Miss |
HID8202 |
Web Proxy Detected Peer Connection Error |
HID8203 |
Web Proxy Failed Cache Refresh |
HID8204 |
Web Proxy Failed to Refresh Cached Web Request |
HID8205 |
Web Proxy Detected Invalid Characters in HTTP Header |
HID8206 |
Web Proxy Denied Remote Client Request |
HID8207 |
Web Proxy Detected Denied Web Request |
HID8300 |
Web Server Detected RSA Certificate CommonName Conflict |
HID8301 |
Web Server Detected Configuration File Error |
HID8302 |
Web Server Detected Undefined Variable |
HID8303 |
Web Server Detected PHP Undefined Offset |
HID8304 |
Web Server Detected Programming Error |
HID8305 |
Apache Webserver Paused Script for Determined Period of Time |
HID8306 |
Apache Webserver Unable to Identify Index |
HID8307 |
Web Server Detected SSI Configuration Error |
HID8308 |
Web Server Negotiated SSLv2 Request |
HID8309 |
Web Server Negotiated TLSv1 Request |
HID8310 |
Web Server Detected Security Warning |
HID8311 |
Web Server Denied Access Due to Server Configuration |
HID8312 |
Web Server Denied Access to Client Request |
HID8313 |
Web Server Denied HTTP Request - Invalid Permissions |
HID8314 |
Web Server Detected Errors with Active SSL Certificate |
HID8315 |
Web Server Detected Forbidden Index Request |
HID8316 |
Web Server Detected Invalid CGI Script Request |
HID8317 |
Web Server Detected Invalid File Request |
HID8318 |
Web Server Detected Invalid HTTP Method Request |
HID8319 |
Web Server Detected Invalid Script Request |
HID8320 |
Web Server Detected Invalid URI Request |
HID8321 |
Web Server Detected Malformed HTTP Host Header |
HID8322 |
Web Server Detected Oversized URI Request |
HID8323 |
Web Server Detected Premature End of Script Headers |
HID8324 |
Web Server Detected Request for Invalid File |
HID8325 |
Web Server Detected Unusuably Short Session ID |
HID8326 |
Web Server Refused CONNECT Proxy Request |
HID8327 |
Web Server Refused Connection Request |
HID8328 |
Web Server Unable to Invoke Directory as Script |
HID8329 |
Web Server Detected PHP fread() Warning |
HID8330 |
Web Server Detected Potential PHP Script Probe |
HID8331 |
Web Server Detected Application Error |
HID8332 |
Web Server Detected Application Warning |
HID8333 |
Web Server Detected Suspicious Application Alert |
2.16. UPS¶
HAWK ID |
Description |
|---|---|
HID9100 |
UPS Enabled Battery Backup Power |
HID9101 |
UPS Returned From Utilizing Battery Backup Power |
2.17. MISC¶
HAWK ID |
Description |
|---|---|
HID1600 |
Detected Potential Data Leakage |
HID4999 |
Network Device Performance Heartbeat |
HID6000 |
Detected Anomaly Present in Network Session |
HID6001 |
Arbor Networks Detected Network Protocol Anomaly |
HID6002 |
Arbor Networks Detected Specified Network Router Anomaly |
HID6003 |
Arbor Networks Detected TCP Protocol Anomaly |
HID6004 |
Arbor Networks Detected UDP Protocol Anomaly |
HID7999 |
HAWK Performance Monitoring Heartbeat |
HID9200 |
HOST-RESOURCES-MIB Host Information Trap |
HID9201 |
DISMAN-EVENT-MIB Information Trap |
HID9202 |
IF-MIB Network Interface Information Trap |
HID9203 |
IP-MIB Network Interface Information Trap |
HID9204 |
SNMPv2-MIB System Information Trap |
HIDUNKNOWN |
AAA Default Message |
HIDUNKNOWN |
AAA Unknown Error |
HIDUNKNOWN |
AAA Unknown NAS Error |
HIDUNKNOWN |
TACACS+ Denied Accounting Request From Host |
CAP1015 |
Cisco Wireless AP Entered Hot Standby Mode |
CF1001 |
Firewall AAA User Accounting Successful |
CF1001 |
Firewall Denied Inbound ICMP Network Request |
CF1001 |
Firewall Logged TCP Session Count Currently In Use |
JR1001 |
Juniper Firewall Default Message |
L15007 |
Operating System Detected TCP Connection Request |
2.18. Microsoft¶
HAWK ID |
Description |
|---|---|
MS7001 |
AlertAlert=Microsoft Windows Detected System Updates Available for Install |
