Check Point Harmony Endpoint

{
    "@timestamp": "2024-09-02T08:53:44.000Z",
    "agent": {
        "ephemeral_id": "cebc2bcd-9723-4948-bfd6-fc0e0dfd5784",
        "id": "d4e5bf31-1f9a-4721-9f32-d3d87eca6898",
        "name": "elastic-agent-88462",
        "type": "filebeat",
        "version": "8.15.1"
    },
    "checkpoint_harmony_endpoint": {
        "antibot": {
            "advanced_info": "\"exclusions\":[{\"exclusion_engine_type\":\"Anti Bot exclusions\",\"exclusion_type\":\"URL\",\"exclusion_value\":{\"default_value\":\"http://www.threat-cloud.com/test/files/MediumConfidenceBot.html\",\"md5\":\"\",\"original_name\":\"\",\"signer\":\"\",\"process\":\"\",\"protection\":\"\",\"comment\":\"\"}}]",
            "client": {
                "name": "Check Point Endpoint Security Client",
                "version": "88.50.0213"
            },
            "confidence_level": "Medium",
            "description": "Detected bot activity [Anti-Bot test.TC.e]. To exclude: On the Harmony Endpoint Management add an exclusion of type \"URL\" with value: \"http://www.threat-cloud.com/test/files/MediumConfidenceBot.html\"",
            "event_type": "Anti Bot Event",
            "installed_products": "Full Disk Encryption; Media Encryption & Port Protection; Firewall; Compliance; Application Control; Anti-Malware; VPN; Anti-Bot; Forensics; Threat Emulation",
            "malware": {
                "action": "Communication with C&C"
            },
            "packet_capture": "Packet Capture",
            "packet_capture_unique_id": "6c239c74-89a9-4797-ab6b-75a2b2a6afd7",
            "policy": {
                "date": "2024-08-29T13:12:51.0000000Z",
                "name": "Default Anti-Bot settings",
                "number": 2
            },
            "product": {
                "family": "Endpoint",
                "name": "Anti-Bot"
            },
            "protection_type": "URL Reputation",
            "proxy_src_ip": "89.160.20.128",
            "sequencenum": 16777215,
            "severity": "Critical",
            "tenant_id": "3e15ed24-89ff-4986-a204-c425cee4ba48",
            "type": "Log"
        }
    },
    "data_stream": {
        "dataset": "checkpoint_harmony_endpoint.antibot",
        "namespace": "78732",
        "type": "logs"
    },
    "destination": {
        "geo": {
            "country_name": "UnitedStates"
        },
        "ip": "89.160.20.128"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "d4e5bf31-1f9a-4721-9f32-d3d87eca6898",
        "snapshot": false,
        "version": "8.15.1"
    },
    "event": {
        "action": "Detect",
        "agent_id_status": "verified",
        "category": [
            "malware"
        ],
        "dataset": "checkpoint_harmony_endpoint.antibot",
        "id": "a4640108-91b1-0f19-66d5-7d9d00000000",
        "ingested": "2024-10-24T05:31:25Z",
        "kind": "event",
        "module": "checkpoint_harmony_endpoint",
        "type": [
            "info"
        ]
    },
    "file": {
        "hash": {
            "md5": "bd075be9d011daaa82c3f9ff2572076e"
        },
        "name": "chrome.exe",
        "size": 2742376,
        "type": "exe"
    },
    "host": {
        "hostname": "DESKTOP-E2P4OL0",
        "ip": [
            "10.35.38.102"
        ],
        "name": "DESKTOP-E2P4OL0",
        "os": {
            "name": "Microsoft Windows 10 Pro",
            "version": "10.0-19045-SP0.0-SMP"
        },
        "type": [
            "Desktop"
        ]
    },
    "input": {
        "type": "cel"
    },
    "process": {
        "user": {
            "name": "admin"
        }
    },
    "related": {
        "hash": [
            "bd075be9d011daaa82c3f9ff2572076e"
        ],
        "hosts": [
            "DESKTOP-E2P4OL0"
        ],
        "ip": [
            "10.35.38.102",
            "89.160.20.128"
        ],
        "user": [
            "admin"
        ]
