General Catch All Level

https://kcm.trellix.com/corporate/index?page=content&id=KB54677

General Catch All Level

Base Rule

Information

General Information

EVID 2022: Boot Record Infection Clean Error

Sub Rule

Error

General Error

EVID 3006: Task Error

Sub Rule

Error

General Error

EVID 3008: Directory Length Access Error

Sub Rule

Error

General Error

EVID 3032: ErrorWhileTryingTo Open/Create Log File

Sub Rule

Error

General Error

EVID 3035: Error Launching A Program

Sub Rule

Error

General Error

EVID 3038: Error Writing To Log

Sub Rule

Error

General Error

EVID 3045: CA - Error While Accessing Log File

Sub Rule

Error

General Error

EVID 3047: CA - Directory Length Access Error

Sub Rule

Error

General Error

EVID 3055: Error Stopping Drivers

Sub Rule

Error

General Error

EVID 3026: Error Sending Information To The Driver

Sub Rule

Error

General Error

EVID 3027: Error Sending Folder To The Driver

Sub Rule

Error

General Error

EVID 3028: Error Obtaining Log Data

Sub Rule

Error

General Error

EVID 3029: Error Occurred While Enabling Driver

Sub Rule

Error

General Error

EVID 3030: Error Occurred While Disabling Driver

Sub Rule

Error

General Error

EVID 3031: Error While Obtaining Statistical Data

Sub Rule

Error

General Error

EVID 3016: Error Opening Service Manager

Sub Rule

Error

General Error

EVID 3017: Error Starting Drivers

Sub Rule

Error

General Error

EVID 3018: Error Occurred Starting Log Subsystem

Sub Rule

Error

General Error

EVID 3019: Error Obtaining Device Driver Versions

Sub Rule

Error

General Error

EVID 3021: Scan Engine Error

Sub Rule

Error

General Error

EVID 3025: Error Sending Options To Device Driver

Sub Rule

Error

General Error

EVID 1511: Abnormal Termination

Sub Rule

Warning

General Warning

EVID 1090: OAS Stopped

Sub Rule

Information

General Information

EVID 1127: Scanning Engine Disabled

Sub Rule

Information

General Information

EVID 1128: Scan Time Exceeded

Sub Rule

Information

General Information

EVID 1204: Report OS And Serial

Sub Rule

Information

General Information

EVID 2017: Centralized Alerting

Sub Rule

Information

General Information

EVID 34153: Signed Content Detected

Sub Rule

Information

General Information

EVID 34157: Protected Content Triggered

Sub Rule

Information

General Information

EVID 34158: Password Protected Content Detected

Sub Rule

Information

General Information

EVID 10191: Audit Results

Sub Rule

Information

General Information

EVID 13001:MachineCompliantOrNon-CompliantWithRul

Sub Rule

Information

General Information

EVID 14000: Intercept IPS Security Event

Sub Rule

Information

General Information

EVID 16001: Reserved For Future Use

Sub Rule

Information

General Information

EVID 16007: Subnet Has Become Unmonitored

Sub Rule

Information

General Information

EVID 34152: Mail Size Filter Rule Triggered

Sub Rule

Information

General Information

EVID 10111: Sentry Results Non-Verbose

Sub Rule

Information

General Information

EVID 10114: Informational Event

Sub Rule

Information

General Information

EVID 10127: IDS Testing Text

Sub Rule

Information

General Information

EVID 10130: Informational Event

Sub Rule

Information

General Information

EVID 10159: AutoDiscovery Results

Sub Rule

Information

General Information

EVID 10175: ThreatScan Results

Sub Rule

Information

General Information

EVID 10066: Informational Event

Sub Rule

Information

General Information

EVID 10082: Informational Event

Sub Rule

Information

General Information

EVID 10094: Smb Grind Status

Sub Rule

Information

General Information

EVID 10095: Smb Grind Result

Sub Rule

Information

General Information

EVID 10098: Informational Event

Sub Rule

Information

General Information

EVID 10110: Sentry Results Verbose

Sub Rule

Information

General Information

EVID 10032: Probe Start

