ESET PROTECT On-Prem

Offline | Go online

ESET PROTECT On-Prem – Table of Contents

# Events exported to JSON format

Copy current article URL Share via email

Define a filter in a Notification log category to filter event logs sent to Syslog.

JSON is a lightweight format for data exchange. It is built on collection of name / value pairs and an ordered list of values.

## Exported events

This section contains details on the format and meaning of attributes of all exported events. The event message is a JSON object with some mandatory and some optional keys. Each one exported event will contain the following key:

event_type | string |  | Type of exported events: •Threat_Event (Antivirus detections) •FirewallAggregated_Event ( Firewall detections) •HipsAggregated_Event ( HIPS detections) •Audit_Event (Audit log) •FilteredWebsites_Event (Filtered websites— Web Protection) •EnterpriseInspectorAlert_Event ( ESET Inspect Alerts) •BlockedFiles_Event ( Blocked files)
--- | --- | --- | ---
ipv4 | string | optional | IPv4 address of the computer generating the event.
ipv6 | string | optional | IPv6 address of the computer generating the event.
hostname | string |  | Hostname of the computer generating the event.
source_uuid | string |  | UUID of the computer generating the event.
occurred | string |  | UTC time of occurrence of the event. Format is %d-%b-%Y %H:%M:%S
severity | string |  | Severity of the event. Possible values (from least severe to most severe) are: Information, Notice, Warning, Error, Critical, Fatal.
group_name | string |  | The full path to the static group of the computer generating the event. If the path is longer than 255 characters, group_name only contains the static group name.
group_description | string |  | Description of the static group.
os_name | string |  | Information about the computer´s operating system.

|  | All event types listed below with all severity levels are reported to Syslog server. Define a filter in a Notification log category to filter event logs sent to Syslog. The reported values depend on the ESET security application (and its version) installed on the managed computer, and ESET PROTECT On-Prem only reports the received data. Therefore, ESET cannot provide an exhaustive list of all values. We recommend watching your network and filtering the logs based on the values you receive.

## Custom keys according to event_type:

### Threat_Event

All Antivirus detection events generated by managed endpoints will be forwarded to Syslog. Detection event specific key:

threat_type | string | optional | Type of detection
--- | --- | --- | ---
threat_name | string | optional | Name of detection
threat_flags | string | optional | Detection related flags
scanner_id | string | optional | Scanner ID
scan_id | string | optional | Scan ID
engine_version | string | optional | Version of the scanning engine
object_type | string | optional | Type of object related to this event
object_uri | string | optional | Object URI
action_taken | string | optional | Action taken by the Endpoint
action_error | string | optional | Error message if the "action" was not successful
threat_handled | bool | optional | Indicates whether or not the detection was handled
need_restart | bool | optional | Whether or not the restart is needed
username | string | optional | Name of the user account associated with the event
processname | string | optional | Name of the process associated with the event
circumstances | string | optional | Short description of what caused the event
hash | string | optional | SHA1 hash of the (detection) data stream.
firstseen | string | optional | Time and date when the detection was found for the first time at that machine. ESET PROTECT On-Prem employs different date-time formats for the firstseen attribute (and any other date-time attribute) depending on log output format (JSON or LEEF): •JSON format: "%d-%b-%Y %H:%M:%S" •LEEF format: "%b %d %Y %H:%M:%S"

Threat_Event JSON log example:

Jun 21 11: 46: 40 030—MG ERAServer[5648]: { "event_type": "Threat_Event", "ipv4": "192.168.30.30", "hostname": "030-mg", "group_name": "All/Lost & found", "os_name": "Microsoft Windows 11 Pro", "group_description": "Lost & found static group", "source_uuid": "1361a9f6-1d45-4561-b33a-b5d6c62c71e0", "occured": "21-Jun-2021 09:46:15", "severity": "Warning", "threat_type": "Virus", "threat_name": "XF/Gydhex.A", "scanner_id": "Real-time file system protection", "scan_id": "virlog.dat", "engine_version": "23497 (20210621)", "object_type": "file", "object_uri": "file:///C:/Users/Administrator/Downloads/xls/YICT080714.xls", "action_taken": "Deleted", "threat_handled": true, "need_restart": false, "username": "030-MG\\Administrator", "processname": "C:\\Program Files\\WinRAR\\WinRAR.exe", "circumstances": "Event occurred on a newly created file.", "firstseen": "21-Jun-2021 09:46:14", "hash": "5B97884A45C6C05F93B22C4059F3D9189E88E8B7" }

