All Trellix JSON values are strings. See the parameters in the table for examples of JSON syntax.
Note
The Z character at the end of a time stamp indicates that the time displayed is in the UTC time zone. Starting in the 7.0.0 release, the time is displayed in UTC by default. To change the displayed time to your local time, use the following CLI command: fenotify default timezone localtime
Element Name | Description | Products | Event Type | Data Type | Release |
|---|---|---|---|---|---|
alerts | alerts represents the topmost element NAME in the notification XPath. For example: "appliance": "2001:470:84a7:1720:2e0:81ff:fe4f:ac03", "product": "Web MPS", "version": "6.2.0.75853", "msg": "concise", "alert": { "id": "918", "name": "domain-match", "severity": "minr", "src": " " "smtp-message "action": "notified", "alert-url": "https://xxx.xxx.xxx.xxx/...", "dst": { "mac": "00:50:56:e8:ba:21" "malware-detected": { "malware": { "name": "Trojan.Downloader.Bredolab" } } } }, { "appliance": "2001:470:84a7:1720:2e0:81ff:fe4f:ac03", "product": "Web MPS", "version": "6.2.0.75853", "alert": { "id": "2989", "name": "infection-match", "severity": "minr", "action": "notified", "alert-url": "https://xxx.xxx.xxx.xxx/" "dst": { "ip": "xxx.xxx.xxx.xxx", "mac": "0a:20:02:8f:a4:27", "port": "80" }, "explanation": { "analysis": "binary", "protocol": "tcp", "cnc-services": { "cnc-service": { "port": "80", "protocol": "tcp", "address": "xxx.xxx.xxx.xxx", "channel": "GET /games/... HTTP/1.1::...::~~::~~" } }, "malware-detected": { "malware": { "name": "Exploit.ToolKit", "sid": "84000006", "stype": "bot-command" } } }, "interface": { "label": "A1", "mode": "tap", "interface": "pether3" }, "occurred": "2012-10-10T07:10:50Z", "src": { "vlan": "0", "ip": "xxx.xxx.xxx.xxx", "mac": "42:54:11:11:ff:03", "port": "49169" } } } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | (See more examples in XML notification examples per infection type):
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ appliance-id | appliance-id represents the appliance that was the origin of the alert. For example (from a Central Management appliance): "product": "CMS", "appliance-id": "01234567897A", "appliance": "xxx.xxx.xxx.xxx", "alert": { "src": { "ip": "87.678.913.234", "mac": "00:0c:29:4e:57:60", "vlan": "0" }, "product": "Web MPS", "appliance-id": "9876543210D0", | NX AX FX EX CM | MC WI IM DM MO IE RC RO | Appliance ID. Six hexadecimal numbers | 7.x 8.x |
alerts/ alert | alert represents the element REF= in the notification XPath For example: "alert": { "id": "29129", "name": "malware-object", "severity": "majr", "action": "notified", "alert-url": "https://xxx.xxx.xxx.xxx/ event_stream/events_for_bot? ma_id=29129&lms_iden=00:E0:81:4F:AC:03", "dst": { "ip": "221.187.185.88" }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | “/alert“ is the secondary level element of each notification message. It may include at least one of the following sub-elements: See more examples in :XML notification examples per infection type
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
sc-version | sc-version represents the security content version For example: "sc-version": "845.114" | EX | MC WI IM DM MO | version number | 8.3 |
alerts/ alert/ src | src represents the element REF for the infected host. The source is either an email address or an IP address. The source IP address is that of the victim of the infection, not the origin of the malware. For example: "src": { "ip": "xxx.xxx.xx.xxx", "mac": "00:20:18:11:ff:40", "vlan": "0", "port": "49177" }, or "src": { "url": "/3lC3L55QC4z3NZNm -1-5_mal_files.zip", "domain": "sender.com", "smtp-mail-from": "trellix@sender.com" }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | This element might include at least one of the following sub-elements or attributes in the notification:
These sub-elements and attribute are described further in other rows of this table. | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ src/ vlan | vlan represents the VLAN ID. For example: "src": { "vlan": "0", "ip": "xxx.xxx.xxx.xxx", "mac": "42:54:11:11:ff:03", "port": "49169" } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | vlan is an XPath attribute of the src element, and this attribute includes the following sub-element values:
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ src/ ip | ip represents the IP address of the infected host. For example: "src": { "vlan": "0", "ip": "xxx.xxx.xxx.xxx", } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | 16-byte integer IPv4 address | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ src/ mac | mac represents the MAC address of the infected host. For example: "src": { "vlan": "0", "ip": "xxx.xxx.xxx.xxx", "mac": "42:54:11:11:ff:03", "port": "49169" } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | MAC Address Six colon-separated hexadecimal numbers | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ src/ url | url represents the URL associated with the malware. For example: "src": { "vlan": "0", "ip": "xxx.xxx.xxx.xxx", "mac": "42:54:11:11:ff:03", "port": "49169" "url": “https://xxx.xxx.xxx.xxx/event_stream/ events_for_bot?ma_id\=51056&lms_iden\=00:25:90:54:7E:6E cs1Label=sname cs1=Trojan. Generic” } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | HTTP or HTTPS source URL of the malware. | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ src/ host | host represents the hostname of the infected machine as detected by a Trellix appliance MVX. For example: "src": { "host": "icqdos0", } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ src/ port | port is the port of the infected machine as detected by a Trellix appliance MVX. For example: "src": { "port": "49169", } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | Integer Valid Port Numbers 0~65535 | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ src/ domain | domain represents the domain of the infected machine as detected by a Trellix appliance MVX For example: "src": { "domain": "networkAlpha.com", } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String | 6.x 7.x 8.x |
alerts/ alert/ src/ smtp-mail-from | smtp-mail-from represents the user name of the sender of the malicious email detected by a Trellix appliance. For example: “smtp-mail-from”: “perfEmailauto mation.local” | EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ src/ repository | repository is the file system SharePoint or mount point. For example: “repository”: “sharepoint” | AX FX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ src/ proxy | proxy represents HTTP proxy (IP address) of the infected host system. For example: “proxy”: “xxx.xxx.xxx.xxx” | NX AX FX EX CM | MC WI IM DM MO IE RC RO | IP address | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ alert-url | alert-url represents the URL generated by the Trellix MVX of the alert notification for a detected malware. For example: “alert-url”: “https://xxx.xxx.xxx.xxx/event_ stream_events_for_bot?ev_id= 12762&lms_iden=00:E0:81 :4F:AC:03” | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ action | action represents the notification action taken by the system during a malware detection. For example: “action”: “notified”, “action”: “blocked” | NX AX FX EX CM | MC WI IM DM MO IE RC RO | action options:
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ locations | locations represents the geolocation from which the detected malware originated. For example: “locations”: “FR” | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String Two-letter abbreviation of country name(s); comma-separated multiple locations are supported. | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ occurred | occurred represents the date and time of the malware infection. For example: “occurred”: “2012-10-11T20:09:39Z” | NX AX FX EX CM | MC WI IM DM MO IE RC RO | Time stamp:
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ dst | For Email Security — Server Edition appliances, dst represents the email destination of the targeted host. For Network Security appliances, dst represents the destination host targeted by the infected source host. For example, for an Email Security — Server Edition appliance: "dst": { "ip": "xxx.xxx.xxx.xxx", "mac": "00:10:db:ff:20:80", "port": "80" ... For example, for a Network Security appliance: "dst": { "ip": "xxx.xxx.xxx.xxx", "mac": "02:35:4b:f8:74:8e", "port": "80" ... | EX CM | MC WI IM DM MO IE RC RO | This element might include at least one of the following sub-elements in the notification:
These sub-elements are described further in other rows of this table. | 6.x 7.x 8.x |
alerts/ alert/ dst/ mac | mac represents the MAC address of the attacker host. For example: "dst": { "ip": "xxx.xxx.xxx.xxx", "mac": "00:10:db:ff:20:80", "port": "80" ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | MAC Address Six colon-separated hexadecimal numbers | 6.x 7.x 8.x |