Sub Rule

Information

General Information

EVID 10033: Probe Stop

Sub Rule

Information

General Information

EVID 10034: Informational Event

Sub Rule

Information

General Information

EVID 10046: Probe Results Header

Sub Rule

Information

General Information

EVID 10047: Probe Hop

Sub Rule

Information

General Information

EVID 10050: Informational Event

Sub Rule

Information

General Information

EVID 3037: Memory Grant Unavailable

Sub Rule

Information

General Information

EVID 8500: Banned Item Found

Sub Rule

Information

General Information

EVID 8502: Item Matched Filtering Criteria

Sub Rule

Information

General Information

EVID 8503: Item Matched Spam Criteria

Sub Rule

Information

General Information

EVID 10018: Informational Event

Sub Rule

Information

General Information

EVID 10031: Module Results

Sub Rule

Information

General Information

EVID 3014: Task Reports General System Error

Sub Rule

Error

General System Error

EVID 3053: CA - Scan Reports General System Error

Sub Rule

Error

General System Error

EVID 1200: Process Started

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10064: Crack Started

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10080: Grind Start

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10096: Sentry Started

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10097: Sentry Finished

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10112: IDS Start

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10177: Audit Stop

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 12000: Rogue System Sensor Started

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10113: IDS Stop

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10144: AutoDiscovery Start

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10145: AutoDiscovery Stop

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10157: AutoDiscovery Host Started

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10158: AutoDiscovery Host Finished

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 10176: Audit Start

Sub Rule

Startup and Shutdown

Process/Service Started

EVID 1032: File Moved To Quarantine Area

Sub Rule

Activity

Quarantine

EVID 1056: File Moved To Quarantine

Sub Rule

Activity

Quarantine

EVID 1501: Infected Email Quarantined

Sub Rule

Activity

Quarantine

EVID 2008: File Moved To Quarantine Area

Sub Rule

Activity

Quarantine

EVID 2018: CA- Infected FileMovedToQuarantine Area

Sub Rule

Activity

Quarantine

EVID 1065: Service Ended

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 1201: Process Ended

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 10065: Crack Finished

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 10081: Grind Stop

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 10189: Audit Host Started

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 10190: Audit Host Finished

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 12002: Rogue System Sensor Stopped

Sub Rule

Startup and Shutdown

Process/Service Stopped

EVID 1037: Infected Boot Record Found

Sub Rule

Information

General Virus Infected

EVID 1052: Infected Binder Object

Sub Rule

Information

General Virus Infected

EVID 1053: Infected File Found

Sub Rule

Information

General Virus Infected

EVID 1503: Infected Email Detected

Sub Rule

Information

General Virus Infected

EVID 2000: Infected File Found

Sub Rule

Information

General Virus Infected

EVID 2001: Infected File Cleaned

Sub Rule

Information

General Virus Infected

EVID 2002: Unable To Clean Infected File

Sub Rule

Information

General Virus Infected

EVID 2010: CA-Infected File Found

Sub Rule

Information

General Virus Infected

EVID 1513: Virus Quarantined And Cleaned

Sub Rule

Information

General Virus Infected Information

EVID 1514: Virus Quarantined (Not Cleaned)

