OsVersion is the version of the operating system being used on the host.
Under TAA properties:
IOAId is the TAA (IOA) rule ID.
IOATag is the information about the results of file analysis using the Targeted Attack Analyzer technology: name of the TAA (IOA) rule that was used to create the alert.
IOATechnique is the MITRE technique.
IOATactics is the MITRE tactic.
IOAImportance is the importance level that is assigned to an event generated using this TAA (IOA) rule.
IOAConfidence is the level of confidence depending on the likelihood of false alarms caused by the rule.
Under File properties:
CreationTime is the event creation time.
FileName is the name of the file.
FilePath is the path to the directory where the file is located.
FileFullName is the full path to the file. Includes the path to the directory and the file name.
ModificationTime is the file modification time.
FileSize is the size of the file.
MD5 is the MD5 hash of the file.
SHA256 is the SHA256 hash of the file.
SimilarDLLPath is the next DLL on the search path. A malicious DLL placed in a directory on the standard search path to make the operating system load it before the original DLL.
Under Linux processes:
LogonRemoteHost is the IP address of the host that initiated remote access.
RealUserName is the name of the user assigned when the user was registered in the system.
EffectiveUserName is the user name that was used to log in to the system.
Environment is system environment variables.
ProcessType is the type of the process.
OperationResult is the type of the operation.
Under Process started:
PID is the process ID.
ParentFileFullName is the path to the parent process file.
ParentMD5 is the MD5 hash of the parent process file.
ParentSHA256 is the SHA256 hash of the parent process file.
StartupParameters is the options that the process was started with.
ParentPID is the parent process ID.
Under Remote connection:
HTTPMethod is the HTTP request method. For example, Get, Post, or Connect.
ConnectionDirection is the direction of the connection (inbound or outbound).
LocalIP is the IP address of the local computer from which the remote connection attempt was made.
LocalPort is the IP address of the local computer from which the remote connection attempt was made.
RemoteHostName is the name of the computer that was the target of the remote connection attempt.
RemoteIP is the IP address of the computer that was the target of the remote connection attempt.
RemotePort is the port of the computer that was the target of the remote connection attempt.
URl is the address of the resource to which the HTTP request was made.
Under Registry modified:
RegistryKey is the registry key.
RegistryValueName is the name of the registry value.
RegistryValue is the data of the registry value.
RegistryOperationType is the type of the operation with the registry.
RegistryPreviousKey is the previous registry key.
RegistryPreviousValue is the previous name of the registry value.
Under System event log:
WinLogEventID is the type ID of the security event in the Windows log.
LinuxEventType is the type of the event.
WinLogName is the name of the log.
WinLogEventRecordID is the log entry ID.
WinLogProviderName is the ID of the system that logged the event.
WinLogTargetDomainName is the domain name of the remote computer.
WinLogObjectName is the name of the object that initiated the event.
WinlogPackageName is the name of the package that initiated the event.
WinLogProcessName is the name of the process that initiated the event.
Under Detect and processing result:
DetectName is the name of the detected object.
RecordID is the ID of the triggered rule.
ProcessingMode is the scanning mode.
ObjectName is the name of the object.
ObjectType is the type of the object.
ThreatStatus is the detection mode.
UntreatedReason is the event processing status.
ObjectContent (for AMSI events too) is the content of the script sent for scanning.
ObjectContentType (for AMSI events too) is the type of script content.
Under Console interactive input:
InteractiveInputText is the text entered on the command line.
InteractiveInputType is the input type (console or pipe).
Under File changed:
FileOperationType is the type of the file operation.
FilePreviousPath is the path to the directory where the file was previously located.
FilePreviousFullName is the full name of the file including the path to the directory where the file was previously located and/or the previous file name.
DroppedFileType is the type of the modified file.
In the drop-down list, select a comparison operator.
Each type of value of the field has its own relevant set of comparison operators. For example, when the EventType field value type is selected, the = and != operators will be available.
Depending on the selected type of field value, perform one of the following actions:
In the field, specify one or several characters by which you want to perform an event search.
In the drop-down list, select the field value option by which you want to perform an event search.
For example, to search for a full match based on a user name, enter the user name.
If you want to add a new condition, use the AND or OR logical operator and repeat the necessary actions for adding a condition.
If you want to add a group of conditions, click the Group button and repeat the actions necessary for adding conditions.
If you want to delete a group of conditions, click the Remove group button.
If you want to search events that occurred during a specific period, in the Any time drop-down list select one of the following event search periods:
Any time, if you want the table to display events found for any period of time.
Last hour, if you want the table to display events that were found during the last hour.
Last day, if you want the table to display events found during the last day.
Custom range, if you want the table to display events found during the period you specify.
If you selected Custom range:
In the calendar that opens, specify the start and end dates of the event display range.
Click Apply.
The calendar closes.
Click Search.
The table of events that satisfy the search criteria is displayed.
Operation mode in which Kaspersky Anti Targeted Attack Platform is used to protect the infrastructure of multiple organizations or branch offices of the same organization simultaneously.
Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a primary control server (Primary Central Node (PCN)) and secondary servers (Secondary Central Nodes (SCN)).
Click the name of the server for which you want to view events.
The host table of the selected server is displayed. Event grouping levels are displayed above the table.
