Malware Scan Information (XML Logs)
Vendor Documentation
Classification
| Rule Name | Rule Type | Classification | Common Event |
|---|---|---|---|
| Malware Scan Information (XML Logs) | Base Rule | Information | Scan Activity |
| EVID 1000 : Malware Scan Started | Sub Rule | Information | Scan Started |
| EVID 1001 : Malware Scan Finished | Sub Rule | Information | Virus Scan Completed With No Errors Detected |
| EVID 1002 : Malware Scan Stopped Before It Finish | Sub Rule | Information | Scan Stopped |
| EVID 1003 : Malware Scan Paused | Sub Rule | Information | Scan Suspended |
| EVID 1004 : Malware Scan Resumed | Sub Rule | Information | Scan Resumed |
| EVID 1005 : Malware Scan Failed | Sub Rule | Warning | Scan Cancelled |
Mapping with LogRhythm Schema
| Device Key in log message | LogRhythm Schema | Data Type | Schema Description |
| Provider | Identifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event. | ||
| EventID | <vmid> | Number | The identifier that the provider used to identify the event. |
| Version | The version number of the event's definition. | ||
| Level | <severity> | String/Number | The severity level defined in the event. |
| Task | The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. | ||
| Opcode | The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. | ||
| Keywords | A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data). | ||
| TimeCreated | The time stamp that identifies when the event was logged. The time stamp includes either the SystemTime attribute or the RawTime attribute. | ||
| EventRecordID | The record number assigned to the event when it was logged. | ||
| Correlation | The activity identifiers that consumers can use to group related events together. | ||
| Execution | Contains information about the process and thread that logged the event. | ||
| Channel | The channel to which the event was logged. | ||
| Computer | <dname> | Text/String | The name of the computer on which the event occurred. |
| Security UserID | |||
| Product Name | |||
| Product Version | |||
| Scan ID | <session> | Text/String | |
| Scan Type Index | |||
| Scan Type | |||
| Scan Parameters Index | |||
| Scan Parameters | |||
| Scan Resources | <object> | Text/String | |
| Domain | <domainorigin> | Text/String | |
| User | <login> | Text/String | |
| SID | |||
| Scan Time Hours | |||
| Scan Time Minutes | |||
| Scan Time Seconds | |||
| Error Code | <responsecode> | Text/String | |
| Error Description | <reason> | Text/String |