    },
    "rule": {
        "name": "Anti-Bot test.TC.e"
    },
    "tags": [
        "forwarded"
    ],
    "url": {
        "original": "www.threat-cloud.com"
    },
    "user": {
        "domain": "SMC User",
        "id": "S-1-5-21-3766288932-3295778425-2939962592-1001",
        "name": [
            "admin"
        ]
    }
}

{
    "@timestamp": "2024-09-02T09:09:07.000Z",
    "agent": {
        "ephemeral_id": "972620ca-77a9-4305-991a-5bd475860580",
        "id": "4cdb965a-db2a-4ec3-9abf-6e20dbb120c9",
        "name": "elastic-agent-21918",
        "type": "filebeat",
        "version": "8.15.1"
    },
    "checkpoint_harmony_endpoint": {
        "antimalware": {
            "action_details": "Infected",
            "advanced_info": "\"exclusions\":[{\"exclusion_engine_type\":\"File & Folder exclusions (system, scheduled and on-demand)\",\"exclusion_type\":\"Path\",\"exclusion_value\":{\"default_value\":\"md5:\",\"md5\":\"\",\"original_name\":\"\",\"signer\":\"\",\"process\":\"\",\"protection\":\"\",\"comment\":\"md5 taken from file C:\\\\\Users\\\\\admin\\\\\AppData\\\\\Local\\\\\Temp\\\\\9e68140d-22bb-4e96-8aaa-70ec80eb2dc4.tmp\"}}]",
            "client": {
                "name": "Check Point Endpoint Security Client",
                "version": "88.50.0213"
            },
            "confidence_level": "High",
            "connectivity_state": "Connected",
            "engine_version": "3.90",
            "event_type": "Infection",
            "installed_products": "Full Disk Encryption; Media Encryption & Port Protection; Firewall; Compliance; Application Control; Anti-Malware; VPN; Anti-Bot; Forensics; Threat Emulation",
            "malware": {
                "category": "Malware"
            },
            "packet_capture": "Packet Capture",
            "packet_capture_unique_id": "31dc576b-7192-49bf-b2fc-b40c93f84b7c",
            "policy": {
                "date": "2024-08-29T13:12:46.0000000Z",
                "name": "Default Anti-Malware settings for the entire organization",
                "number": 3
            },
            "product": {
                "family": "Endpoint",
                "name": "Anti-Malware"
            },
            "protection_type": "Protection",
            "sequencenum": 16777215,
            "severity": "High",
            "signature_version": "202409011444",
            "src": "10.35.38.102",
            "tenant_id": "3e15ed24-89ff-4986-a204-c425cee4ba48",
            "type": "Log"
        }
    },
    "data_stream": {
        "dataset": "checkpoint_harmony_endpoint.antimalware",
        "namespace": "85578",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "4cdb965a-db2a-4ec3-9abf-6e20dbb120c9",
        "snapshot": false,
        "version": "8.15.1"
    },
    "event": {
        "action": "Detect",
        "agent_id_status": "verified",
        "category": [
            "malware"
        ],
        "dataset": "checkpoint_harmony_endpoint.antimalware",
        "id": "a4640108-91b1-0f19-66d5-815d0000000f",
        "ingested": "2024-10-24T05:32:25Z",
        "kind": "alert",
        "module": "checkpoint_harmony_endpoint",
        "type": [
            "info"
        ]
    },
    "file": {
        "name": "9e68140d-22bb-4e96-8aaa-70ec80eb2dc4.tmp"
    },
    "host": {
        "hostname": "DESKTOP-E2P4OL0",
        "ip": [
            "10.35.38.102"
        ],
        "name": "DESKTOP-E2P4OL0",
        "os": {
            "name": "Microsoft Windows 10 Pro",
            "version": "10.0-19045-SP0.0-SMP"
        },
        "type": [
            "Desktop"
        ]
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "hosts": [
            "DESKTOP-E2P4OL0"
        ],
        "ip": [
            "10.35.38.102"
        ],
        "user": [
            "admin"
        ]
    },
    "rule": {
        "name": "Mal/ShellDl-A"
    },
    "source": {
        "ip": [
            "10.35.38.102"