Sub Rule

Information

General Virus Infected Information

EVID 1515: Virus Replaced

Sub Rule

Information

General Virus Infected Information

EVID 2020: Boot Record Infection Found

Sub Rule

Information

General Virus Infected Information

EVID 2023: New File Virus Found

Sub Rule

Information

General Virus Infected Information

EVID 2025: New File Virus Found But Move Failed

Sub Rule

Information

General Virus Infected Information

EVID 3005: Cleaned Infected Files

Sub Rule

Information

General Virus Infected Information

EVID 3041: CA - Virus Found In Memory

Sub Rule

Information

General Virus Infected Information

EVID 3042: CA - Infected Boot Record Found

Sub Rule

Information

General Virus Infected Information

EVID 3043: CA - Scan Found Infected Files

Sub Rule

Information

General Virus Infected Information

EVID 3044: CA - Cleaned Infected Files

Sub Rule

Information

General Virus Infected Information

EVID 8000: Infected Item Found

Sub Rule

Information

General Virus Infected Information

EVID 2026: New File Virus Found And Moved

Sub Rule

Information

General Virus Infected Information

EVID 2027: New File Virus Found But Move Failed

Sub Rule

Information

General Virus Infected Information

EVID 2028: MBR Virus Found

Sub Rule

Information

General Virus Infected Information

EVID 3002: Virus Found In Memory

Sub Rule

Information

General Virus Infected Information

EVID 3003: Infected Boot Record Found

Sub Rule

Information

General Virus Infected Information

EVID 3004: Task Found Infected Files

Sub Rule

Information

General Virus Infected Information

EVID 3034: Unable To Write The Activity Log File

Sub Rule

Warning

Unable To Write Data

EVID 1123: Upgrade Failed

Sub Rule

Error

Upgrade Failed

EVID 1050: Unable To Repair

Sub Rule

Failed Activity

General Failed Activity

EVID 2201: Failed To Install Software Package

Sub Rule

Failed Activity

General Failed Activity

EVID 2216: Cannot Install Software

Sub Rule

Failed Activity

General Failed Activity

EVID 2264: Property Collection Failed

Sub Rule

Failed Activity

General Failed Activity

EVID 2328: Enforce Task Failed

Sub Rule

Failed Activity

General Failed Activity

EVID 4700: Failed To Connect To CMA Updater

Sub Rule

Failed Activity

General Failed Activity

EVID 8621: Failed To Load VSAPIScanSource Module

Sub Rule

Failed Activity

General Failed Activity

EVID 8622: Failed To Load TransportScan Module

Sub Rule

Failed Activity

General Failed Activity

EVID 8625: Failed To Load DLLhost

Sub Rule

Failed Activity

General Failed Activity

EVID 8626: Product Service Failed To Start

Sub Rule

Failed Activity

General Failed Activity

EVID 12001: Rogue System Sensor Failed To Start

Sub Rule

Failed Activity

General Failed Activity

EVID 16009: AD Discovery Task Failed

Sub Rule

Failed Activity

General Failed Activity

EVID 4701: Failed To Connect To CMA Scheduler

Sub Rule

Failed Activity

General Failed Activity

EVID 4702: Failed To Save Schedule Data Into CMA

Sub Rule

Failed Activity

General Failed Activity

EVID 8602: Failed To Download DATs

Sub Rule

Failed Activity

General Failed Activity

EVID 8604: Failed To Load AV Engine

Sub Rule

Failed Activity

General Failed Activity

EVID 8605: On-demand Scan Task Failed

Sub Rule

Failed Activity

General Failed Activity

EVID 8608: Failed To Download Anti-Spam Rules

Sub Rule

Failed Activity

General Failed Activity

EVID 1504: Infected Mail Item Deleted

Sub Rule

Information

Email Deleted

EVID 1500: Infected Email Cleaned

Sub Rule

Information

Email Virus Cleaned

EVID 1004: Task Completed Successfully

Sub Rule

Information

Task Completed

EVID 1070: Task Successful

Sub Rule

Information

Task Completed

EVID 3000: Scan Task Completed

Sub Rule

Information

Task Completed

EVID 16008: AD Discovery Task Ran

Sub Rule

Information

Task Completed

EVID 1005: Error While Stopping Task

Sub Rule

Error

Error Stopping Task

EVID 1089: Scan Settings

Sub Rule

Warning

Virus Scan Configuration

EVID 1035: Scan Was Cancelled

Sub Rule

Warning

Scan Cancelled

EVID 1126: Scan Cancelled

Sub Rule

Warning

Scan Cancelled

EVID 3040: CA - Scan Was Cancelled

Sub Rule

Warning

Scan Cancelled

EVID 1040: Activity Log Error

Sub Rule

Error