MS7001 |
Microsoft Windows Browser Service Unable to Retrieve Backup |
MS7001 |
Microsoft Windows Browser Unable to Communicate with Browser Master |
MS7001 |
Microsoft Windows Detected External Drive Removed |
MS7001 |
Microsoft Windows Detected Invalid Attempted Authentication Request |
MS7001 |
Microsoft Windows Detected Live Windows Updates Available for Installation |
MS7001 |
Microsoft Windows Detected Malicious/Oversized WINS Request |
MS7001 |
Microsoft Windows Detected NTP Time Sychronization Error |
MS7001 |
Microsoft Windows Detected NTP Time Synchronization |
MS7001 |
Microsoft Windows Detected Service Pack Hotfix Installed |
MS7001 |
Microsoft Windows Detected System Updates Available for Install |
MS7001 |
Microsoft Windows Detected System Updates Require System Restart |
MS7001 |
Microsoft Windows Detected TCP Session Limit Reached |
MS7001 |
Microsoft Windows Detected Terminal Service Protocol Error |
MS7001 |
Microsoft Windows FTP Attempted Authentication Failure |
MS7001 |
Microsoft Windows New Printer Drivers Installed Successfully |
MS7001 |
Microsoft Windows Operating System Restarted |
MS7001 |
Microsoft Windows Print Job Error Detected |
MS7001 |
Microsoft Windows Print Job Failure |
MS7001 |
Microsoft Windows Print Job Started |
MS7001 |
Microsoft Windows Printer Deleted Successfully |
MS7001 |
Microsoft Windows Printer Request for Non-Existent Printer |
MS7001 |
Microsoft Windows Radius Attempted Authentication Failure - Invalid Host |
MS7001 |
Microsoft Windows Service Entered Start State |
MS7001 |
Microsoft Windows Service Entered Stop State |
MS7001 |
Microsoft Windows Service Received Start Notification |
MS7001 |
Microsoft Windows Service Received Stop Notification |
MS7001 |
Microsoft Windows Service Terminated Unexpectedly |
MS7001 |
Microsoft Windows System Error Notification |
MS7001 |
Microsoft Windows System Information Notification |
MS7001 |
Microsoft Windows System Update Completed Successfully |
MS7001 |
Microsoft Windows System Warning Notification |
MS7001 |
Microsoft Windows Terminated Process Unexpectedly |
MS7001 |
Microsoft Windows Unplanned Shutdown - Reason Detected |
2.19. System i¶
HAWK ID |
Description |
|---|---|
P1001 |
Alert=System i Message Server Transaction Request Permitted for Remote User |
P1001 |
System i Assigned Profile Token as Non-Regenerable Token |
P1001 |
System i Attempted Authentication Failure |
P1001 |
System i Attempted Authentication Failure - CHKPWD Command Failed |
P1001 |
System i Attempted Authentication Failure - Invalid Password |
P1001 |
System i Attempted Authentication Failure - Invalid Username |
P1001 |
System i Attempted Authentication Failure - SQL Decryption Password Invalid |
P1001 |
System i Began Work On Behalf of Relationship |
P1001 |
System i Client File Transfer Service Failed Request |
P1001 |
System i Client File Transfer Service Permitted Request |
P1001 |
System i Close Remote TCP Connection |
P1001 |
System i Completed Profile Swap |
P1001 |
System i Data Queue Transaction Canceled Pending Request |
P1001 |
System i Data Queue Transaction Canceled Pending Request Denied |
P1001 |
System i Data Queue Transaction Cleared Messages |
P1001 |
System i Data Queue Transaction Created Successfully |
P1001 |
System i Data Queue Transaction Created Unsuccessfully |
P1001 |
System i Data Queue Transaction Deleted Successfully |
P1001 |
System i Data Queue Transaction Deleted Unsuccessfully |
P1001 |
System i Data Queue Transaction Failed for Remote User |
P1001 |
System i Data Queue Transaction Failed to Clear Messages |
P1001 |
System i Data Queue Transaction Permitted for Remote User |
P1001 |
System i Database Server Failed Request from Remote User |
P1001 |
