Logz.io
Fetch & remediate security incidents identified by Logz.io Cloud SIEM.
Analytics & SIEM · Logz.io
Details
| ID | Logz.io |
|---|---|
| Provider | Logz.io |
| Category | Analytics & SIEM |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
Overview
Fetch & remediate security incidents identified by Logz.io Cloud SIEM
This integration was integrated and tested with Logz.io platform.
Logz.io Playbook
Logz.Io Handle Alert: used to handle alerts retrieved from Logz.io. The playbook will retrieve the related events that generated the alert using the logzio-get-logs-by-event-id command
Use Cases
Integrate with Logz.io Cloud SIEM to automatically remediate security incidents identified by Logz.io and increase observability into incident details.
The integration allows Cortex XSOAR users to automatically remediate incidents identified by Logz.io Cloud SIEM using Cortex XSOAR Playbooks.
In addition, users can query Logz.io directly from Cortex XSOAR to investigate open questions or retrieve the logs responsible for triggering security rules.
Configure Logz.io on Cortex XSOAR
- Navigate to Settings > Integrations > Analytics & SIEM.
- Search for Logz.io.
- Click Add instance to create and configure a new integration instance.
- Name: a textual name for the integration instance.
- Fetch incidents.
- Incident type
- API token for Logz.io Security account
- API token for Logz.io Operations account
- Region code of your Logz.io account
- Filter on rule names (Lucene syntax)
- Filter by rule severity
- First fetch time range ({number} {time unit}, e.g., 1 hour, 30 minutes)
- Max. number of incidents fetched per run
- Trust any certificate (not secure)
- Use system proxy settings
- Click Test to validate the URLs, token, and connection.
Commands
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
- logzio-search-logs
- logzio-get-logs-by-event-id
1. logzio-search-logs
Returns logs from your Logz.io Operations account by Lucene query
Note: The search time range can span over 2 calender days at most. If you supply a time range greater than that,
the search window will be the last 2 calender days within the range you supplied.
Required Permissions
Your Logz.io account type should be PRO or above.
Base Command
logzio-search-logs
Input
| Argument Name | Description | Required |
|---|---|---|
| query | A string specifying the search query, written in Apache Lucene syntax e.g. ‘fname:John AND sname:Smith’ . | Required |
| size | An integer specifying the maximum number of results to return. | Optional |
| from_time | Specifies the earliest timestamp to be returned by the query. | Optional |
| to_time | Specifies the latest timestamp to be returned by the query. | Optional |
| timeout | Timeout in seconds | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Logzio.Result | Unknown | An array of search results |
| Logzio.Result.type | string | Log type in the index |
| Logzio.Result.timestamp | date | The log’s timestamp |
Command Example
!logzio-search-logs query="ThreatType:trojan OR input.type:tcp" size="5"
Context Example
{
"Logzio.Result": [
{
"ThreatType": [
"trojan",
"trojan"
],
"Severity": [
"3",
"3"
],
"DetectionMessage": [
"IDS_OAS_DEFAULT_THREAT_MESSAGE",
"IDS_OAS_DEFAULT_THREAT_MESSAGE"
],
"@timestamp": "2020-05-06T00:01:04.441+0000",
"TargetFileSize": [
"249952",
"249952"
],
"domain": [
"Win-Sec-2",
"Win-Sec-2"
],
"tenantGUID": "{00000000-0000-0000-0000-000000000000}",
"SecondActionStatus": [
"False",
"False"
],
"EPOEvents": "EventFwd",
"DurationBeforeDetection": [
"18",
"18"
],
"Cleanable": [
"True",
"True"
],
"bpsId": "1",
"FirstAttemptedAction": [
"IDS_ALERT_THACT_ATT_CLE",
"IDS_ALERT_THACT_ATT_CLE"
],
"SourceProcessName": [
"C:\\Windows\\explorer.exe",
"C:\\Windows\\explorer.exe"
],
"AnalyzerName": [
"McAfee Endpoint Security",
"McAfee Endpoint Security"
],
"AnalyzerContentCreationDate": [
"2020-02-22T08:24:00Z",
"2020-02-22T08:24:00Z"
],
"TargetAccessTime": [
"2020-02-23T15:43:22Z",
"2020-02-23T15:43:22Z"
],
"TargetCreateTime": [
"2020-02-23T15:43:21Z",
"2020-02-23T15:43:21Z"
],
"TargetHostName": [
"WinSec3",
"WinSec3"
],
"logzio_codec": "plain",
"DetectedUTC": [
"2020-02-23T15:43:40Z",
"2020-02-23T15:43:40Z"
],
"Analyzer": [
"ENDP_AM_1060",
"ENDP_AM_1060"
],
"TargetHash": [
"81da244a770c46ace2cf112214f8e75e",
"81da244a770c46ace2cf112214f8e75e"
],
"AttackVectorType": [
"4",
"4"
],
"tags": [
"beats-5015",
"_grokparsefailure",
"_grokparsefailure",
"_logz_http_bulk_json_8070"
],
"ThreatActionTaken": [
"IDS_ALERT_ACT_TAK_DEL",
"IDS_ALERT_ACT_TAK_DEL"
],
"ThreatCategory": [
"av.detect",
"av.detect"
],
"AnalyzerEngineVersion": [
"6010.8670",
"6010.8670"
],
"SourceHostName": [
"WinSec3",
"WinSec3"
],
"FirstActionStatus": [
"True",
"True"
],
"TargetName": [
"test.exe",
"test.exe"
],
"TargetFileName": [
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe",
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe"
],
"tenantId": "1",
"log": {
"source": {
"address": "10.0.1.9:49874"
}
},
"GMTTime": [
"2020-02-23T15:43:40",
"2020-02-23T15:43:40"
],
"ThreatEventID": [
"1027",
"1027"
],
"AMCoreContentVersion": [
"3990.0",
"3990.0"
],
"AnalyzerDATVersion": [
"3990.0",
"3990.0"
],
"timestamp": "2020-05-06T00:01:04.441+0000",
"NaturalLangDescription": [
"IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio",
"IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio"
],
"beat_agent": {
"ephemeral_id": "8d15318f-3a3e-436c-a93e-1b6e8fec0cfb",
"type": "filebeat",
"hostname": "SecLinux",
"version": "7.5.0",
"id": "348cbd8b-b4ce-4531-b6d1-ab6beb37d65f"
},
"AnalyzerVersion": [
"10.6.1",
"10.6.1"
],
"TargetUserName": [
"WinSec3\\Logzio",
"WinSec3\\Logzio"
],
"TaskName": [
"IDS_OAS_TASK_NAME",
"IDS_OAS_TASK_NAME"
],
"ThreatName": [
"Trojan-FRTB!81DA244A770C",
"Trojan-FRTB!81DA244A770C"
],
"AnalyzerHostName": [
"WinSec3",
"WinSec3"
],
"EPOevent": {
"SoftwareInfo": {
"CommonFields": {
"AnalyzerDATVersion": "3990.0",
"Analyzer": "ENDP_AM_1060",
"AnalyzerDetectionMethod": "On-Access Scan",
"AnalyzerVersion": "10.6.1",
"AnalyzerEngineVersion": "6010.8670",
"AnalyzerHostName": "WinSec3",
"AnalyzerName": "McAfee Endpoint Security"
},
"Event": {
"EventID": "1027",
"GMTTime": "2020-02-23T15:43:40",
"CustomFields": {
"DetectionMessage": "IDS_OAS_DEFAULT_THREAT_MESSAGE",
"TargetFileSize": "249952",
"SecondActionStatus": "false",
"DurationBeforeDetection": "18",
"Cleanable": "true",
"FirstAttemptedAction": "IDS_ALERT_THACT_ATT_CLE",
"AnalyzerContentCreationDate": "2020-02-22T08:24:00Z",
"TargetAccessTime": "2020-02-23T15:43:22Z",
"AttackVectorType": "4",
"ThreatDetectedOnCreation": "true",
"FirstActionStatus": "true",
"TargetName": "test.exe",
"AMCoreContentVersion": "3990.0",
"NaturalLangDescription": "IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio",
"TaskName": "IDS_OAS_TASK_NAME",
"TargetHash": "81da244a770c46ace2cf112214f8e75e",
"SecondAttemptedAction": "IDS_ALERT_THACT_ATT_DEL",
"TargetCreateTime": "2020-02-23T15:43:21Z",
"TargetModifyTime": "2020-02-23T15:43:22Z",
"BladeName": "IDS_BLADE_NAME_SPB",
"AnalyzerGTIQuery": "true",
"AccessRequested_obj": {},
"TargetPath": "C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth"
},
"CommonFields": {
"ThreatType": "trojan",
"ThreatEventID": "1027",
"TargetHostName": "WinSec3",
"DetectedUTC": "2020-02-23T15:43:40Z",
"TargetFileName": "C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe",
"ThreatSeverity": "2",
"ThreatCategory": "av.detect",
"TargetUserName": "WinSec3\\Logzio",
"SourceHostName": "WinSec3",
"ThreatName": "Trojan-FRTB!81DA244A770C",
"SourceProcessName": "C:\\Windows\\explorer.exe",
"ThreatActionTaken": "IDS_ALERT_ACT_TAK_DEL",
"ThreatHandled": "true"
},
"Severity": "3"
}
},
"MachineInfo": {
"RawMACAddress": "000d3a373482",
"UserName": "SYSTEM",
"MachineName": "WinSec3",
"OSName": "Windows 10 Workstation",
"TimeZoneBias": "0",
"AgentGUID": "{d140d3c9-53ed-4367-857d-a5a396a97775}",
"IPAddress": "10.0.1.10"
}
},
"SecondAttemptedAction": [
"IDS_ALERT_THACT_ATT_DEL",
"IDS_ALERT_THACT_ATT_DEL"
],
"EventID": [
"1027",
"1027"
],
"input": {
"type": "tcp"
},
"type": "mcafee_epo",
"tenantNodePath": "1\\2",
"TargetModifyTime": [
"2020-02-23T15:43:22Z",
"2020-02-23T15:43:22Z"
],
"AnalyzerDetectionMethod": [
"On-Access Scan",
"On-Access Scan"
],
"BladeName": [
"IDS_BLADE_NAME_SPB",
"IDS_BLADE_NAME_SPB"
],
"ThreatSeverity": [
"2",
"2"
],
"AnalyzerGTIQuery": [
"True",
"True"
],
"AccessRequested": [
"",
""
],
"ecs": {
"version": "1.1.0"
},
"ThreatHandled": [
"True",
"True"
],
"TargetPath": [
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth",
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth"
],
"@metadata": {
"beat": "filebeat",
"version": "7.5.0",
"type": "_doc"
},
"ThreatDetectedOnCreation": [
"True",
"True"
]
},
{
"ThreatType": [
