hmLoadTopic({
hmKeywords:"JSON event",
hmTitle:"Events exported to JSON format",
hmDescription:"JSON is a lightweight format for data exchange. It is built on collection of name \/ value pairs and an ordered list of values.",
hmPrevLink:"admin_server_settings_syslog.html",
hmNextLink:"events-exported-to-leef-format.html",
hmParentLink:"admin_server_settings_export_to_syslog.html",
hmBreadCrumbs:"<a href=\"using.html\">Using ESET PROTECT On-Prem<\/a> &gt; <a href=\"working_with_era.html\">ESET PROTECT On-Prem Main Menu<\/a> &gt; <a href=\"admin.html\">More<\/a> &gt; <a href=\"admin_server_settings_export_to_syslog.html\">Export logs to Syslog<\/a>",
hmTitlePath:"Using ESET PROTECT On-Prem > ESET PROTECT On-Prem Main Menu > More > Export logs to Syslog > Events exported to JSON format",
hmHeader:"<h1 class=\"p_Heading1\"><span class=\"f_Heading1\">Events exported to JSON format<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_Normal\">JSON is a lightweight format for data exchange. It is built on collection of name \/ value pairs and an ordered list of values.<\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><span class=\"f_Heading2\">Exported events<\/span><\/h2>\n\r<p class=\"p_Normal\">This section contains details on the format and meaning of attributes of all exported events. The event message is in the form of a JSON object with some mandatory and some optional keys. Each one exported event will contain the following key:<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_small_no_header\" style=\"width:100%;\">\n\r<thead>\n\r<tr class=\"Table_small_no_header\">\n\r<th class=\"Table_small_no_header\" style=\"width:210px;\" scope=\"col\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">event_type<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:104px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:101px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">&nbsp;<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:700px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Type of exported events:<\/span><\/p>\n\r<p class=\"p_NormalTable\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 8px;\"><span class=\"f_NormalTable\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalTable\"><a href=\"events-exported-to-json-format.html#threat\" class=\"topiclink\">Threat_Event<\/a> (<img alt=\"Antivirus detections\" title=\"Antivirus detections\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_antivirus.png\"\/><\/span><span class=\"f_NormalTableUI\">Antivirus<\/span><span class=\"f_NormalTable\"> detections)<\/span><\/p>\n\r<p class=\"p_NormalTable\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 8px;\"><span class=\"f_NormalTable\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalTable\"><a href=\"events-exported-to-json-format.html#firewall\" class=\"topiclink\">FirewallAggregated_Event<\/a> (<img alt=\"Firewall detections\" title=\"Firewall detections\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_firewall.png\"\/> <\/span><span class=\"f_NormalTableUI\">Firewall<\/span><span class=\"f_NormalTable\"> detections)<\/span><\/p>\n\r<p class=\"p_NormalTable\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 8px;\"><span class=\"f_NormalTable\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalTable\"><a href=\"events-exported-to-json-format.html#hips\" class=\"topiclink\">HipsAggregated_Event<\/a> (<img alt=\"HIPS detections\" title=\"HIPS detections\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_hips.png\"\/> <\/span><span class=\"f_NormalTableUI\">HIPS<\/span><span class=\"f_NormalTable\"> detections)<\/span><\/p>\n\r<p class=\"p_NormalTable\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 8px;\"><span class=\"f_NormalTable\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalTable\"><a href=\"events-exported-to-json-format.html#audit\" class=\"topiclink\">Audit_Event<\/a> (<a href=\"audit_log.html\" class=\"topiclink\">Audit log<\/a>)<\/span><\/p>\n\r<p class=\"p_NormalTable\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 8px;\"><span class=\"f_NormalTable\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalTable\"><a href=\"events-exported-to-json-format.html#websites\" class=\"topiclink\">FilteredWebsites_Event<\/a> (Filtered websites—<img alt=\"Web Protection detections\" title=\"Web Protection detections\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_web_protection.png\"\/> <\/span><span class=\"f_NormalTableUI\">Web Protection<\/span><span class=\"f_NormalTable\">)<\/span><\/p>\n\r<p class=\"p_NormalTable\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 8px;\"><span class=\"f_NormalTable\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalTable\"><a href=\"events-exported-to-json-format.html#eei\" class=\"topiclink\">EnterpriseInspectorAlert_Event<\/a> (<img alt=\"ESET Inspect alerts\" title=\"ESET Inspect alerts\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_ei_alert.png\"\/> <a href=\"eset_inspect.html\" class=\"topiclink\">ESET Inspect Alerts<\/a>)<\/span><\/p>\n\r<p class=\"p_NormalTable\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 8px;\"><span class=\"f_NormalTable\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalTable\"><a href=\"events-exported-to-json-format.html#files\" class=\"topiclink\">BlockedFiles_Event<\/a> (<img alt=\"Blocked files\" title=\"Blocked files\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_blocked.png\"\/> <a href=\"eset_inspect.html#blocked_files\" class=\"topiclink\">Blocked files<\/a>)<\/span><\/p><\/th>\n\r<\/tr>\n\r<\/thead>\n\r<tbody>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">ipv4<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:101px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:700px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">IPv4 address of the computer generating the event.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">ipv6<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:101px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:700px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">IPv6 address of the computer generating the event.