V 2.0 : Cylance Optics : Process Threat Detected

Vendor Documentation

https://docs.blackberry.com/en/unified-endpoint-security/blackberry-ues/cylance-syslog-guide/CylanceOPTICS_Detection_Events/CylanceOptics_Process-based_Detection_Events

Classification

Rule Name	Rule Type	Common Event	Classification
V 2.0 : Cylance Optics: Process Threat Detected	Base Rule	General Threat Message	Activity

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
Description	<policy>	Text/String	The name of the Detection Rule that was triggered.
Device ID	<serialnumber>	Text/String	The unique ID for the device.
Device Name	<dname>	Text/String	The name of the device on which the Detection Event occurred.
Event ID	N/A	N/A	The unique ID for the Detection Event.
Event Name	N/A	N/A	The Detection Event involved a Target Process.
Event Type	<vmid>	Text/String	The Detection Event involved a Target Process.
Instigating Process Image File Sha256	N/A	N/A	The SHA256 hash of the process that instigated the action.
Instigating Process Name	<parentprocessname>	Text/String	The name of the process that instigated the action.
Instigating Process Owner	<domainorigin> <login>	Text/String	The user who owns the process that instigated the action.
Severity	<severity>	Text/String	The severity of the event. High: A malicious event that requires immediate attention. Medium: A suspicious event that should be reviewed. Low: An important event, but may not be malicious. Info: An observed event.
Target Process Image File Sha256	<hash>	Text/String	The SHA256 hash of the process that was started or terminated.
Target Process Name	<process>	Text/String	The name of the process that was started or terminated.
Target Process Owner	<domainimpacted>,<account>	Text/String	The user who owns the process that was started or terminated.
Zone Names	N/A	N/A	The zones to which the device belongs.
Target Process Command Line	<command>	Text/String	This is the command line that was used to start the process of interest for the process event.
Target Process File Path	<parentprocesspath>	Text/String	This is the path of the target process executable.