System i Database Server Permitted Request from Remote User |
P1001 |
System i DDM Server Transaction Failed for Remote User |
P1001 |
System i DDM Server Transaction Permitted for Remote User |
P1001 |
System i Denied Remote Access to TCP/IP Port |
P1001 |
System i Denied System Java Inheritance |
P1001 |
System i Detected A Battery Power Unit Needs To Be Replaced |
P1001 |
System i Detected A Change In A Virtual Device By QWSACCDS API |
P1001 |
System i Detected A Change In User Profile Or Group Profile Using A Profile Token |
P1001 |
System i Detected A Change Within A Profile Or Group Profile |
P1001 |
System i Detected A Change Within The Query Attributes |
P1001 |
System i Detected A Command Run After Command Substitution Took Place |
P1001 |
System i Detected A Descriptor Has Been Provided |
P1001 |
System i Detected A System Processor Failure Detected |
P1001 |
System i Detected Access or Operation Not Authorized |
P1001 |
System i Detected Access to an Unsupported Interface |
P1001 |
System i Detected All Profile Tokens Have Been Invalidated |
P1001 |
System i Detected an Inter-Process Communication Event |
P1001 |
System i Detected Attempted Authentication Failure - Invalid Password |
P1001 |
System i Detected Audit DLO Change |
P1001 |
System i Detected Audit Object Change |
P1001 |
System i Detected Authentication Logoff Request |
P1001 |
System i Detected Authentication Logon Request |
P1001 |
System i Detected Authority Broker Action Failure |
P1001 |
System i Detected Battery Power Unit Fault |
P1001 |
System i Detected Change in SETUID/SETGID or Restricted Rename |
P1001 |
System i Detected Change In Spooled Output File |
P1001 |
System i Detected Change In Subsystem Routing |
P1001 |
System i Detected Change In User Profile |
P1001 |
System i Detected Change Job Command |
P1001 |
System i Detected Change Made To Command String |
P1001 |
System i Detected Changes In Authorization List or Object Authority |
P1001 |
System i Detected CPF0907 Serious storage condition may exist |
P1001 |
System i Detected CPF111C System Scheduled To Power Down |
P1001 |
System i Detected CPF111D System is Powering Down |
P1001 |
System i Detected CPF1269 Program Start Request Received On Device Was Rejected |
P1001 |
System i Detected CPF1393 Subsystem Disabled User Profile On Device |
P1001 |
System i Detected CPF1397 Subsystem Varied Off Work Station For User |
P1001 |
System i Detected CPI0948 Mirrored Protection Is Suspended On Disk Unit |
P1001 |
System i Detected CPI0949 Mirrored Protection Suspended On Disk Unit |
P1001 |
System i Detected CPI0950 Storage Unit Now Available |
P1001 |
System i Detected CPI0953 ASP Storage Threshold Reached |
P1001 |
System i Detected CPI0955 System ASP Unprotected Storage Limit Exceeded |
P1001 |
System i Detected CPI0964 Weak Battery Condition Exists |
P1001 |
System i Detected CPI0965 Failure Of Battery Backup Feature In System Unit |
P1001 |
System i Detected CPI0966 Failure Of The Battery Backup Feature In Expansion Unit |
P1001 |
System i Detected CPI0998 Error Occurred On Disk Unit |
P1001 |
System i Detected CPI099C Critical Storage Lower Limit Reached |
P1001 |
System i Detected CPI1117 Damaged Job Schedule In Library Deleted |
P1001 |
System i Detected CPI1136 Mirrored Protection Still Suspended |
P1001 |
System i Detected CPI1153 System Password Bypass Period Ended |
P1001 |
System i Detected CPI1154 System Password Bypass Period Will End In Days |
P1001 |
System i Detected CPI1159 System Unique Identifier Will Expire With More Installs |
P1001 |
System i Detected CPI1160 System Unique Identifier Expired Or Not Valid |
P1001 |
System i Detected CPI1167 Temporary I/O Processor Error Occurred |
P1001 |
System i Detected CPI1168 Error Occurred On Disk Unit |
P1001 |