"trojan",
"trojan"
],
"Severity": [
"3",
"3"
],
"DetectionMessage": [
"IDS_OAS_DEFAULT_THREAT_MESSAGE",
"IDS_OAS_DEFAULT_THREAT_MESSAGE"
],
"@timestamp": "2020-05-06T02:01:13.778+0000",
"TargetFileSize": [
"249952",
"249952"
],
"domain": [
"Win-Sec-2",
"Win-Sec-2"
],
"tenantGUID": "{00000000-0000-0000-0000-000000000000}",
"SecondActionStatus": [
"False",
"False"
],
"EPOEvents": "EventFwd",
"DurationBeforeDetection": [
"18",
"18"
],
"Cleanable": [
"True",
"True"
],
"bpsId": "1",
"FirstAttemptedAction": [
"IDS_ALERT_THACT_ATT_CLE",
"IDS_ALERT_THACT_ATT_CLE"
],
"SourceProcessName": [
"C:\\Windows\\explorer.exe",
"C:\\Windows\\explorer.exe"
],
"AnalyzerName": [
"McAfee Endpoint Security",
"McAfee Endpoint Security"
],
"AnalyzerContentCreationDate": [
"2020-02-22T08:24:00Z",
"2020-02-22T08:24:00Z"
],
"TargetAccessTime": [
"2020-02-23T15:43:22Z",
"2020-02-23T15:43:22Z"
],
"TargetCreateTime": [
"2020-02-23T15:43:21Z",
"2020-02-23T15:43:21Z"
],
"TargetHostName": [
"WinSec3",
"WinSec3"
],
"logzio_codec": "plain",
"DetectedUTC": [
"2020-02-23T15:43:40Z",
"2020-02-23T15:43:40Z"
],
"Analyzer": [
"ENDP_AM_1060",
"ENDP_AM_1060"
],
"TargetHash": [
"81da244a770c46ace2cf112214f8e75e",
"81da244a770c46ace2cf112214f8e75e"
],
"AttackVectorType": [
"4",
"4"
],
"tags": [
"beats-5015",
"_grokparsefailure",
"_grokparsefailure",
"_logz_http_bulk_json_8070"
],
"ThreatActionTaken": [
"IDS_ALERT_ACT_TAK_DEL",
"IDS_ALERT_ACT_TAK_DEL"
],
"ThreatCategory": [
"av.detect",
"av.detect"
],
"AnalyzerEngineVersion": [
"6010.8670",
"6010.8670"
],
"SourceHostName": [
"WinSec3",
"WinSec3"
],
"FirstActionStatus": [
"True",
"True"
],
"TargetName": [
"test.exe",
"test.exe"
],
"TargetFileName": [
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe",
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe"
],
"tenantId": "1",
"log": {
"source": {
"address": "10.0.1.9:49874"
}
},
"GMTTime": [
"2020-02-23T15:43:40",
"2020-02-23T15:43:40"
],
"ThreatEventID": [
"1027",
"1027"
],
"AMCoreContentVersion": [
"3990.0",
"3990.0"
],
"AnalyzerDATVersion": [
"3990.0",
"3990.0"
],
"timestamp": "2020-05-06T02:01:13.778+0000",
"NaturalLangDescription": [
"IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio",
"IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio"
],
"beat_agent": {
"ephemeral_id": "8d15318f-3a3e-436c-a93e-1b6e8fec0cfb",
"type": "filebeat",
"hostname": "SecLinux",
"version": "7.5.0",
"id": "348cbd8b-b4ce-4531-b6d1-ab6beb37d65f"
},
"AnalyzerVersion": [
"10.6.1",
"10.6.1"
],
"TargetUserName": [
"WinSec3\\Logzio",
"WinSec3\\Logzio"
],
"TaskName": [
"IDS_OAS_TASK_NAME",
"IDS_OAS_TASK_NAME"
],
"ThreatName": [
"Trojan-FRTB!81DA244A770C",
"Trojan-FRTB!81DA244A770C"
],
"AnalyzerHostName": [
"WinSec3",
"WinSec3"
],
"EPOevent": {
"SoftwareInfo": {
"CommonFields": {
"AnalyzerDATVersion": "3990.0",
"Analyzer": "ENDP_AM_1060",
"AnalyzerDetectionMethod": "On-Access Scan",
"AnalyzerVersion": "10.6.1",
"AnalyzerEngineVersion": "6010.8670",
"AnalyzerHostName": "WinSec3",
"AnalyzerName": "McAfee Endpoint Security"
},
"Event": {
"EventID": "1027",
"GMTTime": "2020-02-23T15:43:40",
"CustomFields": {
"DetectionMessage": "IDS_OAS_DEFAULT_THREAT_MESSAGE",
"TargetFileSize": "249952",
"SecondActionStatus": "false",
"DurationBeforeDetection": "18",
"Cleanable": "true",
"FirstAttemptedAction": "IDS_ALERT_THACT_ATT_CLE",
"AnalyzerContentCreationDate": "2020-02-22T08:24:00Z",
"TargetAccessTime": "2020-02-23T15:43:22Z",
"AttackVectorType": "4",
"ThreatDetectedOnCreation": "true",
"FirstActionStatus": "true",
"TargetName": "test.exe",
"AMCoreContentVersion": "3990.0",
"NaturalLangDescription": "IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio",
"TaskName": "IDS_OAS_TASK_NAME",
"TargetHash": "81da244a770c46ace2cf112214f8e75e",
"SecondAttemptedAction": "IDS_ALERT_THACT_ATT_DEL",
"TargetCreateTime": "2020-02-23T15:43:21Z",
"TargetModifyTime": "2020-02-23T15:43:22Z",
"BladeName": "IDS_BLADE_NAME_SPB",
"AnalyzerGTIQuery": "true",
"AccessRequested_obj": {},
"TargetPath": "C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth"
},
"CommonFields": {
"ThreatType": "trojan",
"ThreatEventID": "1027",
"TargetHostName": "WinSec3",
"DetectedUTC": "2020-02-23T15:43:40Z",
"TargetFileName": "C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe",
"ThreatSeverity": "2",
"ThreatCategory": "av.detect",
"TargetUserName": "WinSec3\\Logzio",
"SourceHostName": "WinSec3",
"ThreatName": "Trojan-FRTB!81DA244A770C",
"SourceProcessName": "C:\\Windows\\explorer.exe",
"ThreatActionTaken": "IDS_ALERT_ACT_TAK_DEL",
"ThreatHandled": "true"
},
"Severity": "3"
}
},
"MachineInfo": {
"RawMACAddress": "000d3a373482",
"UserName": "SYSTEM",
"MachineName": "WinSec3",
"OSName": "Windows 10 Workstation",
"TimeZoneBias": "0",
"AgentGUID": "{d140d3c9-53ed-4367-857d-a5a396a97775}",
"IPAddress": "10.0.1.10"
}
},
"SecondAttemptedAction": [
"IDS_ALERT_THACT_ATT_DEL",
"IDS_ALERT_THACT_ATT_DEL"
],
"EventID": [
"1027",
"1027"
],
"input": {
"type": "tcp"
},
"type": "mcafee_epo",
"tenantNodePath": "1\\2",
"TargetModifyTime": [
"2020-02-23T15:43:22Z",
"2020-02-23T15:43:22Z"
],
"AnalyzerDetectionMethod": [
"On-Access Scan",
"On-Access Scan"
],
"BladeName": [
"IDS_BLADE_NAME_SPB",
"IDS_BLADE_NAME_SPB"
],
"ThreatSeverity": [
"2",
"2"
],
"AnalyzerGTIQuery": [
"True",
"True"
],
"AccessRequested": [
"",
""
],
"ecs": {
"version": "1.1.0"
},
"ThreatHandled": [
"True",
"True"
],
"TargetPath": [
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth",
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth"
],
"@metadata": {
"beat": "filebeat",
"version": "7.5.0",
"type": "_doc"
},
"ThreatDetectedOnCreation": [
"True",
"True"
]
},
{
"ThreatType": [
"trojan",
"trojan"
],
"Severity": [
"3",
"3"
],
"DetectionMessage": [
"IDS_OAS_DEFAULT_THREAT_MESSAGE",
"IDS_OAS_DEFAULT_THREAT_MESSAGE"
],
"@timestamp": "2020-05-06T02:16:14.944+0000",
"TargetFileSize": [
"249952",
"249952"
],
"domain": [
"Win-Sec-2",
"Win-Sec-2"
],
"tenantGUID": "{00000000-0000-0000-0000-000000000000}",
"SecondActionStatus": [
"False",
"False"
],
"EPOEvents": "EventFwd",
"DurationBeforeDetection": [
"18",
"18"
],
"Cleanable": [
"True",
"True"
],
"bpsId": "1",
"FirstAttemptedAction": [
"IDS_ALERT_THACT_ATT_CLE",
"IDS_ALERT_THACT_ATT_CLE"
],
"SourceProcessName": [
"C:\\Windows\\explorer.exe",
"C:\\Windows\\explorer.exe"
],
"AnalyzerName": [
"McAfee Endpoint Security",
"McAfee Endpoint Security"
],
"AnalyzerContentCreationDate": [
"2020-02-22T08:24:00Z",
"2020-02-22T08:24:00Z"
],
"TargetAccessTime": [
"2020-02-23T15:43:22Z",
"2020-02-23T15:43:22Z"
],
"TargetCreateTime": [
"2020-02-23T15:43:21Z",
"2020-02-23T15:43:21Z"
],
"TargetHostName": [
"WinSec3",
"WinSec3"
],
"logzio_codec": "plain",
"DetectedUTC": [
"2020-02-23T15:43:40Z",
"2020-02-23T15:43:40Z"
],
"Analyzer": [
"ENDP_AM_1060",
"ENDP_AM_1060"
],
"TargetHash": [
"81da244a770c46ace2cf112214f8e75e",
"81da244a770c46ace2cf112214f8e75e"
],
"AttackVectorType": [
"4",
"4"
],
"tags": [
"beats-5015",
"_grokparsefailure",
"_grokparsefailure",
"_logz_http_bulk_json_8070"
],
"ThreatActionTaken": [
"IDS_ALERT_ACT_TAK_DEL",
"IDS_ALERT_ACT_TAK_DEL"
],
"ThreatCategory": [
"av.detect",
"av.detect"
],
"AnalyzerEngineVersion": [
"6010.8670",
"6010.8670"
],
"SourceHostName": [
"WinSec3",
"WinSec3"
],
"FirstActionStatus": [
"True",
"True"
],
"TargetName": [
"test.exe",
"test.exe"
],
"TargetFileName": [
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe",
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe"
],
"tenantId": "1",
"log": {
"source": {
"address": "10.0.1.9:49874"
}
},
"GMTTime": [
"2020-02-23T15:43:40",
"2020-02-23T15:43:40"
],
"ThreatEventID": [
"1027",
"1027"
],
"AMCoreContentVersion": [
"3990.0",
"3990.0"
],
"AnalyzerDATVersion": [
"3990.0",
"3990.0"
],
"timestamp": "2020-05-06T02:16:14.944+0000",
"NaturalLangDescription": [
"IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio",
"IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio"
],
"beat_agent": {
"ephemeral_id": "8d15318f-3a3e-436c-a93e-1b6e8fec0cfb",
"type": "filebeat",
"hostname": "SecLinux",
"version": "7.5.0",
"id": "348cbd8b-b4ce-4531-b6d1-ab6beb37d65f"
},
"AnalyzerVersion": [
"10.6.1",
"10.6.1"
],
"TargetUserName": [
"WinSec3\\Logzio",
"WinSec3\\Logzio"
],
"TaskName": [
"IDS_OAS_TASK_NAME",
"IDS_OAS_TASK_NAME"
],
"ThreatName": [
"Trojan-FRTB!81DA244A770C",
"Trojan-FRTB!81DA244A770C"
],
"AnalyzerHostName": [
"WinSec3",
"WinSec3"
],
"EPOevent": {
"SoftwareInfo": {
"CommonFields": {
"AnalyzerDATVersion": "3990.0",
"Analyzer": "ENDP_AM_1060",
"AnalyzerDetectionMethod": "On-Access Scan",
"AnalyzerVersion": "10.6.1",
"AnalyzerEngineVersion": "6010.8670",
"AnalyzerHostName": "WinSec3",
"AnalyzerName": "McAfee Endpoint Security"
},
"Event": {
"EventID": "1027",
"GMTTime": "2020-02-23T15:43:40",
"CustomFields": {
