TrendAI™ Deep Security™ Modeling Rule

Details

ID	`Trend_Micro_Deep_Security_ModelingRule`
From Version	8.15.0
Tags	Trend Micro TrendMicro Deep Security DeepSecurity

Schema

`trend_micro_deep_security_manager_raw`

Field	Type	Array?
`TrendMicroDsTags`	string	—
`TrendMicroDsTenant`	string	—
`TrendMicroDsTenantId`	string	—
`cefDeviceEventClassId`	string	—
`cefDeviceProduct`	string	—
`cefDeviceVendor`	string	—
`cefDeviceVersion`	string	—
`cefName`	string	—
`cefSeverity`	string	—
`cefVersion`	string	—
`msg`	string	—
`src`	string	—
`suser`	string	—
`target`	string	—
`targetID`	string	—
`targetType`	string	—

`trend_micro_deep_security_agent_raw`

Field	Type	Array?
`TrendMicroDsBehaviorRuleID`	string	—
`TrendMicroDsBehaviorType`	string	—
`TrendMicroDsCommandLine`	string	—
`TrendMicroDsCve`	string	—
`TrendMicroDsFileMD5`	string	—
`TrendMicroDsFileSHA256`	string	—
`TrendMicroDsMalwareTarget`	string	—
`TrendMicroDsMalwareTargetType`	string	—
`TrendMicroDsMitre`	string	—
`TrendMicroDsProcess`	string	—
`TrendMicroDsRelevantDetectionNames`	string	—
`TrendMicroDsTags`	string	—
`TrendMicroDsTenant`	string	—
`TrendMicroDsTenantId`	string	—
`act`	string	—
`cefDeviceEventClassId`	string	—
`cefDeviceProduct`	string	—
`cefDeviceVendor`	string	—
`cefDeviceVersion`	string	—
`cefName`	string	—
`cefSeverity`	string	—
`cefVersion`	string	—
`cn1`	int	—
`cn2`	int	—
`cn3`	int	—
`cnt`	int	—
`cs1`	string	—
`cs2`	string	—
`cs3`	string	—
`cs4`	string	—
`cs5`	string	—
`cs6`	string	—
`dmac`	string	—
`dpt`	int	—
`dst`	string	—
`duser`	string	—
`dvc`	string	—
`dvchost`	string	—
`fileHash`	string	—
`filePath`	string	—
`fname`	string	—
`fsize`	string	—
`in`	string	—
`msg`	string	—
`oldfilePath`	string	—
`out`	string	—
`proto`	string	—
`request`	string	—
`result`	string	—
`shost`	string	—
`smac`	string	—
`sproc`	string	—
`spt`	int	—
`src`	string	—
`suid`	string	—
`suser`	string	—
`xff`	string	—

Source

TrendMicroDeepSecurity_2_11.xif TrendMicroDeepSecurity_2_11.yml TrendMicroDeepSecurity_2_11_schema.json

Download History Raw

fromversion: 8.15.0
id: Trend_Micro_Deep_Security_ModelingRule
name: TrendAI™ Deep Security™ Modeling Rule
rules: ''
schema: ''
tags: Trend Micro TrendMicro Deep Security DeepSecurity
supportedModules:
- xsiam