        ]
    },
    "tags": [
        "forwarded"
    ],
    "user": {
        "domain": "SMC User",
        "id": "S-1-5-21-3766288932-3295778425-2939962592-1001",
        "name": [
            "admin"
        ]
    }
}

{
    "@timestamp": "2024-09-03T08:53:12.000Z",
    "agent": {
        "ephemeral_id": "76820ab1-9086-4fc7-975c-2e7cda1f601c",
        "id": "3df1f948-9917-4dc4-a724-f2b5934a6652",
        "name": "elastic-agent-71957",
        "type": "filebeat",
        "version": "8.15.1"
    },
    "checkpoint_harmony_endpoint": {
        "forensics": {
            "attack_status": "Dormant",
            "client": {
                "name": "Check Point Endpoint Security Client",
                "version": "88.50.0213"
            },
            "confidence_level": "High",
            "description": "To exclude the file: On the Harmony Endpoint Management add this sha1 exclusion: 62f0bd56-b0e1235b-99940b34-916c19ec-fac8e80c Attack status: Dormant.",
            "detected_by": "Endpoint File Reputation",
            "event_type": "Forensics Case Analysis",
            "installed_products": "Full Disk Encryption; Media Encryption & Port Protection; Firewall; Compliance; Application Control; Anti-Malware; VPN; Anti-Bot; Forensics; Threat Emulation",
            "malware": {},
            "packet_capture": "Packet Capture",
            "packet_capture_unique_id": "0acd55a9-f241-4097-a699-6b7e41cd26af",
            "policy": {
                "date": "2024-09-02T06:23:25.0000000Z",
                "name": "Default Forensics settings",
                "number": 3
            },
            "product": {
                "family": "Endpoint",
                "name": "Forensics"
            },
            "protection_type": "File Reputation",
            "remediated_files": "malz5.zip(Remediation disabled in policy)",
            "sequencenum": 1,
            "service_domain": "ep-demo",
            "severity": "Critical",
            "src": "10.35.38.102",
            "suspicious_events": "System Shutdown / Reboot: ; ",
            "tenant_id": "3e15ed24-89ff-4986-a204-c425cee4ba48",
            "type": "Log"
        }
    },
    "data_stream": {
        "dataset": "checkpoint_harmony_endpoint.forensics",
        "namespace": "38429",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "3df1f948-9917-4dc4-a724-f2b5934a6652",
        "snapshot": false,
        "version": "8.15.1"
    },
    "event": {
        "action": "Detect",
        "agent_id_status": "verified",
        "category": [
            "malware"
        ],
        "dataset": "checkpoint_harmony_endpoint.forensics",
        "id": "a4640108-91b1-0f19-66d6-ceb500000000",
        "ingested": "2024-10-24T05:33:21Z",
        "kind": "alert",
        "module": "checkpoint_harmony_endpoint",
        "type": [
            "info"
        ]
    },
    "file": {
        "hash": {
            "md5": "1468c1908845ef238f7f196809946288",
            "sha1": "62f0bd56b0e1235b99940b34916c19ecfac8e80c"
        },
        "name": "malz5.zip",
        "path": "c:\\users\\admin\\downloads\\malz5.zip",
        "size": 12707198,
        "type": "zip"
    },
    "host": {
        "hostname": "DESKTOP-E2P4OL0",
        "ip": [
            "10.35.38.102"
        ],
        "name": "DESKTOP-E2P4OL0",
        "os": {
            "name": "Microsoft Windows 10 Pro",
            "version": "10.0-19045-SP0.0-SMP"
        },
        "type": [
            "Desktop"
        ]
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "hash": [
            "1468c1908845ef238f7f196809946288",
            "62f0bd56b0e1235b99940b34916c19ecfac8e80c"
        ],
        "hosts": [
            "DESKTOP-E2P4OL0"
        ],
        "ip": [
            "10.35.38.102"
        ],
        "user": [
            "admin"
        ]
    },
    "rule": {
        "name": "Gen.Rep.zip"
    },
    "tags": [
        "forwarded"