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">hostname<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:101px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">&nbsp;<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:700px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Hostname of the computer generating the event.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">source_uuid<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:101px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">&nbsp;<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:700px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">UUID of the computer generating the event.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">occurred<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:101px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">&nbsp;<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:700px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">UTC time of occurrence of the event. Format is %d-%b-%Y %H:%M:%S<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; height:16px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">severity<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; height:16px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:101px; height:16px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">&nbsp;<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:700px; height:16px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Severity of the event. Possible values (from least severe to most severe) are: <\/span><span class=\"f_NormalTableCode\">Information<\/span><span class=\"f_NormalTable\">, <\/span><span class=\"f_NormalTableCode\">Notice<\/span><span class=\"f_NormalTable\">, <\/span><span class=\"f_NormalTableCode\">Warning<\/span><span class=\"f_NormalTable\">, <\/span><span class=\"f_NormalTableCode\">Error<\/span><span class=\"f_NormalTable\">, <\/span><span class=\"f_NormalTableCode\">Critical<\/span><span class=\"f_NormalTable\">, <\/span><span class=\"f_NormalTableCode\">Fatal<\/span><span class=\"f_NormalTable\">.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">group_name<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:101px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">&nbsp;<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:700px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">The full path to the static group of the computer generating the event. If the path is longer than 255 characters, group_name only contains the static group name.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">group_description<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:101px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">&nbsp;<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:700px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Description of the static group.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">os_name<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:101px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">&nbsp;<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:700px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Information about the computer´s operating system.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/tbody>\n\r<\/table>\n\r<\/div>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_note\" >\n\r<tr class=\"Table_note\">\n\r<td class=\"Table_note\" style=\"width:4px; background-color:#3DAAE1;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_note\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Note\" title=\"Note\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/note.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_note\"><p class=\"p_Normal\">All event types listed below with all severity levels are reported to Syslog server. To filter the event logs sent to Syslog, <a href=\"admin_notif_events_on.html\" class=\"topiclink\">create a log category notification<\/a> with a defined filter.<\/p>\n\r<p class=\"p_Normal\">The reported values depend on the ESET security product (and its version) installed on the managed computer, and ESET PROTECT On-Prem only reports the received data. Therefore, ESET cannot provide an exhaustive list of all values. We recommend watching your network and filtering the logs based on the values you receive.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><a id=\"custom_keys\" class=\"hmanchor\"><\/a><span class=\"f_Heading2\">Custom keys according to event_type:<\/span><\/h2>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><a id=\"threat\" class=\"hmanchor\"><\/a><span class=\"f_Heading3\">Threat_Event<\/span><\/h3>\n\r<p class=\"p_Normal\">All <img alt=\"Antivirus detections\" title=\"Antivirus detections\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_antivirus.png\"\/><span class=\"f_UI\">Antivirus<\/span> detection events generated by managed endpoints will be forwarded to Syslog. Detection event specific key:<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_small_no_header\" style=\"width:100%;\">\n\r<thead>\n\r<tr class=\"Table_small_no_header\">\n\r<th class=\"Table_small_no_header\" style=\"width:210px;\" scope=\"col\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">threat_type<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:104px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:100px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:696px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Type of detection<\/span><\/p>\n\r<\/th>\n\r<\/tr>\n\r<\/thead>\n\r<tbody>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">threat_name<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Name of detection<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">threat_flags<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Detection related flags<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">scanner_id<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Scanner ID<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">scan_id<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Scan