V 2.0 Malicious File Blocked By Amp Event

V 2.0 Malicious File Blocked By Amp Event

Base Rule

Activity

General Threat Protection Event

url

<url>

Text/String

url

src

<sip>
<sport>

IP Address
Number

N/A

dst

<dip>
<dport>

IP Address
Number

N/A

mac

<dmac>

Text/String

mac_addr

name

<subject>

Text/String

name

sha256

<hash>

Text/String

sha256_hash

disposition

<result>

Text/String

disposition

action

<action>

Text/String

action