alerts/ alert/ dst/ port | port is the port of the attacker machine as detected by a Trellix appliance MVX. For example: "dst": { "ip": "xxx.xxx.xxx.xxx", "mac": "00:10:db:ff:20:80", "port": "80" ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | Integer Valid port numbers 0~65535 | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ dst/ ip | ip represents the IP address of the attacker host. For example: "dst": { "ip": "xxx.xxx.xxx.xxx", "mac": "00:10:db:ff:20:80", "port": "80" ... | EX CM | MC WI IM DM MO IE RC RO | 16-byte integer IPv4 address | 6.x 7.x 8.x |
alerts/ alert/ dst/ smtp-to | smtp-to represents the recipient of the malicious email detected by a Trellix appliance. For example: "dst": { "smtp-to": "trellix_1@rock.titania.com" }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.x 7.x 8.x |
alerts/ alert/ dst/ smtp-cc | smtp-cc represents the recipient of the malicious email detected by a Trellix appliance For example: "dst": { "ip": "xxx.xxx.xxx.xxx", "smtp-cc": "johndoe@zAnew.com", "port": "80" ... | EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.x 7.x 8.x |
alerts/ alert/ smtp-message | smtp-message represents the SMTP email message ID and other information associated with the infected email. For example: "smtp-message": “20121017232425.6706.77689. Email-48trellix.com” ... | EX CM | MC WI IM DM MO IE RC RO | String 1023 characters This element might include at least one of the following sub-elements and attribute in the notification:
These sub-elements and attribute are described further in other rows of this table. | 6.x 7.x 8.x |
alerts/ alert/ smtp-message/ subject | subject represents the SMTP email message subject line on the infected email. For example: "smtp-message": { “subject”: “RE:Upcoming Meeting” } ... | EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.x 7.x 8.x |
alerts/ alert/ smtp-message/ smtp-header | smtp-header provides the SMTP email message header (including any configured X-header data) of the infected email. For example: "smtp-message": { “smtp-header”: “X-Trellix: Malicious Email Found” } ... | EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.x 7.x 8.x |
alerts/ alert/ smtp-message/ last-malware | last-malware represents the name associated with last malicious email infection. For example: "smtp-message": { “last-malware”: “Trojan.Win32” } ... | EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.x 7.x 8.x |
alerts/ alert/ smtp-message/ protocol | protocol represents the transport protocol detected by the Trellix appliance MVX. For example: "smtp-message": { “protocol”: “udp” } ... | EX CM | MC WI IM DM MO IE RC RO | TCP or UDP | 6.x 7.x 8.x |
alerts/ alert/ smtp-message/ id | The id attribute represents the SMTP email message ID of the infected email. For example: "smtp-message": { “id”: “20121017232425.6706.77689.Email-48trellix.com” } ... | EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.x 7.x 8.x |
alerts/ alert/ interface | The interface element represents the configured interface n the Trellix appliance. For example: "interface": { "label": "A1", "mode": "tap", "interface": "pether3" }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters This element might include at least one of the following attributes in the notification:
These attributes are described further in other rows of this table. | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ interface/ label | The label attribute represents the label of the Trellix appliance interface. For example: "interface": { "label": "A1", "mode": "tap", "interface": "pether3" }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.x 7.x 8.x |
alerts/ alert/ interface/ mode | The mode attribute indicates whether the Trellix appliance is deployed in SPAN or TAP mode. For example: "interface": { "label": "A1", "mode": "tap", "interface": "pether3" }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters There are two values:
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation | The explanation element provides supporting details about the MVX analysis and detected malware. For example: "explanation": { "analysis": "binary", "protocol": "tcp", "cnc-services": { "cnc-service": { "port": "80", "protocol": "tcp", "address": "xxx.xxx.xxx.xxx", "channel": "GET /games/... ...Connection: keep- alive::~~Referer: http:// moa3.co.cc/imgurlfx.php? hl=180ce3af78870604::~~:: ~~" } }, "malware-detected": { "malware": { "name": "Exploit.Tool Kit.BlackHole", "sid": "84000006", "stype": "bot-command" } } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | This element might include at least one of the following attributes and sub-elements in the notification:
