Application
The application category contains events that are related to application activity, such as email or FTP activity.
The following table describes the low-level event categories and associated severity levels for the application category.
| Low-level event category | Category ID | Description | Severity level (0 - 10) |
|---|---|---|---|
| Mail Opened | 18001 | Indicates that an email connection was established. | 1 |
| Mail Closed | 18002 | Indicates that an email connection was closed. | 1 |
| Mail Reset | 18003 | Indicates that an email connection was reset. | 3 |
| Mail Terminated | 18004 | Indicates that an email connection was terminated. | 4 |
| Mail Denied | 18005 | Indicates that an email connection was denied. | 4 |
| Mail in Progress | 18006 | Indicates that an email connection is being attempted. | 1 |
| Mail Delayed | 18007 | Indicates that an email connection was delayed. | 4 |
| Mail Queued | 18008 | Indicates that an email connection was queued. | 3 |
| Mail Redirected | 18009 | Indicates that an email connection was redirected. | 1 |
| FTP Opened | 18010 | Indicates that an FTP connection was opened. | 1 |
| FTP Closed | 18011 | Indicates that an FTP connection was closed. | 1 |
| FTP Reset | 18012 | Indicates that an FTP connection was reset. | 3 |
| FTP Terminated | 18013 | Indicates that an FTP connection was terminated. | 4 |
| FTP Denied | 18014 | Indicates that an FTP connection was denied. | 4 |
| FTP In Progress | 18015 | Indicates that an FTP connection is in progress. | 1 |
| FTP Redirected | 18016 | Indicates that an FTP connection was redirected. | 3 |
| HTTP Opened | 18017 | Indicates that an HTTP connection was established. | 1 |
| HTTP Closed | 18018 | Indicates that an HTTP connection was closed. | 1 |
| HTTP Reset | 18019 | Indicates that an HTTP connection was reset. | 3 |
| HTTP Terminated | 18020 | Indicates that an HTTP connection was terminated. | 4 |
| HTTP Denied | 18021 | Indicates that an HTTP connection was denied. | 4 |
| HTTP In Progress | 18022 | Indicates that an HTTP connection is in progress. | 1 |
| HTTP Delayed | 18023 | Indicates that an HTTP connection was delayed. | 3 |
| HTTP Queued | 18024 | Indicates that an HTTP connection was queued. | 1 |
| HTTP Redirected | 18025 | Indicates that an HTTP connection was redirected. | 1 |
| HTTP Proxy | 18026 | Indicates that an HTTP connection is being proxied. | 1 |
| HTTPS Opened | 18027 | Indicates that an HTTPS connection was established. | 1 |
| HTTPS Closed | 18028 | Indicates that an HTTPS connection was closed. | 1 |
| HTTPS Reset | 18029 | Indicates that an HTTPS connection was reset. | 3 |
| HTTPS Terminated | 18030 | Indicates that an HTTPS connection was terminated. | 4 |
| HTTPS Denied | 18031 | Indicates that an HTTPS connection was denied. | 4 |
| HTTPS In Progress | 18032 | Indicates that an HTTPS connection is in progress. | 1 |
| HTTPS Delayed | 18033 | Indicates that an HTTPS connection was delayed. | 3 |
| HTTPS Queued | 18034 | Indicates that an HTTPS connection was queued. | 3 |
| HTTPS Redirected | 18035 | Indicates that an HTTPS connection was redirected. | 3 |
| HTTPS Proxy | 18036 | Indicates that an HTTPS connection is proxied. | 1 |
| SSH Opened | 18037 | Indicates that an SSH connection was established. | 1 |
| SSH Closed | 18038 | Indicates that an SSH connection was closed. | 1 |
| SSH Reset | 18039 | Indicates that an SSH connection was reset. | 3 |
| SSH Terminated | 18040 | Indicates that an SSH connection was terminated. | 4 |
| SSH Denied | 18041 | Indicates that an SSH session was denied. | 4 |
| SSH In Progress | 18042 | Indicates that an SSH session is in progress. | 1 |
| RemoteAccess Opened | 18043 | Indicates that a remote access connection was established. | 1 |
| RemoteAccess Closed | 18044 | Indicates that a remote access connection was closed. | 1 |
| RemoteAccess Reset | 18045 | Indicates that a remote access connection was reset. | 3 |
| RemoteAccess Terminated | 18046 | Indicates that a remote access connection was terminated. | 4 |
| RemoteAccess Denied | 18047 | Indicates that a remote access connection was denied. | 4 |
| RemoteAccess In Progress | 18048 | Indicates that a remote access connection is in progress. | 1 |
| RemoteAccess Delayed | 18049 | Indicates that a remote access connection was delayed. | 3 |
| RemoteAccess Redirected | 18050 | Indicates that a remote access connection was redirected. | 3 |
| VPN Opened | 18051 | Indicates that a VPN connection was opened. | 1 |
| VPN Closed | 18052 | Indicates that a VPN connection was closed. | 1 |
| VPN Reset | 18053 | Indicates that a VPN connection was reset. | 3 |
| VPN Terminated | 18054 | Indicates that a VPN connection was terminated. | 4 |