ID<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">engine_version<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Version of the scanning engine<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">object_type<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Type of object related to this event<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">object_uri<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Object URI<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">action_taken<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Action taken by the Endpoint<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">action_error<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Error message if the &quot;action&quot; was not successful<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">threat_handled<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">bool<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Indicates whether or not the detection was handled<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">need_restart<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">bool<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Whether or not the restart is needed<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">username<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Name of the user account associated with the event<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">processname<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Name of the process associated with the event<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">circumstances<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Short description of what caused the event<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">hash<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">SHA1 hash of the (detection) data stream.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><a id=\"firstseen\" class=\"hmanchor\"><\/a><span class=\"f_NormalTableUI\">firstseen<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Time and date when the detection was found for the first time at that machine. ESET PROTECT On-Prem employs different date-time formats for the firstseen attribute (and any other date-time attribute) depending on log output format (JSON or LEEF):<\/span><\/p>\n\r<p class=\"p_NormalTable\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 8px;\"><span class=\"f_NormalTable\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalTable\">JSON format: &quot;%d-%b-%Y %H:%M:%S&quot;<\/span><\/p>\n\r<p class=\"p_NormalTable\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 8px;\"><span class=\"f_NormalTable\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalTable\">LEEF format: &quot;%b %d %Y %H:%M:%S&quot;<\/span><\/p><\/td>\n\r<\/tr>\n\r<\/tbody>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\"><img id=\"toggle0186a1_ICON\" class=\"dropdown-toggle-icon\" alt=\"arrow_down_business\" width=\"21\" height=\"21\" style=\"margin:0;width:21px;height:21px;border:none\" src=\".\/images\/arrow_down_business.svg\"\/> <a id=\"toggle0186a1_LINK\" class=\"dropdown-toggle\" href=\"javascript:void(0)\" data-type=\"dropdown\" data-state=\"0\" data-icon=\"toggle0186a1_ICON\" data-src0=\".\/images\/arrow_down_business.svg\" data-src1=\".\/images\/arrow_up_business.svg\">Threat_Event JSON log example:<\/a><\/p>\n\r<div id=\"toggle0186a1\" class=\"dropdown-toggle-body\" style=\"text-align: left; padding: 0 0 0 0; margin: 0 0 10px 32px;display:none\"><table class=\"Table_code\"  role=\"presentation\">\n\r<tr class=\"Table_code\">\n\r<td class=\"Table_code\"><p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">Jun&nbsp;21&nbsp;11:&nbsp;46:&nbsp;40&nbsp;030—MG&nbsp;ERAServer[5648]:&nbsp;{<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;event_type&quot;:&nbsp;&quot;Threat_Event&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;ipv4&quot;:&nbsp;&quot;192.168.30.30&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;hostname&quot;:&nbsp;&quot;030-mg&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;group_name&quot;:&nbsp;&quot;All\/Lost&nbsp;&amp;&nbsp;found&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;os_name&quot;:&nbsp;&quot;Microsoft&nbsp;Windows&nbsp;11&nbsp;Pro&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;group_description&quot;:&nbsp;&quot;Lost&nbsp;&amp;&nbsp;found&nbsp;static&nbsp;group&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;source_uuid&quot;:&nbsp;&quot;1361a9f6-1d45-4561-b33a-b5d6c62c71e0&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;occured&quot;:&nbsp;&quot;21-Jun-2021&nbsp;09:46:15&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;severity&quot;:&nbsp;&quot;Warning&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;threat_type&quot;:&nbsp;&quot;Virus&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;threat_name&quot;:&nbsp;&quot;XF\/Gydhex.A&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;scanner_id&quot;:&nbsp;&quot;Real-time&nbsp;file&nbsp;system&nbsp;protection&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;scan_id&quot;:&nbsp;&quot;virlog.dat&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;engine_version&quot;:&nbsp;&quot;23497&nbsp;(20210621)&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;object_type&quot;:&nbsp;&quot;file&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;object_uri&quot;:&nbsp;&quot;file:\/\/\/C:\/Users\/Administrator\/Downloads\/xls\/YICT080714.xls&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;action_taken&quot;:&nbsp;&quot;Deleted&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;threat_handled&quot;:&nbsp;true,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;need_restart&quot;:&nbsp;false,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;username&quot;:&nbsp;&quot;030-MG\\\\Administrator&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;processname&quot;:&nbsp;&quot;C:\\\\Program&nbsp;Files\\\\WinRAR\\\\WinRAR.exe&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;circumstances&quot;:&nbsp;&quot;Event&nbsp;occurred&nbsp;on&nbsp;a&nbsp;newly&nbsp;created&nbsp;file.