EVID 1121 : ASR Rule Blocked Activity

https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Rule Name

Rule Type

Classification

Common Event

EVID 1121 : ASR Rule Blocked Activity

Base Rule

Failed Activity

Process Blocked

Device Key in log message

LogRhythm Schema

Data Type

Schema Description

Provider

N/A

N/A

Identifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.

EventID

<vmid>

Number

The identifier that the provider used to identify the event.

Version

N/A

N/A

The version number of the event's definition.

Level

<severity>

Text/String

The severity level defined in the event.

Task

N/A

N/A

The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.

Opcode

N/A

N/A

The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.

Keywords

N/A

N/A

A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).

TimeCreated 

N/A

N/A

The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.

EventRecordID

N/A

N/A

The record number assigned to the event when it was logged.

Correlation 

N/A

N/A

The activity identifiers that consumers can use to group related events together.

Execution 

N/A

N/A

Contains information about the process and thread that logged the event.

Channel

N/A

N/A

The channel to which the event was logged.

Computer

<dname>

Text/String

The name of the computer on which the event occurred.

Security 

N/A

N/A

N/A

Product Name

N/A

N/A

N/A

Product Version

<version>

Text/String

N/A

Unused

N/A

N/A

N/A

ID

<session>

Text/String

N/A

Detection Time

N/A

N/A

N/A

User

<login>

Text/String

N/A

Path

<parentprocesspath>

Text/String

N/A

Process Name

<process>

Text/String

N/A

Security intelligence Version

N/A

N/A

N/A

Engine Version

N/A

N/A

N/A

RuleType

<objecttype>

Text/String

N/A

Target Commandline

<command>

Text/String

N/A

Parent Commandline

N/A

N/A

N/A

Involved File

N/A

N/A

N/A

Inhertiance Flags

<status>

Text/String

N/A