Pretražite sadržaj pomoći

Događaji izvezeni u format LEEF

Putanje

ESET-ova online pomoć > ESET PROTECT > Upotreba sustava ESET PROTECT > ESET PROTECT Glavni izbornik > Integracije > Syslog Forwarder > Događaji izvezeni u format LEEF

Kopirajte URL-a trenutačnog članka Podijelite putem e-pošte

Ovaj članak (PDF) Cjelokupna dokumentacija (PDF)

Da biste filtrirali dnevnike događaja poslane u Syslog, stvorite obavijest o kategoriji dnevnika s definiranim filtrom.

LEEFformat prilagođeni je format za događaje za IBM® Security QRadar®. Događaji imaju standardne i prilagođene atribute:

•ESET PROTECT upotrebljava neke od standardnih atributa opisanih u službenoj dokumentaciji IBM-a.

•Prilagođeni atributi isti su kao i za format JSON. Atribut deviceGroupName sadrži cijeli put statičke grupe računala koje generira događaj. Ako je put dulji od 255 znakova, deviceGroupName sadrži samo naziv statičke grupe. Atribut deviceOSName sadrži informacije o operacijskom sustavu računala, a atribut deviceGroupDescription sadrži opis statičke grupe.

Kategorije događaja

Antivirusne otkrivene prijetnje

Primjer događaja prijetnje

deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7

devTime=Sep 02 2026 14:23:07 GMT

threatType=Trojan

threatName=Win32/Filecoder.NLM

scannerID=Real-time file system protection

scanID=ndl32941.dat

objectType=File

objectUri=file:///C:/Users/jnovak/Downloads/invoice_0912.exe

actionTaken=Cleaned by deleting

threatHandled=true

needRestart=false

accountName=CONTOSO\jnovak

processName=C:\Windows\explorer.exe

circumstances=Event occurred on a newly created file.

engineVersion=31842 (20260902)