&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;firstseen&quot;:&nbsp;&quot;21-Jun-2021&nbsp;09:46:14&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;hash&quot;:&nbsp;&quot;5B97884A45C6C05F93B22C4059F3D9189E88E8B7&quot;<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">}<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><a id=\"firewall\" class=\"hmanchor\"><\/a><span class=\"f_Heading3\">FirewallAggregated_Event<\/span><\/h3>\n\r<p class=\"p_Normal\">Event logs generated by ESET Firewall (<img alt=\"Firewall detections\" title=\"Firewall detections\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_firewall.png\"\/> <span class=\"f_UI\">Firewall<\/span> detections) are aggregated by the managing ESET Management Agent to avoid wasting bandwidth during ESET Management Agent\/ ESET PROTECT Server replication. Firewall event specific key:<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_small_no_header\" style=\"width:100%;\">\n\r<thead>\n\r<tr class=\"Table_small_no_header\">\n\r<th class=\"Table_small_no_header\" style=\"width:210px;\" scope=\"col\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">event<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:104px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:100px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:696px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Event name<\/span><\/p>\n\r<\/th>\n\r<\/tr>\n\r<\/thead>\n\r<tbody>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">source_address<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Address of the event source<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">source_address_type<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Type of address of the event source<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">source_port<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">number<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Port of the event source<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">target_address<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Address of the event destination<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">target_address_type<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Type of address of the event destination<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">target_port<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">number<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Port of the event destination<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">protocol<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Protocol<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">account<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Name of the user account associated with the event<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">process_name<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Name of the process associated with the event<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">rule_name<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Rule name<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">rule_id<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Rule ID<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">inbound<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">bool<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Whether or not the connection was inbound<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">threat_name<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Name of the detection<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">aggregate_count<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">number<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">How many exact same messages were generated by the endpoint between two consecutive replications between ESET PROTECT Server and managing ESET Management Agent<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">action<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Action taken<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">handled<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Indicates whether or not the detection was handled<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/tbody>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\"><img id=\"toggle0186a2_ICON\" class=\"dropdown-toggle-icon\" alt=\"arrow_down_business\" width=\"21\" height=\"21\" style=\"margin:0;width:21px;height:21px;border:none\" src=\".\/images\/arrow_down_business.svg\"\/> <a id=\"toggle0186a2_LINK\" class=\"dropdown-toggle\" href=\"javascript:void(0)\" data-type=\"dropdown\" data-state=\"0\" data-icon=\"toggle0186a2_ICON\" data-src0=\".\/images\/arrow_down_business.svg\" data-src1=\".\/images\/arrow_up_business.svg\">FirewallAggregated_Event JSON log example:<\/a><\/p>\n\r<div id=\"toggle0186a2\" class=\"dropdown-toggle-body\" style=\"text-align: left; padding: 0 0 0 0; margin: 0 0 10px 32px;display:none\"><table class=\"Table_code\"  role=\"presentation\">\n\r<tr class=\"Table_code\">\n\r<td class=\"Table_code\"><p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">Jun&nbsp;21&nbsp;3:&nbsp;54:&nbsp;07&nbsp;030—MG&nbsp;ERAServer[5648]:&nbsp;{<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;event_type&quot;:&nbsp;&quot;FirewallAggregated_Event&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;ipv4&quot;:&nbsp;&quot;192.168.30.30&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;hostname&quot;:&nbsp;&quot;w16test&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;group_name&quot;:&nbsp;&quot;All\/Lost&nbsp;&amp;&nbsp;found&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;os_name&quot;:&nbsp;&quot;Microsoft&nbsp;Windows&nbsp;11&nbsp;Pro&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;group_description&quot;:&nbsp;&quot;Lost&nbsp;&amp;&nbsp;found&nbsp;static&nbsp;group&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;source_uuid&quot;:&nbsp;&quot;d9477661-8fa4-4144-b8d4-e37b983bcd69&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;occured&quot;:&nbsp;&quot;21-Jun-2021&nbsp;13:10:04&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;severity&quot;:&nbsp;&quot;&quot;Warning&