| VPN Denied | 18055 | Indicates that a VPN connection was denied. | 4 |
| VPN In Progress | 18056 | Indicates that a VPN connection is in progress. | 1 |
| VPN Delayed | 18057 | Indicates that a VPN connection was delayed | 3 |
| VPN Queued | 18058 | Indicates that a VPN connection was queued. | 3 |
| VPN Redirected | 18059 | Indicates that a VPN connection was redirected. | 3 |
| RDP Opened | 18060 | Indicates that an RDP connection was established. | 1 |
| RDP Closed | 18061 | Indicates that an RDP connection was closed. | 1 |
| RDP Reset | 18062 | Indicates that an RDP connection was reset. | 3 |
| RDP Terminated | 18063 | Indicates that an RDP connection was terminated. | 4 |
| RDP Denied | 18064 | Indicates that an RDP connection was denied. | 4 |
| RDP In Progress | 18065 | Indicates that an RDP connection is in progress. | 1 |
| RDP Redirected | 18066 | Indicates that an RDP connection was redirected. | 3 |
| FileTransfer Opened | 18067 | Indicates that a file transfer connection was established. | 1 |
| FileTransfer Closed | 18068 | Indicates that a file transfer connection was closed. | 1 |
| FileTransfer Reset | 18069 | Indicates that a file transfer connection was reset. | 3 |
| FileTransfer Terminated | 18070 | Indicates that a file transfer connection was terminated. | 4 |
| FileTransfer Denied | 18071 | Indicates that a file transfer connection was denied. | 4 |
| FileTransfer In Progress | 18072 | Indicates that a file transfer connection is in progress. | 1 |
| FileTransfer Delayed | 18073 | Indicates that a file transfer connection was delayed. | 3 |
| FileTransfer Queued | 18074 | Indicates that a file transfer connection was queued. | 3 |
| FileTransfer Redirected | 18075 | Indicates that a file transfer connection was redirected. | 3 |
| DNS Opened | 18076 | Indicates that a DNS connection was established. | 1 |
| DNS Closed | 18077 | Indicates that a DNS connection was closed. | 1 |
| DNS Reset | 18078 | Indicates that a DNS connection was reset. | 5 |
| DNS Terminated | 18079 | Indicates that a DNS connection was terminated. | 5 |
| DNS Denied | 18080 | Indicates that a DNS connection was denied. | 5 |
| DNS In Progress | 18081 | Indicates that a DNS connection is in progress. | 1 |
| DNS Delayed | 18082 | Indicates that a DNS connection was delayed. | 5 |
| DNS Redirected | 18083 | Indicates that a DNS connection was redirected. | 4 |
| Chat Opened | 18084 | Indicates that a chat connection was opened. | 1 |
| Chat Closed | 18085 | Indicates that a chat connection was closed. | 1 |
| Chat Reset | 18086 | Indicates that a chat connection was reset. | 3 |
| Chat Terminated | 18087 | Indicates that a chat connection was terminated. | 3 |
| Chat Denied | 18088 | Indicates that a chat connection was denied. | 3 |
| Chat In Progress | 18089 | Indicates that a chat connection is in progress. | 1 |
| Chat Redirected | 18090 | Indicates that a chat connection was redirected. | 1 |
| Database Opened | 18091 | Indicates that a database connection was established. | 1 |
| Database Closed | 18092 | Indicates that a database connection was closed. | 1 |
| Database Reset | 18093 | Indicates that a database connection was reset. | 5 |
| Database Terminated | 18094 | Indicates that a database connection was terminated. | 5 |
| Database Denied | 18095 | Indicates that a database connection was denied. | 5 |
| Database In Progress | 18096 | Indicates that a database connection is in progress. | 1 |
| Database Redirected | 18097 | Indicates that a database connection was redirected. | 3 |
| SMTP Opened | 18098 | Indicates that an SMTP connection was established. | 1 |
| SMTP Closed | 18099 | Indicates that an SMTP connection was closed. | 1 |
| SMTP Reset | 18100 | Indicates that an SMTP connection was reset. | 3 |
| SMTP Terminated | 18101 | Indicates that an SMTP connection was terminated. | 5 |
| SMTP Denied | 18102 | Indicates that an SMTP connection was denied. | 5 |
| SMTP In Progress | 18103 | Indicates that an SMTP connection is in progress. | 1 |
| SMTP Delayed | 18104 | Indicates that an SMTP connection was delayed. | 3 |
| SMTP Queued | 18105 | Indicates that an SMTP connection was queued. | 3 |
| SMTP Redirected | 18106 | Indicates that an SMTP connection was redirected. | 3 |
| Auth Opened | 18107 | Indicates that an authorization server connection was established. | 1 |
| Auth Closed | 18108 | Indicates that an authorization server connection was closed. | 1 |
| Auth Reset | 18109 | Indicates that an authorization server connection was reset. | 3 |
| Auth Terminated | 18110 | Indicates that an authorization server connection was terminated. | 4 |
| Auth Denied | 18111 | Indicates that an authorization server connection was denied. | 4 |
| Auth In Progress | 18112 | Indicates that an authorization server connection is in progress. | 1 |