    ],
    "user": {
        "domain": "SMC User",
        "id": "S-1-5-21-3766288932-3295778425-2939962592-1001",
        "name": [
            "admin"
        ]
    }
}

{
    "@timestamp": "2024-09-02T09:04:54.000Z",
    "agent": {
        "ephemeral_id": "8723e6bf-0b1a-4a95-95b6-d5e11a0380a7",
        "id": "9f7d3384-0b1f-462c-9d71-0e0580545765",
        "name": "elastic-agent-95748",
        "type": "filebeat",
        "version": "8.15.1"
    },
    "checkpoint_harmony_endpoint": {
        "threatemulation": {
            "advanced_info": "\"exclusions\":[{\"exclusion_engine_type\":\"Threat Emulation, Extraction and Zero Phishing Exclusions\",\"exclusion_type\":\"SHA1\",\"exclusion_value\":{\"default_value\":\"9d3395d94c6bbba52abf0e6afcbf4ca312597c21\",\"md5\":\"\",\"original_name\":\"\",\"signer\":\"\",\"process\":\"\",\"protection\":\"\",\"comment\":\"\"}}]",
            "analyzed_on": "Check Point Threat Emulation Cloud",
            "client": {
                "name": "Check Point Endpoint Security Client",
                "version": "88.50.0213"
            },
            "confidence_level": "High",
            "description": "Endpoint TE detected malicious file (681573a2-414a-4f7d-9683-177df4f8ca7f.tmp) . To exclude the file: On the Harmony Endpoint Management add this sha1 exclusion: 9d3395d9-4c6bbba5-2abf0e6a-fcbf4ca3-12597c21",
            "event_type": "TE Event",
            "incident_uid": "74a33ecb-1b91-4c25-a136-1989eb175638",
            "installed_products": "Full Disk Encryption; Media Encryption & Port Protection; Firewall; Compliance; Application Control; Anti-Malware; VPN; Anti-Bot; Forensics; Threat Emulation",
            "malware": {
                "action": "Adware\",\"Solimba\",\"Trojan\",\"behavior"
            },
            "packet_capture": "Packet Capture",
            "packet_capture_unique_id": "5e3302e5-3f73-4b77-beec-2849003e9d47",
            "policy": {
                "date": "2024-08-29T13:12:50.0000000Z",
                "name": "Default Threat Extraction, Emulation and Anti-Exploit settings for the entire organization",
                "number": 3
            },
            "product": {
                "family": "Endpoint",
                "name": "Threat Emulation"
            },
            "protection_type": "File System Emulation",
            "sequencenum": 16777215,
            "severity": "Critical",
            "src": "10.35.38.102",
            "tenant_id": "3e15ed24-89ff-4986-a204-c425cee4ba48",
            "type": "Log",
            "verdict": "Malicious"
        }
    },
    "data_stream": {
        "dataset": "checkpoint_harmony_endpoint.threatemulation",
        "namespace": "43839",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "9f7d3384-0b1f-462c-9d71-0e0580545765",
        "snapshot": false,
        "version": "8.15.1"
    },
    "event": {
        "action": "Detect",
        "agent_id_status": "verified",
        "category": [
            "malware"
        ],
        "dataset": "checkpoint_harmony_endpoint.threatemulation",
        "id": "a4640108-91b1-0f19-66d5-803100000012",
        "ingested": "2024-10-24T05:34:17Z",
        "kind": "alert",
        "module": "checkpoint_harmony_endpoint",
        "type": [
            "info"
        ]
    },
    "file": {
        "hash": {
            "md5": "ebe8b633d231bbfee9543d744a2ab59d",
            "sha1": "9d3395d94c6bbba52abf0e6afcbf4ca312597c21"
        },
        "name": "681573a2-414a-4f7d-9683-177df4f8ca7f.tmp",
        "path": "C:\\Users\\admin\\Downloads\\681573a2-414a-4f7d-9683-177df4f8ca7f.tmp",
        "size": 139648,
        "type": "zip"
    },
    "host": {
        "hostname": "DESKTOP-E2P4OL0",
        "ip": [
            "10.35.38.102"
        ],
        "name": "DESKTOP-E2P4OL0",
        "os": {
            "name": "Microsoft Windows 10 Pro",
            "version": "10.0-19045-SP0.0-SMP"