"DetectionMessage": "IDS_OAS_DEFAULT_THREAT_MESSAGE",
"TargetFileSize": "249952",
"SecondActionStatus": "false",
"DurationBeforeDetection": "18",
"Cleanable": "true",
"FirstAttemptedAction": "IDS_ALERT_THACT_ATT_CLE",
"AnalyzerContentCreationDate": "2020-02-22T08:24:00Z",
"TargetAccessTime": "2020-02-23T15:43:22Z",
"AttackVectorType": "4",
"ThreatDetectedOnCreation": "true",
"FirstActionStatus": "true",
"TargetName": "test.exe",
"AMCoreContentVersion": "3990.0",
"NaturalLangDescription": "IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio",
"TaskName": "IDS_OAS_TASK_NAME",
"TargetHash": "81da244a770c46ace2cf112214f8e75e",
"SecondAttemptedAction": "IDS_ALERT_THACT_ATT_DEL",
"TargetCreateTime": "2020-02-23T15:43:21Z",
"TargetModifyTime": "2020-02-23T15:43:22Z",
"BladeName": "IDS_BLADE_NAME_SPB",
"AnalyzerGTIQuery": "true",
"AccessRequested_obj": {},
"TargetPath": "C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth"
},
"CommonFields": {
"ThreatType": "trojan",
"ThreatEventID": "1027",
"TargetHostName": "WinSec3",
"DetectedUTC": "2020-02-23T15:43:40Z",
"TargetFileName": "C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe",
"ThreatSeverity": "2",
"ThreatCategory": "av.detect",
"TargetUserName": "WinSec3\\Logzio",
"SourceHostName": "WinSec3",
"ThreatName": "Trojan-FRTB!81DA244A770C",
"SourceProcessName": "C:\\Windows\\explorer.exe",
"ThreatActionTaken": "IDS_ALERT_ACT_TAK_DEL",
"ThreatHandled": "true"
},
"Severity": "3"
}
},
"MachineInfo": {
"RawMACAddress": "000d3a373482",
"UserName": "SYSTEM",
"MachineName": "WinSec3",
"OSName": "Windows 10 Workstation",
"TimeZoneBias": "0",
"AgentGUID": "{d140d3c9-53ed-4367-857d-a5a396a97775}",
"IPAddress": "10.0.1.10"
}
},
"SecondAttemptedAction": [
"IDS_ALERT_THACT_ATT_DEL",
"IDS_ALERT_THACT_ATT_DEL"
],
"EventID": [
"1027",
"1027"
],
"input": {
"type": "tcp"
},
"type": "mcafee_epo",
"tenantNodePath": "1\\2",
"TargetModifyTime": [
"2020-02-23T15:43:22Z",
"2020-02-23T15:43:22Z"
],
"AnalyzerDetectionMethod": [
"On-Access Scan",
"On-Access Scan"
],
"BladeName": [
"IDS_BLADE_NAME_SPB",
"IDS_BLADE_NAME_SPB"
],
"ThreatSeverity": [
"2",
"2"
],
"AnalyzerGTIQuery": [
"True",
"True"
],
"AccessRequested": [
"",
""
],
"ecs": {
"version": "1.1.0"
},
"ThreatHandled": [
"True",
"True"
],
"TargetPath": [
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth",
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth"
],
"@metadata": {
"beat": "filebeat",
"version": "7.5.0",
"type": "_doc"
},
"ThreatDetectedOnCreation": [
"True",
"True"
]
},
{
"ThreatType": [
"trojan",
"trojan"
],
"Severity": [
"3",
"3"
],
"DetectionMessage": [
"IDS_OAS_DEFAULT_THREAT_MESSAGE",
"IDS_OAS_DEFAULT_THREAT_MESSAGE"
],
"@timestamp": "2020-05-06T02:31:16.087+0000",
"TargetFileSize": [
"249952",
"249952"
],
"domain": [
"Win-Sec-2",
"Win-Sec-2"
],
"tenantGUID": "{00000000-0000-0000-0000-000000000000}",
"SecondActionStatus": [
"False",
"False"
],
"EPOEvents": "EventFwd",
"DurationBeforeDetection": [
"18",
"18"
],
"Cleanable": [
"True",
"True"
],
"bpsId": "1",
"FirstAttemptedAction": [
"IDS_ALERT_THACT_ATT_CLE",
"IDS_ALERT_THACT_ATT_CLE"
],
"SourceProcessName": [
"C:\\Windows\\explorer.exe",
"C:\\Windows\\explorer.exe"
],
"AnalyzerName": [
"McAfee Endpoint Security",
"McAfee Endpoint Security"
],
"AnalyzerContentCreationDate": [
"2020-02-22T08:24:00Z",
"2020-02-22T08:24:00Z"
],
"TargetAccessTime": [
"2020-02-23T15:43:22Z",
"2020-02-23T15:43:22Z"
],
"TargetCreateTime": [
"2020-02-23T15:43:21Z",
"2020-02-23T15:43:21Z"
],
"TargetHostName": [
"WinSec3",
"WinSec3"
],
"logzio_codec": "plain",
"DetectedUTC": [
"2020-02-23T15:43:40Z",
"2020-02-23T15:43:40Z"
],
"Analyzer": [
"ENDP_AM_1060",
"ENDP_AM_1060"
],
"TargetHash": [
"81da244a770c46ace2cf112214f8e75e",
"81da244a770c46ace2cf112214f8e75e"
],
"AttackVectorType": [
"4",
"4"
],
"tags": [
"beats-5015",
"_grokparsefailure",
"_grokparsefailure",
"_logz_http_bulk_json_8070"
],
"ThreatActionTaken": [
"IDS_ALERT_ACT_TAK_DEL",
"IDS_ALERT_ACT_TAK_DEL"
],
"ThreatCategory": [
"av.detect",
"av.detect"
],
"AnalyzerEngineVersion": [
"6010.8670",
"6010.8670"
],
"SourceHostName": [
"WinSec3",
"WinSec3"
],
"FirstActionStatus": [
"True",
"True"
],
"TargetName": [
"test.exe",
"test.exe"
],
"TargetFileName": [
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe",
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe"
],
"tenantId": "1",
"log": {
"source": {
"address": "10.0.1.9:49874"
}
},
"GMTTime": [
"2020-02-23T15:43:40",
"2020-02-23T15:43:40"
],
"ThreatEventID": [
"1027",
"1027"
],
"AMCoreContentVersion": [
"3990.0",
"3990.0"
],
"AnalyzerDATVersion": [
"3990.0",
"3990.0"
],
"timestamp": "2020-05-06T02:31:16.087+0000",
"NaturalLangDescription": [
"IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio",
"IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio"
],
"beat_agent": {
"ephemeral_id": "8d15318f-3a3e-436c-a93e-1b6e8fec0cfb",
"type": "filebeat",
"hostname": "SecLinux",
"version": "7.5.0",
"id": "348cbd8b-b4ce-4531-b6d1-ab6beb37d65f"
},
"AnalyzerVersion": [
"10.6.1",
"10.6.1"
],
"TargetUserName": [
"WinSec3\\Logzio",
"WinSec3\\Logzio"
],
"TaskName": [
"IDS_OAS_TASK_NAME",
"IDS_OAS_TASK_NAME"
],
"ThreatName": [
"Trojan-FRTB!81DA244A770C",
"Trojan-FRTB!81DA244A770C"
],
"AnalyzerHostName": [
"WinSec3",
"WinSec3"
],
"EPOevent": {
"SoftwareInfo": {
"CommonFields": {
"AnalyzerDATVersion": "3990.0",
"Analyzer": "ENDP_AM_1060",
"AnalyzerDetectionMethod": "On-Access Scan",
"AnalyzerVersion": "10.6.1",
"AnalyzerEngineVersion": "6010.8670",
"AnalyzerHostName": "WinSec3",
"AnalyzerName": "McAfee Endpoint Security"
},
"Event": {
"EventID": "1027",
"GMTTime": "2020-02-23T15:43:40",
"CustomFields": {
"DetectionMessage": "IDS_OAS_DEFAULT_THREAT_MESSAGE",
"TargetFileSize": "249952",
"SecondActionStatus": "false",
"DurationBeforeDetection": "18",
"Cleanable": "true",
"FirstAttemptedAction": "IDS_ALERT_THACT_ATT_CLE",
"AnalyzerContentCreationDate": "2020-02-22T08:24:00Z",
"TargetAccessTime": "2020-02-23T15:43:22Z",
"AttackVectorType": "4",
"ThreatDetectedOnCreation": "true",
"FirstActionStatus": "true",
"TargetName": "test.exe",
"AMCoreContentVersion": "3990.0",
"NaturalLangDescription": "IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio",
"TaskName": "IDS_OAS_TASK_NAME",
"TargetHash": "81da244a770c46ace2cf112214f8e75e",
"SecondAttemptedAction": "IDS_ALERT_THACT_ATT_DEL",
"TargetCreateTime": "2020-02-23T15:43:21Z",
"TargetModifyTime": "2020-02-23T15:43:22Z",
"BladeName": "IDS_BLADE_NAME_SPB",
"AnalyzerGTIQuery": "true",
"AccessRequested_obj": {},
"TargetPath": "C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth"
},
"CommonFields": {
"ThreatType": "trojan",
"ThreatEventID": "1027",
"TargetHostName": "WinSec3",
"DetectedUTC": "2020-02-23T15:43:40Z",
"TargetFileName": "C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe",
"ThreatSeverity": "2",
"ThreatCategory": "av.detect",
"TargetUserName": "WinSec3\\Logzio",
"SourceHostName": "WinSec3",
"ThreatName": "Trojan-FRTB!81DA244A770C",
"SourceProcessName": "C:\\Windows\\explorer.exe",
"ThreatActionTaken": "IDS_ALERT_ACT_TAK_DEL",
"ThreatHandled": "true"
},
"Severity": "3"
}
},
"MachineInfo": {
"RawMACAddress": "000d3a373482",
"UserName": "SYSTEM",
"MachineName": "WinSec3",
"OSName": "Windows 10 Workstation",
"TimeZoneBias": "0",
"AgentGUID": "{d140d3c9-53ed-4367-857d-a5a396a97775}",
"IPAddress": "10.0.1.10"
}
},
"SecondAttemptedAction": [
"IDS_ALERT_THACT_ATT_DEL",
"IDS_ALERT_THACT_ATT_DEL"
],
"EventID": [
"1027",
"1027"
],
"input": {
"type": "tcp"
},
"type": "mcafee_epo",
"tenantNodePath": "1\\2",
"TargetModifyTime": [
"2020-02-23T15:43:22Z",
"2020-02-23T15:43:22Z"
],
"AnalyzerDetectionMethod": [
"On-Access Scan",
"On-Access Scan"
],
"BladeName": [
"IDS_BLADE_NAME_SPB",
"IDS_BLADE_NAME_SPB"
],
"ThreatSeverity": [
"2",
"2"
],
"AnalyzerGTIQuery": [
"True",
"True"
],
"AccessRequested": [
"",
""
],
"ecs": {
"version": "1.1.0"
},
"ThreatHandled": [
"True",
"True"
],
"TargetPath": [
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth",
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth"
],
"@metadata": {
"beat": "filebeat",
"version": "7.5.0",
"type": "_doc"
},
"ThreatDetectedOnCreation": [
"True",
"True"
]
},
{
"ThreatType": [
"trojan",
"trojan"
],
"Severity": [
"3",
"3"
],
"DetectionMessage": [
"IDS_OAS_DEFAULT_THREAT_MESSAGE",
"IDS_OAS_DEFAULT_THREAT_MESSAGE"
],
"@timestamp": "2020-05-06T01:46:12.663+0000",
"TargetFileSize": [
"249952",
"249952"
],
"domain": [
"Win-Sec-2",
"Win-Sec-2"
],
"tenantGUID": "{00000000-0000-0000-0000-000000000000}",
"SecondActionStatus": [
"False",
"False"
],
"EPOEvents": "EventFwd",
"DurationBeforeDetection": [
"18",
"18"
],
"Cleanable": [
"True",
"True"
],
"bpsId": "1",
"FirstAttemptedAction": [
"IDS_ALERT_THACT_ATT_CLE",
"IDS_ALERT_THACT_ATT_CLE"
],
"SourceProcessName": [
