导出为 LEEF 格式的事件
要过滤发送到系统日志的事件日志，请使用定义的过滤器创建日志类别通知。
LEEF 格式是 IBM® Security QRadar® 的自定义事件格式。事件具有标准和自定义属性：
•ESET PROTECT 使用官方 IBM 文档中所述的某些标准属性。
•自定义属性与 JSON 格式中的相同。deviceGroupName 属性包含生成事件的计算机的静态组的完整路径。如果路径的长度超过 255 个字符，则 deviceGroupName 仅会包含静态组名称。deviceOSName 属性包含有关计算机操作系统的信息，deviceGroupDescription 属性包含静态组的说明。
事件类别：
•
病毒防护检测
LEEF:1.0|ESET|RemoteAdministrator|10.1.0.0|Threat Event|cat=ESET Threat Event sev=3 devTime=Jan 18 2022 14:46:00 GMT devTimeFormat=MMM dd yyyy HH:mm:ss z src= deviceName=mydevice deviceUuid=fb6c25d2-116e-4d0f-a159-695bb16e7b78 deviceGroupName=All threatType=Virus threatName=W97M/Marker.KS scannerID=On-demand scanner engineVersion=18563 objectUri=mekpoimnjoheutqgzz1o objectType=File threatHandled=true needRestart=false detectionUuid=90a37fe6-f4f4-4ea6-a265-93dfd9823b12 accountName=Feri firstseen=20220118T14460hash=AB37916418A79BF117E9F7D91D35CD0ABFD78E4B |
•
防火墙
LEEF:1.0|ESET|RemoteAdministrator|10.1.0.0|Firewall Event|cat=ESET Firewall Event sev=5 devTime=Dec 11 2022 05:39:49 GMT devTimeFormat=MMM dd yyyy HH:mm:ss z src= deviceName=mydevice deviceUuid=fb6c25d2-116e-4d0f-a159-695bb16e7b78 deviceGroupName=All action=Blocked eventDesc=TCP Port Scanning attack dst=192.168.27.20 src=192.168.26.208 inbound=true dstPort=2508 srcPort=49192 targetAddressType=IPv4 sourceAddressType=IPv4 proto=TCP threatName=Win32/Botnet.generic aggregateCount=1 handled=1 detectionUuid=ed8232d9-ddff-411a-ad48-efdaea13a0e6 |
•过滤的网站 - 
Web 防护
LEEF:1.0|ESET|RemoteAdministrator|10.1.0.0|Filtered Website Event|cat=ESET Filtered Website Event sev=5 devTime=Jan 19 2022 00:50:00 GMT devTimeFormat=MMM dd yyyy HH:mm:ss z src= deviceName=mydevice deviceUuid=fb6c25d2-116e-4d0f-a159-695bb16e7b78 deviceGroupName=All objectUri=https://deloplen.com actionTaken=Blocked eventDesc=An attempt to connect to URL scannerID=HTTP filter dst=192.168.200.81 targetAddressType=IPv4 detectionUuid=ccec3a9e-0f15-4629-982a-22afdd7b9400 accountName=Frantisek hash=8EECCDD290BE2E99183290FDBE4172EBE3DC7EC5 processName=chrome.exe ruleID=Blocked by internal blacklist handled=0 |
•
HIPS
LEEF:1.0|ESET|RemoteAdministrator|10.1.0.0|ESET HIPS Event|cat=ESET HIPS Event sev=3 devTime=Dec 01 2022 15:00:02 GMT devTimeFormat=MMM dd yyyy HH:mm:ss z src= deviceName=mydevice deviceUuid=fb6c25d2-116e-4d0f-a159-695bb16e7b78 deviceGroupName=All handled=1 application=C:\Users\Admin\Desktop\HIPS_test\HIPS_test\es_pack_to_test\es_pack_to_test\test\java.exe operation=Attempt to run a suspicious object target=C:\Users\Admin\Desktop\HIPS_test\HIPS_test\es_pack_to_test\es_pack_to_test\test\trojan.exe action=Blocked ruleID=Suspicious attempt to launch an application aggregateCount=1 detectionUuid=8f95d794-4075-46d1-a0b0-749e34327c8d |
•审核
•
ESET Inspect 警报
LEEF:1.0|ESET|RemoteAdministrator|10.1.0.0|ESET Inspect Alert|cat=ESET Inspect Alert sev=3 devTime=Dec 02 2022 08:43:59 GMT devTimeFormat=MMM dd yyyy HH:mm:ss z src= deviceName=mydevice deviceUuid=fb6c25d2-116e-4d0f-a159-695bb16e7b78 deviceGroupName=All hash=4F7B45CA215E163E963FB3AE00A52650A7E8AF2B detectionUuid=8407c4d1-c629-4d03-930a-895d135a0edc user=kj_win10_local\damian process=%TMP%\34e1824e-5612-4879-92da-5713ceaa965b\rsawdds.doc.exe eiconsolelink=https://test-inspect.eset.com:443/console/detection/31 rule=Process with a suspicious extension has started [Z0406] count=1 compSevScore=2976 sevScore=75 triggerEvent=Test Trigger commandLine=C:\Windows\System32\cmd.exe eialarmid=31 |
•
阻止的文件
LEEF:1.0|ESET|RemoteAdministrator|10.1.0.0|Blocked File Event|cat=ESET Blocked File Event sev=5 devTime=Nov 30 2022 12:51:58 GMT devTimeFormat=MMM dd yyyy HH:mm:ss z src= deviceName=mydevice deviceUuid=fb6c25d2-116e-4d0f-a159-695bb16e7b78 deviceGroupName=All objectUri=file:///C:/Program Files/WindowsApps/Microsoft.WindowsCalculator_10.2103.8.0_x64__8wekyb3d8bbwe/Calculator.exe action=Blocked and cleaned description=ESET Inspect hash=FF1CE0EB6007E6BC2EB9D563B2DAA8C4D8F45E87 detectionUuid=edc7c64c-5097-40d5-b45a-e854270c0bb4 firstseen=20210508T072301 cause=Blocked by Administrator |
|
可以在官方 IBM 网站上，了解有关 Log Event Extended Format (LEEF) 的详细信息。 |
