赛门铁克 EDR 云 (已弃用)

{
    "@timestamp": "2023-04-26T21:46:10.400Z",
    "agent": {
        "ephemeral_id": "e84ef800-cd51-4dd1-b1f4-c33951281380",
        "id": "94a22d9c-6d6d-444a-9f96-6383ca581cef",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.10.1"
    },
    "data_stream": {
        "dataset": "symantec_edr_cloud.incident",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "94a22d9c-6d6d-444a-9f96-6383ca581cef",
        "snapshot": false,
        "version": "8.10.1"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "malware"
        ],
        "created": "2023-04-26T21:46:10.400Z",
        "dataset": "symantec_edr_cloud.incident",
        "id": "8e7edfb1-27d2-4837-98ca-e7d794119c3b",
        "ingested": "2023-10-25T06:42:49Z",
        "kind": "alert",
        "original": "{\"category_id\":1,\"conclusion\":\"Suspicious Activity\",\"created\":\"2023-04-26T21:46:10.400+00:00\",\"customer_uid\":\"TEST-JvOsaJktSS-eyL-dXhxOvA\",\"detection_type\":\"Advanced Analytics\",\"device_time\":1682545570400,\"domain_uid\":\"TEST-ZBg_IqnyTAijNjP2BOOcuw\",\"event_id\":8075004,\"id\":4,\"incident_uid\":\"8e7edfb1-27d2-4837-98ca-e7d794119c3b\",\"incident_url\":\"https://sep.securitycloud.symantec.com/v2/incidents/incidentListing/8e7edfb1-27d2-4837-98ca-e7d794119c3b/details\",\"message\":\"Victim-2:Signed Binary Proxy Execution, Deobfuscate/Decode Files or Information, Command and Scripting Interpreter: PowerShell, System Services: Service Execution\",\"modified\":\"2023-04-26T22:01:58.648+00:00\",\"priority_id\":4,\"product_name\":\"Symantec Integrated Cyber Defense Manager\",\"product_uid\":\"31B0C880-0229-49E8-94C5-48D56B1BD7B9\",\"ref_incident_uid\":102110,\"remediation\":\"Investigate further activity at the endpoint by downloading a full dump of the endpoint's recorded data. Give particular attention to activities performed by cmd.exe.\",\"resolution_id\":1,\"rule_name\":\"Advanced Attack Technique\",\"severity_id\":4,\"state_id\":1,\"suspected_breach\":\"Yes\",\"time\":1682545570400,\"type\":\"INCIDENT_CREATION\",\"type_id\":8075,\"version\":\"1.0\"}",
        "provider": "Symantec Integrated Cyber Defense Manager",
        "reason": "Suspicious Activity",
        "severity": 4,
        "type": [
            "info"
        ],
        "url": "https://sep.securitycloud.symantec.com/v2/incidents/incidentListing/8e7edfb1-27d2-4837-98ca-e7d794119c3b/details"
    },
    "http": {
        "version": "1.0"
    },
    "input": {
        "type": "cel"
    },
    "message": "Victim-2:Signed Binary Proxy Execution, Deobfuscate/Decode Files or Information, Command and Scripting Interpreter: PowerShell, System Services: Service Execution",
    "rule": {
        "name": "Advanced Attack Technique"
    },
    "symantec_edr_cloud": {
        "incident": {
            "category": "Security",
            "category_id": "1",
            "conclusion": "Suspicious Activity",
            "created": "2023-04-26T21:46:10.400Z",
            "customer_uid": "TEST-JvOsaJktSS-eyL-dXhxOvA",
            "detection_type": "Advanced Analytics",
            "device_time": "2023-04-26T21:46:10.400Z",
            "domain_uid": "TEST-ZBg_IqnyTAijNjP2BOOcuw",
            "event": "Incident Creation: Logged",
            "event_id": "8075004",
            "id": "4",
            "incident_uid": "8e7edfb1-27d2-4837-98ca-e7d794119c3b",
            "incident_url": "https://sep.securitycloud.symantec.com/v2/incidents/incidentListing/8e7edfb1-27d2-4837-98ca-e7d794119c3b/details",
            "message": "Victim-2:Signed Binary Proxy Execution, Deobfuscate/Decode Files or Information, Command and Scripting Interpreter: PowerShell, System Services: Service Execution",
            "modified": "2023-04-26T22:01:58.648Z",
            "outcome": "Logged",
            "priority": "Critical",
            "priority_id": "4",
            "product_name": "Symantec Integrated Cyber Defense Manager",
            "product_uid": "31B0C880-0229-49E8-94C5-48D56B1BD7B9",
            "ref_incident_uid": "102110",
            "remediation": "Investigate further activity at the endpoint by downloading a full dump of the endpoint's recorded data. Give particular attention to activities performed by cmd.exe.",
            "resolution": "Insufficient data",
            "resolution_id": "1",
            "rule_name": "Advanced Attack Technique",
            "severity": "Major",
            "severity_id": 4,
            "state": "New",
            "state_id": "1",
            "suspected_breach": true,
            "time": "2023-04-26T21:46:10.400Z",
            "type": "INCIDENT_CREATION",
            "type_id": "8075",
            "version": "1.0"
        }
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "symantec_edr_cloud-incident"
    ],
    "url": {
        "domain": "sep.securitycloud.symantec.com",
        "original": "https://sep.securitycloud.symantec.com/v2/incidents/incidentListing/8e7edfb1-27d2-4837-98ca-e7d794119c3b/details",
        "path": "/v2/incidents/incidentListing/8e7edfb1-27d2-4837-98ca-e7d794119c3b/details",
        "scheme": "https"
    }
}