Activity Log Error

EVID 1041: Memory Allocation Error

Sub Rule

Error

Memory Allocation Error

EVID 1077: Memory Allocation Error

Sub Rule

Error

Memory Allocation Error

EVID 3007: Task Reports Memory Allocation Error

Sub Rule

Error

Memory Allocation Error

EVID 3023: Memory Allocation Error

Sub Rule

Error

Memory Allocation Error

EVID 3046: CA - Memory Allocation Error

Sub Rule

Error

Memory Allocation Error

EVID 1042: Path Too Long

Sub Rule

Warning

Path Too Long

EVID 1043: Media Is Write Protected

Sub Rule

Warning

Media Is Write Protected

EVID 3009: Media Write Protected

Sub Rule

Warning

Media Is Write Protected

EVID 3048: CA - Media Write Protected

Sub Rule

Warning

Media Is Write Protected

EVID 1044: Specified Media Not Found

Sub Rule

Warning

Media Not Found

EVID 3010: Specified Media Not Found

Sub Rule

Warning

Media Not Found

EVID 3049: CA - Specified Media Not Found

Sub Rule

Warning

Media Not Found

EVID 1045: Specified Scan Item Invalid

Sub Rule

Warning

Scan Item Invalid

EVID 3011: Specified Scan Item Is Invalid

Sub Rule

Warning

Scan Item Invalid

EVID 3050: CA - Specified Scan Item Invalid

Sub Rule

Warning

Scan Item Invalid

EVID 1046: File I/O Errors

Sub Rule

Error

File I/O Error

EVID 3012: File I/O Errors

Sub Rule

Error

File I/O Error

EVID 3013: Disk I/O Errors

Sub Rule

Error

File I/O Error

EVID 3051: CA - File I/O Errors

Sub Rule

Error

File I/O Error

EVID 1047: Disk I/O Errors

Sub Rule

Error

Disk I/O Error

EVID 3052: CA - Disk I/O Errors

Sub Rule

Error

Disk I/O Error

EVID 1051: Unable To Scan

Sub Rule

Warning

Scan Failure - Password Protected

EVID 1059: Scan Timed Out

Sub Rule

Warning

Scan Timeout

EVID 1062: Error Sending Alert

Sub Rule

Error

Error Sending Alert

EVID 1063: Invalid Options Specified

Sub Rule

Warning

Invalid Options

EVID 1067: Unable To Start Scheduled Task

Sub Rule

Error

Failed To Start Scheduled Task

EVID 1068: Scheduled Task Stopped

Sub Rule

Warning

Scheduled Task Stopped

EVID 1069: Error Stopping Scheduled Task

Sub Rule

Error

Error Stopping Scheduled Task

EVID 1071: Task Cancelled

Sub Rule

Information

Scheduled Task Canceled

EVID 3001: Task Was Cancelled

Sub Rule

Information

Scheduled Task Canceled

EVID 1076: Error Logging Information

Sub Rule

Error

Error Logging Information

EVID 1086: Scan Process Error

Sub Rule

Error

Scan Process Error

EVID 1088: On-Access Scan Stopped

Sub Rule

Information

On-Access Virus Scan Stopped

EVID 16005: Distributed Reposit Replication Failed

Sub Rule

Error

Replication Failed

EVID 10129: Upgrade Stop

Sub Rule

Information

Upgrade Stopped

EVID 2204: Insufficient Disk Space To Install SW

Sub Rule

Warning

Insufficient Disk Space

EVID 2208: Insufficient Disk Space To Download SW

Sub Rule

Warning

Insufficient Disk Space

EVID 8603: Insufficient Disk Space

Sub Rule

Warning

Insufficient Disk Space

EVID 34154: Encrypted Content Detected

Sub Rule

Warning

Encrypted / Corrupted Data Found

EVID 1029: File Excluded From Scans

Sub Rule

Information

Items Excluded From Scan

EVID 2005: File Excluded From Scans

Sub Rule

Information

Items Excluded From Scan

EVID 2015: CA-File Excluded From Scans

Sub Rule

Information

Items Excluded From Scan

EVID 1120: Update Running

Sub Rule

Information

Update Running

EVID 1124: Upgrade Was Cancelled

Sub Rule

Warning

Upgrade Canceled

EVID 16000: Computers Are Non-Compliant

Sub Rule

Other Audit

Computers Are Non-Compliant

EVID 1094: Rule Violation Detected

Sub Rule

Warning

Rule Violation

EVID 13002: System Compliance Profiler Rule Violation

Sub Rule

Warning

Rule Violation

EVID 3020: Invalid Virus Signature Files

Sub Rule

Warning

Invalid Signature File

EVID 1507: Inbound Email Suspend

Sub Rule

Warning

Inbound Email Suspend For Low Disk

EVID 1508: Inbound Mail Resumed

Sub Rule

Information

Inbound Mail Resumed

EVID 1030: Unable To Exclude From Scans

Sub Rule

Warning

Can't Exclude Items From Scan

EVID 2006: Unable To Exclude From Scans

Sub Rule

Warning

Can't Exclude Items From Scan

EVID 2016: CA-Unable To Exclude Item From Scans

Sub Rule

Warning

Can't Exclude Items From Scan

EVID 1125: DAT Version Not New

Sub Rule

Warning

Data Version Not New Enough