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ analysis | The “explanation” element’s attribute analysis describes the type of analysis performed by the Trellix appliance MVX. For example: "explanation": { "analysis": "binary", "protocol": "tcp", "cnc-services": { "cnc-service": { "port": "80", "protocol": "tcp", "address": "xxx.xxx.xxx.xxx", ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | The type of malware analysis model used with the following possible values:
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ protocol | The “explanation” element’s attribute protocol describes the type of protocol detected by the Trellix appliance MVX. For example: (not applicable for release 6.0; same for releases 6.1 and later) "explanation": { "analysis": "binary", "protocol": "tcp", ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | protocol options include:
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ urls | The “explanation” element’s attribute urls represents the URLs detected by the Trellix appliance MVX, separated by commas. For example: "explanation": { "analysis": "binary", "protocol": "tcp", "urls”: “https://xxx.xxx.xxx.xxx/event_stream/events_for_bot?ma_id\=51056&l ms_iden\=00:25:90:54:7E:6E cs1Label=sname cs1=Trojan. Generic>”... ...} | NX AX FX EX CM | MC WI IM DM MO IE RC RO | URLs that may have been involved in an infection. | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ service | The service element represents the profile service name set for the Trellix appliance MVX. For example: "explanation": "service": "service name”... ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ anomaly | The anomaly element defines the type of anomalous event detected by the Trellix appliance MVX. For example: "explanation": "anomaly": "misc-anomaly”... ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | Available values for the type of anomaly detected:
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ target-application | The target-application element indicates the application running in the Trellix appliance MVX profile at the time of infection. For example: "explanation": "target-application": "InternetEx plorer 6.0.2600.0000.xpcli ent.010817-1148”... ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters Name of the application running on the infected target. | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ target-os | The target-os element indicates the operating system running in the Trellix appliance MVX at the time of infection. For example: "explanation": "target-os": "Microsoft WindowsXP Professional 5.1 base”... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters Name of the OS running on the infected target. | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ stolen_data | The stolen-data element provides information about data stolen at the time of infection. For example: “stolen_data”: } ” "size”: "99" } "info:”: { "type”: "identity" , "encryption": “RC4", "decrypted”: "yes" } "description”: "Trellix sample malware-call back data-theft plugin output for sid 2345”, "severity”: “3”, "field”: { "service" “https://www.fe-/ examples.com/samples/ reporting/login "name”: "user", "name”: "password", } | NX AX FX EX CM | MC WI IM DM MO IE | This element might include at least one of the following attributes in the notification:
These sub-elements and attributes are described further in other rows in this table. | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ stolen_data/ event_id | The event_id attribute represents the stolen data event ID. For example: “stolen_data”: } ” "size”: "99" ” "event_id”: "events_for_bot?ma_id\ =51056&lms_iden\= 00:25:90:54:7E:6E" } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters Trellix appliance internal unique event ID | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ stolen_data/ size | The size attribute represents the size of the stolen data in bytes. For example: “stolen_data”: } ” "size”: "99" ” "event_id”: "events_for_bot?ma_id\ =51056&lms_iden\= 00:25:90:54:7E:6E" } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ stolen_data/ info/ decrypted | The decrypted attribute indicates whether the stolen data file was decrypted. For example: “stolen_data”: } ” "size”: "99" } "info:”: { "type”: "identity" , "encryption": “RC4", "decrypted”: "yes" } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ stolen_data/ info/ encrypted | The encrypted attribute indicates whether the stolen data file was encrypted. For example: “stolen_data”: } ” "size”: "99" } "info:”: { "type”: "identity" , "encryption": “RC4", "decrypted”: "yes" } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ stolen_data/ info/ type | The type attribute represents the type of stolen data. For example: “stolen_data”: } ” "size”: "99" } "info:”: { "type”: "credit card theft" , "encryption": “RC4", "decrypted”: "yes" } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters Available stolen data types:
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ stolen_data/ info/ description | The info/description element provides a description of the stolen data. For example: “stolen_data”: "description”: "Trellix sample malware-call back data-theft plugin output for sid 2345”, "severity”: “3”, ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 4096 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ stolen_data/ info/ severity | The info/severity element represents the severity level of the infection. For example: “stolen_data”: "description”: "Trellix sample malware-call back data-theft plugin output for sid 2345”, "severity”: “crit”, ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String Available severity levels:
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ stolen_data/ info/ field/ name | The name attribute represents name of the info field in the alert notification. For example: “stolen_data”: } ” "size”: "99" } "description”: "Trellix sample malware-call back data-theft plugin output for sid 2345”, "severity”: “3”, "field”: { "service" “https://www.fe-/ examples.com/samples/ reporting/login "name”: "user", "name”: "password", } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected | The malware-detected element provides details about detected malware. For example: "malware-detected": { "malware": { "name": "Worm.Email.Bagle", "sid": "11111276", "stype": "bot-command" } | NX AX FX EX CM | MC WI IM DM MO IE RC RO | This element might include at least one of the following attributes in the notification:
These sub-elements and attributes are described further in other rows of this table. | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware | The malware element uses attributes that define the detected malware. For example: "explanation": { "malware-detected": { "malware": { "name": "Trojan.Down loader.Bredolab" } } , | NX AX FX EX CM | MC WI IM DM MO IE RC RO | This element might include at least one of the following attributes in the notification:
These attributes are described further in other rows of this table. | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ content | The content attribute defines the content type of a URL associated with the detected malware. For example: "explanation": { "malware-detected": { "malware": { "name": "Trojan.Down loader.Bredolab" "content": "mime" } } , | NX AX FX EX CM | MC WI IM DM MO IE RC RO | Content attribute options:
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ name | The name attribute indicates the name of the detected malware. For example: "explanation": { "malware-detected": { "malware": { "name": "InfoStealer.Ban ker.Zbot.DNS" "content": "mime" } } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ scan | The scan attribute specifies the scan iteration ID for detected malware. For example: "explanation": { "malware-detected": { "malware": { "name": "InfoStealer.Banker.Zbot.DNS" "scan": "54042166" } } }, | FX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ sid | The sid attribute represents the Trellix internal alert sID for the detected malware. For example: "explanation": { "malware-detected": { "malware": { "name": "InfoStealer.Banker.Zbot.DNS" "sid": "80440378" } } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | Integer | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ type | The type attribute specifies the file type of the detected malware. For example: "explanation": { "malware-detected": { "malware": { "name": "InfoStealer.Banker.Zbot.DNS" "type": "exe" } } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | Possible values:
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ stype | The stype attribute specifies the Trellix-assigned signature for the detected malware. For example: "explanation": { "malware-detected": { "malware": { "name": "InfoStealer.Banker.Zbot.DNS" "stype": "blacklist" } } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | Possible values: 'generated-content', 'fireeye-content', 'bot-command', 'fqc', ‘known-md5sum', 'known-url', 'duplicate-md5sum', 'av-match', 'vm-bot-command', 'blacklist', 'yara', 'avs', 'archive', 'encoding', 'timestamp', 'embedded', 'file-check', 'protocol-header-check', 'email-block-listed', 'malware-block-listed', 'malware-intrinsic-analysis', 'fireeye-feed-match', 'custom-feed-match', 'retroactive', 'pe-sign-riskware', 'malware-guard', 'email-impersonation', 'custom-blacklist', 'faude', 'email-faude', 'email-hdr-typosquat', 'fscan', 'faude-url-click', 'static-analysis-extraction', 'impersonation-newdomain', 'impersonation-sender-profiling', 'impersonation-sender-domain', 'url-scan-policy', 'dynamic-url-analysis', 'fe-feed', 'custom-feed', 'local-avs', 'local-faude', 'private-GTI', 'phish-Detector', 'parent-child-correlator', 'bale', 'unknown' | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ archives | The archives attribute specifies the archives count. For example: "explanation": { "malware-detected": { "malware": { "name": "InfoStealer.Banker.Zbot.DNS" "archives": "8" } } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | Integer | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ parent | The parent attribute specifies the parent malware ID of detected child/nested malware. For example: "explanation": { "malware-detected": { "malware": { "name": "InfoStealer.Banker.Zbot.DNS" "parent": "33459873" } } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ origid | The origid attribute specifies the original malware ID for an infection, indicating that the detected malware is a duplicate of an original malware. For example: "explanation": { "malware-detected": { "malware": { "name": "InfoStealer.Banker.Zbot.DNS" "origid": "218799" } } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ malicious | The malicious attribute specifies whether the detected malware is malicious: true or false. For example: "explanation": { "malware-detected": { "malware": { "name": "InfoStealer.Banker.Zbot.DNS" "malicious": "true" } } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | Available options:
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ note | The note element allows the system to add notes or details to alert notifications about the detected malware. For example: "explanation": { "malware-detected": { "malware": { "note": "AttackZone3" "content": "mime" } } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ url | The url element provides the primary URL associated with the detected malware. For example: "explanation": { "malware-detected": { "malware": { "url": "https://xxx.xxx.xxx.xxx/event_streamevents_for_bot?ma_id\=51056&lms_iden\=00:25:90:54:7E:6Ecs1Label=sname cs1=Trojan. Generic" "malicious": "true" } } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | HTTP or HTTPS | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ profile | The profile element provides details about the MVX profile in use during detection of the malware. For example: "explanation": { "malware-detected": { "malware": { "profile": "winxp-sp2" } } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ md5sum | The md5sum element provides the MD5 checksum details for the detected malware. For example: "explanation": "malware-detected": "malware": "md5sum": "4c40057a9b241 2e61472154d66df4c0d" ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ application | The application element specifies the application running at the time of malware detection. For example: "explanation": "malware-detected": "malware": "application": "InternetExplorer6.0.2600.0000 .xpclient010817-1148" ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ http-header | The http-header element provides the captured header information for the detected malware. For example: "explanation": "malware-detected": "malware": "http-header": "GET /pood load.php HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (com patible; MSIE 6.0; Windows NT 5.1;SV1) Host: icqdosug.com Connection: Keep-Alive..." ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ domain | The domain element names the domain associated with the detected malware. For example: "explanation": "malware-detected": "malware": "domain":"networkAlpha.com" ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ user | The user element specifies the user name of the appliance user that has submitted the malware for analysis. For example: "explanation": "malware-detected": "malware": "user":"networkAlpha.com" ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ original | The original element specifies the name of the original detected malware. For example: "explanation": "malware-detected": "malware": "original":"load.exe" ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ downloaded-at | The downloaded-at element provides date and time