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;event&quot;:&nbsp;&quot;Security&nbsp;vulnerability&nbsp;exploitation&nbsp;attempt&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;source_address&quot;:&nbsp;&quot;127.0.0.1&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;source_address_type&quot;:&nbsp;&quot;IPv4&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;source_port&quot;:&nbsp;54568,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;target_address&quot;:&nbsp;&quot;127.0.0.1&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;target_address_type&quot;:&nbsp;&quot;IPv4&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;target_port&quot;:&nbsp;80,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;protocol&quot;:&nbsp;&quot;TCP&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;account&quot;:&nbsp;&quot;NT&nbsp;AUTHORITY\\\\NETWORK&nbsp;SERVICE&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;process_name&quot;:&nbsp;&quot;C:\\\\Program&nbsp;Files\\\\Apache&nbsp;Software&nbsp;Foundation\\\\apache-tomcat-9.0.41\\\\bin\\\\tomcat9.exe&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;inbound&quot;:&nbsp;true,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;threat_name&quot;:&nbsp;&quot;CVE-2017-5638.Struts2&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;aggregate_count&quot;:&nbsp;1<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">}<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><a id=\"hips\" class=\"hmanchor\"><\/a><span class=\"f_Heading3\">HIPSAggregated_Event<\/span><\/h3>\n\r<p class=\"p_Normal\">Events from Host-based Intrusion Prevention System (<img alt=\"HIPS detections\" title=\"HIPS detections\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_hips.png\"\/> <span class=\"f_UI\">HIPS<\/span> detections) are filtered on <span class=\"f_UI\">severity<\/span> before they are sent further as Syslog messages. HIPS specific attributes are as follows:<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_small_no_header\" style=\"width:100%;\">\n\r<thead>\n\r<tr class=\"Table_small_no_header\">\n\r<th class=\"Table_small_no_header\" style=\"width:210px;\" scope=\"col\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">application<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:104px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:100px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:696px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Application name<\/span><\/p>\n\r<\/th>\n\r<\/tr>\n\r<\/thead>\n\r<tbody>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">operation<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Operation<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">target<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Target<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">action<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Action taken<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">action_taken<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Action taken by the Endpoint<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">rule_name<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Rule name<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">rule_id<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Rule ID<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">aggregate_count<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">number<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">How many exact same messages were generated by the endpoint between two consecutive replications between ESET PROTECT Server and managing ESET Management Agent<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">handled<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Indicates whether or not the detection was handled<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/tbody>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\"><img id=\"toggle0186a3_ICON\" class=\"dropdown-toggle-icon\" alt=\"arrow_down_business\" width=\"21\" height=\"21\" style=\"margin:0;width:21px;height:21px;border:none\" src=\".\/images\/arrow_down_business.svg\"\/> <a id=\"toggle0186a3_LINK\" class=\"dropdown-toggle\" href=\"javascript:void(0)\" data-type=\"dropdown\" data-state=\"0\" data-icon=\"toggle0186a3_ICON\" data-src0=\".\/images\/arrow_down_business.svg\" data-src1=\".\/images\/arrow_up_business.svg\">HipsAggregated_Event JSON log example:<\/a><\/p>\n\r<div id=\"toggle0186a3\" class=\"dropdown-toggle-body\" style=\"text-align: left; padding: 0 0 0 0; margin: 0 0 10px 32px;display:none\"><table class=\"Table_code\"  role=\"presentation\">\n\r<tr class=\"Table_code\">\n\r<td class=\"Table_code\"><p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">Jun&nbsp;21&nbsp;13:&nbsp;54:&nbsp;07&nbsp;030—MG&nbsp;ERAServer[5648]:&nbsp;{<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;event_type&quot;:&nbsp;&quot;HipsAggregated_Event&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;ipv4&quot;:&nbsp;&quot;192.168.30.181&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;hostname&quot;:&nbsp;&quot;test-w10-uefi&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;group_name&quot;:&nbsp;&quot;All\/Lost&nbsp;&amp;&nbsp;found&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;os_name&quot;:&nbsp;&quot;Microsoft&nbsp;Windows&nbsp;11&nbsp;Pro&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;group_description&quot;:&nbsp;&quot;Lost&nbsp;&amp;&nbsp;found&nbsp;static&nbsp;group&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;source_uuid&quot;:&nbsp;&quot;5dbe31ae-4ca7-4e8c-972f-15c197d12474&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;occured&quot;:&nbsp;&quot;21-Jun-2021&nbsp;11:53:21&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;severity&quot;:&nbsp;&quot;Critical&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;application&quot;:&nbsp;&quot;C:\\\\Users\\\\Administrator\\\\Desktop\\\\es_pack_to_test\\\\test\\\\java.exe&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;operation&quot;:&nbsp;&quot;Attempt&nbsp;to&nbsp;run&nbsp;a&nbsp;suspicious&nbsp;object&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;target&quot;:&nbsp;&quot;C:\\\\Users\\\\Administrator\\\\Desktop\\\\es_pack_to_test\\\\test\\\\trojan.exe&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;action&quot;:&nbsp;&quot;blocked&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;handled&quot;:&nbsp;true,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;rule_id&quot;:&nbsp;&quot;Suspicious&nbsp;attempt&nbsp;to&nbsp;launch&nbsp;an&nbsp;application&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;aggregate_count&quot;:&nbsp;2<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">}<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><a