"C:\\Windows\\explorer.exe",
"C:\\Windows\\explorer.exe"
],
"AnalyzerName": [
"McAfee Endpoint Security",
"McAfee Endpoint Security"
],
"AnalyzerContentCreationDate": [
"2020-02-22T08:24:00Z",
"2020-02-22T08:24:00Z"
],
"TargetAccessTime": [
"2020-02-23T15:43:22Z",
"2020-02-23T15:43:22Z"
],
"TargetCreateTime": [
"2020-02-23T15:43:21Z",
"2020-02-23T15:43:21Z"
],
"TargetHostName": [
"WinSec3",
"WinSec3"
],
"logzio_codec": "plain",
"DetectedUTC": [
"2020-02-23T15:43:40Z",
"2020-02-23T15:43:40Z"
],
"Analyzer": [
"ENDP_AM_1060",
"ENDP_AM_1060"
],
"TargetHash": [
"81da244a770c46ace2cf112214f8e75e",
"81da244a770c46ace2cf112214f8e75e"
],
"AttackVectorType": [
"4",
"4"
],
"tags": [
"beats-5015",
"_grokparsefailure",
"_grokparsefailure",
"_logz_http_bulk_json_8070"
],
"ThreatActionTaken": [
"IDS_ALERT_ACT_TAK_DEL",
"IDS_ALERT_ACT_TAK_DEL"
],
"ThreatCategory": [
"av.detect",
"av.detect"
],
"AnalyzerEngineVersion": [
"6010.8670",
"6010.8670"
],
"SourceHostName": [
"WinSec3",
"WinSec3"
],
"FirstActionStatus": [
"True",
"True"
],
"TargetName": [
"test.exe",
"test.exe"
],
"TargetFileName": [
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe",
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe"
],
"tenantId": "1",
"log": {
"source": {
"address": "10.0.1.9:49874"
}
},
"GMTTime": [
"2020-02-23T15:43:40",
"2020-02-23T15:43:40"
],
"ThreatEventID": [
"1027",
"1027"
],
"AMCoreContentVersion": [
"3990.0",
"3990.0"
],
"AnalyzerDATVersion": [
"3990.0",
"3990.0"
],
"timestamp": "2020-05-06T01:46:12.663+0000",
"NaturalLangDescription": [
"IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio",
"IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio"
],
"beat_agent": {
"ephemeral_id": "8d15318f-3a3e-436c-a93e-1b6e8fec0cfb",
"type": "filebeat",
"hostname": "SecLinux",
"version": "7.5.0",
"id": "348cbd8b-b4ce-4531-b6d1-ab6beb37d65f"
},
"AnalyzerVersion": [
"10.6.1",
"10.6.1"
],
"TargetUserName": [
"WinSec3\\Logzio",
"WinSec3\\Logzio"
],
"TaskName": [
"IDS_OAS_TASK_NAME",
"IDS_OAS_TASK_NAME"
],
"ThreatName": [
"Trojan-FRTB!81DA244A770C",
"Trojan-FRTB!81DA244A770C"
],
"AnalyzerHostName": [
"WinSec3",
"WinSec3"
],
"EPOevent": {
"SoftwareInfo": {
"CommonFields": {
"AnalyzerDATVersion": "3990.0",
"Analyzer": "ENDP_AM_1060",
"AnalyzerDetectionMethod": "On-Access Scan",
"AnalyzerVersion": "10.6.1",
"AnalyzerEngineVersion": "6010.8670",
"AnalyzerHostName": "WinSec3",
"AnalyzerName": "McAfee Endpoint Security"
},
"Event": {
"EventID": "1027",
"GMTTime": "2020-02-23T15:43:40",
"CustomFields": {
"DetectionMessage": "IDS_OAS_DEFAULT_THREAT_MESSAGE",
"TargetFileSize": "249952",
"SecondActionStatus": "false",
"DurationBeforeDetection": "18",
"Cleanable": "true",
"FirstAttemptedAction": "IDS_ALERT_THACT_ATT_CLE",
"AnalyzerContentCreationDate": "2020-02-22T08:24:00Z",
"TargetAccessTime": "2020-02-23T15:43:22Z",
"AttackVectorType": "4",
"ThreatDetectedOnCreation": "true",
"FirstActionStatus": "true",
"TargetName": "test.exe",
"AMCoreContentVersion": "3990.0",
"NaturalLangDescription": "IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\\Windows\\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\\Logzio",
"TaskName": "IDS_OAS_TASK_NAME",
"TargetHash": "81da244a770c46ace2cf112214f8e75e",
"SecondAttemptedAction": "IDS_ALERT_THACT_ATT_DEL",
"TargetCreateTime": "2020-02-23T15:43:21Z",
"TargetModifyTime": "2020-02-23T15:43:22Z",
"BladeName": "IDS_BLADE_NAME_SPB",
"AnalyzerGTIQuery": "true",
"AccessRequested_obj": {},
"TargetPath": "C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth"
},
"CommonFields": {
"ThreatType": "trojan",
"ThreatEventID": "1027",
"TargetHostName": "WinSec3",
"DetectedUTC": "2020-02-23T15:43:40Z",
"TargetFileName": "C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth\\test.exe",
"ThreatSeverity": "2",
"ThreatCategory": "av.detect",
"TargetUserName": "WinSec3\\Logzio",
"SourceHostName": "WinSec3",
"ThreatName": "Trojan-FRTB!81DA244A770C",
"SourceProcessName": "C:\\Windows\\explorer.exe",
"ThreatActionTaken": "IDS_ALERT_ACT_TAK_DEL",
"ThreatHandled": "true"
},
"Severity": "3"
}
},
"MachineInfo": {
"RawMACAddress": "000d3a373482",
"UserName": "SYSTEM",
"MachineName": "WinSec3",
"OSName": "Windows 10 Workstation",
"TimeZoneBias": "0",
"AgentGUID": "{d140d3c9-53ed-4367-857d-a5a396a97775}",
"IPAddress": "10.0.1.10"
}
},
"SecondAttemptedAction": [
"IDS_ALERT_THACT_ATT_DEL",
"IDS_ALERT_THACT_ATT_DEL"
],
"EventID": [
"1027",
"1027"
],
"input": {
"type": "tcp"
},
"type": "mcafee_epo",
"tenantNodePath": "1\\2",
"TargetModifyTime": [
"2020-02-23T15:43:22Z",
"2020-02-23T15:43:22Z"
],
"AnalyzerDetectionMethod": [
"On-Access Scan",
"On-Access Scan"
],
"BladeName": [
"IDS_BLADE_NAME_SPB",
"IDS_BLADE_NAME_SPB"
],
"ThreatSeverity": [
"2",
"2"
],
"AnalyzerGTIQuery": [
"True",
"True"
],
"AccessRequested": [
"",
""
],
"ecs": {
"version": "1.1.0"
},
"ThreatHandled": [
"True",
"True"
],
"TargetPath": [
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth",
"C:\\Users\\Logzio\\Downloads\\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\\taskhealth"
],
"@metadata": {
"beat": "filebeat",
"version": "7.5.0",
"type": "_doc"
},
"ThreatDetectedOnCreation": [
"True",
"True"
]
}
]
}
Human Readable Output
Logs
| @metadata | @timestamp | AMCoreContentVersion | AccessRequested | Analyzer | AnalyzerContentCreationDate | AnalyzerDATVersion | AnalyzerDetectionMethod | AnalyzerEngineVersion | AnalyzerGTIQuery | AnalyzerHostName | AnalyzerName | AnalyzerVersion | AttackVectorType | BladeName | Cleanable | DetectedUTC | DetectionMessage | DurationBeforeDetection | EPOEvents | EPOevent | EventID | FirstActionStatus | FirstAttemptedAction | GMTTime | NaturalLangDescription | SecondActionStatus | SecondAttemptedAction | Severity | SourceHostName | SourceProcessName | TargetAccessTime | TargetCreateTime | TargetFileName | TargetFileSize | TargetHash | TargetHostName | TargetModifyTime | TargetName | TargetPath | TargetUserName | TaskName | ThreatActionTaken | ThreatCategory | ThreatDetectedOnCreation | ThreatEventID | ThreatHandled | ThreatName | ThreatSeverity | ThreatType | beat_agent | bpsId | domain | ecs | input | log | logzio_codec | tags | tenantGUID | tenantId | tenantNodePath | timestamp | type |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| beat: filebeat version: 7.5.0 type: _doc | 2020-05-06T00:01:04.441+0000 | 3990.0, 3990.0 | , | ENDP_AM_1060, ENDP_AM_1060 | 2020-02-22T08:24:00Z, 2020-02-22T08:24:00Z | 3990.0, 3990.0 | On-Access Scan, On-Access Scan | 6010.8670, 6010.8670 | True, True | WinSec3, WinSec3 | McAfee Endpoint Security, McAfee Endpoint Security | 10.6.1, 10.6.1 | 4, 4 | IDS_BLADE_NAME_SPB, IDS_BLADE_NAME_SPB | True, True | 2020-02-23T15:43:40Z, 2020-02-23T15:43:40Z | IDS_OAS_DEFAULT_THREAT_MESSAGE, IDS_OAS_DEFAULT_THREAT_MESSAGE | 18, 18 | EventFwd | SoftwareInfo: {“CommonFields”: {“AnalyzerDATVersion”: “3990.0”, “Analyzer”: “ENDP_AM_1060”, “AnalyzerDetectionMethod”: “On-Access Scan”, “AnalyzerVersion”: “10.6.1”, “AnalyzerEngineVersion”: “6010.8670”, “AnalyzerHostName”: “WinSec3”, “AnalyzerName”: “McAfee Endpoint Security”}, “Event”: {“EventID”: “1027”, “GMTTime”: “2020-02-23T15:43:40”, “CustomFields”: {“DetectionMessage”: “IDS_OAS_DEFAULT_THREAT_MESSAGE”, “TargetFileSize”: “249952”, “TargetModifyTime”: “2020-02-23T15:43:22Z”, “DurationBeforeDetection”: “18”, “Cleanable”: “true”, “FirstAttemptedAction”: “IDS_ALERT_THACT_ATT_CLE”, “AnalyzerContentCreationDate”: “2020-02-22T08:24:00Z”, “TargetAccessTime”: “2020-02-23T15:43:22Z”, “AttackVectorType”: “4”, “ThreatDetectedOnCreation”: “true”, “FirstActionStatus”: “true”, “TargetName”: “test.exe”, “AMCoreContentVersion”: “3990.0”, “NaturalLangDescription”: “IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio”, “TaskName”: “IDS_OAS_TASK_NAME”, “TargetHash”: “81da244a770c46ace2cf112214f8e75e”, “SecondAttemptedAction”: “IDS_ALERT_THACT_ATT_DEL”, “TargetCreateTime”: “2020-02-23T15:43:21Z”, “SecondActionStatus”: “false”, “BladeName”: “IDS_BLADE_NAME_SPB”, “AnalyzerGTIQuery”: “true”, “AccessRequested_obj”: {}, “TargetPath”: “C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth”}, “CommonFields”: {“ThreatType”: “trojan”, “TargetHostName”: “WinSec3”, “DetectedUTC”: “2020-02-23T15:43:40Z”, “TargetFileName”: “C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe”, “SourceHostName”: “WinSec3”, “ThreatSeverity”: “2”, “ThreatCategory”: “av.detect”, “TargetUserName”: “WinSec3\Logzio”, “SourceProcessName”: “C:\Windows\explorer.exe”, “ThreatName”: “Trojan-FRTB!81DA244A770C”, “ThreatEventID”: “1027”, “ThreatActionTaken”: “IDS_ALERT_ACT_TAK_DEL”, “ThreatHandled”: “true”}, “Severity”: “3”}} MachineInfo: {“RawMACAddress”: “000d3a373482”, “UserName”: “SYSTEM”, “MachineName”: “WinSec3”, “OSName”: “Windows 10 Workstation”, “TimeZoneBias”: “0”, “AgentGUID”: “{d140d3c9-53ed-4367-857d-a5a396a97775}”, “IPAddress”: “10.0.1.10”} | 1027, 1027 | True, True | IDS_ALERT_THACT_ATT_CLE, IDS_ALERT_THACT_ATT_CLE | 2020-02-23T15:43:40, 2020-02-23T15:43:40 | IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio, IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio | False, False | IDS_ALERT_THACT_ATT_DEL, IDS_ALERT_THACT_ATT_DEL | 3, 3 | WinSec3, WinSec3 | C:\Windows\explorer.exe, C:\Windows\explorer.exe | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | 2020-02-23T15:43:21Z, 2020-02-23T15:43:21Z | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe | 249952, 249952 | 81da244a770c46ace2cf112214f8e75e, 81da244a770c46ace2cf112214f8e75e | WinSec3, WinSec3 | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | test.exe, test.exe | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth | WinSec3\Logzio, WinSec3\Logzio | IDS_OAS_TASK_NAME, IDS_OAS_TASK_NAME | IDS_ALERT_ACT_TAK_DEL, IDS_ALERT_ACT_TAK_DEL | av.detect, av.detect | True, True | 1027, 1027 | True, True | Trojan-FRTB!81DA244A770C, Trojan-FRTB!81DA244A770C | 2, 2 | trojan, trojan | ephemeral_id: 8d15318f-3a3e-436c-a93e-1b6e8fec0cfb type: filebeat hostname: SecLinux version: 7.5.0 id: 348cbd8b-b4ce-4531-b6d1-ab6beb37d65f | 1 | Win-Sec-2, Win-Sec-2 | version: 1.1.0 | type: tcp | source: {“address”: “10.0.1.9:49874”} | plain | beats-5015, _grokparsefailure,_grokparsefailure, _logz_http_bulk_json_8070 | {00000000-0000-0000-0000-000000000000} | 1 | 1\2 | 2020-05-06T00:01:04.441+0000 | mcafee_epo |
| beat: filebeat version: 7.5.0 type: _doc | 2020-05-06T02:01:13.778+0000 | 3990.0, 3990.0 | , | ENDP_AM_1060, ENDP_AM_1060 | 2020-02-22T08:24:00Z, 2020-02-22T08:24:00Z | 3990.0, 3990.0 | On-Access Scan, On-Access Scan | 6010.8670, 6010.8670 | True, True | WinSec3, WinSec3 | McAfee Endpoint Security, McAfee Endpoint Security | 10.6.1, 10.6.1 | 4, 4 | IDS_BLADE_NAME_SPB, IDS_BLADE_NAME_SPB | True, True | 2020-02-23T15:43:40Z, 2020-02-23T15:43:40Z | IDS_OAS_DEFAULT_THREAT_MESSAGE, IDS_OAS_DEFAULT_THREAT_MESSAGE | 18, 18 | EventFwd | SoftwareInfo: {“CommonFields”: {“AnalyzerDATVersion”: “3990.0”, “Analyzer”: “ENDP_AM_1060”, “AnalyzerDetectionMethod”: “On-Access Scan”, “AnalyzerVersion”: “10.6.1”, “AnalyzerEngineVersion”: “6010.8670”, “AnalyzerHostName”: “WinSec3”, “AnalyzerName”: “McAfee Endpoint Security”}, “Event”: {“EventID”: “1027”, “GMTTime”: “2020-02-23T15:43:40”, “CustomFields”: {“DetectionMessage”: “IDS_OAS_DEFAULT_THREAT_MESSAGE”, “TargetFileSize”: “249952”, “TargetModifyTime”: “2020-02-23T15:43:22Z”, “DurationBeforeDetection”: “18”, “Cleanable”: “true”, “FirstAttemptedAction”: “IDS_ALERT_THACT_ATT_CLE”, “AnalyzerContentCreationDate”: “2020-02-22T08:24:00Z”, “TargetAccessTime”: “2020-02-23T15:43:22Z”, “AttackVectorType”: “4”, “ThreatDetectedOnCreation”: “true”, “FirstActionStatus”: “true”, “TargetName”: “test.exe”, “AMCoreContentVersion”: “3990.0”, “NaturalLangDescription”: “IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio”, “TaskName”: “IDS_OAS_TASK_NAME”, “TargetHash”: “81da244a770c46ace2cf112214f8e75e”, “SecondAttemptedAction”: “IDS_ALERT_THACT_ATT_DEL”, “TargetCreateTime”: “2020-02-23T15:43:21Z”, “SecondActionStatus”: “false”, “BladeName”: “IDS_BLADE_NAME_SPB”, “AnalyzerGTIQuery”: “true”, “AccessRequested_obj”: {}, “TargetPath”: “C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth”}, “CommonFields”: {“ThreatType”: “trojan”, “TargetHostName”: “WinSec3”, “DetectedUTC”: “2020-02-23T15:43:40Z”, “TargetFileName”: “C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe”, “SourceHostName”: “WinSec3”, “ThreatSeverity”: “2”, “ThreatCategory”: “av.detect”, “TargetUserName”: “WinSec3\Logzio”, “SourceProcessName”: “C:\Windows\explorer.exe”, “ThreatName”: “Trojan-FRTB!81DA244A770C”, “ThreatEventID”: “1027”, “ThreatActionTaken”: “IDS_ALERT_ACT_TAK_DEL”, “ThreatHandled”: “true”}, “Severity”: “3”}} MachineInfo: {“RawMACAddress”: “000d3a373482”, “UserName”: “SYSTEM”, “MachineName”: “WinSec3”, “OSName”: “Windows 10 Workstation”, “TimeZoneBias”: “0”, “AgentGUID”: “{d140d3c9-53ed-4367-857d-a5a396a97775}”, “IPAddress”: “10.0.1.10”} | 1027, 1027 | True, True | IDS_ALERT_THACT_ATT_CLE, IDS_ALERT_THACT_ATT_CLE | 2020-02-23T15:43:40, 2020-02-23T15:43:40 | IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio, IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio | False, False | IDS_ALERT_THACT_ATT_DEL, IDS_ALERT_THACT_ATT_DEL | 3, 3 | WinSec3, WinSec3 | C:\Windows\explorer.exe, C:\Windows\explorer.exe | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | 2020-02-23T15:43:21Z, 2020-02-23T15:43:21Z | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe | 249952, 249952 | 81da244a770c46ace2cf112214f8e75e, 81da244a770c46ace2cf112214f8e75e | WinSec3, WinSec3 | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | test.exe, test.exe | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth | WinSec3\Logzio, WinSec3\Logzio | IDS_OAS_TASK_NAME, IDS_OAS_TASK_NAME | IDS_ALERT_ACT_TAK_DEL, IDS_ALERT_ACT_TAK_DEL | av.detect, av.detect | True, True | 1027, 1027 | True, True | Trojan-FRTB!81DA244A770C, Trojan-FRTB!81DA244A770C | 2, 2 | trojan, trojan | ephemeral_id: 8d15318f-3a3e-436c-a93e-1b6e8fec0cfb type: filebeat hostname: SecLinux version: 7.5.0 id: 348cbd8b-b4ce-4531-b6d1-ab6beb37d65f | 1 | Win-Sec-2, Win-Sec-2 | version: 1.1.0 | type: tcp | source: {“address”: “10.0.1.9:49874”} | plain | beats-5015, _grokparsefailure,_grokparsefailure, _logz_http_bulk_json_8070 | {00000000-0000-0000-0000-000000000000} | 1 | 1\2 | 2020-05-06T02:01:13.778+0000 | mcafee_epo |
| beat: filebeat version: 7.5.0 type: _doc | 2020-05-06T02:16:14.944+0000 | 3990.0, 3990.0 | , | ENDP_AM_1060, ENDP_AM_1060 | 2020-02-22T08:24:00Z, 2020-02-22T08:24:00Z | 3990.0, 3990.0 | On-Access Scan, On-Access Scan | 6010.8670, 6010.8670 | True, True | WinSec3, WinSec3 | McAfee Endpoint Security, McAfee Endpoint Security | 10.6.1, 10.6.1 | 4, 4 | IDS_BLADE_NAME_SPB, IDS_BLADE_NAME_SPB | True, True | 2020-02-23T15:43:40Z, 2020-02-23T15:43:40Z | IDS_OAS_DEFAULT_THREAT_MESSAGE, IDS_OAS_DEFAULT_THREAT_MESSAGE | 18, 18 | EventFwd | SoftwareInfo: {“CommonFields”: {“AnalyzerDATVersion”: “3990.0”, “Analyzer”: “ENDP_AM_1060”, “AnalyzerDetectionMethod”: “On-Access Scan”, “AnalyzerVersion”: “10.6.1”, “AnalyzerEngineVersion”: “6010.8670”, “AnalyzerHostName”: “WinSec3”, “AnalyzerName”: “McAfee Endpoint Security”}, “Event”: {“EventID”: “1027”, “GMTTime”: “2020-02-23T15:43:40”, “CustomFields”: {“DetectionMessage”: “IDS_OAS_DEFAULT_THREAT_MESSAGE”, “TargetFileSize”: “249952”, “TargetModifyTime”: “2020-02-23T15:43:22Z”, “DurationBeforeDetection”: “18”, “Cleanable”: “true”, “FirstAttemptedAction”: “IDS_ALERT_THACT_ATT_CLE”, “AnalyzerContentCreationDate”: “2020-02-22T08:24:00Z”, “TargetAccessTime”: “2020-02-23T15:43:22Z”, “AttackVectorType”: “4”, “ThreatDetectedOnCreation”: “true”, “FirstActionStatus”: “true”, “TargetName”: “test.exe”, “AMCoreContentVersion”: “3990.0”, “NaturalLangDescription”: “IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio”, “TaskName”: “IDS_OAS_TASK_NAME”, “TargetHash”: “81da244a770c46ace2cf112214f8e75e”, “SecondAttemptedAction”: “IDS_ALERT_THACT_ATT_DEL”, “TargetCreateTime”: “2020-02-23T15:43:21Z”, “SecondActionStatus”: “false”, “BladeName”: “IDS_BLADE_NAME_SPB”, “AnalyzerGTIQuery”: “true”, “AccessRequested_obj”: {}, “TargetPath”: “C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth”}, “CommonFields”: {“ThreatType”: “trojan”, “TargetHostName”: “WinSec3”, “DetectedUTC”: “2020-02-23T15:43:40Z”, “TargetFileName”: “C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe”, “SourceHostName”: “WinSec3”, “ThreatSeverity”: “2”, “ThreatCategory”: “av.detect”, “TargetUserName”: “WinSec3\Logzio”, “SourceProcessName”: “C:\Windows\explorer.exe”, “ThreatName”: “Trojan-FRTB!81DA244A770C”, “ThreatEventID”: “1027”, “ThreatActionTaken”: “IDS_ALERT_ACT_TAK_DEL”, “ThreatHandled”: “true”}, “Severity”: “3”}} MachineInfo: {“RawMACAddress”: “000d3a373482”, “UserName”: “SYSTEM”, “MachineName”: “WinSec3”, “OSName”: “Windows 10 Workstation”, “TimeZoneBias”: “0”, “AgentGUID”: “{d140d3c9-53ed-4367-857d-a5a396a97775}”, “IPAddress”: “10.0.1.10”} | 1027, 1027 | True, True | IDS_ALERT_THACT_ATT_CLE, IDS_ALERT_THACT_ATT_CLE | 2020-02-23T15:43:40, 2020-02-23T15:43:40 | IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio, IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio | False, False | IDS_ALERT_THACT_ATT_DEL, IDS_ALERT_THACT_ATT_DEL | 3, 3 | WinSec3, WinSec3 | C:\Windows\explorer.exe, C:\Windows\explorer.exe | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | 2020-02-23T15:43:21Z, 2020-02-23T15:43:21Z | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe | 249952, 249952 | 81da244a770c46ace2cf112214f8e75e, 81da244a770c46ace2cf112214f8e75e | WinSec3, WinSec3 | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | test.exe, test.exe | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth | WinSec3\Logzio, WinSec3\Logzio | IDS_OAS_TASK_NAME, IDS_OAS_TASK_NAME | IDS_ALERT_ACT_TAK_DEL, IDS_ALERT_ACT_TAK_DEL | av.detect, av.detect | True, True | 1027, 1027 | True, True | Trojan-FRTB!81DA244A770C, Trojan-FRTB!81DA244A770C | 2, 2 | trojan, trojan | ephemeral_id: 8d15318f-3a3e-436c-a93e-1b6e8fec0cfb type: filebeat hostname: SecLinux version: 7.5.0 id: 348cbd8b-b4ce-4531-b6d1-ab6beb37d65f | 1 | Win-Sec-2, Win-Sec-2 | version: 1.1.0 | type: tcp | source: {“address”: “10.0.1.9:49874”} | plain | beats-5015, _grokparsefailure,_grokparsefailure, _logz_http_bulk_json_8070 | {00000000-0000-0000-0000-000000000000} | 1 | 1\2 | 2020-05-06T02:16:14.944+0000 | mcafee_epo |