firstseen=Sep 02 2026 14:23:05 GMT

hash=9F2E1B77C4A0D5E8B31F6C09A4D72E5B18C3A6F0

detectionUuid=6b0f3d21-9c74-4a58-8e13-77af52d0c9b4

tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63

tenantName=Contoso Retail

deviceName=WS-PRG-0421

deviceOSName=Microsoft Windows 11 Pro

deviceGroupName=All/Contoso Retail/Prague/Workstations

deviceGroupDescription=Prague office workstations

devTimeFormat=MMM dd yyyy HH:mm:ss z

src=10.42.7.19

sev=3

Firewall

Primjer događaja firewalla

deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7

devTime=Sep 02 2026 14:23:07 GMT

eventDesc=Communication denied by rule

srcPort=49712

dstPort=445

proto=TCP

accountName=NT AUTHORITY\SYSTEM

processName=C:\Windows\System32\svchost.exe

ruleName=Block incoming SMB from outside

ruleID=User rule

aggregateCount=12

inbound=true

src=198.51.100.77

sourceAddressType=IPv4

dst=10.42.7.19

targetAddressType=IPv4

detectionUuid=2a7c5e91-04b8-4d3f-95ac-61e0f7d28b34

action=Blocked

handled=true

tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63

tenantName=Contoso Retail

deviceName=WS-PRG-0421

deviceOSName=Microsoft Windows 11 Pro

deviceGroupName=All/Contoso Retail/Prague/Workstations

deviceGroupDescription=Prague office workstations

devTimeFormat=MMM dd yyyy HH:mm:ss z

sev=3

Filtrirane web stranice – web zaštita

Primjer događaja filtriranih web stranica

deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7

devTime=Sep 02 2026 14:23:07 GMT

eventDesc=An attempt to connect to URL

ruleID=Blocked by internal blacklist

actionTaken=Blocked

objectUri=http://malicious.example.com/payload.bin

processName=C:\Program Files\Google\Chrome\Application\chrome.exe

accountName=CONTOSO\jnovak

hash=B71C0A34F9D2E5871C60A4B8D93F2E017C5A6D48

dst=203.0.113.44

targetAddressType=IPv4

scannerID=HTTP filter

resolved=false

detectionUuid=7e51b8c3-2d94-40a6-b7f2-5c81a0e934dd

handled=true

tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63

tenantName=Contoso Retail

deviceName=WS-PRG-0421

deviceOSName=Microsoft Windows 11 Pro

deviceGroupName=All/Contoso Retail/Prague/Workstations

deviceGroupDescription=Prague office workstations

devTimeFormat=MMM dd yyyy HH:mm:ss z

src=10.42.7.19

sev=3

HIPS

Primjer događaja HIPS

deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7

devTime=Sep 02 2026 14:23:07 GMT

application=C:\Users\jnovak\AppData\Local\Temp\setup.exe

operation=Modify startup registry key

target=HKLM\Software\Microsoft\Windows\CurrentVersion\Run

action=Blocked

ruleName=Suspicious autostart modification

ruleID=User rule

aggregateCount=3

detectionUuid=d47a9f10-8c62-4b05-a1e7-3f9b62c05d81

handled=true

tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63

tenantName=Contoso Retail

deviceName=WS-PRG-0421

deviceOSName=Microsoft Windows 11 Pro

deviceGroupName=All/Contoso Retail/Prague/Workstations

deviceGroupDescription=Prague office workstations

devTimeFormat=MMM dd yyyy HH:mm:ss z

src=10.42.7.19

sev=3

Provjera

Primjer događaja revizije

devTime=Sep 02 2026 14:23:07 GMT

domain=Native user

action=Login attempt

result=Success

user=jnovak@contoso.example

detail=Login from 203.0.113.9 using the web console

tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63

tenantName=Contoso Retail

devTimeFormat=MMM dd yyyy HH:mm:ss z

sev=1

ESET Inspect upozorenja

Primjer događaja upozorenja u alatu ESET Inspect

deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7

devTime=Sep 02 2026 14:23:07 GMT

process=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

user=CONTOSO\jnovak

rule=Suspicious PowerShell download cradle

count=1

eiconsolelink=https://inspect.eset.systems/console/detection/48213

resolved=false

detectionUuid=b93c17e4-5d80-4a62-9f31-c0e785a2d417

hash=E20D74B1C3A96F5807D2B4E1930CA6F85D71B204

sevScore=78

compSevScore=64

triggerEvent=Process started

commandLine=powershell -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0A

tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63

tenantName=Contoso Retail

deviceName=WS-PRG-0421

deviceOSName=Microsoft Windows 11 Pro

deviceGroupName=All/Contoso Retail/Prague/Workstations

deviceGroupDescription=Prague office workstations

devTimeFormat=MMM dd yyyy HH:mm:ss z

src=10.42.7.19

eialarmid=48213

sev=5

Blokirane datoteke

Primjer događaja blokiranih datoteka

deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7

devTime=Sep 02 2026 14:23:07 GMT

objectUri=file:///C:/Users/jnovak/Downloads/portscan_tool.exe

description=Blocked by Application control

cause=Blocked by hash

action=Blocked

processName=C:\Windows\explorer.exe

accountName=CONTOSO\jnovak

hash=4C0E9B21A7F58D3306E14B7CA2905F8D71B3E6A9

firstseen=Sep 01 2026 09:12:44 GMT

resolved=false

detectionUuid=0fb3d572-6a18-4e29-8c74-b25f19e0a3c6

handled=true

tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63

tenantName=Contoso Retail

deviceName=WS-PRG-0421

deviceOSName=Microsoft Windows 11 Pro

deviceGroupName=All/Contoso Retail/Prague/Workstations

deviceGroupDescription=Prague office workstations

devTimeFormat=MMM dd yyyy HH:mm:ss z

src=10.42.7.19

sev=3

Incidenti

Događaj integracije incidenata

incidentUuid=5c2a8f31-77d0-4e16-b9a4-0e63f8127bda

incidentName=Ransomware staging on WS-PRG-0421

devTime=Sep 02 2026 14:23:07 GMT

indicatorCount=7

deviceCount=2

processCount=5

moduleCount=3

url=https://protect.eset.systems/incidents/5c2a8f31-77d0-4e16-b9a4-0e63f8127bda

tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63

tenantName=Contoso Retail

devTimeFormat=MMM dd yyyy HH:mm:ss z

action=Create

status=New

sev=5

Više informacija o značajci Log Event Extended Format (LEEF) možete pronaći na službenim stranicama tvrtke IBM.

˄˅