| Auth Delayed | 18113 | Indicates that an authorization server connection was delayed. | 3 |
| Auth Queued | 18114 | Indicates that an authorization server connection was queued. | 3 |
| Auth Redirected | 18115 | Indicates that an authorization server connection was redirected. | 2 |
| P2P Opened | 18116 | Indicates that a Peer-to-Peer (P2P) connection was established. | 1 |
| P2P Closed | 18117 | Indicates that a P2P connection was closed. | 1 |
| P2P Reset | 18118 | Indicates that a P2P connection was reset. | 4 |
| P2P Terminated | 18119 | Indicates that a P2P connection was terminated. | 4 |
| P2P Denied | 18120 | Indicates that a P2P connection was denied. | 3 |
| P2P In Progress | 18121 | Indicates that a P2P connection is in progress. | 1 |
| Web Opened | 18122 | Indicates that a web connection was established. | 1 |
| Web Closed | 18123 | Indicates that a web connection was closed. | 1 |
| Web Reset | 18124 | Indicates that a web connection was reset. | 4 |
| Web Terminated | 18125 | Indicates that a web connection was terminated. | 4 |
| Web Denied | 18126 | Indicates that a web connection was denied. | 4 |
| Web In Progress | 18127 | Indicates that a web connection is in progress. | 1 |
| Web Delayed | 18128 | Indicates that a web connection was delayed. | 3 |
| Web Queued | 18129 | Indicates that a web connection was queued. | 1 |
| Web Redirected | 18130 | Indicates that a web connection was redirected. | 1 |
| Web Proxy | 18131 | Indicates that a web connection was proxied. | 1 |
| VoIP Opened | 18132 | Indicates that a Voice Over IP (VoIP) connection was established. | 1 |
| VoIP Closed | 18133 | Indicates that a VoIP connection was closed. | 1 |
| VoIP Reset | 18134 | Indicates that a VoIP connection was reset. | 3 |
| VoIP Terminated | 18135 | Indicates that a VoIP connection was terminated. | 3 |
| VoIP Denied | 18136 | Indicates that a VoIP connection was denied. | 3 |
| VoIP In Progress | 18137 | Indicates that a VoIP connection is in progress. | 1 |
| VoIP Delayed | 18138 | Indicates that a VoIP connection was delayed. | 3 |
| VoIP Redirected | 18139 | Indicates that a VoIP connection was redirected. | 3 |
| LDAP Session Started | 18140 | Indicates an LDAP session started. | 1 |
| LDAP Session Ended | 18141 | Indicates an LDAP session ended. | 1 |
| LDAP Session Denied | 18142 | Indicates that an LDAP session was denied. | 3 |
| LDAP Session Status | 18143 | Indicates that an LDAP session status message was reported. | 1 |
| LDAP Authentication Failed | 18144 | Indicates that an LDAP authentication failed. | 4 |
| LDAP Authentication Succeeded | 18145 | Indicates that an LDAP authentication was successful. | 1 |
| AAA Session Started | 18146 | Indicates that an Authentication, Authorization, and Accounting (AAA) session started. | 1 |
| AAA Session Ended | 18147 | Indicates that an AAA session ended. | 1 |
| AAA Session Denied | 18148 | Indicates that an AAA session was denied. | 3 |
| AAA Session Status | 18149 | Indicates that an AAA session status message was reported. | 1 |
| AAA Authentication Failed | 18150 | Indicates that an AAA authentication failed. | 4 |
| AAA Authentication Succeeded | 18151 | Indicates that an AAA authentication was successful. | 1 |
| IPSEC Authentication Failed | 18152 | Indicates that an Internet Protocol Security (IPSEC) authentication failed. | 4 |
| IPSEC Authentication Succeeded | 18153 | Indicates that an IPSEC authentication was successful. | 1 |
| IPSEC Session Started | 18154 | Indicates that an IPSEC session started. | 1 |
| IPSEC Session Ended | 18155 | Indicates that an IPSEC session ended. | 1 |
| IPSEC Error | 18156 | Indicates that an IPSEC error message was reported. | 5 |
| IPSEC Status | 18157 | Indicates that an IPSEC session status message was reported. | 1 |
| IM Session Opened | 18158 | Indicates that an Instant Messenger (IM) session was established. | 1 |
| IM Session Closed | 18159 | Indicates that an IM session was closed. | 1 |
| IM Session Reset | 18160 | Indicates that an IM session was reset. | 3 |
| IM Session Terminated | 18161 | Indicates that an IM session was terminated. | 3 |
| IM Session Denied | 18162 | Indicates that an IM session was denied. | 3 |
| IM Session In Progress | 18163 | Indicates that an IM session is in progress. | 1 |
| IM Session Delayed | 18164 | Indicates that an IM session was delayed | 3 |
| IM Session Redirected | 18165 | Indicates that an IM session was redirected. | 3 |
| WHOIS Session Opened | 18166 | Indicates that a WHOIS session was established. | 1 |
| WHOIS Session Closed | 18167 | Indicates that a WHOIS session was closed. | 1 |
| WHOIS Session Reset | 18168 | Indicates that a WHOIS session was reset. | 3 |