| beat: filebeat version: 7.5.0 type: _doc | 2020-05-06T02:31:16.087+0000 | 3990.0, 3990.0 | , | ENDP_AM_1060, ENDP_AM_1060 | 2020-02-22T08:24:00Z, 2020-02-22T08:24:00Z | 3990.0, 3990.0 | On-Access Scan, On-Access Scan | 6010.8670, 6010.8670 | True, True | WinSec3, WinSec3 | McAfee Endpoint Security, McAfee Endpoint Security | 10.6.1, 10.6.1 | 4, 4 | IDS_BLADE_NAME_SPB, IDS_BLADE_NAME_SPB | True, True | 2020-02-23T15:43:40Z, 2020-02-23T15:43:40Z | IDS_OAS_DEFAULT_THREAT_MESSAGE, IDS_OAS_DEFAULT_THREAT_MESSAGE | 18, 18 | EventFwd | SoftwareInfo: {“CommonFields”: {“AnalyzerDATVersion”: “3990.0”, “Analyzer”: “ENDP_AM_1060”, “AnalyzerDetectionMethod”: “On-Access Scan”, “AnalyzerVersion”: “10.6.1”, “AnalyzerEngineVersion”: “6010.8670”, “AnalyzerHostName”: “WinSec3”, “AnalyzerName”: “McAfee Endpoint Security”}, “Event”: {“EventID”: “1027”, “GMTTime”: “2020-02-23T15:43:40”, “CustomFields”: {“DetectionMessage”: “IDS_OAS_DEFAULT_THREAT_MESSAGE”, “TargetFileSize”: “249952”, “TargetModifyTime”: “2020-02-23T15:43:22Z”, “DurationBeforeDetection”: “18”, “Cleanable”: “true”, “FirstAttemptedAction”: “IDS_ALERT_THACT_ATT_CLE”, “AnalyzerContentCreationDate”: “2020-02-22T08:24:00Z”, “TargetAccessTime”: “2020-02-23T15:43:22Z”, “AttackVectorType”: “4”, “ThreatDetectedOnCreation”: “true”, “FirstActionStatus”: “true”, “TargetName”: “test.exe”, “AMCoreContentVersion”: “3990.0”, “NaturalLangDescription”: “IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio”, “TaskName”: “IDS_OAS_TASK_NAME”, “TargetHash”: “81da244a770c46ace2cf112214f8e75e”, “SecondAttemptedAction”: “IDS_ALERT_THACT_ATT_DEL”, “TargetCreateTime”: “2020-02-23T15:43:21Z”, “SecondActionStatus”: “false”, “BladeName”: “IDS_BLADE_NAME_SPB”, “AnalyzerGTIQuery”: “true”, “AccessRequested_obj”: {}, “TargetPath”: “C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth”}, “CommonFields”: {“ThreatType”: “trojan”, “TargetHostName”: “WinSec3”, “DetectedUTC”: “2020-02-23T15:43:40Z”, “TargetFileName”: “C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe”, “SourceHostName”: “WinSec3”, “ThreatSeverity”: “2”, “ThreatCategory”: “av.detect”, “TargetUserName”: “WinSec3\Logzio”, “SourceProcessName”: “C:\Windows\explorer.exe”, “ThreatName”: “Trojan-FRTB!81DA244A770C”, “ThreatEventID”: “1027”, “ThreatActionTaken”: “IDS_ALERT_ACT_TAK_DEL”, “ThreatHandled”: “true”}, “Severity”: “3”}} MachineInfo: {“RawMACAddress”: “000d3a373482”, “UserName”: “SYSTEM”, “MachineName”: “WinSec3”, “OSName”: “Windows 10 Workstation”, “TimeZoneBias”: “0”, “AgentGUID”: “{d140d3c9-53ed-4367-857d-a5a396a97775}”, “IPAddress”: “10.0.1.10”} | 1027, 1027 | True, True | IDS_ALERT_THACT_ATT_CLE, IDS_ALERT_THACT_ATT_CLE | 2020-02-23T15:43:40, 2020-02-23T15:43:40 | IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio, IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio | False, False | IDS_ALERT_THACT_ATT_DEL, IDS_ALERT_THACT_ATT_DEL | 3, 3 | WinSec3, WinSec3 | C:\Windows\explorer.exe, C:\Windows\explorer.exe | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | 2020-02-23T15:43:21Z, 2020-02-23T15:43:21Z | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe | 249952, 249952 | 81da244a770c46ace2cf112214f8e75e, 81da244a770c46ace2cf112214f8e75e | WinSec3, WinSec3 | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | test.exe, test.exe | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth | WinSec3\Logzio, WinSec3\Logzio | IDS_OAS_TASK_NAME, IDS_OAS_TASK_NAME | IDS_ALERT_ACT_TAK_DEL, IDS_ALERT_ACT_TAK_DEL | av.detect, av.detect | True, True | 1027, 1027 | True, True | Trojan-FRTB!81DA244A770C, Trojan-FRTB!81DA244A770C | 2, 2 | trojan, trojan | ephemeral_id: 8d15318f-3a3e-436c-a93e-1b6e8fec0cfb type: filebeat hostname: SecLinux version: 7.5.0 id: 348cbd8b-b4ce-4531-b6d1-ab6beb37d65f | 1 | Win-Sec-2, Win-Sec-2 | version: 1.1.0 | type: tcp | source: {“address”: “10.0.1.9:49874”} | plain | beats-5015, _grokparsefailure,_grokparsefailure, _logz_http_bulk_json_8070 | {00000000-0000-0000-0000-000000000000} | 1 | 1\2 | 2020-05-06T02:31:16.087+0000 | mcafee_epo |
| beat: filebeat version: 7.5.0 type: _doc | 2020-05-06T01:46:12.663+0000 | 3990.0, 3990.0 | , | ENDP_AM_1060, ENDP_AM_1060 | 2020-02-22T08:24:00Z, 2020-02-22T08:24:00Z | 3990.0, 3990.0 | On-Access Scan, On-Access Scan | 6010.8670, 6010.8670 | True, True | WinSec3, WinSec3 | McAfee Endpoint Security, McAfee Endpoint Security | 10.6.1, 10.6.1 | 4, 4 | IDS_BLADE_NAME_SPB, IDS_BLADE_NAME_SPB | True, True | 2020-02-23T15:43:40Z, 2020-02-23T15:43:40Z | IDS_OAS_DEFAULT_THREAT_MESSAGE, IDS_OAS_DEFAULT_THREAT_MESSAGE | 18, 18 | EventFwd | SoftwareInfo: {“CommonFields”: {“AnalyzerDATVersion”: “3990.0”, “Analyzer”: “ENDP_AM_1060”, “AnalyzerDetectionMethod”: “On-Access Scan”, “AnalyzerVersion”: “10.6.1”, “AnalyzerEngineVersion”: “6010.8670”, “AnalyzerHostName”: “WinSec3”, “AnalyzerName”: “McAfee Endpoint Security”}, “Event”: {“EventID”: “1027”, “GMTTime”: “2020-02-23T15:43:40”, “CustomFields”: {“DetectionMessage”: “IDS_OAS_DEFAULT_THREAT_MESSAGE”, “TargetFileSize”: “249952”, “TargetModifyTime”: “2020-02-23T15:43:22Z”, “DurationBeforeDetection”: “18”, “Cleanable”: “true”, “FirstAttemptedAction”: “IDS_ALERT_THACT_ATT_CLE”, “AnalyzerContentCreationDate”: “2020-02-22T08:24:00Z”, “TargetAccessTime”: “2020-02-23T15:43:22Z”, “AttackVectorType”: “4”, “ThreatDetectedOnCreation”: “true”, “FirstActionStatus”: “true”, “TargetName”: “test.exe”, “AMCoreContentVersion”: “3990.0”, “NaturalLangDescription”: “IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio”, “TaskName”: “IDS_OAS_TASK_NAME”, “TargetHash”: “81da244a770c46ace2cf112214f8e75e”, “SecondAttemptedAction”: “IDS_ALERT_THACT_ATT_DEL”, “TargetCreateTime”: “2020-02-23T15:43:21Z”, “SecondActionStatus”: “false”, “BladeName”: “IDS_BLADE_NAME_SPB”, “AnalyzerGTIQuery”: “true”, “AccessRequested_obj”: {}, “TargetPath”: “C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth”}, “CommonFields”: {“ThreatType”: “trojan”, “TargetHostName”: “WinSec3”, “DetectedUTC”: “2020-02-23T15:43:40Z”, “TargetFileName”: “C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe”, “SourceHostName”: “WinSec3”, “ThreatSeverity”: “2”, “ThreatCategory”: “av.detect”, “TargetUserName”: “WinSec3\Logzio”, “SourceProcessName”: “C:\Windows\explorer.exe”, “ThreatName”: “Trojan-FRTB!81DA244A770C”, “ThreatEventID”: “1027”, “ThreatActionTaken”: “IDS_ALERT_ACT_TAK_DEL”, “ThreatHandled”: “true”}, “Severity”: “3”}} MachineInfo: {“RawMACAddress”: “000d3a373482”, “UserName”: “SYSTEM”, “MachineName”: “WinSec3”, “OSName”: “Windows 10 Workstation”, “TimeZoneBias”: “0”, “AgentGUID”: “{d140d3c9-53ed-4367-857d-a5a396a97775}”, “IPAddress”: “10.0.1.10”} | 1027, 1027 | True, True | IDS_ALERT_THACT_ATT_CLE, IDS_ALERT_THACT_ATT_CLE | 2020-02-23T15:43:40, 2020-02-23T15:43:40 | IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=test.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio, IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetNametest.exe|TargetPath=C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth|ThreatName=Trojan-FRTB!81DA244A770C|SourceProcessName=C:\Windows\explorer.exe|ThreatType=trojan|TargetUserName=WinSec3\Logzio | False, False | IDS_ALERT_THACT_ATT_DEL, IDS_ALERT_THACT_ATT_DEL | 3, 3 | WinSec3, WinSec3 | C:\Windows\explorer.exe, C:\Windows\explorer.exe | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | 2020-02-23T15:43:21Z, 2020-02-23T15:43:21Z | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth\test.exe | 249952, 249952 | 81da244a770c46ace2cf112214f8e75e, 81da244a770c46ace2cf112214f8e75e | WinSec3, WinSec3 | 2020-02-23T15:43:22Z, 2020-02-23T15:43:22Z | test.exe, test.exe | C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth, C:\Users\Logzio\Downloads\2019-12-20-Emotet-and-Trickbot-malware-and-artifacts\taskhealth | WinSec3\Logzio, WinSec3\Logzio | IDS_OAS_TASK_NAME, IDS_OAS_TASK_NAME | IDS_ALERT_ACT_TAK_DEL, IDS_ALERT_ACT_TAK_DEL | av.detect, av.detect | True, True | 1027, 1027 | True, True | Trojan-FRTB!81DA244A770C, Trojan-FRTB!81DA244A770C | 2, 2 | trojan, trojan | ephemeral_id: 8d15318f-3a3e-436c-a93e-1b6e8fec0cfb type: filebeat hostname: SecLinux version: 7.5.0 id: 348cbd8b-b4ce-4531-b6d1-ab6beb37d65f | 1 | Win-Sec-2, Win-Sec-2 | version: 1.1.0 | type: tcp | source: {“address”: “10.0.1.9:49874”} | plain | beats-5015, _grokparsefailure,_grokparsefailure, _logz_http_bulk_json_8070 | {00000000-0000-0000-0000-000000000000} | 1 | 1\2 | 2020-05-06T01:46:12.663+0000 | mcafee_epo |
