Syslog үйл явдлын мессежүүд — 5-р хэсэг: Antiexploit, Network Attack Defense, Task Status, Content Control, Storage Antimalware

{
  "module": "antiexploit",
  "product_installed": "BEST",
  "VM_NAME": "btoma-exchange-onPrem",
  "VM_ID": "vm-4190",
  "UUID_INSTANCE": "501606d3-c8b0-1127-920a-1edc7d3a76b0",
  "UUID_BIOS": "42166a12-1437-7e14-db35-8f100b85041b",
  "computer_name": "btoma-exchange-onPrem",
  "computer_fqdn": "win-lfk7i9vslr2.sacumen.local",
  "computer_ip": "10.18.159.13",
  "computer_id": "6256a3b130015b2201bf496d",
  "container_id": "42166a12-1437-7e14-db35-8f100b85041b",
  "detection_action": "kill",
  "detection_pid": "46856",
  "detection_exploitTechnique": "ProcessCreation\/ObsoleteChildProcessCreation",
  "detection_parentPid": "48508",
  "detection_path": "C:\\Users\\Administrator\\Desktop\\samples\\samples\\bd_anti-exploit-test\\test-gemma-alert\\opera64.exe",
  "detection_parentPath": "C:\\Windows\\System32\\cmd.exe",
  "detection_username": "Administrator@sacumen.local",
  "detection_time": "2022-04-17T11:52:30.000Z",
  "endpoint_id": "6256a3b130015b2201bf496b"
}

{
  "name": "Network Incidents event",
  "created": "2022-04-26T09:49:18+03:00",
  "company_name": "root",
  "user_name": "user1@domain.com",
  "computer_id": "625c19913a58151e63702862",
  "computer_name": "TEST_ENDPOINT",
  "computer_ip": "31.41.59.265",
  "computer_fqdn": "test-endpoint.dsd.ro",
  "action_taken": "block",
  "attack_technique": "discovery",
  "detection_name": "Eicar.NetworkMonitor.DiscoveryThreat",
  "source_ip": "213.211.198.58",
  "victim_ip": "10.17.134.4",
  "local_port": "80",
  "date": "2015-02-02T13:34:54.000Z"
}

{
  "module": "task-status",
  "product_installed": "BEST",
  "VM_NAME": "Pi-machine",
  "VM_ID": "Pi-3141",
  "UUID_INSTANCE": "50164ed1-28af-41af-cdaf-8e550506c37b",
  "UUID_BIOS": "4216d501-36c5-22ed-de02-0e4da0badb7a",
  "computer_name": "Pi-machine",
  "computer_fqdn": "Pi14159-automation-win64",
  "computer_ip": "31.14.159.265",
  "computer_id": "6257cf1130015b2201bf4a00",
  "userId": "6177f2319908e641be7b8eda",
  "taskId": "627cd4a6c9f8cd6efe672e74",
  "taskName": "Restore Quarantine Item Task 2022-05-12(sub-task)",
  "taskType": 280,
  "targetName": "Pi-machine",
  "isSuccessful": true,
  "status": 3,
  "errorMessage": "",
  "errorCode": 0,
  "errorMessageParams": []
}

{
  "module": "uc",
  "product_installed": "SVA",
  "user": {
    "id": "S-1-5-21-2807410960-349943591-4067985531-1001",
    "name": "admin"
  },
  "computer_name": "AD-ONPREM-2019A 1",
  "computer_fqdn": "ad-onprem-2019a",
  "computer_ip": "10.18.156.47",
  "computer_id": "627cd5854e604906f22aa6ed",
  "uc_type": "http",
  "url": "http:\/\/block_type_4.com",
  "block_type": "http_categories",
  "categories": "Illegal,Shopping,OnlinePay,IM",
  "status": "uc_site_blocked",
  "last_blocked": "2015-02-25T12:21:54.000Z",
  "count": 2
}

{
  "name": "Storage Antimalware Event",
  "created": "2022-04-15T17:02:59+03:00",
  "company_name": "root",
  "user_name": "root",
  "computer_name": "bitdefender-sva",
  "storage_name": "10.17.42.77",
  "storage_ip": "10.17.42.77",
  "storage_type": "Unknown",
  "malware_path": "\/ifs\/data\/btoma_test3",
  "malware_hash": "2f41772245a9d55a0725061337b18e8eba2cee7965d081b52c40afe2c0201dcd",
  "malware_type": "Malware",
  "malware_name": "BAT.Trojan.FormatC.Z",
  "malware_status": "Blocked",
  "detection_time": "2022-04-15T14:02:02.000Z",
  "sandboxDetection": 0,
  "sandboxHostname": "",
  "security_server_version": "6.2.7.11403",
  "engines_version": "7.91671"
}