Additional attributes must be presented as string in JSON format, for example: {"engine":1,"method":3,"local":true,"harm":false,"blacklist":false}
Possible attributes:
- "engine" - (JSON number) instrument which used to detect malicious action, see EDetectionEngine
- "method" - (JSON number) method of detection (intelligence classes), see EDetectionMethod
- "local" - (JSON boolean) true if virus found on local storage
- "harm" - (JSON boolean) true if virus may destroy data
- "blacklist" - (JSON boolean) true if the object is blocked based on client verdict
- "edr_ver" - (JSON number) version of JSON parameter of event that can be used to select a set of plugins that support killchain visualization
- "edr" - (JSON object) optional parameter, may include following product specific attributes: -- "id" - (JSON string) killchain network list item identifier (see KILLCHAIN_LIST_NAME)