2. logzio-get-logs-by-event-id
Fetches the logs that triggered a security event in Logz.io Cloud SIEM
Base Command
logzio-get-logs-by-event-id
Input
| Argument Name | Description | Required |
|---|---|---|
| id | Logz.io Alert Event ID (found under Incident details) | Required |
| size | An integer specifying the maximum number of results to return | Optional |
| timeout | Timeout in seconds | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Logzio.Result | Unknown | An array of search results |
| Logzio.Result.type | string | Log type in the index |
| Logzio.Result.timestamp | date | The log’s timestamp |
Command Example
!logzio-get-logs-by-event-id id=9fb0e6a9-90c0-43ac-8e50-23028d8ea76c size=10
Context Example
{
"Logzio.Result": [
{
"log_information": {
"level": "warning"
},
"logzio_codec": "json",
"timestamp": "2020-05-06T08:28:04.640Z",
"@timestamp": "2020-05-06T08:28:04.640Z",
"tags": [
"beats-5015",
"_logzio_codec_json",
"_jsonparsefailure"
],
"ecs": {
"version": "1.4.0"
},
"beat_agent": {
"ephemeral_id": "2e94ea91-0375-4b60-8766-ee6d3f254832",
"type": "winlogbeat",
"hostname": "WinTesting",
"version": "7.6.2",
"id": "3aa2739f-7d9c-48d1-8d95-9441d5fbffe1"
},
"message": "Windows Defender Antivirus has detected malware or other potentially unwanted software.\n For more information please see the following:\nhttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0\n \tName: Virus:DOS/EICAR_Test_File\n \tID: 2147519003\n \tSeverity: Severe\n \tCategory: Virus\n \tPath: containerfile:_C:\\Users\\test_user\\Downloads\\eicar_com.zip; file:_C:\\Users\\test_user\\Downloads\\eicar_com.zip->eicar.com; webfile:_C:\\Users\\test_user\\Downloads\\eicar_com.zip|https://www.eicar.org/download/eicar_com.zip|pid:7500,ProcessStart:132332202146885957\n \tDetection Origin: Internet\n \tDetection Type: Concrete\n \tDetection Source: Downloads and attachments\n \tUser: WinTesting\\test_user\n \tProcess Name: Unknown\n \tSignature Version: AV: 1.315.44.0, AS: 1.315.44.0, NIS: 1.315.44.0\n \tEngine Version: AM: 1.1.17000.7, NIS: 1.1.17000.7",
"winlog": {
"activity_id": "{2baa0795-dcd6-4cf7-b921-d9ad5e9cd6f0}",
"task": "",
"event_id": 1116,
"process": {
"pid": 3232,
"thread": {
"id": 4992
}
},
"api": "wineventlog",
"opcode": "Info",
"user": {
"domain": "NT AUTHORITY",
"identifier": "S-1-5-18",
"type": "User",
"name": "SYSTEM"
},
"computer_name": "WinTesting",
"record_id": 136,
"provider_name": "Microsoft-Windows-Windows Defender",
"provider_guid": "{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}",
"event_data": {
"Type Name": "%%822",
"Error Code": "0x00000000",
"State": "1",
"Category Name": "Virus",
"Additional Actions String": "No additional actions required",
"Post Clean Status": "0",
"Action Name": "%%887",
"Threat ID": "2147519003",
"Signature Version": "AV: 1.315.44.0, AS: 1.315.44.0, NIS: 1.315.44.0",
"Category ID": "42",
"Execution Name": "%%812",
"Detection ID": "{26C3583A-98B2-4E88-9B8A-0E9BDEBEB9B4}",
"Status Code": "1",
"Product Name": "%%827",
"Action ID": "9",
"Path": "containerfile:_C:\\Users\\test_user\\Downloads\\eicar_com.zip; file:_C:\\Users\\test_user\\Downloads\\eicar_com.zip->eicar.com; webfile:_C:\\Users\\test_user\\Downloads\\eicar_com.zip|https://www.eicar.org/download/eicar_com.zip|pid:7500,ProcessStart:132332202146885957",
"Process Name": "Unknown",
"Detection User": "WinTesting\\test_user",
"Detection Time": "2020-05-06T08:28:04.604Z",
"FWLink": "https://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0",
"Execution ID": "0",
"Origin Name": "%%847",
"Error Description": "The operation completed successfully. ",
"Type ID": "0",
"Additional Actions ID": "0",
"Threat Name": "Virus:DOS/EICAR_Test_File",
"Severity ID": "5",
"Severity Name": "Severe",
"Engine Version": "AM: 1.1.17000.7, NIS: 1.1.17000.7",
"Source Name": "%%819",
"Origin ID": "4",
"Pre Execution Status": "0",
"Product Version": "4.18.2004.6",
"Source ID": "4"
},
"channel": "Microsoft-Windows-Windows Defender/Operational",
"event_id_description": "Unknown"
},
"type": "wineventlog",
"event": {
"kind": "event",
"code": 1116,
"provider": "Microsoft-Windows-Windows Defender",
"created": "2020-05-06T08:28:05.674Z"
},
"@metadata": {
"beat": "winlogbeat",
"version": "7.6.2",
"type": "_doc"
}
}
]
}
Human Readable Output
Logs
| @metadata | @timestamp | beat_agent | ecs | event | log_information | logzio_codec | message | tags | timestamp | type | winlog |
|---|---|---|---|---|---|---|---|---|---|---|---|
| beat: winlogbeat type: _doc version: 7.6.2 | 2020-05-06T08:28:04.640Z | hostname: WinTesting id: 3aa2739f-7d9c-48d1-8d95-9441d5fbffe1 version: 7.6.2 type: winlogbeat ephemeral_id: 2e94ea91-0375-4b60-8766-ee6d3f254832 | version: 1.4.0 | kind: event code: 1116 provider: Microsoft-Windows-Windows Defender created: 2020-05-06T08:28:05.674Z | level: warning | json | Windows Defender Antivirus has detected malware or other potentially unwanted software. For more information please see the following: https://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0 Name: Virus:DOS/EICAR_Test_File ID: 2147519003 Severity: Severe Category: Virus Path: containerfile:_C:\Users\test_user\Downloads\eicar_com.zip; file:_C:\Users\test_user\Downloads\eicar_com.zip->eicar.com; webfile:_C:\Users\test_user\Downloads\eicar_com.zip|https://www.eicar.org/download/eicar_com.zip|pid:7500,ProcessStart:132332202146885957 Detection Origin: Internet Detection Type: Concrete Detection Source: Downloads and attachments User: WinTesting\test_user Process Name: Unknown Signature Version: AV: 1.315.44.0, AS: 1.315.44.0, NIS: 1.315.44.0 Engine Version: AM: 1.1.17000.7, NIS: 1.1.17000.7 | beats-5015, _logzio_codec_json,_jsonparsefailure | 2020-05-06T08:28:04.640Z | wineventlog | channel: Microsoft-Windows-Windows Defender/Operational provider_name: Microsoft-Windows-Windows Defender api: wineventlog computer_name: WinTesting user: {“name”: “SYSTEM”, “domain”: “NT AUTHORITY”, “type”: “User”, “identifier”: “S-1-5-18”} provider_guid: {11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78} activity_id: {2baa0795-dcd6-4cf7-b921-d9ad5e9cd6f0} process: {“pid”: 3232, “thread”: {“id”: 4992}} event_data: {“Path”: “containerfile:_C:\Users\test_user\Downloads\eicar_com.zip; file:_C:\Users\test_user\Downloads\eicar_com.zip->eicar.com; webfile:_C:\Users\test_user\Downloads\eicar_com.zip|https://www.eicar.org/download/eicar_com.zip|pid:7500,ProcessStart:132332202146885957”, “Action Name”: “%%887”, “Product Version”: “4.18.2004.6”, “Severity ID”: “5”, “Signature Version”: “AV: 1.315.44.0, AS: 1.315.44.0, NIS: 1.315.44.0”, “Post Clean Status”: “0”, “Execution Name”: “%%812”, “Type ID”: “0”, “Category ID”: “42”, “Engine Version”: “AM: 1.1.17000.7, NIS: 1.1.17000.7”, “Threat Name”: “Virus:DOS/EICAR_Test_File”, “Category Name”: “Virus”, “Origin ID”: “4”, “Error Description”: “The operation completed successfully. “, “Detection User”: “WinTesting\test_user”, “Product Name”: “%%827”, “State”: “1”, “Detection Time”: “2020-05-06T08:28:04.604Z”, “Error Code”: “0x00000000”, “Source Name”: “%%819”, “FWLink”: “https://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0”, “Threat ID”: “2147519003”, “Source ID”: “4”, “Detection ID”: “{26C3583A-98B2-4E88-9B8A-0E9BDEBEB9B4}”, “Status Code”: “1”, “Additional Actions ID”: “0”, “Additional Actions String”: “No additional actions required”, “Severity Name”: “Severe”, “Action ID”: “9”, “Execution ID”: “0”, “Type Name”: “%%822”, “Origin Name”: “%%847”, “Pre Execution Status”: “0”, “Process Name”: “Unknown”} task: opcode: Info event_id: 1116 record_id: 136 event_id_description: Unknown |
Configuration parameters
isFetch— Fetch incidentsincidentType— Incident typeincidentFetchInterval— Incidents Fetch Intervalsecurity_api_token— API token for Logz.io Security accountoperational_api_token— API token for Logz.io Operations accountregion— Region code of your Logz.io accountsearch— Filter by rule nameseverities— Filter by rule severityfetch_time— First fetch time range (<number> <time unit>, e.g., 1 hour, 30 minutes)fetch_count— Max. number of incidents fetched per runinsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (2)
-
logzio-get-logs-by-event-idFetches the logs that triggered a security event in Logz.io Cloud SIEM.