        },
        "type": [
            "Desktop"
        ]
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "hash": [
            "ebe8b633d231bbfee9543d744a2ab59d",
            "9d3395d94c6bbba52abf0e6afcbf4ca312597c21"
        ],
        "hosts": [
            "DESKTOP-E2P4OL0"
        ],
        "ip": [
            "10.35.38.102"
        ],
        "user": [
            "admin"
        ]
    },
    "rule": {
        "name": "Gen.SB.zip"
    },
    "tags": [
        "forwarded"
    ],
    "user": {
        "domain": "SMC User",
        "id": "S-1-5-21-3766288932-3295778425-2939962592-1001",
        "name": [
            "admin"
        ]
    }
}

{
    "@timestamp": "2024-09-02T09:21:42.000Z",
    "agent": {
        "ephemeral_id": "b2ca27d2-5544-4cc2-9491-f91097060c1c",
        "id": "82b03ad0-7025-436d-9e81-8a39705e0152",
        "name": "elastic-agent-30042",
        "type": "filebeat",
        "version": "8.15.1"
    },
    "checkpoint_harmony_endpoint": {
        "threatextraction": {
            "advanced_info": " \"disable_exclusion\": true ",
            "client": {
                "name": "Check Point Endpoint Security Client",
                "version": "88.50.0213"
            },
            "confidence_level": "High",
            "description": "File is not supported for extraction",
            "event_type": "TEX Event",
            "installed_products": "Full Disk Encryption; Media Encryption & Port Protection; Firewall; Compliance; Application Control; Anti-Malware; VPN; Anti-Bot; Forensics; Threat Emulation",
            "malware": {
                "action": "Not Supported"
            },
            "policy": {
                "date": "2024-08-29T13:12:50.0000000Z",
                "name": "Default Threat Extraction, Emulation and Anti-Exploit settings for the entire organization",
                "number": 3
            },
            "product": {
                "family": "Endpoint",
                "name": "Threat Extraction"
            },
            "protection_type": "Content Removal",
            "sequencenum": 1,
            "severity": "Informational",
            "src": "10.35.38.102",
            "tenant_id": "3e15ed24-89ff-4986-a204-c425cee4ba48",
            "type": "Log",
            "web_client_type": "Chrome"
        }
    },
    "data_stream": {
        "dataset": "checkpoint_harmony_endpoint.threatextraction",
        "namespace": "81720",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "82b03ad0-7025-436d-9e81-8a39705e0152",
        "snapshot": false,
        "version": "8.15.1"
    },
    "event": {
        "action": "Extract",
        "agent_id_status": "verified",
        "category": [
            "malware"
        ],
        "dataset": "checkpoint_harmony_endpoint.threatextraction",
        "id": "a4640108-91b1-0f19-66d5-83f100000019",
        "ingested": "2024-10-24T05:35:11Z",
        "kind": "alert",
        "module": "checkpoint_harmony_endpoint",
        "type": [
            "info"
        ]
    },
    "file": {
        "hash": {
            "sha1": "no-sha1"
        },
        "name": "mirai.sh4",
        "path": "blob:https://github.com/6bd30ea7-29a8-4dd2-9056-f5077632e110",
        "size": 0,
        "type": "sh4"
    },
    "host": {
        "hostname": "DESKTOP-E2P4OL0",
        "ip": [
            "10.35.38.102"
        ],
        "name": "DESKTOP-E2P4OL0",
        "os": {
            "name": "Microsoft Windows 10 Pro",
            "version": "10.0-19045-SP0.0-SMP"
        },
        "type": [
            "Desktop"
        ]
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "hash": [
            "no-sha1"
        ],
        "hosts": [
            "DESKTOP-E2P4OL0"
        ],
        "ip": [
            "10.35.38.102"
        ],
        "user": [
            "admin"
        ]
    },
    "rule": {
        "name": "Extract potentially malicious content"
    },
    "tags": [
