LEEF 형식으로 내보낸 이벤트
Syslog로 전송된 이벤트 로그를 필터링하려면 필터가 정의된 로그 범주 알림을 생성합니다.
LEEF 형식은 IBM® Security QRadar®용으로 사용자 지정된 이벤트 형식입니다. 이벤트에는 표준 특성과 사용자 지정 특성이 있습니다:
•ESET PROTECT는 공식 IBM 설명서에 설명되어 있는 몇 가지 표준 특성을 사용합니다.
•사용자 지정 특성은 JSON 형식과 동일합니다. deviceGroupName 특성에는 이벤트를 생성하는 컴퓨터의 정적 그룹에 대한 전체 경로가 포함됩니다. 경로가 255자보다 길면 deviceGroupName에는 정적 그룹 이름만 포함됩니다. deviceOSName 특성에는 컴퓨터의 운영 체제에 대한 정보가 포함되고, deviceGroupDescription 특성에는 정적 그룹의 설명이 포함됩니다.
이벤트 범주:
안티바이러스 탐지
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|Threat Event|cat=ESET Threat Event deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7 devTime=Sep 02 2026 14:23:07 GMT threatType=Trojan threatName=Win32/Filecoder.NLM scannerID=Real-time file system protection scanID=ndl32941.dat objectType=File objectUri=file:///C:/Users/jnovak/Downloads/invoice_0912.exe actionTaken=Cleaned by deleting threatHandled=true needRestart=false accountName=CONTOSO\jnovak processName=C:\Windows\explorer.exe circumstances=Event occurred on a newly created file. engineVersion=31842 (20260902) firstseen=Sep 02 2026 14:23:05 GMT hash=9F2E1B77C4A0D5E8B31F6C09A4D72E5B18C3A6F0 detectionUuid=6b0f3d21-9c74-4a58-8e13-77af52d0c9b4 tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail deviceName=WS-PRG-0421 deviceOSName=Microsoft Windows 11 Pro deviceGroupName=All/Contoso Retail/Prague/Workstations deviceGroupDescription=Prague office workstations devTimeFormat=MMM dd yyyy HH:mm:ss z src=10.42.7.19 sev=3 |
방화벽
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|Firewall Event|cat=ESET Firewall Event deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7 devTime=Sep 02 2026 14:23:07 GMT eventDesc=Communication denied by rule srcPort=49712 dstPort=445 proto=TCP accountName=NT AUTHORITY\SYSTEM processName=C:\Windows\System32\svchost.exe ruleName=Block incoming SMB from outside ruleID=User rule aggregateCount=12 inbound=true src=198.51.100.77 sourceAddressType=IPv4 dst=10.42.7.19 targetAddressType=IPv4 detectionUuid=2a7c5e91-04b8-4d3f-95ac-61e0f7d28b34 action=Blocked handled=true tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail deviceName=WS-PRG-0421 deviceOSName=Microsoft Windows 11 Pro deviceGroupName=All/Contoso Retail/Prague/Workstations deviceGroupDescription=Prague office workstations devTimeFormat=MMM dd yyyy HH:mm:ss z sev=3 |
필터링된 웹 사이트 - 웹 보호
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|Filtered Website Event|cat=ESET Filtered Website Event deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7 devTime=Sep 02 2026 14:23:07 GMT eventDesc=An attempt to connect to URL ruleID=Blocked by internal blacklist actionTaken=Blocked objectUri=http://malicious.example.com/payload.bin processName=C:\Program Files\Google\Chrome\Application\chrome.exe accountName=CONTOSO\jnovak hash=B71C0A34F9D2E5871C60A4B8D93F2E017C5A6D48 dst=203.0.113.44 targetAddressType=IPv4 scannerID=HTTP filter resolved=false detectionUuid=7e51b8c3-2d94-40a6-b7f2-5c81a0e934dd handled=true tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail deviceName=WS-PRG-0421 deviceOSName=Microsoft Windows 11 Pro deviceGroupName=All/Contoso Retail/Prague/Workstations deviceGroupDescription=Prague office workstations devTimeFormat=MMM dd yyyy HH:mm:ss z src=10.42.7.19 sev=3 |
HIPS