id=\"audit\" class=\"hmanchor\"><\/a><span class=\"f_Heading3\">Audit_Event<\/span><\/h3>\n\r<p class=\"p_Normal\">ESET PROTECT On-Prem forwards internal <a href=\"audit_log.html\" class=\"topiclink\">audit log<\/a> messages to Syslog. Specific attributes are as follows:<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_small_no_header\" style=\"width:100%;\">\n\r<thead>\n\r<tr class=\"Table_small_no_header\">\n\r<th class=\"Table_small_no_header\" style=\"width:210px;\" scope=\"col\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">domain<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:104px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:100px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:696px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Audit log domain<\/span><\/p>\n\r<\/th>\n\r<\/tr>\n\r<\/thead>\n\r<tbody>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">action<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Action taking place<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">target<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Target action is operating on<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">detail<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Detailed description of the action<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">user<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Security user involved<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">result<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Result of the action<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/tbody>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\"><img id=\"toggle0186a4_ICON\" class=\"dropdown-toggle-icon\" alt=\"arrow_down_business\" width=\"21\" height=\"21\" style=\"margin:0;width:21px;height:21px;border:none\" src=\".\/images\/arrow_down_business.svg\"\/> <a id=\"toggle0186a4_LINK\" class=\"dropdown-toggle\" href=\"javascript:void(0)\" data-type=\"dropdown\" data-state=\"0\" data-icon=\"toggle0186a4_ICON\" data-src0=\".\/images\/arrow_down_business.svg\" data-src1=\".\/images\/arrow_up_business.svg\">Audit_Event log example:<\/a><\/p>\n\r<div id=\"toggle0186a4\" class=\"dropdown-toggle-body\" style=\"text-align: left; padding: 0 0 0 0; margin: 0 0 10px 32px;display:none\"><table class=\"Table_code\"  role=\"presentation\">\n\r<tr class=\"Table_code\">\n\r<td class=\"Table_code\"><p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">Jun&nbsp;21&nbsp;11:&nbsp;42:&nbsp;00&nbsp;030—MG&nbsp;ERAServer[5648]:&nbsp;{<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;event_type&quot;:&nbsp;&quot;Audit_Event&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;ipv4&quot;:&nbsp;&quot;192.168.30.30&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;hostname&quot;:&nbsp;&quot;030-MG&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;group_name&quot;:&nbsp;&quot;All\/Lost&nbsp;&amp;&nbsp;found&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;os_name&quot;:&nbsp;&quot;Microsoft&nbsp;Windows&nbsp;11&nbsp;Pro&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;group_description&quot;:&nbsp;&quot;Lost&nbsp;&amp;&nbsp;found&nbsp;static&nbsp;group&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;source_uuid&quot;:&nbsp;&quot;72cdf05f-f9c8-49cc-863d-c6b3059a9e8e&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;occured&quot;:&nbsp;&quot;21-Jun-2021&nbsp;09:42:00&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;severity&quot;:&nbsp;&quot;Information&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;domain&quot;:&nbsp;&quot;Native&nbsp;user&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;action&quot;:&nbsp;&quot;Login&nbsp;attempt&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;target&quot;:&nbsp;&quot;Administrator&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;detail&quot;:&nbsp;&quot;Authenticating&nbsp;native&nbsp;user&nbsp;\'Administrator\'.&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;user&quot;:&nbsp;&quot;&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&quot;result&quot;:&nbsp;&quot;Success&quot;<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">}<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><a id=\"websites\" class=\"hmanchor\"><\/a><span class=\"f_Heading3\">FilteredWebsites_Event<\/span><\/h3>\n\r<p class=\"p_Normal\">ESET PROTECT On-Prem forwards the filtered websites (<img alt=\"Web Protection detections\" title=\"Web Protection detections\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_web_protection.png\"\/> <span class=\"f_UI\">Web Protection<\/span> detections) to Syslog. Specific attributes are as follows:<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_small_no_header\" style=\"width:100%;\">\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">processname<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Name of the process associated with the event<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">username<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Name of the user account associated with the event<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">hash<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">SHA1 hash of the filtered object<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">event<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Event type<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">rule_id<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Rule