        "forwarded"
    ],
    "user": {
        "domain": "SMC User",
        "id": "S-1-5-21-3766288932-3295778425-2939962592-1001",
        "name": [
            "admin"
        ]
    }
}

{
    "@timestamp": "2024-09-06T10:07:43.000Z",
    "agent": {
        "ephemeral_id": "95fc55ec-9d54-4116-87cc-a4fe3767eba0",
        "id": "3c23eeec-fde0-4811-91a1-6bc5b403c95e",
        "name": "elastic-agent-18777",
        "type": "filebeat",
        "version": "8.15.1"
    },
    "checkpoint_harmony_endpoint": {
        "urlfiltering": {
            "advanced_info": "\"exclusions\":[{\"exclusion_engine_type\":\"URL Filtering exclusions\",\"exclusion_type\":\"Domain\",\"exclusion_value\":{\"default_value\":\"secure.indeed.com\",\"md5\":\"\",\"original_name\":\"\",\"signer\":\"\",\"process\":\"\",\"protection\":\"\",\"comment\":\"\"}}]",
            "app": {
                "id": "0",
                "properties": "Job Search / Careers, Business / Economy"
            },
            "appi_name": "secure.indeed.com",
            "client": {
                "name": "Check Point Endpoint Security Client",
                "version": "88.50.0213"
            },
            "description": "URLF Info Event",
            "event_type": "URLF Info Event",
            "installed_products": "Full Disk Encryption; Media Encryption & Port Protection; Firewall; Compliance; Application Control; Anti-Malware; VPN; Anti-Bot; Forensics; Threat Emulation",
            "matched_category": "Job Search / Careers",
            "policy": {
                "date": "2024-09-06T09:57:28.0000000Z",
                "name": "Default Anti-Bot settings",
                "number": 4
            },
            "process_exe_path": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
            "product": {
                "family": "Endpoint",
                "name": "URL Filtering"
            },
            "protection_type": "URL Filtering",
            "sequencenum": 16777215,
            "severity": "Informational",
            "src": "10.35.38.102",
            "tenant_id": "3e15ed24-89ff-4986-a204-c425cee4ba48",
            "type": "Log",
            "usercheck_incident_uid": "b04d8940",
            "web_client_type": "Chrome"
        }
    },
    "data_stream": {
        "dataset": "checkpoint_harmony_endpoint.urlfiltering",
        "namespace": "69408",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "3c23eeec-fde0-4811-91a1-6bc5b403c95e",
        "snapshot": false,
        "version": "8.15.1"
    },
    "event": {
        "action": "Detect",
        "agent_id_status": "verified",
        "category": [
            "malware"
        ],
        "dataset": "checkpoint_harmony_endpoint.urlfiltering",
        "id": "a4640108-91b1-0f19-66da-d62100000013",
        "ingested": "2024-10-24T05:36:11Z",
        "kind": "alert",
        "module": "checkpoint_harmony_endpoint",
        "type": [
            "info"
        ]
    },
    "host": {
        "hostname": "DESKTOP-E2P4OL0",
        "ip": [
            "10.35.38.102"
        ],
        "name": "DESKTOP-E2P4OL0",
        "os": {
            "name": "Microsoft Windows 10 Pro",
            "version": "10.0-19045-SP0.0-SMP"
        },
        "type": [
            "Desktop"
        ]
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "hosts": [
            "DESKTOP-E2P4OL0"
        ],
        "ip": [
            "10.35.38.102"
        ],
        "user": [
            "admin"
        ]
    },
    "rule": {
        "name": "gen.urlf"
    },
    "tags": [
        "forwarded"
    ],
    "url": {
        "domain": "secure.indeed.com",
        "original": "https://secure.indeed.com/auth?branding=save-profile-modal&tmpl=inline&from=act_zeroauth_profile_tst&iframe_tk=9a019527-a6f1-4b3d-b803-2b25bb46b1db&hl=en_IN&co=IN",
        "path": "/auth",