System i Detected CPI1169 Disk Unit Not Operating |
P1001 |
System i Detected CPI2209 User profile Deleted Because It Was Damaged |
P1001 |
System i Detected CPI8898 An Optical System Bus Failure |
P1001 |
System i Detected CPI8A13 QDOC Library Nearing System Object Limit |
P1001 |
System i Detected CPI8A14 QDOC library Has Exceeded System Object Limit |
P1001 |
System i Detected CPI9014 Password Received From Device Not Valid |
P1001 |
System i Detected CPI94A0 Disk Error On Device |
P1001 |
System i Detected CPI94CE Error Detected In Bus Expansion Adapter, Bus Extension Adapter, System Processor, Or Cables |
P1001 |
System i Detected CPI94CF Main Storage Card Failure Is Detected |
P1001 |
System i Detected CPI94FC Disk Error On Device |
P1001 |
System i Detected CPP0DD9 A System Processor Failure Is Detected |
P1001 |
System i Detected CPP0DDC A System Processor Error Is Detected |
P1001 |
System i Detected CPP0DDD System Processor Diagnostic Code Detected On Error |
P1001 |
System i Detected CPP0DDE A System Processor Error Is Detected |
P1001 |
System i Detected CPP0DDF A System Processor Is Missing |
P1001 |
System i Detected CPP29B0 Recovery Threshold Exceeded On Device Under Controller |
P1001 |
System i Detected CPP29B8 RAID Protection Suspended On Controller |
P1001 |
System i Detected CPP29B9 Power Protection Suspended On Controller |
P1001 |
System i Detected CPP29BA Hardware Error On Device Under Controller |
P1001 |
System i Detected CPP955E A Battery Power Unit Is Not Installed In The 9406 System Unit |
P1001 |
System i Detected CPP9589 Test Of The Battery Power Unit Is Complete |
P1001 |
System i Detected CPP9616 A Battery Power Unit Is Not Installed |
P1001 |
System i Detected Delete Operation |
P1001 |
System i Detected Discconect Job Command |
P1001 |
System i Detected Disk Error On Device |
P1001 |
System i Detected End Change Made To Adoption of Program |
P1001 |
System i Detected End Job Command |
P1001 |
System i Detected Failed Restore-Time Program Validation Check |
P1001 |
System i Detected FireCall Logged |
P1001 |
System i Detected General Purpose Audit Record Change |
P1001 |
System i Detected Hardware Storage Protection Violation |
P1001 |
System i Detected Hold Job Command |
P1001 |
System i Detected ICAPI Authorization Error |
P1001 |
System i Detected Inauthorized Request to Existing JUID Field |
P1001 |
System i Detected Intrusion Activity |
P1001 |
System i Detected Invalid Permissions |
P1001 |
System i Detected Invalid Permissions During Request |
P1001 |
System i Detected Invalid Profile Token |
P1001 |
System i Detected Java Program Adoption of Owner’s Authority |
P1001 |
System i Detected Job Description User Profile Change |
P1001 |
System i Detected Job Description With User Profile Restored |
P1001 |
System i Detected Mirrored Protection Resuming On Disk Unit |
P1001 |
System i Detected Network Logon Rejected |
P1001 |
System i Detected Network Logon Request |
P1001 |
System i Detected New Object Restored Successfully |
P1001 |
System i Detected No User ID or Password |
P1001 |
System i Detected Object Delete Was Rolled Back |
P1001 |
System i Detected Object Moved |
P1001 |
System i Detected Object Ownership Changed |
P1001 |
System i Detected Object Renamed |
P1001 |
System i Detected Object Restore Authority Change |
P1001 |
System i Detected Object Restored Successfully |
P1001 |
System i Detected Optical Object Authority Failure |
P1001 |
System i Detected Owner Change to QDFTOWN During Restore |
P1001 |
System i Detected Pending Object Create Was Rolled Back |
P1001 |
System i Detected Pending Object Delete Was Committed |
P1001 |
System i Detected Pending Object Deletion |
P1001 |
System i Detected Potential System Violation |
P1001 |
