Dragos Events

Dragos Events

Base Rule

Operations : Information

General Alert Message

Dragos Configuration Alert

Sub Rule

Operations : Information

General Alert Message

Dragos Indicator Alert

Sub Rule

Security : Attack

General Attack Activity

Dragos Modeling Alert

Sub Rule

Security : Attack

General Attack Activity

Dragos Threat Behavior Alert

Sub Rule

Security : Attack

General Attack Activity

(CEF Header) Version

N/A

 N/A

 N/A

(CEF Header) Device Vendor

N/A

N/A

 N/A

(CEF Header) Device Product

N/A

N/A

 N/A

(CEF Header) Device Version

<version>

Number

 N/A

(CEF Header) Signature ID

N/A

N/A

 N/A

(CEF Header) Name

<vmid>

String

Summary of the Event. 

(CEF Header) Severity

<severity>

Number

Dragos Event Severity. 

content

<vendorinfo>

Text/String

Detailed description of the Event. 

asset_id

N/A

N/A

Asset ID for single Asset Events.

asset_ip

N/A

N/A

Asset IP Address(s) for single Asset Events. 

asset_class

 N/A

 N/A

Asset class for single asset events.

asset_hostname

N/A

Text/String

Asset Hostname(s) for single Asset Events. 

asset_mac

N/A

Text/String

Asset MAC Address(s) for single Asset events. 

asset_domain

N/A

Text/String

Asset Domain(s) for single Asset Events. 

dst_asset_id

N/A

N/A

Destination asset ID for multi-asset events.

dst_asset_ip

<dip>

Text/String

Destination asset IP address(s) for multi-asset events.

dst_asset_hostname

<dname>

Text/String

Destination asset name for multi-asset events.

dst_asset_mac

<dmac>

Text/String

Destination asset MAC Address(s) for multi-asset events.

dst_asset_domain

<domainimpacted>

Text/String

Destination asset domain for multi-asset events.

src_asset_id

N/A

N/A

Source asset ID for multi-asset events.

src_asset_ip

<sip>

Text/String

Source asset IP address(s) for multi-asset events.

src_asset_hostname

<sname>

Text/String

Source asset name for multi-asset events.

src_asset_mac

<smac>

Text/String

Source asset MAC Address(s) for multi-asset events.

src_asset_domain

<domainorigin>

Text/String

Source asset domain for multi-asset events.

id

<threatid>

Number

Unique ID for the Event. 

createdAt

N/A

N/A

Date and time Event was created. 

detection_quad

<objecttype>
<tag1>

String

Dragos Threat Detection Type

detector_Id

<object>

Text/String

Unique ID of the Collector 

matchedRuleId

N/A

N/A

Unique ID for the Match Rule. 

attack_tactic

N/A

N/A

List of Dragos Attack Tactic Types

attack_technique

<threatname>

String

List of Dragos Attack Technique Types

occurredAt

N/A

N/A

Date and time the Event occurred. 

originalSeverity

N/A

N/A

Original Dragos severity. 

reviewed

N/A

N/A

True if the Event has been reviewed. 

type

N/A

N/A

Type of Event.

sensor_description

N/A

N/A

 N/A

sensor_hostname

N/A

N/A

 N/A

sensor_geo

N/A

N/A

 N/A