        "query": "branding=save-profile-modal&tmpl=inline&from=act_zeroauth_profile_tst&iframe_tk=9a019527-a6f1-4b3d-b803-2b25bb46b1db&hl=en_IN&co=IN",
        "scheme": "https"
    },
    "user": {
        "domain": "SMC User",
        "id": "S-1-5-21-3766288932-3295778425-2939962592-1001",
        "name": [
            "admin"
        ]
    }
}

{
    "@timestamp": "2024-09-02T08:51:08.000Z",
    "agent": {
        "ephemeral_id": "9fc6c363-e390-492c-bfdf-684e4d20aff8",
        "id": "64f03e47-f005-4ecd-8d91-e63af37617a3",
        "name": "elastic-agent-34074",
        "type": "filebeat",
        "version": "8.15.1"
    },
    "checkpoint_harmony_endpoint": {
        "zerophishing": {
            "advanced_info": "\"exclusions\":[{\"exclusion_engine_type\":\"Threat Emulation, Extraction and Zero Phishing Exclusions\",\"exclusion_type\":\"Domain\",\"exclusion_value\":{\"default_value\":\"main.sbm-demo.xyz\",\"md5\":\"\",\"original_name\":\"\",\"signer\":\"\",\"process\":\"\",\"protection\":\"\",\"comment\":\"\"}}]",
            "client": {
                "name": "Check Point Endpoint Security Client",
                "version": "88.50.0213"
            },
            "confidence_level": "High",
            "description": "Deceptive site (https://main.sbm-demo.xyz/zero-phishing) was detected.",
            "event_type": "Phishing Event",
            "extension_version": "Check Point Endpoint Security Client",
            "installed_products": "Full Disk Encryption; Media Encryption & Port Protection; Firewall; Compliance; Application Control; Anti-Malware; VPN; Anti-Bot; Forensics; Threat Emulation",
            "malware": {},
            "policy": {
                "date": "2024-08-29T13:12:50.0000000Z",
                "name": "Default Threat Extraction, Emulation and Anti-Exploit settings for the entire organization",
                "number": 3
            },
            "product": {
                "family": "Endpoint",
                "name": "Zero Phishing"
            },
            "protection_type": "Phishing",
            "sequencenum": 16777215,
            "severity": "High",
            "src": "10.35.38.102",
            "tenant_id": "3e15ed24-89ff-4986-a204-c425cee4ba48",
            "type": "Log",
            "web_client_type": "Chrome"
        }
    },
    "data_stream": {
        "dataset": "checkpoint_harmony_endpoint.zerophishing",
        "namespace": "39288",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "64f03e47-f005-4ecd-8d91-e63af37617a3",
        "snapshot": false,
        "version": "8.15.1"
    },
    "event": {
        "action": "Detect",
        "agent_id_status": "verified",
        "category": [
            "malware"
        ],
        "dataset": "checkpoint_harmony_endpoint.zerophishing",
        "id": "a4640108-91b1-0f19-66d5-7d6100000004",
        "ingested": "2024-10-24T05:37:11Z",
        "kind": "alert",
        "module": "checkpoint_harmony_endpoint",
        "type": [
            "info"
        ]
    },
    "host": {
        "hostname": "DESKTOP-E2P4OL0",
        "ip": [
            "10.35.38.102"
        ],
        "name": "DESKTOP-E2P4OL0",
        "os": {
            "name": "Microsoft Windows 10 Pro",
            "version": "10.0-19045-SP0.0-SMP"
        },
        "type": [
            "Desktop"
        ]
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "hosts": [
            "DESKTOP-E2P4OL0"
        ],
        "ip": [
            "10.35.38.102"
        ],
        "user": [
            "admin"
        ]
    },
    "rule": {
        "name": "gen.ba.phishing"
    },
    "tags": [
        "forwarded"
    ],
    "url": {
        "domain": "main.sbm-demo.xyz",
        "original": "https://main.sbm-demo.xyz/zero-phishing",
        "path": "/zero-phishing",
        "scheme": "https"
    },
    "user": {
        "domain": "SMC User",
        "id": "S-1-5-21-3766288932-3295778425-2939962592-1001",
        "name": [
            "admin"
        ]
    }
}