导出为 LEEF 格式的事件
要过滤发送到系统日志的事件日志，请使用定义的过滤器创建日志类别通知。
LEEF 格式是 IBM® Security QRadar® 的自定义事件格式。事件具有标准和自定义属性：
•ESET PROTECT 使用官方 IBM 文档中所述的某些标准属性。
•自定义属性与 JSON 格式中的相同。deviceGroupName 属性包含生成事件的计算机的静态组的完整路径。如果路径的长度超过 255 个字符，则 deviceGroupName 仅会包含静态组名称。deviceOSName 属性包含有关计算机操作系统的信息，deviceGroupDescription 属性包含静态组的说明。
事件类别：
病毒防护检测
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|Threat Event|cat=ESET Threat Event deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7 devTime=Sep 02 2026 14:23:07 GMT threatType=Trojan threatName=Win32/Filecoder.NLM scannerID=Real-time file system protection scanID=ndl32941.dat objectType=File objectUri=file:///C:/Users/jnovak/Downloads/invoice_0912.exe actionTaken=Cleaned by deleting threatHandled=true needRestart=false accountName=CONTOSO\jnovak processName=C:\Windows\explorer.exe circumstances=Event occurred on a newly created file. engineVersion=31842 (20260902) firstseen=Sep 02 2026 14:23:05 GMT hash=9F2E1B77C4A0D5E8B31F6C09A4D72E5B18C3A6F0 detectionUuid=6b0f3d21-9c74-4a58-8e13-77af52d0c9b4 tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail deviceName=WS-PRG-0421 deviceOSName=Microsoft Windows 11 Pro deviceGroupName=All/Contoso Retail/Prague/Workstations deviceGroupDescription=Prague office workstations devTimeFormat=MMM dd yyyy HH:mm:ss z src=10.42.7.19 sev=3 |
防火墙
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|Firewall Event|cat=ESET Firewall Event deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7 devTime=Sep 02 2026 14:23:07 GMT eventDesc=Communication denied by rule srcPort=49712 dstPort=445 proto=TCP accountName=NT AUTHORITY\SYSTEM processName=C:\Windows\System32\svchost.exe ruleName=Block incoming SMB from outside ruleID=User rule aggregateCount=12 inbound=true src=198.51.100.77 sourceAddressType=IPv4 dst=10.42.7.19 targetAddressType=IPv4 detectionUuid=2a7c5e91-04b8-4d3f-95ac-61e0f7d28b34 action=Blocked handled=true tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail deviceName=WS-PRG-0421 deviceOSName=Microsoft Windows 11 Pro deviceGroupName=All/Contoso Retail/Prague/Workstations deviceGroupDescription=Prague office workstations devTimeFormat=MMM dd yyyy HH:mm:ss z sev=3 |
过滤的网站 - Web 防护
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|Filtered Website Event|cat=ESET Filtered Website Event deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7 devTime=Sep 02 2026 14:23:07 GMT eventDesc=An attempt to connect to URL ruleID=Blocked by internal blacklist actionTaken=Blocked objectUri=http://malicious.example.com/payload.bin processName=C:\Program Files\Google\Chrome\Application\chrome.exe accountName=CONTOSO\jnovak hash=B71C0A34F9D2E5871C60A4B8D93F2E017C5A6D48 dst=203.0.113.44 targetAddressType=IPv4 scannerID=HTTP filter resolved=false detectionUuid=7e51b8c3-2d94-40a6-b7f2-5c81a0e934dd handled=true tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail deviceName=WS-PRG-0421 deviceOSName=Microsoft Windows 11 Pro deviceGroupName=All/Contoso Retail/Prague/Workstations deviceGroupDescription=Prague office workstations devTimeFormat=MMM dd yyyy HH:mm:ss z src=10.42.7.19 sev=3 |
HIPS