System i Detected Profile Change |
P1001 |
System i Detected Profile Token Generated By User |
P1001 |
System i Detected Program Adoption of Owner Authority Restored |
P1001 |
System i Detected Program Change - Adoption of Owner |
P1001 |
System i Detected QAUDCTL System Value Changed To *NONE |
P1001 |
System i Detected QSECOFR Password Changed (Default) |
P1001 |
System i Detected QSYGETPH API Generated Profile Handle |
P1001 |
System i Detected Restricted MI Instruction |
P1001 |
System i Detected Scan Attribute Changes (CHGATR) |
P1001 |
System i Detected Scan Exit Program Action |
P1001 |
System i Detected Service Tools User ID is Disabled |
P1001 |
System i Detected Service Tools User ID is Invalid |
P1001 |
System i Detected Service Tools User ID Password Changed |
P1001 |
System i Detected Service Tools User ID Password is Invalid |
P1001 |
System i Detected Special Authority Violation |
P1001 |
System i Detected Start Change Made To Program Adoption |
P1001 |
System i Detected Storage Overflow Recovered For ASP |
P1001 |
System i Detected Switch Extra Information |
P1001 |
System i Detected System Object Change |
P1001 |
System i Detected System Object Creation |
P1001 |
System i Detected System Object Has Been Created |
P1001 |
System i Detected System Object Has Been Replaced |
P1001 |
System i Detected System Value Change |
P1001 |
System i Detected Target User Profile Change |
P1001 |
System i Detected The Battery Power Unit In The 9406 Needs To Be Replaced |
P1001 |
System i Detected The Current Job is About To Be Interrupted |
P1001 |
System i Detected The Current Job is Attempting to Interupt Another Job |
P1001 |
System i Detected The Interruption Of The Current Job is Complete |
P1001 |
System i Detected Timed Switch Completed |
P1001 |
System i Detected Unit With Device Parity Protection Fully Operational |
P1001 |
System i Detected Unit With Device Parity Protection Not Fully Operational |
P1001 |
System i Detected Upgrade of Open Access to Existing Object |
P1001 |
System i Detected User Profile Swap Logging |
P1001 |
System i Detected Work Ending On Behalf of Relationship |
P1001 |
System i DRDA Transaction Denied SQL Connection Request |
P1001 |
System i DRDA Transaction Received SQL Connection Request |
P1001 |
System i Failed While Binding APPC |
P1001 |
System i File Server Transaction Request Failed for Remote User |
P1001 |
System i File Server Transaction Request Permitted for Remote User |
P1001 |
System i FTP Client Transaction Request Failed for Remote User |
P1001 |
System i FTP Client Transaction Request Permitted for Remote User |
P1001 |
System i FTP Remote Command (REXEC) Transaction Failed |
P1001 |
System i FTP Remote Command (REXEC) Transaction Permitted |
P1001 |
System i FTP Server Signon Request Failed for Remote User |
P1001 |
System i FTP Server Signon Request Permitted for Remote User |
P1001 |
System i FTP Server Transaction Request Failed for Remote User |
P1001 |
System i FTP Server Transaction Request Permitted for Remote User |
P1001 |
System i Has Issued A ENDJOB Command |
P1001 |
System i Has Issued An Attach Prestart Or Batch Immediate Job |
P1001 |
System i has Removed All Profile Tokens For Specified User |
P1001 |
System i HAWK Agent Default Message |
P1001 |
System i Initiated Authority Broker Swap |
P1001 |
System i Issued A Run Command |
P1001 |
System i Issued An OCL Statement |
P1001 |
System i Issued An Operator Control Command |
P1001 |
System i Issued An S/36 Procedure Command |
P1001 |
System i Issued An Utility Control Statement |
P1001 |
System i Issued CHGUSRTRC Command |
P1001 |
System i Issued ENDJOBABN Command |
P1001 |
System i License Management Central Server Denied Active Client |
P1001 |