EVID 8623: Postgres Process Stopped Responding

Sub Rule

Information

General Process Information

EVID 8624: RPCServ Process Stopped Responding

Sub Rule

Information

General Process Information

EVID 2232: Enforce Policy Failed

Sub Rule

Information

General POLICY Information

EVID 1129: Scan Shut Down By Windows

Sub Rule

Information

Scan Stopped

EVID 10161: ThreatScan Stop

Sub Rule

Information

Scan Stopped

EVID 10174: ThreatScan Host Finished

Sub Rule

Information

Scan Stopped

EVID 1091: Violation Detected And Blocked

Sub Rule

Other Security

Security Violation

EVID 4650: Detected Spam Email

Sub Rule

Activity

Spam Detected

EVID 4651: Spam Email Scanning Statistics

Sub Rule

Information

Email And Web Statistics

EVID 3022: Initialization Error With Scan Buffer

Sub Rule

Error

Initialization Error

EVID 3036: Error During Initialization

Sub Rule

Error

Initialization Error

EVID 10128: Upgrade Start

Sub Rule

Information

Upgrade Started

EVID 10049: Update Stop

Sub Rule

Information

Update Stopped

EVID 1122: Upgrade Running

Sub Rule

Information

The Upgrade Is Running

EVID 2402: Update Failed

Sub Rule

Error

Update Failed

EVID 16003: Master Repository Update Failed

Sub Rule

Error

Update Failed

EVID 1003: Error Starting Task

Sub Rule

Error

Error Starting Task

EVID 1506: Email Content Blocked

Sub Rule

Warning

Email Content Denied

EVID 10061: Update Results Header

Sub Rule

Information

Update Event

EVID 10062: Update Download File

Sub Rule

Information

Update Event

EVID 10063: Update Install File

Sub Rule

Information

Update Event

EVID 1033: Unable To Move File To Quarantine

Sub Rule

Failed Activity

Quarantined Message

EVID 1057: Unable To Move Infected To Quarantine

Sub Rule

Failed Activity

Quarantined Message

EVID 2009: Unable To Move File To Quarantine

Sub Rule

Failed Activity

Quarantined Message

EVID 2019: CA- Unable To Move File To Quarantine

Sub Rule

Failed Activity

Quarantined Message

EVID 8606: Failed To Quarantine

Sub Rule

Failed Activity

Quarantined Message

EVID 11002: Failed Quarantine Check

Sub Rule

Failed Activity

Quarantined Message

EVID 8607: Process Failed To Recreate

Sub Rule

Error

Process Failed

EVID 1031: Infected File Access Denied

Sub Rule

Warning

Access Denied

EVID 2007: Infected File Access Denied

Sub Rule

Warning

Access Denied

EVID 10143: Upgrade Results

Sub Rule

Information

Upgrade Information

EVID 34160: Statistics And Average Scan Time

Sub Rule

Information

System Statistics

EVID 16004: Distributed Repo Replication Succeeded

Sub Rule

Information

Replication Successful

EVID 3033: Activity Log File Maximum Size Reached

Sub Rule

Warning

File Exceeds Defined Size Limit

EVID 16002: Master Repository Update Succeeded

Sub Rule

Information

Update Successful

EVID 1509: Startup Request Processed

Sub Rule

Other Audit Success

Request Approved

EVID 1510: Shutdown Request Processed

Sub Rule

Other Audit Success

Request Approved

EVID 2202: Install Retry Limit Reached

Sub Rule

Error

Client Limit Reached

EVID 1055: Unable To Delete Infected File

Sub Rule

Error

File Delete Failure

EVID 2004: Unable To Delete Infected File

Sub Rule

Error

File Delete Failure

EVID 2014: CA-Unable To Delete Infected File

Sub Rule

Error

File Delete Failure

EVID 3024: Unknown Error Reported

Sub Rule

Error

Unknown Error

EVID 1512: A Maximum Load Occurring

Sub Rule

Warning

Approaching Maximum Capacity

EVID 1900: New MIB File Available

Sub Rule

Information

New File Found On Network

EVID 14500: Intercept Firewall Event

Sub Rule

Information

General Firewall Event

EVID 3039: CA - Scan Completed

Sub Rule

Other Audit Success

Scan Completed

EVID 10017: Scan Finished

Sub Rule

Other Audit Success

Scan Completed

EVID 10030: Scan Host Finished

Sub Rule

Other Audit Success

Scan Completed

EVID 8501: Encrypted/Corrupted Item Found

Sub Rule

Warning

Damaged Object Found

EVID 16006: New Rogue System Detected

Sub Rule

Information

New Device Found

EVID 1028: Unable To Delete Infected File

Sub Rule

Error

Unable To Delete File

EVID 2024: New File Virus Found And Deleted

Sub Rule

Access Success

Object Deleted/Removed

EVID 16013: AD Discovery Task Removed Computers

Sub Rule

Access Success