ID<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">action_taken<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Action taken<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">scanner_id<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Scanner ID<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">object_uri<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Object URI<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">target_address<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Address of the event destination<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">target_address_type<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Type of address of the event destination (25769803777 = IPv4; 25769803778 = IPv6)<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">handled<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Indicates whether or not the detection was handled<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\"><img id=\"toggle0186a5_ICON\" class=\"dropdown-toggle-icon\" alt=\"arrow_down_business\" width=\"21\" height=\"21\" style=\"margin:0;width:21px;height:21px;border:none\" src=\".\/images\/arrow_down_business.svg\"\/> <a id=\"toggle0186a5_LINK\" class=\"dropdown-toggle\" href=\"javascript:void(0)\" data-type=\"dropdown\" data-state=\"0\" data-icon=\"toggle0186a5_ICON\" data-src0=\".\/images\/arrow_down_business.svg\" data-src1=\".\/images\/arrow_up_business.svg\">FilteredWebsites_Event JSON log example:<\/a><\/p>\n\r<div id=\"toggle0186a5\" class=\"dropdown-toggle-body\" style=\"text-align: left; padding: 0 0 0 0; margin: 0 0 10px 32px;display:none\"><table class=\"Table_code\"  role=\"presentation\">\n\r<tr class=\"Table_code\">\n\r<td class=\"Table_code\"><p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">Jun&nbsp;21&nbsp;3:&nbsp;56:&nbsp;03&nbsp;020—MG&nbsp;ERAServer[5648]:&nbsp;{<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;event_type&quot;:&nbsp;&quot;FilteredWebsites_Event&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;ipv4&quot;:&nbsp;&quot;192.168.30.30&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;hostname&quot;:&nbsp;&quot;win-test&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;group_name&quot;:&nbsp;&quot;All\/Lost&nbsp;&amp;&nbsp;found&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;os_name&quot;:&nbsp;&quot;Microsoft&nbsp;Windows&nbsp;11&nbsp;Pro&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;group_description&quot;:&nbsp;&quot;Lost&nbsp;&amp;&nbsp;found&nbsp;static&nbsp;group&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;source_uuid&quot;:&nbsp;&quot;d9477661-8fa4-4144-b8d4-e37b983bcd69&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;occured&quot;:&nbsp;&quot;21-Jun-2021&nbsp;03:56:20&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;severity&quot;:&nbsp;&quot;Warning&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;event&quot;:&nbsp;&quot;An&nbsp;attempt&nbsp;to&nbsp;connect&nbsp;to&nbsp;URL&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;target_address&quot;:&nbsp;&quot;192.255.255.255&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;target_address_type&quot;:&nbsp;&quot;IPv4&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;scanner_id&quot;:&nbsp;&quot;HTTP&nbsp;filter&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;action_taken&quot;:&nbsp;&quot;blocked&quot;, &nbsp; &nbsp; &nbsp; &nbsp;&quot;object_uri&quot;:&nbsp;&quot;https:\/\/test.com&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;hash&quot;:&nbsp;&quot;ABCDAA625E6961037B8904E113FD0C232A7D0EDC&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;username&quot;:&nbsp;&quot;WIN-TEST\\\\Administrator&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;processname&quot;:&nbsp;&quot;C:\\\\Program&nbsp;Files\\\\Web&nbsp;browser\\\\brwser.exe&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;rule_id&quot;:&nbsp;&quot;Blocked&nbsp;by&nbsp;PUA&nbsp;blacklist&quot;<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">}<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><a id=\"eei\" class=\"hmanchor\"><\/a><span class=\"f_Heading3\">EnterpriseInspectorAlert_Event<\/span><\/h3>\n\r<p class=\"p_Normal\">ESET PROTECT On-Prem forwards <img alt=\"ESET Inspect alerts\" title=\"ESET Inspect alerts\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_ei_alert.png\"\/><a href=\"eset_inspect.html\" class=\"topiclink\">ESET Inspect Alerts<\/a> to Syslog. Specific attributes are as follows:<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_small_no_header\" style=\"width:100%;\">\n\r<thead>\n\r<tr class=\"Table_small_no_header\">\n\r<th class=\"Table_small_no_header\" style=\"width:210px;\" scope=\"col\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">processname<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:104px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:100px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/th>\n\r<th class=\"Table_small_no_header\" style=\"width:696px;\" scope=\"col\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Name of the process causing this alarm<\/span><\/p>\n\r<\/th>\n\r<\/tr>\n\r<\/thead>\n\r<tbody>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">username<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Owner of the process<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">rulename<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Name of the rule triggering this alarm<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">count<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">number<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Number of alerts of this type generated since last alarm<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">hash<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">SHA1 hash of the alarm<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">eiconsolelink<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Link to the alarm in ESET Inspect On-Prem console<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">eialarmid<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">ID sub-part of the alarm link (\$1 in ^http.