| WHOIS Session Terminated | 18169 | Indicates that a WHOIS session was terminated. | 3 |
| WHOIS Session Denied | 18170 | Indicates that a WHOIS session was denied. | 3 |
| WHOIS Session In Progress | 18171 | Indicates that a WHOIS session is in progress. | 1 |
| WHOIS Session Redirected | 18172 | Indicates that a WHOIS session was redirected. | 3 |
| Traceroute Session Opened | 18173 | Indicates that a Traceroute session was established. | 1 |
| Traceroute Session Closed | 18174 | Indicates that a Traceroute session was closed. | 1 |
| Traceroute Session Denied | 18175 | Indicates that a Traceroute session was denied. | 3 |
| Traceroute Session In Progress | 18176 | Indicates that a Traceroute session is in progress. | 1 |
| TN3270 Session Opened | 18177 | TN3270 is a terminal emulation program, which is used to connect to an IBM® 3270 terminal. This category indicates that a TN3270 session was established. | 1 |
| TN3270 Session Closed | 18178 | Indicates that a TN3270 session was closed. | 1 |
| TN3270 Session Reset | 18179 | Indicates that a TN3270 session was reset. | 3 |
| TN3270 Session Terminated | 18180 | Indicates that a TN3270 session was terminated. | 3 |
| TN3270 Session Denied | 18181 | Indicates that a TN3270 session was denied. | 3 |
| TN3270 Session In Progress | 18182 | Indicates that a TN3270 session is in progress. | 1 |
| TFTP Session Opened | 18183 | Indicates that a TFTP session was established. | 1 |
| TFTP Session Closed | 18184 | Indicates that a TFTP session was closed. | 1 |
| TFTP Session Reset | 18185 | Indicates that a TFTP session was reset. | 3 |
| TFTP Session Terminated | 18186 | Indicates that a TFTP session was terminated. | 3 |
| TFTP Session Denied | 18187 | Indicates that a TFTP session was denied. | 3 |
| TFTP Session In Progress | 18188 | Indicates that a TFTP session is in progress. | 1 |
| Telnet Session Opened | 18189 | Indicates that a Telnet session was established. | 1 |
| Telnet Session Closed | 18190 | Indicates that a Telnet session was closed. | 1 |
| Telnet Session Reset | 18191 | Indicates that a Telnet session was reset. | 3 |
| Telnet Session Terminated | 18192 | Indicates that a Telnet session was terminated. | 3 |
| Telnet Session Denied | 18193 | Indicates that a Telnet session was denied. | 3 |
| Telnet Session In Progress | 18194 | Indicates that a Telnet session is in progress. | 1 |
| Syslog Session Opened | 18201 | Indicates that a syslog session was established. | 1 |
| Syslog Session Closed | 18202 | Indicates that a syslog session was closed. | 1 |
| Syslog Session Denied | 18203 | Indicates that a syslog session was denied. | 3 |
| Syslog Session In Progress | 18204 | Indicates that a syslog session is in progress. | 1 |
| SSL Session Opened | 18205 | Indicates that a Secure Socket Layer (SSL) session was established. | 1 |
| SSL Session Closed | 18206 | Indicates that an SSL session was closed. | 1 |
| SSL Session Reset | 18207 | Indicates that an SSL session was reset. | 3 |
| SSL Session Terminated | 18208 | Indicates that an SSL session was terminated. | 3 |
| SSL Session Denied | 18209 | Indicates that an SSL session was denied. | 3 |
| SSL Session In Progress | 18210 | Indicates that an SSL session is in progress. | 1 |
| SNMP Session Opened | 18211 | Indicates that a Simple Network Management Protocol (SNMP) session was established. | 1 |
| SNMP Session Closed | 18212 | Indicates that an SNMP session was closed. | 1 |
| SNMP Session Denied | 18213 | Indicates that an SNMP session was denied. | 3 |
| SNMP Session In Progress | 18214 | Indicates that an SNMP session is in progress. | 1 |
| SMB Session Opened | 18215 | Indicates that a Server Message Block (SMB) session was established. | 1 |
| SMB Session Closed | 18216 | Indicates that an SMB session was closed. | 1 |
| SMB Session Reset | 18217 | Indicates that an SMB session was reset. | 3 |
| SMB Session Terminated | 18218 | Indicates that an SMB session was terminated. | 3 |
| SMB Session Denied | 18219 | Indicates that an SMB session was denied. | 3 |
| SMB Session In Progress | 18220 | Indicates that an SMB session is in progress. | 1 |
| Streaming Media Session Opened | 18221 | Indicates that a Streaming Media session was established. | 1 |
| Streaming Media Session Closed | 18222 | Indicates that a Streaming Media session was closed. | 1 |
| Streaming Media Session Reset | 18223 | Indicates that a Streaming Media session was reset. | 3 |
| Streaming Media Session Terminated | 18224 | Indicates that a Streaming Media session was terminated. | 3 |
| Streaming Media Session Denied | 18225 | Indicates that a Streaming Media session was denied. | 3 |
| Streaming Media Session In Progress | 18226 | Indicates that a Streaming Media session is in progress. | 1 |
