Alert details

When you select a single AMSI alert on the Alerts page, the details of the alert are shown on the Hosts page of the Endpoint Security Web UI.

The Endpoint Security server provides a raw view of the alert details in JSON format. Most of the information available in the AMSI home page is reformatted to generalize the alerts data coming from various modules. The following table shows notable alert fields that the AMSI module generates.

Alert Fields	Description
`Event_at`	Time when the script was executed.
`Content_name`	The script name if the file is on the disk. This field can also be used to indicate when a `DotNet` assembly is dynamically loaded.
`matched_rule`	Contains the rule name and additional metadata, such as `MetaData` and `MatchedStrings`, that help analyze the detection.
`Intel_version`	Version of the intel package that includes the AMSI rules.
`Rules_version`	AMSI rules package version.
`Amsi_data`	Suspicious data scanned by AMSI.
`Arguments`	Command-line arguments passed to the source process.
`Attributes`	Scan metadata.
`Account_name`	User account that the scripting engine targeted.