### FirewallAggregated_Event

Event logs generated by ESET Firewall ( Firewall detections) are aggregated by the managing ESET Management Agent to avoid wasting bandwidth during ESET Management Agent/ ESET PROTECT Server replication. Firewall event specific key:

event | string | optional | Event name
--- | --- | --- | ---
source_address | string | optional | Address of the event source
source_address_type | string | optional | Type of address of the event source
source_port | number | optional | Port of the event source
target_address | string | optional | Address of the event destination
target_address_type | string | optional | Type of address of the event destination
target_port | number | optional | Port of the event destination
protocol | string | optional | Protocol
account | string | optional | Name of the user account associated with the event
process_name | string | optional | Name of the process associated with the event
rule_name | string | optional | Rule name
rule_id | string | optional | Rule ID
inbound | bool | optional | Whether or not the connection was inbound
threat_name | string | optional | Name of the detection
aggregate_count | number | optional | How many exact same messages were generated by the endpoint between two consecutive replications between ESET PROTECT Server and managing ESET Management Agent
action | string | optional | Action taken
handled | string | optional | Indicates whether or not the detection was handled

FirewallAggregated_Event JSON log example:

Jun 21 3: 54: 07 030—MG ERAServer[5648]: { "event_type": "FirewallAggregated_Event", "ipv4": "192.168.30.30", "hostname": "w16test", "group_name": "All/Lost & found", "os_name": "Microsoft Windows 11 Pro", "group_description": "Lost & found static group", "source_uuid": "d9477661-8fa4-4144-b8d4-e37b983bcd69", "occured": "21-Jun-2021 13:10:04", "severity": ""Warning", "event": "Security vulnerability exploitation attempt", "source_address": "127.0.0.1", "source_address_type": "IPv4", "source_port": 54568, "target_address": "127.0.0.1", "target_address_type": "IPv4", "target_port": 80, "protocol": "TCP", "account": "NT AUTHORITY\\NETWORK SERVICE", "process_name": "C:\\Program Files\\Apache Software Foundation\\apache-tomcat-9.0.41\\bin\\tomcat9.exe", "inbound": true, "threat_name": "CVE-2017-5638.Struts2", "aggregate_count": 1 }

### HIPSAggregated_Event

Events from Host-based Intrusion Prevention System ( HIPS detections) are filtered on severity before they are sent further as Syslog messages. HIPS specific attributes are as follows:

application | string | optional | Application name
--- | --- | --- | ---
operation | string | optional | Operation
target | string | optional | Target
action | string | optional | Action taken
action_taken | string | optional | Action taken by the Endpoint
rule_name | string | optional | Rule name
rule_id | string | optional | Rule ID
aggregate_count | number | optional | How many exact same messages were generated by the endpoint between two consecutive replications between ESET PROTECT Server and managing ESET Management Agent
handled | string | optional | Indicates whether or not the detection was handled

HipsAggregated_Event JSON log example:

Jun 21 13: 54: 07 030—MG ERAServer[5648]: { "event_type": "HipsAggregated_Event", "ipv4": "192.168.30.181", "hostname": "test-w10-uefi", "group_name": "All/Lost & found", "os_name": "Microsoft Windows 11 Pro", "group_description": "Lost & found static group", "source_uuid": "5dbe31ae-4ca7-4e8c-972f-15c197d12474", "occured": "21-Jun-2021 11:53:21", "severity": "Critical", "application": "C:\\Users\\Administrator\\Desktop\\es_pack_to_test\\test\\java.exe", "operation": "Attempt to run a suspicious object", "target": "C:\\Users\\Administrator\\Desktop\\es_pack_to_test\\test\\trojan.exe", "action": "blocked", "handled": true, "rule_id": "Suspicious attempt to launch an application", "aggregate_count": 2 }

### Audit_Event

ESET PROTECT On-Prem forwards internal audit log messages to Syslog. Specific attributes are as follows:

domain | string | optional | Audit log domain
--- | --- | --- | ---
action | string | optional | Action taking place
target | string | optional | Target action is operating on
detail | string | optional | Detailed description of the action
user | string | optional | Security user involved
result | string | optional | Result of the action

Audit_Event log example:

Jun 21 11: 42: 00 030—MG ERAServer[5648]: { "event_type": "Audit_Event", "ipv4": "192.168.30.30", "hostname": "030-MG", "group_name": "All/Lost & found", "os_name": "Microsoft Windows 11 Pro", "group_description": "Lost & found static group", "source_uuid": "72cdf05f-f9c8-49cc-863d-c6b3059a9e8e", "occured": "21-Jun-2021 09:42:00", "severity": "Information", "domain": "Native user", "action": "Login attempt", "target": "Administrator", "detail": "Authenticating native user 'Administrator'.", "user": "", "result": "Success" }

### FilteredWebsites_Event

ESET PROTECT On-Prem forwards the filtered websites ( Web Protection detections) to Syslog. Specific attributes are as follows:

processname | string | optional | Name of the process associated with the event
username | string | optional | Name of the user account associated with the event
hash | string | optional | SHA1 hash of the filtered object
event | string | optional | Event type
rule_id | string | optional | Rule ID
action_taken | string | optional | Action taken
scanner_id | string | optional | Scanner ID
object_uri | string | optional | Object URI
target_address | string | optional | Address of the event destination
target_address_type | string | optional | Type of address of the event destination (25769803777 = IPv4; 25769803778 = IPv6)
handled | string | optional | Indicates whether or not the detection was handled

FilteredWebsites_Event JSON log example:

Jun 21 3: 56: 03 020—MG ERAServer[5648]: { "event_type": "FilteredWebsites_Event", "ipv4": "192.168.30.30", "hostname": "win-test", "group_name": "All/Lost & found", "os_name": "Microsoft Windows 11 Pro", "group_description": "Lost & found static group", "source_uuid": "d9477661-8fa4-4144-b8d4-e37b983bcd69", "occured": "21-Jun-2021 03:56:20", "severity": "Warning", "event": "An attempt to connect to URL", "target_address": "192.255.255.255", "target_address_type": "IPv4", "scanner_id": "HTTP filter", "action_taken": "blocked", "object_uri": "https://test.com", "hash": "ABCDAA625E6961037B8904E113FD0C232A7D0EDC", "username": "WIN-TEST\\Administrator", "processname": "C:\\Program Files\\Web browser\\brwser.exe", "rule_id": "Blocked by PUA blacklist" }

### EnterpriseInspectorAlert_Event

ESET PROTECT On-Prem forwards ESET Inspect Alerts to Syslog. Specific attributes are as follows:

processname | string | optional | Name of the process causing this alarm
--- | --- | --- | ---
username | string | optional | Owner of the process
rulename | string | optional | Name of the rule triggering this alarm
count | number | optional | Number of alerts of this type generated since last alarm
hash | string | optional | SHA1 hash of the alarm
eiconsolelink | string | optional | Link to the alarm in ESET Inspect On-Prem console
eialarmid | string | optional | ID sub-part of the alarm link ($1 in ^http.*/alarm/([0-9]+)$)
computer_severity_score | number | optional | Computer severity score
severity_score | number | optional | Rule severity score

EnterpriseInspectorAlert_Event JSON log example:

Jun 16 16:19:00 Win2016Std ERAServer[2772]: { "event_type": "EnterpriseInspectorAlert_Event", "ipv4": "192.168.30.30", "hostname": "shdsolec.vddjc", "group_name": "All/Lost & found", "os_name": "Microsoft Windows 11 Pro", "group_description": "Lost & found static group", "source_uuid": "csd77ad2-2453-42f4-80a4-d86dfa9d0543", "occured": "13-Jun-2021 07:45:00", "severity": "Warning", "processname": "ProcessName", "username": "UserName", "rulename": "RuleName2", "count": 158, "eiconsolelink": "http://eiserver.tmp/linkToConsole", "computer_severity_score": "1", "severity_score": "1" }

### BlockedFiles_Event

ESET PROTECT On-Prem forwards ESET Inspect On-Prem Blocked files to Syslog. Specific attributes are as follows:

processname | string | optional | Name of the process associated with the event
username | string | optional | Name of the user account associated with the event
hash | string | optional | SHA1 hash of the blocked file
object_uri | string | optional | Object URI
action | string | optional | Action taken
firstseen | string | optional | Time and date when the detection was found for the first time at that machine (date and time format).
cause | string | optional |
description | string | optional | Description of the blocked file
handled | string | optional | Indicates whether or not the detection was handled

˄˅