| RUSERS Session Opened | 18227 | Indicates that a (Remote Users) RUSERS session was established. | 1 |
| RUSERS Session Closed | 18228 | Indicates that a RUSERS session was closed. | 1 |
| RUSERS Session Denied | 18229 | Indicates that a RUSERS session was denied. | 3 |
| RUSERS Session In Progress | 18230 | Indicates that a RUSERS session is in progress. | 1 |
| Rsh Session Opened | 18231 | Indicates that a remote shell (rsh) session was established. | 1 |
| Rsh Session Closed | 18232 | Indicates that an rsh session was closed. | 1 |
| Rsh Session Reset | 18233 | Indicates that an rsh session was reset. | 3 |
| Rsh Session Terminated | 18234 | Indicates that an rsh session was terminated. | 3 |
| Rsh Session Denied | 18235 | Indicates that an rsh session was denied. | 3 |
| Rsh Session In Progress | 18236 | Indicates that an rsh session is in progress. | 1 |
| RLOGIN Session Opened | 18237 | Indicates that a Remote Login (RLOGIN) session was established. | 1 |
| RLOGIN Session Closed | 18238 | Indicates that an RLOGIN session was closed. | 1 |
| RLOGIN Session Reset | 18239 | Indicates that an RLOGIN session was reset. | 3 |
| RLOGIN Session Terminated | 18240 | Indicates that an RLOGIN session was terminated. | 3 |
| RLOGIN Session Denied | 18241 | Indicates that an RLOGIN session was denied. | 3 |
| RLOGIN Session In Progress | 18242 | Indicates that an RLOGIN session is in progress. | 1 |
| REXEC Session Opened | 18243 | Indicates that a (Remote Execution) REXEC session was established. | 1 |
| REXEC Session Closed | 18244 | Indicates that an REXEC session was closed. | 1 |
| REXEC Session Reset | 18245 | Indicates that an REXEC session was reset. | 3 |
| REXEC Session Terminated | 18246 | Indicates that an REXEC session was terminated. | 3 |
| REXEC Session Denied | 18247 | Indicates that an REXEC session was denied. | 3 |
| REXEC Session In Progress | 18248 | Indicates that an REXEC session is in progress. | 1 |
| RPC Session Opened | 18249 | Indicates that a Remote Procedure Call (RPC) session was established. | 1 |
| RPC Session Closed | 18250 | Indicates that an RPC session was closed. | 1 |
| RPC Session Reset | 18251 | Indicates that an RPC session was reset. | 3 |
| RPC Session Terminated | 18252 | Indicates that an RPC session was terminated. | 3 |
| RPC Session Denied | 18253 | Indicates that an RPC session was denied. | 3 |
| RPC Session In Progress | 18254 | Indicates that an RPC session is in progress. | 1 |
| NTP Session Opened | 18255 | Indicates that a Network Time Protocol (NTP) session was established. | 1 |
| NTP Session Closed | 18256 | Indicates that an NTP session was closed. | 1 |
| NTP Session Reset | 18257 | Indicates that an NTP session was reset. | 3 |
| NTP Session Terminated | 18258 | Indicates that an NTP session was terminated. | 3 |
| NTP Session Denied | 18259 | Indicates that an NTP session was denied. | 3 |
| NTP Session In Progress | 18260 | Indicates that an NTP session is in progress. | 1 |
| NNTP Session Opened | 18261 | Indicates that a Network News Transfer Protocol (NNTP) session was established. | 1 |
| NNTP Session Closed | 18262 | Indicates that an NNTP session was closed. | 1 |
| NNTP Session Reset | 18263 | Indicates that an NNTP session was reset. | 3 |
| NNTP Session Terminated | 18264 | Indicates that an NNTP session was terminated. | 3 |
| NNTP Session Denied | 18265 | Indicates that an NNTP session was denied. | 3 |
| NNTP Session In Progress | 18266 | Indicates that an NNTP session is in progress. | 1 |
| NFS Session Opened | 18267 | Indicates that a Network File System (NFS) session was established. | 1 |
| NFS Session Closed | 18268 | Indicates that an NFS session was closed. | 1 |
| NFS Session Reset | 18269 | Indicates that an NFS session was reset. | 3 |
| NFS Session Terminated | 18270 | Indicates that an NFS session was terminated. | 3 |
| NFS Session Denied | 18271 | Indicates that an NFS session was denied. | 3 |
| NFS Session In Progress | 18272 | Indicates that an NFS session is in progress. | 1 |
| NCP Session Opened | 18273 | Indicates that a Network Control Program (NCP) session was established. | 1 |
| NCP Session Closed | 18274 | Indicates that an NCP session was closed. | 1 |
| NCP Session Reset | 18275 | Indicates that an NCP session was reset. | 3 |
| NCP Session Terminated | 18276 | Indicates that an NCP session was terminated. | 3 |
| NCP Session Denied | 18277 | Indicates that an NCP session was denied. | 3 |
| NCP Session In Progress | 18278 | Indicates that an NCP session is in progress. | 1 |
| NetBIOS Session Opened | 18279 | Indicates that a NetBIOS session was established. | 1 |
| NetBIOS Session Closed | 18280 | Indicates that a NetBIOS session was closed. | 1 |
| NetBIOS Session Reset | 18281 | Indicates that a NetBIOS session was reset. | 3 |