-
logzio-search-logsRuns an Apache Lucene query on your Logz.io Operations account.
import json import time import dateparser import demistomock as demisto import urllib3 from CommonServerPython import * # Disable insecure warnings urllib3.disable_warnings() """ CLIENT CLASS""" DEFAULT_LIMIT = 50 MAX_LOGZIO_DOCS = 1000 ONE_MINUTE = 60 ONE_HOUR = ONE_MINUTE * 60 DEFAULT_TIMEOUT_SEC = 2 MAX_REQUEST_TIMEOUT = 15 DATE_FORMAT = "%Y-%m-%dT%H:%M:%SZ" BASE_URL = "https://api.logz.io/" TRIGGERED_RULES_API_SUFFIX = "v2/security/rules/events/search" SEARCH_LOGS_API_SUFFIX = "v1/search" SEARCH_RULE_LOGS_API_SUFFIX = "v2/security/rules/events/logs/search" SEVERITIES_DICT = {"UNCLASSIFIED": 0, "INFO": 0.5, "LOW": 1, "MEDIUM": 2, "HIGH": 3, "SEVERE": 4} class Client(BaseClient): def __init__(self, region, security_api_token, op_api_token, verify, proxy, max_fetch=DEFAULT_LIMIT): self.security_api_token = security_api_token self.op_api_token = op_api_token self.region = region self.max_fetch = max_fetch super().__init__(self.get_base_api_url(), verify, proxy) def fetch_triggered_rules(self, search=None, severities=None, start_time=time.time()): payload = { "pagination": {"pageNumber": 1, "pageSize": self.max_fetch}, "sort": [{"field": "DATE", "descending": False}], "filter": { "searchTerm": search, "severities": severities, "timeRange": { "fromDate": start_time, "toDate": time.time() - (ONE_MINUTE * 3), # 3 Minutes delay for missing/incomplete indexing }, }, } remove_nulls_from_dictionary(payload["filter"]) remove_nulls_from_dictionary(payload) return self.execute_api(TRIGGERED_RULES_API_SUFFIX, payload, self.security_api_token) def search_logs(self, query, size, from_time, to_time, timeout=DEFAULT_TIMEOUT_SEC): payload = {"query": {"bool": {"must": [{"query_string": {"query": query}}]}}, "size": size} if from_time is not None or to_time is not None: time_filter = {} if from_time is not None: if not from_time.isdigit(): orig_time = from_time from_time = dateparser.parse(from_time, settings={"TIMEZONE": "UTC"}) if from_time is None: raise Exception(f"Counld not parse from_time parameter: {orig_time}") from_time = int(time.mktime(from_time.timetuple())) * 1000 time_filter["from"] = from_time time_filter["include_lower"] = True if to_time is not None: if not to_time.isdigit(): orig_time = from_time to_time = dateparser.parse(to_time, settings={"TIMEZONE": "UTC"}) if to_time is None: raise Exception(f"Counld not parse from_time parameter: {orig_time}") to_time = int(time.mktime(to_time.timetuple())) * 1000 time_filter["to"] = to_time time_filter["include_upper"] = True payload["query"]["bool"]["must"].append({"range": {"@timestamp": time_filter}}) response = self.execute_api(SEARCH_LOGS_API_SUFFIX, payload, self.op_api_token, timeout) return response.get("hits", {}).get("hits", {}) def get_rule_logs(self, id, size, page_size=MAX_LOGZIO_DOCS, timeout=DEFAULT_TIMEOUT_SEC): payload = {"filter": {"alertEventId": id}, "pagination": {"pageNumber": 1, "pageSize": page_size}} response = self.execute_api(SEARCH_RULE_LOGS_API_SUFFIX, payload, self.security_api_token, timeout) total = response.get("total", 0) results = response.get("results", []) if total > page_size and size > page_size: for i in range(2, (min(size, total) + page_size - 1) // page_size + 1): # Ceiling division payload["pagination"]["pageNumber"] = i response = self.execute_api(SEARCH_RULE_LOGS_API_SUFFIX, payload, self.security_api_token, timeout) results += response.get("results", []) return results def get_base_api_url(self): return BASE_URL.replace("api.", f"api{self.get_region_code()}.") def get_region_code(self): if self.region != "us" and self.region != "": return f"-{self.region}" return "" def execute_api(self, url_suffix, payload, api_token, timeout=None): if timeout is None or float(timeout) > 15: timeout = 15 headers = {"Content-Type": "application/json", "X-API-TOKEN": api_token} return BaseClient._http_request( self, "POST", url_suffix, headers=headers, data=json.dumps(payload), ok_codes=(200,), timeout=float(timeout) ) """ COMMANDS + REQUESTS FUNCTIONS """ def test_module(client): try: client.fetch_triggered_rules() client.search_logs("*", 10, None, None) return "ok" except Exception as e: return f"Test failed: {e}" def get_formatted_logs(response): content = [] for log in response: if "@timestamp" in log: log["timestamp"] = log["@timestamp"] content.append(log) if len(content) == 0: context = None readable = "### No logs were found" else: context = {"Logzio.Result": content} readable = tableToMarkdown("Logs", content) return readable, context def search_logs_command(client, args): if client.op_api_token is None: raise Exception("Operational API Token wasn't provided, cannot perform search") query = args.get("query") size = args.get("size", MAX_LOGZIO_DOCS) from_time = args.get("from_time") to_time = args.get("to_time") timeout = args.get("timeout", DEFAULT_TIMEOUT_SEC) resp = [log["_source"] for log in client.search_logs(query, size, from_time, to_time, timeout)] readable, context = get_formatted_logs(resp) return_outputs(readable, context, resp) def get_rule_logs_by_id_command(client, args): if client.security_api_token is None: raise Exception("Security API Token wasn't provided, cannot perform search") id = args.get("id") size = int(args.get("size", 100)) page_size = int(args.get("page_size", MAX_LOGZIO_DOCS)) timeout = int(args.get("timeout", DEFAULT_TIMEOUT_SEC)) resp = client.get_rule_logs(id, size, page_size, timeout) readable, context = get_formatted_logs(resp) return_outputs(readable, context, resp) def fetch_incidents(client, last_run, search, severities, first_fetch_time): if client.security_api_token is None: raise Exception("Security API Token wasn't provided, cannot fetch incidents") incidents = [] next_run = last_run start_query_time = last_run.get("last_fetch") if not start_query_time: start_query_time, _ = parse_date_range(first_fetch_time, date_format=DATE_FORMAT, utc=False, to_timestamp=True) start_query_time = start_query_time / 1000 next_run["last_fetch"] = max(start_query_time, time.time() - ONE_HOUR) raw_events = client.fetch_triggered_rules(search=search, severities=severities, start_time=start_query_time) for event in raw_events.get("results", []): if "groupBy" in event: for field in event["groupBy"]: event[field] = event["groupBy"][field] del event["groupBy"] if "hits" in event: del event["hits"] # this field is incorrect event_date = datetime.fromtimestamp(event["eventDate"]) event_date_string = event_date.strftime(DATE_FORMAT) event["datasource"] = "Logz.Io" incident = { "name": event.get("name", ""), "rawJSON": json.dumps(event), "occurred": event_date_string, "severity": SEVERITIES_DICT[event.get("severity", "UNCLASSIFIED")], } incidents.append(incident) if incidents: last_incident = raw_events.get("results", [{}])[-1] latest_event_timestamp = last_incident.get("eventDate", last_run.get("last_fetch")) next_run["last_fetch"] = latest_event_timestamp + 0.1 # The addition here is so we won't have duplicates return incidents, next_run """ COMMANDS MANAGER / SWITCH PANEL """ def main(): try: security_api_token = demisto.params().get("security_api_token") op_api_token = demisto.params().get("operational_api_token") if security_api_token is None and op_api_token is None: raise ValueError( "No tokens were provided. Please provide either Logz.io Operational API token," " Logz.io Security API token, or both." ) region = demisto.params().get("region") first_fetch_time = demisto.params().get("fetch_time", "1 hours") severities = demisto.params().get("severities") search = demisto.params().get("search") max_fetch = demisto.params().get("fetch_count", DEFAULT_LIMIT) verify = not demisto.params().get("insecure", False) proxy = demisto.params().get("proxy", False) client = Client(region, security_api_token, op_api_token, verify, proxy, max_fetch) command = demisto.command() # Run the commands if command == "logzio-search-logs": search_logs_command(client, demisto.args()) elif command == "logzio-get-logs-by-event-id": get_rule_logs_by_id_command(client, demisto.args()) elif demisto.command() == "test-module": # This is the call made when pressing the integration Test button. return_outputs(test_module(client)) elif demisto.command() == "fetch-incidents": incidents, next_run = fetch_incidents( client=client, last_run=demisto.getLastRun(), first_fetch_time=first_fetch_time, search=search, severities=severities, ) demisto.setLastRun(next_run) demisto.incidents(incidents) except Exception as e: return_error(f"Failed to execute command. Error: {e!s}") if __name__ in ("__main__", "__builtin__", "builtins"): main()