Object Deleted/Removed

EVID 16012: AD Discovery Task Added Computers

Sub Rule

Access Success

Object Added

EVID 34155: Corrupted Content Detected

Sub Rule

Warning

Data Corrupt

EVID 34150: Packer Detected

Sub Rule

Information

Device Detected

EVID 1505: Email Content Filtered

Sub Rule

Information

Email Filter Information

EVID 4600: WebShield - URL Blocked

Sub Rule

Information

URL Information

EVID 34159: Blocked Mime Type Detected

Sub Rule

Warning

Device Blocked

EVID 8601: File Reputation Failed

Sub Rule

Information

General Reputation Information

EVID 1093: Buffer Overflow Detected

Sub Rule

Attack

Buffer Overflow/Underflow

EVID 1099: Buffer Overflow Not Blocked

Sub Rule

Attack

Buffer Overflow/Underflow

EVID 34151: Phish Detected

Sub Rule

Attack

Phishing Activity

EVID 1002: Task Started Successfully

Sub Rule

Information

Scheduled Task Started

EVID 1066: Task Started OK

Sub Rule

Information

Scheduled Task Started

EVID 1049: Internal Application Error

Sub Rule

Error

Application Error

EVID 3015: Internal Application Error

Sub Rule

Error

Application Error

EVID 3054: CA - Internal Application Error

Sub Rule

Error

Application Error

EVID 1054: Infected File Deleted

Sub Rule

Information

File Deleted

EVID 2003: Infected File Deleted

Sub Rule

Information

File Deleted

EVID 2013: CA-Infected File Deleted

Sub Rule

Information

File Deleted

EVID 1025: Infected File Successfully Cleaned

Sub Rule

Activity

General Threat Message

EVID 1026: Unable To Clean Infected File

Sub Rule

Activity

General Threat Message

EVID 1036: Memory Infected

Sub Rule

Activity

General Threat Message

EVID 1038: Scan Found Infected Files

Sub Rule

Activity

General Threat Message

EVID 1039: Cleaned Infected Files

Sub Rule

Activity

General Threat Message

EVID 1060: Virus Cleaned

Sub Rule

Activity

General Threat Message

EVID 2021: Boot Record Infection Cleaned

Sub Rule

Activity

General Threat Message

EVID 2100: Outbreak Rule Name

Sub Rule

Activity

General Threat Message

EVID 11001: Intrusion Detected

Sub Rule

Activity

General Threat Message

EVID 1061: Error While Cleaning Virus

Sub Rule

Activity

General Threat Message

EVID 1100: Macro Detected In File

Sub Rule

Activity

General Threat Message

EVID 1101: Macro Deleted From File

Sub Rule

Activity

General Threat Message

EVID 1502: Unable To Clean Infected Mail

Sub Rule

Activity

General Threat Message

EVID 2011: CA-Infected File Cleaned

Sub Rule

Activity

General Threat Message

EVID 2012: CA-Unable To Clean Infected File

Sub Rule

Activity

General Threat Message

EVID 10016: Scan Started

Sub Rule

Information

Scan Started

EVID 10029: Scan Host Started

Sub Rule

Information

Scan Started

EVID 10160: ThreatScan Start

Sub Rule

Information

Scan Started

EVID 10173: ThreatScan Host Started

Sub Rule

Information

Scan Started

EVID 34156: Denial Of Service Triggered

Sub Rule

Denial Of Service

Application Denial Of Service

EVID 10048: Update Start

Sub Rule

Information

Update Process Started

MachineName

<dname>

Text/String

Name of the system hosting the detecting product.

AgentGUID

N/A

N/A

Unique identifier of the agent that forwarded the event.

IPAddress

<dip>

IP Address

IP address of the system hosting the detecting product (if given in the event).

OSName

N/A

N/A

N/A

UserName

<domainimpacted>
<account>

Text/String

N/A

TimeZoneBias

N/A

N/A

N/A

RawMACAddress

<dmac>

Text/String/Number

MAC address of the system hosting the detecting product.

ProductName

<vendorinfo>

Text/String

Name of the detecting managed product.

ProductVersion

<version>

Text/String/Number

Version number of the detecting product.

ProductFamily

N/A

N/A

N/A

EngineVersion

N/A

N/A

Version number of the detecting product’s engine

DATVersion

N/A

N/A

DAT version on the system that sent the event.

ScannerType

N/A

N/A

N/A

TaskName

<object>

Text/String

N/A

ProductFamily

N/A

N/A

N/A

ProductName

N/A

N/A

Name of the detecting managed product.

ProductVersion

N/A

N/A

Version number of the detecting product.

EventID

<vmid>

Number

Unique identifier of the event class.

Severity

<severity>

Text/String/Number

N/A

GMTTime

N/A

N/A

N/A

UTCTime

N/A

N/A

N/A