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|ESET HIPS Event|cat=ESET HIPS Event deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7 devTime=Sep 02 2026 14:23:07 GMT application=C:\Users\jnovak\AppData\Local\Temp\setup.exe operation=Modify startup registry key target=HKLM\Software\Microsoft\Windows\CurrentVersion\Run action=Blocked ruleName=Suspicious autostart modification ruleID=User rule aggregateCount=3 detectionUuid=d47a9f10-8c62-4b05-a1e7-3f9b62c05d81 handled=true tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail deviceName=WS-PRG-0421 deviceOSName=Microsoft Windows 11 Pro deviceGroupName=All/Contoso Retail/Prague/Workstations deviceGroupDescription=Prague office workstations devTimeFormat=MMM dd yyyy HH:mm:ss z src=10.42.7.19 sev=3 |
감사
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|Audit Event|cat=ESET RA Audit Event devTime=Sep 02 2026 14:23:07 GMT domain=Native user action=Login attempt result=Success user=jnovak@contoso.example detail=Login from 203.0.113.9 using the web console tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail devTimeFormat=MMM dd yyyy HH:mm:ss z sev=1 |
ESET Inspect 경고
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|ESET Inspect Alert|cat=ESET Inspect Alert deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7 devTime=Sep 02 2026 14:23:07 GMT process=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe user=CONTOSO\jnovak rule=Suspicious PowerShell download cradle count=1 eiconsolelink=https://inspect.eset.systems/console/detection/48213 resolved=false detectionUuid=b93c17e4-5d80-4a62-9f31-c0e785a2d417 hash=E20D74B1C3A96F5807D2B4E1930CA6F85D71B204 sevScore=78 compSevScore=64 triggerEvent=Process started commandLine=powershell -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0A tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail deviceName=WS-PRG-0421 deviceOSName=Microsoft Windows 11 Pro deviceGroupName=All/Contoso Retail/Prague/Workstations deviceGroupDescription=Prague office workstations devTimeFormat=MMM dd yyyy HH:mm:ss z src=10.42.7.19 eialarmid=48213 sev=5 |
차단된 파일
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|Blocked File Event|cat=ESET Blocked File Event deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7 devTime=Sep 02 2026 14:23:07 GMT objectUri=file:///C:/Users/jnovak/Downloads/portscan_tool.exe description=Blocked by Application control cause=Blocked by hash action=Blocked processName=C:\Windows\explorer.exe accountName=CONTOSO\jnovak hash=4C0E9B21A7F58D3306E14B7CA2905F8D71B3E6A9 firstseen=Sep 01 2026 09:12:44 GMT resolved=false detectionUuid=0fb3d572-6a18-4e29-8c74-b25f19e0a3c6 handled=true tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail deviceName=WS-PRG-0421 deviceOSName=Microsoft Windows 11 Pro deviceGroupName=All/Contoso Retail/Prague/Workstations deviceGroupDescription=Prague office workstations devTimeFormat=MMM dd yyyy HH:mm:ss z src=10.42.7.19 sev=3 |
사고
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|Incident Created|cat=ESET Incident Event incidentUuid=5c2a8f31-77d0-4e16-b9a4-0e63f8127bda incidentName=Ransomware staging on WS-PRG-0421 devTime=Sep 02 2026 14:23:07 GMT indicatorCount=7 deviceCount=2 processCount=5 moduleCount=3 url=https://protect.eset.systems/incidents/5c2a8f31-77d0-4e16-b9a4-0e63f8127bda tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail devTimeFormat=MMM dd yyyy HH:mm:ss z action=Create status=New sev=5 |
|
자세한 내용은 공식 IBM 웹 사이트의 Log Event Extended Format (LEEF)에서 확인할 수 있습니다. |