| NetBIOS Session Terminated | 18282 | Indicates that a NetBIOS session was terminated. | 3 |
| NetBIOS Session Denied | 18283 | Indicates that a NetBIOS session was denied. | 3 |
| NetBIOS Session In Progress | 18284 | Indicates that a NetBIOS session is in progress. | 1 |
| MODBUS Session Opened | 18285 | Indicates that a MODBUS session was established. | 1 |
| MODBUS Session Closed | 18286 | Indicates that a MODBUS session was closed. | 1 |
| MODBUS Session Reset | 18287 | Indicates that a MODBUS session was reset. | 3 |
| MODBUS Session Terminated | 18288 | Indicates that a MODBUS session was terminated. | 3 |
| MODBUS Session Denied | 18289 | Indicates that a MODBUS session was denied. | 3 |
| MODBUS Session In Progress | 18290 | Indicates that a MODBUS session is in progress. | 1 |
| LPD Session Opened | 18291 | Indicates that a Line Printer Daemon (LPD) session was established. | 1 |
| LPD Session Closed | 18292 | Indicates that an LPD session was closed. | 1 |
| LPD Session Reset | 18293 | Indicates that an LPD session was reset. | 3 |
| LPD Session Terminated | 18294 | Indicates that an LPD session was terminated. | 3 |
| LPD Session Denied | 18295 | Indicates that an LPD session was denied. | 3 |
| LPD Session In Progress | 18296 | Indicates that an LPD session is in progress. | 1 |
| Lotus Notes Session Opened | 18297 | Indicates that a Lotus Notes session was established. | 1 |
| Lotus Notes Session Closed | 18298 | Indicates that a Lotus Notes session was closed. | 1 |
| Lotus Notes Session Reset | 18299 | Indicates that a Lotus Notes session was reset. | 3 |
| Lotus Notes Session Terminated | 18300 | Indicates that a Lotus Notes session was terminated. | 3 |
| Lotus Notes Session Denied | 18301 | Indicates that a Lotus Notes session was denied. | 3 |
| Lotus Notes Session In Progress | 18302 | Indicates that a Lotus Notes session is in progress. | 1 |
| Kerberos Session Opened | 18303 | Indicates that a Kerberos session was established. | 1 |
| Kerberos Session Closed | 18304 | Indicates that a Kerberos session was closed. | 1 |
| Kerberos Session Reset | 18305 | Indicates that a Kerberos session was reset. | 3 |
| Kerberos Session Terminated | 18306 | Indicates that a Kerberos session was terminated. | 3 |
| Kerberos Session Denied | 18307 | Indicates that a Kerberos session was denied. | 3 |
| Kerberos Session In Progress | 18308 | Indicates that a Kerberos session is in progress. | 1 |
| IRC Session Opened | 18309 | Indicates that an Internet Relay Chat (IRC) session was established. | 1 |
| IRC Session Closed | 18310 | Indicates that an IRC session was closed. | 1 |
| IRC Session Reset | 18311 | Indicates that an IRC session was reset. | 3 |
| IRC Session Terminated | 18312 | Indicates that an IRC session was terminated. | 3 |
| IRC Session Denied | 18313 | Indicates that an IRC session was denied. | 3 |
| IRC Session In Progress | 18314 | Indicates that an IRC session is in progress. | 1 |
| IEC 104 Session Opened | 18315 | Indicates that an IEC 104 session was established. | 1 |
| IEC 104 Session Closed | 18316 | Indicates that an IEC 104 session was closed. | 1 |
| IEC 104 Session Reset | 18317 | Indicates that an IEC 104 session was reset. | 3 |
| IEC 104 Session Terminated | 18318 | Indicates that an IEC 104 session was terminated. | 3 |
| IEC 104 Session Denied | 18319 | Indicates that an IEC 104 session was denied. | 3 |
| IEC 104 Session In Progress | 18320 | Indicates that an IEC 104 session is in progress. | 1 |
| Ident Session Opened | 18321 | Indicates that a TCP Client Identity Protocol (Ident) session was established. | 1 |
| Ident Session Closed | 18322 | Indicates that an Ident session was closed. | 1 |
| Ident Session Reset | 18323 | Indicates that an Ident session was reset. | 3 |
| Ident Session Terminated | 18324 | Indicates that an Ident session was terminated. | 3 |
| Ident Session Denied | 18325 | Indicates that an Ident session was denied. | 3 |
| Ident Session In Progress | 18326 | Indicates that an Ident session is in progress. | 1 |
| ICCP Session Opened | 18327 | Indicates that an Inter-Control Center Communications Protocol (ICCP) session was established. | 1 |
| ICCP Session Closed | 18328 | Indicates that an ICCP session was closed. | 1 |
| ICCP Session Reset | 18329 | Indicates that an ICCP session was reset. | 3 |
| ICCP Session Terminated | 18330 | Indicates that an ICCP session was terminated. | 3 |
| ICCP Session Denied | 18331 | Indicates that an ICCP session was denied. | 3 |
| ICCP Session In Progress | 18332 | Indicates that an ICCP session is in progress. | 1 |
| GroupWiseSession Opened | 18333 | Indicates that a GroupWisesession was established. | 1 |
| GroupWiseSession Closed | 18334 | Indicates that a GroupWise session was closed. | 1 |
