Symantec EDR Event layout

Layout for Symantec EDR event

Symantec Endpoint Detection and Response Incident

Details

IDSymantec EDR Event layout
Groupincident
Version-1
From Version6.10.0

Layout Structure

Case info 7 sections

EDR Events Details

Field IDPosition
externalid Col 0-2, Height: 22
deviceid Col 0-2, Height: 22
devicename Col 0-2, Height: 22
deviceusername Col 0-2, Height: 22
devicelocalip Col 0-2, Height: 22
deviceexternalip Col 0-2, Height: 22
devicemacaddress Col 0-2, Height: 22
destinationmacaddress Col 0-2, Height: 22
devicename Col 0-2, Height: 22
deviceosname Col 0-2, Height: 22
usersid Col 2-4, Height: 22
domainname Col 2-4, Height: 22
destinationport Col 2-4, Height: 22
hostname Col 2-4, Height: 22
sourceport Col 2-4, Height: 22
sourcehostname Col 2-4, Height: 22
sourceip Col 2-4, Height: 22
symantecedrlogname Col 2-4, Height: 22

Case Details

Field IDPosition
type Col 0-2, Height: 22
dbotsource Col 0-2, Height: 22
description Col 0-2, Height: 22
eventtype Col 0-2, Height: 22
symantecedreventtypeid Col 0-2, Height: 22
sourceinstance Col 0-2, Height: 22
sourcebrand Col 0-2, Height: 22
severity Col 0-2, Height: 22
owner Col 0-2, Height: 22
playbookid Col 0-2, Height: 22
occurred Col 0-2, Height: 22

Notes

Team Members

Work Plan

EDR Events Attacks

Field IDPosition
techniqueid Col 0-2, Height: 22
technique Col 0-2, Height: 22
tacticid Col 0-2, Height: 22
tactic Col 0-2, Height: 22

Malicious or Suspicious Indicators

Investigation 12 sections

Event Actor

Field IDPosition
symantecedreventactor Col 0-6, Height: 106

Event Actor File

Field IDPosition
symantecedreventactorfile Col 0-6, Height: 106

Event User

Field IDPosition
symantecedreventactoruser Col 0-2, Height: 106

Event Process

Field IDPosition
processid Col 0-2, Height: 22
processpath Col 0-2, Height: 22
processmd5 Col 0-2, Height: 22
processsha256 Col 0-2, Height: 22

EDR Event File

Field IDPosition
filename Col 0-2, Height: 22
filepath Col 0-2, Height: 22
filemd5 Col 0-2, Height: 22
filesha256 Col 0-2, Height: 22

SymantecEDR Antivirus

Field IDPosition
symantecedrantivirus Col 0-2, Height: 22

SymantecEDR Receiver

Field IDPosition
emailfrom Col 0-2, Height: 22
emailsentsuccessfully Col 0-2, Height: 22

SymantecEDR Sender

Field IDPosition
emailto Col 0-2, Height: 22
emailsenderip Col 0-2, Height: 22

SymantecEDR Intrusion

SymantecEDR Threat

Registry

Field IDPosition
registryvaluetype Col 0-2, Height: 22
registryvalue Col 0-2, Height: 22
registrykey Col 0-2, Height: 22

Enriched Data

Field IDPosition
rulename Col 0-2, Height: 22
details Col 0-2, Height: 22
War Room 0 sections

No sections defined.

Work Plan 0 sections

No sections defined.

Canvas 0 sections

No sections defined.