System i License Management Central Server Denied Inactive Client |
P1001 |
System i License Management Central Server Detected Active Client |
P1001 |
System i License Management Central Server Detected Inactive Client |
P1001 |
System i License Management Central Server Failed License Retrieval |
P1001 |
System i License Management Central Server Retrieved Conversion Map |
P1001 |
System i License Management Central Server Retrieved License |
P1001 |
System i License Management Central Server Transaction Failed |
P1001 |
System i License Management Central Server Transaction Permitted |
P1001 |
System i LM Server Transaction Request Failed for Remote User |
P1001 |
System i LM Server Transaction Request Permitted for Remote User |
P1001 |
System i Message Server Transaction Request Failed for Remote User |
P1001 |
System i Message Server Transaction Request Permitted for Remote User |
P1001 |
System i Native Database Transaction Request Failed |
P1001 |
System i Native Database Transaction Request Permitted |
P1001 |
System i Network Print Service Detected Request |
P1001 |
System i Reached Maximum Number of Profile Tokens Have Been Created |
P1001 |
System i Released A Job Successfully |
P1001 |
System i Remote Command Server Failed Request |
P1001 |
System i Remote Command Server Permitted Request |
P1001 |
System i Remote Execute Command Request Failed |
P1001 |
System i Remote Execute Command Request Permitted |
P1001 |
System i RQ Server Failed Request |
P1001 |
System i RQ Server Permitted Request |
P1001 |
System i RTV Object Server Failed Request |
P1001 |
System i RTV Object Server Permitted Request |
P1001 |
System i ShowCase Analyzer Service Detected Request |
P1001 |
System i ShowCase Data Dist Service Detected Request |
P1001 |
System i ShowCase Data View Service Detected Request |
P1001 |
System i ShowCase Info Dir W JOIN Service Detected Request |
P1001 |
System i ShowCase Vista Admi Service Detected Request |
P1001 |
System i ShowCase Vista Service Detected Request |
P1001 |
System i Signon Server Failed Request from Remote User |
P1001 |
System i Signon Server Permitted Request from Remote User |
P1001 |
System i SQL Server Failed Request from Remote User |
P1001 |
System i SQL Server Permitted Request from Remote User |
P1001 |
System i Started A Job Successfully |
P1001 |
System i Submitted a Job Successfully |
P1001 |
System i Successfully Authenticated User Profile |
P1001 |
System i Telnet Server FaileFailed Request from Remote User |
P1001 |
System i Telnet Server Permitted Request from Remote User |
P1001 |
System i TFTP Service Detected Incoming File Request |
P1001 |
System i TFTP Service Detected Outgoing File Request |
P1001 |
System i Unable to Assign Invalid Profile Handle |
P1001 |
System i Updated Read-Only Option |
P1001 |
System i VPRT Service Detected Remote Request |
P1001 |
System i Workstation Gateway Signon Service Detected Request |
HB1001 |
System i BRMS Failed to Utilize Configured Volume |
HB1001 |
System i BRMS Unable To Duplicate Volumes Owned By System |
HB1001 |
System i BRMS Unable to Reclaim Volumes Owned by System |
HB1001 |
System i BRMS Unable to Specify Parallel Type For Backup Item |
HB1001 |
System i BRMS Verified One or More Volumes Successfully |
HB1001 |
System i Detected BRMS Backup Network Action |
HB1001 |
System i Detected BRMS Backup Recovery and Media Services Action |
HB1001 |
System i Detected BRMS Backup, Recovery, Media, Archive, Retrieval, and Migration Managment |
HB1001 |
System i Detected BRMS Control Group Backup Completed With Errors |
HB1001 |
System i Detected BRMS Help Index |
HB1001 |
System i Detected Objects Saved On Local System |
HB1001 |
System i Detected Subsystem Startup |
HB1002 |
System i Detected BRMS Advanced Functions Action |