Events pertaining to alerts from Trellix or other security products.
These events may belong to the antivirus or ids metaclass.
Fields such as action, category, severity, and virus are used in Trellix rules and analytics.
Taxonomy | Type | Description |
|---|---|---|
| string | Action taken for an event, such as allow, drop, or quarantine |
| string | Category name |
| string | Malware name |
| string | Malware classification |
| string | Severity level |
| string | Virus name |