| GroupWiseSession Reset | 18335 | Indicates that a GroupWisesession was reset. | 3 |
| GroupWiseSession Terminated | 18336 | Indicates that a GroupWisesession was terminated. | 3 |
| GroupWiseSession Denied | 18337 | Indicates that a GroupWise session was denied. | 3 |
| GroupWiseSession In Progress | 18338 | Indicates that a GroupWise session is in progress. | 1 |
| Gopher Session Opened | 183398 | Indicates that a Gopher session was established. | 1 |
| Gopher Session Closed | 18340 | Indicates that a Gopher session was closed. | 1 |
| Gopher Session Reset | 18341 | Indicates that a Gopher session was reset. | 3 |
| Gopher Session Terminated | 18342 | Indicates that a Gopher session was terminated. | 3 |
| Gopher Session Denied | 18343 | Indicates that a Gopher session was denied. | 3 |
| Gopher Session In Progress | 18344 | Indicates that a Gopher session is in progress. | 1 |
| GIOP Session Opened | 18345 | Indicates that a General Inter-ORB Protocol (GIOP) session was established. | 1 |
| GIOP Session Closed | 18346 | Indicates that a GIOP session was closed. | 1 |
| GIOP Session Reset | 18347 | Indicates that a GIOP session was reset. | 3 |
| GIOP Session Terminated | 18348 | Indicates that a GIOP session was terminated. | 3 |
| GIOP Session Denied | 18349 | Indicates that a GIOP session was denied. | 3 |
| GIOP Session In Progress | 18350 | Indicates that a GIOP session is in progress. | 1 |
| Finger Session Opened | 18351 | Indicates that a Finger session was established. | 1 |
| Finger Session Closed | 18352 | Indicates that a Finger session was closed. | 1 |
| Finger Session Reset | 18353 | Indicates that a Finger session was reset. | 3 |
| Finger Session Terminated | 18354 | Indicates that a Finger session was terminated. | 3 |
| Finger Session Denied | 18355 | Indicates that a Finger session was denied. | 3 |
| Finger Session In Progress | 18356 | Indicates that a Finger session is in progress. | 1 |
| Echo Session Opened | 18357 | Indicates that an Echo session was established. | 1 |
| Echo Session Closed | 18358 | Indicates that an Echo session was closed. | 1 |
| Echo Session Denied | 18359 | Indicates that an Echo session was denied. | 3 |
| Echo Session In Progress | 18360 | Indicates that an Echo session is in progress. | 1 |
| Remote .NET Session Opened | 18361 | Indicates that a Remote .NET session was established. | 1 |
| Remote .NET Session Closed | 18362 | Indicates that a Remote .NET session was closed. | 1 |
| Remote .NET Session Reset | 18363 | Indicates that a Remote .NET session was reset. | 3 |
| Remote .NET Session Terminated | 18364 | Indicates that a Remote .NET session was terminated. | 3 |
| Remote .NET Session Denied | 18365 | Indicates that a Remote .NET session was denied. | 3 |
| Remote .NET Session In Progress | 18366 | Indicates that a Remote .NET session is in progress. | 1 |
| DNP3 Session Opened | 18367 | Indicates that a Distributed Network Proctologic (DNP3) session was established. | 1 |
| DNP3 Session Closed | 18368 | Indicates that a DNP3 session was closed. | 1 |
| DNP3 Session Reset | 18369 | Indicates that a DNP3 session was reset. | 3 |
| DNP3 Session Terminated | 18370 | Indicates that a DNP3 session was terminated. | 3 |
| DNP3 Session Denied | 18371 | Indicates that a DNP3 session was denied. | 3 |
| DNP3 Session In Progress | 18372 | Indicates that a DNP3 session is in progress. | 1 |
| Discard Session Opened | 18373 | Indicates that a Discard session was established. | 1 |
| Discard Session Closed | 18374 | Indicates that a Discard session was closed. | 1 |
| Discard Session Reset | 18375 | Indicates that a Discard session was reset. | 3 |
| Discard Session Terminated | 18376 | Indicates that a Discard session was terminated. | 3 |
| Discard Session Denied | 18377 | Indicates that a Discard session was denied. | 3 |
| Discard Session In Progress | 18378 | Indicates that a Discard session is in progress. | 1 |
| DHCP Session Opened | 18379 | Indicates that a Dynamic Host Configuration Protocol (DHCP) session was established. | 1 |
| DHCP Session Closed | 18380 | Indicates that a DHCP session was closed. | 1 |
| DHCP Session Denied | 18381 | Indicates that a DHCP session was denied. | 3 |
| DHCP Session In Progress | 18382 | Indicates that a DHCP session is in progress. | 1 |
| DHCP Success | 18383 | Indicates that a DHCP lease was successfully obtained | 1 |
| DHCP Failure | 18384 | Indicates that a DHCP lease cannot be obtained. | 3 |
| CVS Session Opened | 18385 | Indicates that a Concurrent Versions System (CVS) session was established. | 1 |
| CVS Session Closed | 18386 | Indicates that a CVS session was closed. | 1 |
| CVS Session Reset | 18387 | Indicates that a CVS session was reset. | 3 |
