EVID : 18059 : EPO - Network Threat Blocked

EVID : 18059 : EPO - Network Threat Blocked

Base Rule

Failed Attack

Failed General Attack Activity

MachineName

N/A

N/A

Name of the system hosting the detecting product.

AgentGUID

N/A

N/A

Unique identifier of the agent that forwarded the event.

IPAddress

N/A

N/A

IP address of the system hosting the detecting product (if given in the event).

OSName

N/A

N/A

N/A

UserName

<domainimpacted><account>

Text/String

N/A

TimeZoneBias

N/A

N/A

N/A

RawMACAddress

N/A

N/A

MAC address of the system hosting the detecting product.

ProductName

<vendorinfo>

Text/String

Name of the detecting managed product.

ProductVersion

<version>

Text/String/Number

Version number of the detecting product.

ProductFamily

N/A

N/A

N/A

Analyzer

N/A

N/A

N/A

AnalyzerName

N/A

N/A

Name of the detecting managed product.

AnalyzerVersion

N/A

N/A

Version number of the detecting product.

AnalyzerHostName

N/A

N/A

Name of the system hosting the detecting product.

AnalyzerDetectionMethod

N/A

N/A

The name of the task or task type that was responsible for detecting the threat.

EventID

<vmid>

Number

Unique identifier of the event class.

Severity

N/A

N/A

N/A

GMTTime

N/A

N/A

N/A

ThreatCategory

<subject>

Text/String

Category of the event. Possible categories depend on the product.

ThreatEventID

N/A

N/A

Unique identifier of the event class.

ThreatName

<threatname>

Text/String

Name of the threat.

ThreatType

N/A

Text/String

Class of the threat.

ThreatActionTaken

<action>

Text/String

The action taken by the product in response to the threat.

ThreatHandled

<result>

Text/String

Specifies whether the action taken was successful.

SourceIPV4

<sip>

IP Address

IPv4 address of the system from which the threat originated (if given in the event).

SourceMAC

<smac>

Text/String

MAC address of the system from which the threat originated (if given in the event).

TargetHostName

<dname>

Text/String

Name of the system that created the event.

TargetIPV4

<dip>

IP Address

IPv4 address of the system that sent the event.

TargetPort

<dport>

Number

The threat target port for threat classes.

TargetMAC

<dmac>

Text/String

MAC address of the system that sent the event.

ThreatSeverity

<severity>

Text/String/Number

The severity of the detected threat as defined by each managed product.