Skip to content

Logsource in correlation rules

The logsource section of a correlation (detection) rule tells LogMan.io Correlator which event lanes to subscribe to. The correlator matches the rule’s logsource against logsource on tenant event lane declarations under /EventLanes/<tenant>/. If nothing matches, the rule is loaded but does not consume Kafka topics and will not fire.

When you see this Attention / error

Message (short form):

Logsource section defined by this detection rule is not matching any event lane in the library …

The UI Attention beacon is placed on the logsource line in the rule YAML. The message lists a few example logsource blocks taken from event lanes that already exist for the tenant.

What to do

  1. Open the Library and go to /EventLanes/<your-tenant>/.
  2. Open the event lane that should feed this detection (the stream whose events you want to correlate).
  3. Find the logsource section in that event lane declaration (or in the event lane template it was created from under /Templates/EventLanes/).
  4. Copy that logsource into the correlation rule (same keys and values: vendor, product, category, service, …).
  5. Save the rule. After Library reload, the correlator should resolve a Kafka topic and the Attention beacon for this problem should clear.

Example — event lane:

# /EventLanes/mytenant/fortinet-fortigate-1.yaml
define:
  type: lmio/event-lane
  name: FortiGate

logsource:
  vendor:
    - fortinet
  product:
    - fortigate
  category:
    - firewall

kafka:
  events:
    topic: events.mytenant.fortinet-fortigate-1

Same logsource on the rule:

# /Correlations/.../My FortiGate Rule.yaml
define:
  name: My FortiGate Rule
  type: correlator/match
  # ...

logsource:
  vendor:
    - fortinet
  product:
    - fortigate
  category:
    - firewall

predicate:
  # ...

Tip

Renaming only the rule file is not enough if define.name collides with another rule. For logsource mismatches, the fix is always to align logsource with an existing event lane, not to invent new vendor/product strings unless you also update the lane (or template).

If the message says there are no event lanes with a logsource under the tenant path, create or repair event lanes first (from templates), then copy logsource into the rule.

How logsource looks in a template

A typical template under /Templates/EventLanes/ defines logsource like this:

logsource:
  vendor:
    - microsoft
  product:
    - windows
  category:
    - authentication

Each key usually contains one or more strings. A few templates do not define logsource at all.

Keys in object logsource

Key What it selects
vendor Vendor or brand (e.g. microsoft, cisco)
product Product or platform (e.g. windows, fortigate)
category Broad event domain (e.g. firewall, authentication)
service Finer service-level label where templates use it (uncommon)

category (alphabetical)

access-control, anomaly, anomaly-detection, antivirus, application, audit, authentication, backup, cloud, communication, compute, connection, containerization, database, dhcp, dns, edr, email, endpoint, endpoint-security, file, file-access, firewall, ftp, hardware, healthcare-informatics, ids, intrusion-detection, intrusion_detection (same idea as intrusion-detection; both forms appear in templates), malware, management, medical-imaging, monitoring, network, network-attached-storage, oob, power, printing, proxy, scada, security, sharepoint, spam, storage, switch, system, telephony, threat-detection, ups, virtualization, voip, vpn, webserver, wifi

vendor (alphabetical)

alcatel-lucent, apache, apc, barracuda, bitdefender, bluecoat, broadcom, brother, check-point, cisco, citrix, dell, devolutions, eaton, eset, f5, fidelis, filezilla, flowmon, fortinet, gfi, gordic, haproxy, helios, hp, hpe, ibm, icewarp, innovaphone, ivanti, juniper, kerio, lenovo, manageengine, mcafee, microsoft, mikrotik, minolta, netgate, netgear, openstack, oracle, palo-alto-networks, philips, philips-healthcare, purestorage, qnap, samba, schneider-electric, sentinelone, siemens, socomec, sophos, symantec, synology, teskalabs, ubiquiti, veeam, vmware, whalebone, wowza, ysoft, zabbix, zeek, zyxel

product (alphabetical)

advanced-threat-analytics, advanced-visualization-workspace, advanced-visualization-workspace-15, apache-http-server, apc-ups, avw, bitdefender-cloud-security, bitdefender-gravityzone, brother-mfc, check-point-firewall, cisco-aci, cisco-asa, cisco-catalyst, cisco-ftd, cisco-ios, cisco-ise, cisco-mds, cisco-meraki, cisco-nexus, cisco-ucs, cisco-wlc, defender, defender-for-endpoint, dell-idrac, dell-powervault, diris, diskstation-manager, dna-center, dsm, eaton-ups, ecs, elastic-cloud-storage, eset-protect, ex-series, fidelis-endpoint, fidelis-network, flashsystem, flowmon-ads, fortianalyzer, fortiauthenticator, forticlient, fortigate, fortimail, fortimanager, fortiswitch, helios, hp-laserjet, hpe-primera, hpe-storeonce, ibm-qradar, ibm-tape-library, icewarp-mailserver, junos, kerio-connect, kubernetes, linux, logmanio, m365, manageengine-ad-audit-plus, manageengine-endpoint, mcafee-webwasher, microsoft-dhcp, microsoft-dns, microsoft-exchange, microsoft-iis, microsoft-sharepoint, microsoft-sql, minolta-bizhub, nas, net-vision, netapp, netscaler, network-policy-server, nginx, nova, nps, ntopng, omniswitch, openvpn, oracle-cloud, oracle-listener, oracle-spark, pan-os, pbx, pfsense, qfx-series, qnap-nas, samba-ad-dc, secure-email-gateway, sentinelone, siemens-scalance, software-defined-access, spectrum-scale, squid, srx-series, storwize, switch, synology-nas, ubiquiti-unifi, ups, veeam-backup-replication, vmware-cloud-director, vmware-esxi, vmware-vcenter, windows, wowza-streaming-engine, ysoft-safeq, zabbix, zeek-analyzer, zeek-conn, zeek-dns, zeek-files, zeek-http, zeek-kerberos, zeek-ldapsearch, zeek-mqttconnect, zeek-mqttpublish, zeek-ntp, zeek-ocsp, zeek-pe, zeek-quic, zeek-radius, zeek-sip, zeek-smtp, zeek-snmp, zeek-ssh, zeek-ssl, zeek-syslog, zeek-tunnel, zeek-weird, zeek-x509, zyxel-firewall, zyxel-switch

service (alphabetical)

Used only in some templates (often Microsoft-related): aaa, auditd, messagetrace, syslog

Scalar logsource in correlation rules

In /Correlations/ you may also see a single value instead of an object, for example:

logsource: complex

Values such as base, complex, or activity choose which class of input the rule consumes. They are not the same as the template vendor / product lists above.

Object logsource in correlation rules

When you filter by lane classification, use the same keys as in templates (vendor, product, category, service, …) and pick values from the lists on this page or from the event lane that matches your stream. If you need a value that is not listed yet, extend the corresponding template in /Templates/EventLanes/ first so parsing and correlation stay in sync.

See also

Sigma uses a related but different logsource model. For Sigma’s category, product, and service conventions, see Log sources.