Syslog үйл явдлын мессежүүд — 3-р хэсэг: Data Protection, Exchange, Firewall, Hyper Detect

{
  "module": "dp",
  "product_installed": "BEST",
  "user": {
    "id": "S-1-5-21-3569875631-4240938805-1797204764-1001",
    "name": "Admin1"
  },
  "computer_name": "TEST_ENDPOINT",
  "computer_fqdn": "test-endpoint.dsd.ro",
  "computer_ip": "31.41.59.265",
  "computer_id": "625c19913a58151e63702862",
  "target_type": "http",
  "blocking_rule_name": "asdf",
  "url": "http:\/\/www.zf.ro\/search",
  "status": "data_protection_blocked",
  "last_blocked": "2018-05-25T08:56:42.000Z",
  "count": 1
}

{
  "name": "Exchange Malware Detected",
  "created": "2022-04-18T10:52:14+03:00",
  "company_name": "root",
  "user_name": "root",
  "endpoint_id": "625d18aa9f69720ddfaee9c7",
  "server_name": "TEST_ENDPOINT-email",
  "installed_agent": "BEST",
  "sender": "test@test.com",
  "recipients": ["test@test.com", "test@test.com"],
  "subject": "test",
  "detection_time": "2014-10-29T16:14:51.000Z",
  "detected_malware": [{
    "malwareName": "EICAR-Test-File (not a virus)",
    "malwareType": "virus",
    "infectedObject": "someFile.txt",
    "actionTaken": "ignore"
  }, {
    "malwareName": "EICAR-Test-File (not a virus)",
    "malwareType": "virus",
    "infectedObject": "someFile.txt",
    "actionTaken": "disinfect"
  }]
}

{
  "name": "Exchange License Usage Limit Has Been Reached",
  "created": "2019-01-18T13:01:15+00:00",
  "company_name": "nebula_CO",
  "user_name": "root",
  "mailboxes": 8,
  "license_limit": 5,
  "license_key": "5IMICR5",
  "recv_for_his_company": true,
  "recv_for_partner_company": false
}

{
  "name": "Invalid Exchange user credentials",
  "created": "2022-04-14T09:58:26+00:00",
  "company_name": "root",
  "user_name": "sacumen\\administrator",
  "endpoint_id": "6256a3b130015b2201bf496b",
  "target_name": "WIN-LFK7I9VSLR2",
  "policy_name": "no_update"
}

{
  "module": "fw",
  "product_installed": "BEST",
  "user": {
    "id": "S-1-5-18",
    "name": "SYSTEM"
  },
  "VM_NAME": "Pi-machine",
  "VM_ID": "Pi-3141",
  "UUID_INSTANCE": "50164ed1-28af-41af-cdaf-8e550506c37b",
  "UUID_BIOS": "4216d501-36c5-22ed-de02-0e4da0badb7a",
  "computer_name": "Pi-machine",
  "computer_fqdn": "Pi14159-automation-win64",
  "computer_ip": "31.14.159.265",
  "computer_id": "6257cf1130015b2201bf4a00",
  "status": "traffic_blocked",
  "local_port": "445",
  "protocol_id": "6",
  "application_path": "System",
  "last_blocked": "2022-04-17T11:34:59.000Z",
  "count": 1
}

{
  "module": "hd",
  "product_installed": "BEST",
  "user": {
    "name": "bdvm",
    "sid": "S-1-5-21-2018264366-2484004464-1617746128-1001"
  },
  "VM_NAME": "Pi-machine",
  "VM_ID": "Pi-3141",
  "UUID_INSTANCE": "50164ed1-28af-41af-cdaf-8e550506c37b",
  "UUID_BIOS": "4216d501-36c5-22ed-de02-0e4da0badb7a",
  "computer_name": "Pi-machine",
  "computer_fqdn": "Pi14159-automation-win64",
  "computer_ip": "31.14.159.265",
  "computer_id": "6257cf1130015b2201bf4a00",
  "malware_type": "file",
  "malware_name": "Gen:Illusion.Jazz.1.2010103",
  "hash": "",
  "final_status": "still present",
  "container_id": "4216d501-36c5-22ed-de02-0e4da0badb7a",
  "file_path": "C:\\Users\\bdvm\\Desktop\\_samples_on_execute\\_samples_on_execute\\paranoia.3.2.exe",
  "attack_type": "Ransomware",
  "detection_level": "Normal",
  "is_fileless_attack": "false",
  "process_info_path": "C:\\Users\\bdvm\\Desktop\\_samples_on_execute\\_samples_on_execute\\paranoia.3.2.exe",
  "process_info_command_line": "-test parameter \\ for 3",
  "parent_process_id": 12432,
  "parent_process_path": "C:\\Windows\\System32\\cmd.exe",
  "hwid": "01d51642-c536-ed22-de02-0e4da0badb7a-00505696d1c3",
  "date": "2022-04-15T08:06:27.000Z"
}