information about when the detected malware was first downloaded. For example: "explanation": "malware-detected": "malware": "downloaded-at":"2012-10- 10T04:06:35Z" ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters Standard XML daytime format | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ executed-at | The executed-at element provides details about when the detected malware was executed in the MVX. For example: "explanation": "malware-detected": "malware": "executed-at":"2012-10- 10T05:08:30Z" ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters Standard XML daytime format | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ malware-detected/ malware/ objurl | The objurl element provides details about detected malware URL. For example: "explanation": "malware-detected": "malware": "objurl":"www.networkAlpha .com" ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ cnc-services | The cnc-services element uses attributes and sub-elements that detail command and control center information. For example: "explanation": { "analysis": "binary", "protocol": "tcp", "cnc-services": { "cnc-service": { "port": "80", "protocol": "tcp", "address": "xxx.xxx.xxx.xxx", "channel": "GET /images/ news.php?p=15353&id=349 92661&e=0 HTTP/1.1::~ ~User-Agent: szNotify Ident::~~Host: efrering- basilea.com::~~::~~", "location": "FR" } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters This element might include at least one of the following attributes in the notification:
These attributes and sub-elements are described further in other rows of the table. | 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ cnc-services/ cnc-service | The cnc-service element uses attributes that detail command and control center port and protocol information. For example: "explanation": { "analysis": "binary", "protocol": "tcp", "cnc-services": { "cnc-service": { "port": "80", "protocol": "tcp", ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | cnc-service
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ cnc-services/ address | The address element specifies the IP address associated with the malware’s command and control center. For example: "explanation": { "cnc-services": { "cnc-service": { "port": "80", "protocol": "tcp", "address": "xxx.xxx.xxx.xxx", ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | IPv4 or IPv6 IP address | 6.0 6.1 6.2 6.3 6.4 7.x |
alerts/ alert/ explanation/ cnc-services/ channel | The channel element specifies the GET command for the channel associated with the detected malware. For example: "explanation": { "cnc-services": { "cnc-service": { "port": "80", "protocol": "tcp", "address": "xxx.xxx.xxx.xxx", "channel": "GET /images/ news.php?p=15353&id=349 92661&e=0 HTTP/1.1::~ ~User-Agent: szNotify Ident::~~Host: efrering- basilea.com::~~::~~", "location": "FR" } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String 1023 characters | 6.x 7.x 8.x |
alerts/ alert/ explanation/ cnc-services/ location | The location element specifies the geolocation(s) from which the detected malware originated. For example: "explanation": { "cnc-services": { "cnc-service": { "port": "80", "protocol": "tcp", "address": "xxx.xxx.xxx.xxx", "location": "FR" } }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | String Location. For example:
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ os-changes | The os-changes element uses attributes that detail MVX operating system information at the time of infection. For example: "explanation": { "os-changes": { "“osinfo": “WindowsXP Pro fessional 5.1” "id": "34872232", "version": "6.2.0.75853", ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | This element might include at least one of the following attributes in the notification: os-changes
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
alerts/ alert/ explanation/ static-analysis | The static-analysis element uses attributes that detail information about the static analysis tool(s) used during malware analysis. For example: "explanation": { "static-analysis": { "“osinfo": “Sophos” ""version": "5.1", ... | NX AX FX EX CM | MC WI IM DM MO IE RC RO | This element might include at least one of the following attributes in the notification: static-analysis
| 6.0 6.1 6.2 6.3 6.4 7.x 8.x |
javacall | The javacall element is reported when the Java method of interest is called. | NX AX FX EX CM | MC WI IM DM MO IE RC RO | This element might include at least one of the following items in the notification:
| 7.x 8.x |
