The following criteria can be used to search for events:
General information:
Host is the host name.
HostIP is the IP address of the host.
EventType is the type of the event.
UserName is the name of the user.
OsFamily is the family of the operating system.
OsVersion is the version of the operating system being used on the host.
TAA properties:
IOAId is the TAA (IOA) rule ID.
IOATag is the information about the results of file analysis using the Targeted Attack Analyzer technology: name of the TAA (IOA) rule that was used to create the alert.
IOATechnique is the MITRE technique.
IOATactics is the MITRE tactic.
IOAImportance is the importance level that is assigned to an event generated using this TAA (IOA) rule.
IOAConfidence is the level of confidence depending on the likelihood of false alarms caused by the rule.
File properties:
CreationTime is the event creation time.
FileName is the name of the file.
FilePath is the path to the directory where the file is located.
FileFullName is the full path to the file. Includes the path to the directory and the file name.
ModificationTime is the file modification time.
FileSize is the size of the file.
MD5 is the MD5 hash of the file.
SHA256 is the SHA256 hash of the file.
SimilarDLLPath — Malicious DLL placed in a directory on the standard search path to make the operating system load it before the original DLL.
Linux processes:
LogonRemoteHost is the IP address of the host that initiated remote access.
RealUserName is the name of the user assigned when the user was registered in the system.
EffectiveUserName is the user name that was used to log in to the system.
Environment is system environment variables.
ProcessType is the type of the process.
OperationResult is the result of the operation.
FileOwnerUserName is the name of the file owner.
RealGroupName is the name of the user group.
EffectiveGroupName is the name of the user group that is used for operation.
Process started:
PID is the process ID.
ParentFileFullName is the path to the parent process file.
ParentMD5 is the MD5 hash of the parent process file.
ParentSHA256 is the SHA256 hash of the parent process file.
StartupParameters is the options that the process was started with.
ParentPID is the parent process ID.
ParentStartupParameters—Parent process startup settings.
Remote connection:
HTTPMethod is the HTTP request method. For example, Get, Post, or Connect.
ConnectionDirection is the direction of the connection (inbound or outbound).
LocalIP is the IP address of the local computer from which the remote connection attempt was made.
LocalPort is the IP address of the local computer from which the remote connection attempt was made.
RemoteHostName is the name of the computer that was the target of the remote connection attempt.
RemoteIP is the IP address of the computer that was the target of the remote connection attempt.
RemotePort is the port of the computer that was the target of the remote connection attempt.
URl is the address of the resource to which the HTTP request was made.
Registry modified:
RegistryKey is the registry key.
RegistryValueName is the name of the registry value.
RegistryValue is the data of the registry value.
RegistryOperationType is the type of the operation with the registry.
RegistryPreviousKey is the previous registry key.
RegistryPreviousValue is the previous name of the registry value.
System event log:
WinLogEventID is the type ID of the security event in the Windows log.
LinuxEventType is the type of the event. This criterion is used for Linux and macOS operating systems.
WinLogName is the name of the log.
WinLogEventRecordID is the log entry ID.
WinLogProviderName is the ID of the system that logged the event.
WinLogTargetDomainName is the domain name of the remote computer.
WinLogObjectName is the name of the object that initiated the event.
WinlogPackageName is the name of the package that initiated the event.
WinLogProcessName is the name of the process that initiated the event.
Detect and processing result:
DetectName is the name of the detected object.
RecordID is the ID of the triggered rule.
ProcessingMode is the scanning mode.
ObjectName is the name of the object.
ObjectType is the type of the object.
ThreatStatus is the detection mode.
UntreatedReason is the event processing status.
ObjectContent (for AMSI events too) is the content of the script sent for scanning.
ObjectContentType (for AMSI events too) is the type of script content.
Console interactive input:
InteractiveInputText is the text entered on the command line.
InteractiveInputType is the input type (console or pipe).
File modified:
FileOperationType is the type of the file operation.
FilePreviousPath is the path to the directory where the file was previously located.
FilePreviousName is the previous name of the file.
FilePreviousFullName is the full name of the file including the path to the directory where the file was previously located and/or the previous file name.