*\/alarm\/([0-9]+)\$)<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">computer_severity_score<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">number<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Computer severity score<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">severity_score<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">number<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Rule severity score<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/tbody>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\"><img id=\"toggle0186a6_ICON\" class=\"dropdown-toggle-icon\" alt=\"arrow_down_business\" width=\"21\" height=\"21\" style=\"margin:0;width:21px;height:21px;border:none\" src=\".\/images\/arrow_down_business.svg\"\/> <a id=\"toggle0186a6_LINK\" class=\"dropdown-toggle\" href=\"javascript:void(0)\" data-type=\"dropdown\" data-state=\"0\" data-icon=\"toggle0186a6_ICON\" data-src0=\".\/images\/arrow_down_business.svg\" data-src1=\".\/images\/arrow_up_business.svg\">EnterpriseInspectorAlert_Event JSON log example:<\/a><\/p>\n\r<div id=\"toggle0186a6\" class=\"dropdown-toggle-body\" style=\"text-align: left; padding: 0 0 0 0; margin: 0 0 10px 32px;display:none\"><table class=\"Table_code\"  role=\"presentation\">\n\r<tr class=\"Table_code\">\n\r<td class=\"Table_code\"><p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">Jun&nbsp;16&nbsp;16:19:00&nbsp;Win2016Std&nbsp;ERAServer[2772]:&nbsp;{<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;event_type&quot;:&nbsp;&quot;EnterpriseInspectorAlert_Event&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;ipv4&quot;:&nbsp;&quot;192.168.30.30&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;hostname&quot;:&nbsp;&quot;shdsolec.vddjc&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;group_name&quot;:&nbsp;&quot;All\/Lost&nbsp;&amp;&nbsp;found&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;os_name&quot;:&nbsp;&quot;Microsoft&nbsp;Windows&nbsp;11&nbsp;Pro&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;group_description&quot;:&nbsp;&quot;Lost&nbsp;&amp;&nbsp;found&nbsp;static&nbsp;group&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;source_uuid&quot;:&nbsp;&quot;csd77ad2-2453-42f4-80a4-d86dfa9d0543&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;occured&quot;:&nbsp;&quot;13-Jun-2021&nbsp;07:45:00&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;severity&quot;:&nbsp;&quot;Warning&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;processname&quot;:&nbsp;&quot;ProcessName&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;username&quot;:&nbsp;&quot;UserName&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;rulename&quot;:&nbsp;&quot;RuleName2&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;count&quot;:&nbsp;158,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;eiconsolelink&quot;:&nbsp;&quot;http:\/\/eiserver.tmp\/linkToConsole&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;computer_severity_score&quot;:&nbsp;&quot;1&quot;,<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span style=\"width:48px;display:inline-block\">&nbsp;<\/span><span class=\"f_Code\">&quot;severity_score&quot;:&nbsp;&quot;1&quot;<\/span><\/p>\n\r<p class=\"p_Code\" style=\"page-break-inside: avoid;\"><span class=\"f_Code\">}<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<h3 class=\"p_Heading3\" style=\"page-break-after: avoid;\"><a id=\"files\" class=\"hmanchor\"><\/a><span class=\"f_Heading3\">BlockedFiles_Event<\/span><\/h3>\n\r<p class=\"p_Normal\">ESET PROTECT On-Prem forwards ESET Inspect On-Prem <img alt=\"Blocked files\" title=\"Blocked files\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_blocked.png\"\/> <a href=\"eset_inspect.html#blocked_files\" class=\"topiclink\">Blocked files<\/a> to Syslog. Specific attributes are as follows:<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_small_no_header\" style=\"width:100%;\">\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">processname<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Name of the process associated with the event<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">username<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Name of the user account associated with the event<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">hash<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">SHA1 hash of the blocked file<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">object_uri<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Object URI<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">action<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Action taken<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">firstseen<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Time and date when the detection was found for the first time at that machine (<a href=\"events-exported-to-json-format.html#firstseen\" class=\"topiclink\">date and time format<\/a>).<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">cause<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">&nbsp;<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px; background-color:#F4F5F4;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">description<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px; background-color:#F4F5F4;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Description of the blocked file<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<tr class=\"Table_small_no_header\">\n\r<td class=\"Table_small_no_header\" style=\"width:210px;\"><p class=\"p_NormalTableUI\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTableUI\">handled<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:104px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">string<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:100px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">optional<\/span><\/p>\n\r<\/td>\n\r<td class=\"Table_small_no_header\" style=\"width:696px;\"><p class=\"p_NormalTable\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalTable\">Indicates whether or not the detection was handled<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r"
})