javaevent | The javaevent attribute is reported when an action is taken to modify the current Java SecurityManager state. | NX AX FX EX CM | MC WI IM DM MO IE RC RO | This element might include at least one of the following in the notification:
| 7.x 8.x |
dialog-dismissed | The dialog-dismissed element is reported when a dialog box is recognized and about to be dismissed. For example: "dialog-dismissed": { "note": "Dismissed with a click on the first button", "timestamp": "30630", "pid": "3168", "sequenceNumber": "22", "dlg-id": "General_purpose_ Adobe_8_and_better_MB" }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | This element might include at least one of the following items in the notification:
| 7.x 8.x |
popup-dialog | The popup-dialog element is reported when a recognized dialog box is shown from a browser process. For example: "popup-dialog": { "timestamp": "131480", "processinfo": { "tid": "2624", "imagepath": "c:\\program files \\internet explorer \\iexplore.exe", "pid": "3048" }, "title": "File Download - Security Warning" }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | This element might include at least one of the following items in the notification:
| 7.x 8.x |
api_patch | This an internal detection-only feature. | NX AX FX EX CM | MC WI IM DM MO IE RC RO | Not applicable | 7.x 8.x |
thread | The thread element is reported for various operation on a thread (such as suspended, terminated, or hide), for threads created with NtQueueApcThread[Ex]/QueueUserAPC, and for opened threads (opened or duplicate_opened). | NX AX FX EX CM | MC WI IM DM MO IE RC RO | This element might include at least one of the following items in the notification:
| 7.x 8.x |
BootSectorModified | The BootSectorModified element is reported when a specimen overwrites the master boot record (MBR) of the system volume. | NX AX FX EX CM | MC WI IM DM MO IE RC RO | Not applicable | 7.x 8.x |
StackPivot | The StackPivot element refers to the stack pointer going out of the range maintained in the thread execution block (TEB). This an industry-known indicator of exploit/ROP attempts. For example: "stackpivot": [ { "StackBottom": "0x0000000000126000", "processinfo": { "imagepath": "C:\\Program Files \\Adobe\\Reader 8.0 \\Reader\\AcroRd32.exe", "pid": "860", "md5sum": "1a5b4b58dbb62677 6920260704fd0116" }, "SuppressMode": "None", "timestamp": "16329", "CallerAddress": "0x000000004a802f70", "StackAddress": "0x000000000f602038", "apiname": "MapViewOfFile", "StackTop": "0x0000000000130000", "params": { "param": [ { "id": "1", "param": "0x238" }, { "id": "2", "param": "38" }, { "id": "3", "param": "0" }, { "id": "4", "param": "0" }, { "id": "5", "param": "0" } ] }, "suppressed": "false", "CallerModule": "C:\\Program Files \\Adobe\\Reader 8.0 \\Reader\\icucnv34.dll" }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | This element might include at least one of the following items in the notification:
| 7.x 8.x |
ROP | Return-oriented programming (ROP) is an exploit technique that leverages executable code from loaded system modules. Also a well-known technique in the security space. For example: "ROP": [ { "PreviousBytes": "75 08 e8 b1 ff ff ff 59 59 50 ff 15 1c 0d d1 01", "ModuleName": "NULL", "processinfo": { "imagepath": "C:\\Program Files \\Internet Explorer\\iexplore.exe", "pid": "2768", "md5sum": "b60dddd2d63ce 41cb8c487fcfbb6419e" }, "CallerOffset": "0x0000000000000000", "timestamp": "8357", "mode": "CallerCheck", "apiname": "LoadLibraryA", "ForwardBytes": "8b d8 33 ff 3b df 74 34 66 39 7d 10 76 2e 8b 4d", "ModuleBase": "0x0000000000000000" }, | NX AX FX EX CM | MC WI IM DM MO IE RC RO | This element might include at least one of the following items in the notification:
| 7.x 8.x |
queue-id | Postfix queue ID. | EX CM | MC WI IM DM MO IE RC RO | String | 7.6 and later |
sname | The name of the network anomaly. For example: "cnc-services": { "cnc-service": { "sname": "InfoStealer.Banker.Zbot.DNS", "protocol": "udp", "sid": "80441019", "address": "sir-t.cn", "type": "CncSigMatch", "port": "53" } }, | NX CM | MC WI IM DM MO IE RC RO | String | 7.9 and later |
type | The type of network anomaly. For example: "cnc-services": { "cnc-service": { "sname": "InfoStealer.Banker.Zbot.DNS", "protocol": "udp", "sid": "80441019", "address": "sir-t.cn", "type": "CncSigMatch", "port": "53" } }, | NX CM | MC WI IM DM MO IE RC RO | String | 7.9 and later |
ack | Indicates whether the alert has been acknowledged. | EX NX CM | DM IM MC MO WI | yes or no | 7.x 8.x |
submitted-at | Submitted time. | NX AX FX EX CM | MC MO RC RO | Time stamp | 8.x |