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|ESET HIPS Event|cat=ESET HIPS Event deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7 devTime=Sep 02 2026 14:23:07 GMT application=C:\Users\jnovak\AppData\Local\Temp\setup.exe operation=Modify startup registry key target=HKLM\Software\Microsoft\Windows\CurrentVersion\Run action=Blocked ruleName=Suspicious autostart modification ruleID=User rule aggregateCount=3 detectionUuid=d47a9f10-8c62-4b05-a1e7-3f9b62c05d81 handled=true tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail deviceName=WS-PRG-0421 deviceOSName=Microsoft Windows 11 Pro deviceGroupName=All/Contoso Retail/Prague/Workstations deviceGroupDescription=Prague office workstations devTimeFormat=MMM dd yyyy HH:mm:ss z src=10.42.7.19 sev=3 |
审计
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|Audit Event|cat=ESET RA Audit Event devTime=Sep 02 2026 14:23:07 GMT domain=Native user action=Login attempt result=Success user=jnovak@contoso.example detail=Login from 203.0.113.9 using the web console tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail devTimeFormat=MMM dd yyyy HH:mm:ss z sev=1 |
ESET Inspect 警报
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|ESET Inspect Alert|cat=ESET Inspect Alert deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7 devTime=Sep 02 2026 14:23:07 GMT process=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe user=CONTOSO\jnovak rule=Suspicious PowerShell download cradle count=1 eiconsolelink=https://inspect.eset.systems/console/detection/48213 resolved=false detectionUuid=b93c17e4-5d80-4a62-9f31-c0e785a2d417 hash=E20D74B1C3A96F5807D2B4E1930CA6F85D71B204 sevScore=78 compSevScore=64 triggerEvent=Process started commandLine=powershell -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0A tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail deviceName=WS-PRG-0421 deviceOSName=Microsoft Windows 11 Pro deviceGroupName=All/Contoso Retail/Prague/Workstations deviceGroupDescription=Prague office workstations devTimeFormat=MMM dd yyyy HH:mm:ss z src=10.42.7.19 eialarmid=48213 sev=5 |
阻止的文件
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|Blocked File Event|cat=ESET Blocked File Event deviceUuid=c1d9e77a-3b52-4f08-9a6e-2d84bb31f5c7 devTime=Sep 02 2026 14:23:07 GMT objectUri=file:///C:/Users/jnovak/Downloads/portscan_tool.exe description=Blocked by Application control cause=Blocked by hash action=Blocked processName=C:\Windows\explorer.exe accountName=CONTOSO\jnovak hash=4C0E9B21A7F58D3306E14B7CA2905F8D71B3E6A9 firstseen=Sep 01 2026 09:12:44 GMT resolved=false detectionUuid=0fb3d572-6a18-4e29-8c74-b25f19e0a3c6 handled=true tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail deviceName=WS-PRG-0421 deviceOSName=Microsoft Windows 11 Pro deviceGroupName=All/Contoso Retail/Prague/Workstations deviceGroupDescription=Prague office workstations devTimeFormat=MMM dd yyyy HH:mm:ss z src=10.42.7.19 sev=3 |
事件
LEEF:1.0|ESET|RemoteAdministrator|11.3.78.0|Incident Created|cat=ESET Incident Event incidentUuid=5c2a8f31-77d0-4e16-b9a4-0e63f8127bda incidentName=Ransomware staging on WS-PRG-0421 devTime=Sep 02 2026 14:23:07 GMT indicatorCount=7 deviceCount=2 processCount=5 moduleCount=3 url=https://protect.eset.systems/incidents/5c2a8f31-77d0-4e16-b9a4-0e63f8127bda tenantUuid=8f2b1c40-6d3a-4e91-b7d2-0c5a9e1f4a63 tenantName=Contoso Retail devTimeFormat=MMM dd yyyy HH:mm:ss z action=Create status=New sev=5 |
|
可以在官方 IBM 网站上，了解有关 Log Event Extended Format (LEEF) 的详细信息。 |