| CVS Session Terminated | 18388 | Indicates that a CVS session was terminated. | 3 |
| CVS Session Denied | 18389 | Indicates that a CVS session was denied. | 3 |
| CVS Session In Progress | 18390 | Indicates that a CVS session is in progress. | 1 |
| CUPS Session Opened | 18391 | Indicates that a Common UNIX Printing System (CUPS) session was established. | 1 |
| CUPS Session Closed | 18392 | Indicates that a CUPS session was closed. | 1 |
| CUPS Session Reset | 18393 | Indicates that a CUPS session was reset. | 3 |
| CUPS Session Terminated | 18394 | Indicates that a CUPS session was terminated. | 3 |
| CUPS Session Denied | 18395 | Indicates that a CUPS session was denied. | 3 |
| CUPS Session In Progress | 18396 | Indicates that a CUPS session is in progress. | 1 |
| Chargen Session Started | 18397 | Indicates that a Character Generator (Chargen) session was started. | 1 |
| Chargen Session Closed | 18398 | Indicates that a Chargen session was closed. | 1 |
| Chargen Session Reset | 18399 | Indicates that a Chargen session was reset. | 3 |
| Chargen Session Terminated | 18400 | Indicates that a Chargen session was terminated. | 3 |
| Chargen Session Denied | 18401 | Indicates that a Chargen session was denied. | 3 |
| Chargen Session In Progress | 18402 | Indicates that a Chargen session is in progress. | 1 |
| Misc VPN | 18403 | Indicates that a miscellaneous VPN session was detected | 1 |
| DAP Session Started | 18404 | Indicates that a DAP session was established. | 1 |
| DAP Session Ended | 18405 | Indicates that a DAP session ended. | 1 |
| DAP Session Denied | 18406 | Indicates that a DAP session was denied. | 3 |
| DAP Session Status | 18407 | Indicates that a DAP session status request was made. | 1 |
| DAP Session in Progress | 18408 | Indicates that a DAP session is in progress. | 1 |
| DAP Authentication Failed | 18409 | Indicates that a DAP authentication failed. | 4 |
| DAP Authentication Succeeded | 18410 | Indicates that DAP authentication succeeded. | 1 |
| TOR Session Started | 18411 | Indicates that a TOR session was established. | 1 |
| TOR Session Closed | 18412 | Indicates that a TOR session was closed. | 1 |
| TOR Session Reset | 18413 | Indicates that a TOR session was reset. | 3 |
| TOR Session Terminated | 18414 | Indicates that a TOR session was terminated. | 3 |
| TOR Session Denied | 18415 | Indicates that a TOR session was denied. | 3 |
| TOR Session In Progress | 18416 | Indicates that a TOR session is in progress. | 1 |
| Game Session Started | 18417 | Indicates that a game session was started. | 1 |
| Game Session Closed | 18418 | Indicates that a game session was closed. | 1 |
| Game Session Reset | 18419 | Indicates that a game session was reset. | 3 |
| Game Session Terminated | 18420 | Indicates that a game session was terminated. | 3 |
| Game Session Denied | 18421 | Indicates that a game session was denied. | 3 |
| Game Session In Progress | 18422 | Indicates that a game session is in progress. | 1 |
| Admin Login Attempt | 18423 | Indicates that an attempt to log in as an administrative user was detected. | 2 |
| User Login Attempt | 18424 | Indicates that an attempt to log in as a non-administrative user was detected. | 2 |
| Client Server | 18425 | Indicates client/server activity. | 1 |
| Content Delivery | 18426 | Indicates content delivery activity. | 1 |
| Data Transfer | 18427 | Indicates a data transfer. | 3 |
| Data Warehousing | 18428 | Indicates data warehousing activity. | 3 |
| Directory Services | 18429 | Indicates directory service activity. | 2 |
| File Print | 18430 | Indicates file print activity. | 1 |
| File Transfer | 18431 | Indicates file transfer. | 2 |
| Games | 18432 | Indicates game activity. | 4 |
| Healthcare | 18433 | Indicates healthcare activity. | 1 |
| Inner System | 18434 | Indicates inner system activity. | 1 |
| Internet Protocol | 18435 | Indicates Internet Protocol activity. | 1 |
| Legacy | 18436 | Indicates legacy activity. | 1 |
| 18437 | Indicates mail activity. | 1 | |
| Misc | 18438 | Indicates miscellaneous activity. | 2 |
| Multimedia | 18439 | Indicates multimedia activity. | 2 |
| Network Management | 18440 | Indicates network management activity. | |
| P2P | 18441 | Indicates Peer-to-Peer (P2P) activity. | 4 |
| Remote Access | 18442 | Indicates Remote Access activity. | 3 |
| Routing Protocols | 18443 | Indicates routing protocol activity. | 1 |
| Security Protocols | 18444 | Indicates security protocol activity. | 2 |
| Streaming | 18445 | Indicates streaming activity. | 2 |
| Uncommon Protocol | 18446 | Indicates uncommon protocol activity. | 3 |
| VoIP | 18447 | Indicates VoIP activity. | 1 |
| Web | 18448 | Indicates web activity. | 1 |
| ICMP | 18449 | Indicates ICMP activity | 1 |