Skip to main content

Security Telemetry events sent to SIEM

This section explains what information security agents send to the SIEM solution (Splunk). The information is grouped by event type.

Process create

Field name

Description

cmdline

The command line that started the process.

company_id

Indicates the company ID in GravityZone.

ctc_version

The version of CTC security signatures

datetime

The date and time in Unix epoch time format

elevation

The numeric ID associated with the elevation level of the process

elevation_sz

Indicates whether the process ran with elevated privileges. Possible values:

  • elevated

  • restricted

event_name

The event name

event_version

Event version

hardware_id

An ID, generated by BEST, that uniquely identifies an endpoint.

integrity

The numeric ID associated with the integrity level

integrity_sz

The process integrity level. Possible values:

  • untrusted

  • low

  • medium

  • high

  • system

These values are the equivalent of mandatory integrity levels described here.

machine_name

The host name

mitre_ids

This field contains the following information related to Mitre attack and techniques:

  • name - The Mitre technique name, as documented on the official website. For example: Command and Scripting Interpreter.

  • id - The Mitre Technique ID, as documented on the official website. For example: T1074.

  • subtechniques - This field contains the following information related to Mitre subtechniques:

    • name - The Mitre subtechnique name

    • id - The Mitre subtechnique ID. For example: T1595.002.

  • categories - This field contains the following information:

    • categories - The Mitre category, the Mitre mapping of kill chain phases

os_family

The type of operating system. Possible values:

  • windows

  • linux

  • macos

os_platform

The type of OS architecture, x86, x64, or arm64.

os_type

Indicates whether the operating system fulfils the role of a client or a server.

os_version

The operating system version. For example: Windows 11.

parent_cmdline

The command line that started the parent process.

parent_elevation

The numeric ID associated with the elevation level of the parent process

parent_elevation_sz

Indicates whether the parent process ran with elevated privileges. Possible values:

  • elevated

  • restricted

parent_integrity

The numeric ID associated with the integrity level of the parent process

parent_integrity_sz

The integrity level of the parent process. Possible values:

  • untrusted

  • low

  • medium

  • high

  • system

These values are the equivalent of mandatory integrity levels described here.

parent_pid

The parent process identifier

parent_process_path

The file path of the parent process

parent_user_name

The username listed for the parent process

pid

The process identifier

process_md5

The MD5 hash of the process

process_path

The process path

process_sha

The SHA256 hash of the process

product_version

BEST product version

user_name

The user who started the process.

user_sid

The ID associated with the user account that started the process.

[
    {
        "parent_user_name": "1022H2X64-N74\\testadmin",
        "integrity_sz": "high",
        "integrity": 12288,
        "ctc_version": "2.13.4.3",
        "parent_integrity": 12288,
        "parent_elevation": 1,
        "process_sha": "81de431987304676134138705fc1c21188ad7f27edf6b77a6551aa693194485e",
        "user_sid": "S-1-5-21-2405739389-2309292873-14435642-1001",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "parent_process_path": "c:\\python36\\pythonw.exe",
        "parent_cmdline": "C:\\framework\\main.py frk",
        "cmdline": "\"C:\\putty9ebd95c0-5eb4-49b6-82ee-e7c7a879a373.exe\"",
        "event_name": "process_create",
        "pid": 7912,
        "process_md5": "b6c12d88eeb910784d75a5e4df954001",
        "elevation_sz": "elevated",
        "elevation": 1,
        "parent_elevation_sz": "elevated",
        "user_name": "1022H2X64-N74\\testadmin",
        "parent_integrity_sz": "high",
        "process_path": "c:\\putty9ebd95c0-5eb4-49b6-82ee-e7c7a879a373.exe",
        "datetime": 1715023630446,
        "mitre_ids": [],
        "os_version": "Windows 10",
        "parent_pid": 2932,
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Terminate process

Field name

Description

company_id

Indicates the company ID in GravityZone.

ctc_version

The version of CTC security signatures

datetime

The date and time in Unix epoch time format

event_name

Event name

event_version

Event version

hardware_id

An ID, generated by BEST, that uniquely identifies an endpoint.

machine_name

The host name

os_family

The type of operating system. Possible values:

  • windows

  • linux

  • macos

os_platform

The type of OS architecture, x86, x64, or arm64.

os_type

Indicates whether the operating system fulfils the role of a client or a server.

os_version

The operating system version. For example: Windows 11.

pid

The process identifier

product_version

BEST product version

[
    {
        "ctc_version": "2.13.4.3",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "terminate_process",
        "pid": 7912,
        "datetime": 1715023652647,
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Network connection

Field name

Description

bytes_sent

The number of bytes sent by the source endpoint

bytes_received

The number of bytes received by the destination endpoint

company_id

Indicates the company ID in GravityZone.

ctc_version

The version of CTC security signatures

datetime

The date and time in Unix epoch time format

direction

Indicates where the network connection originated, whether it was inbound or outbound.

event_name

Event name

event_version

Event version

hardware_id

An ID, generated by BEST, that uniquely identifies an endpoint.

ip_dest

The destination IP address

ip_source

The source IP address

machine_name

The host name

operation

Indicates the type of network operation performed. For example: connect, disconnect.

os_family

The type of operating system. Possible values:

  • windows

  • linux

  • macos

os_platform

The type of OS architecture, x86, x64, or arm64.

os_type

Indicates whether the operating system fulfils the role of a client or a server.

os_version

The operating system version. For example: Windows 11.

pid

The process identifier

port_dest

The destination port

port_source

The source port

process_path

The process path

product_version

BEST product version

 {
        "port_source": 54788,
        "port_dest": 8089,
        "bytes_sent": 0,
        "ctc_version": "2.13.4.3",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "ip_dest": "10.17.130.193",
        "event_name": "network_connection",
        "pid": 2932,
        "direction": "outbound",
        "operation": "disconnect",
        "bytes_received": 0,
        "process_path": "c:\\python36\\pythonw.exe",
        "datetime": 1715023721139,
        "ip_source": "10.25.102.114",
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }

Logon

To receive logon events successfully, you must first enable the Audit Logon policy on the endpoint.

Field name

Description

company_id

Indicates the company ID in GravityZone.

ctc_version

The version of CTC security signatures

datetime

The date and time in Unix epoch time format

event_name

Event name

event_version

Event version

hardware_id

An ID, generated by BEST, that uniquely identifies an endpoint.

ip_source

The source IP address

logon_type

The ID associated with the logon type. Possible values:

  • 0: correlates with system logon type

  • 2: correlates with interactive logon type

  • 3: correlates with network logon type

  • 4: correlates with batch logon type

  • 5: correlates with service logon type

  • 7: correlates with unlock logon type

  • 8: correlates with networkcleartext logon type

  • 9: correlates with newcredentials logon type

  • 10: correlates with remoteinteractive logon type

  • 11: correlates with cachedinteractive logon type

  • 12: correlates with cachedremoteinteractive logon type

  • 13: correlates with cachedunlock logon type

  • 255: correlates with invalid logon type

logon_type_sz

The type of login. Possible values:

  • system

  • interactive

  • network

  • batch

  • service

  • unlock

  • networkcleartext

  • newcredentials

  • remoteinteractive

  • cachedinteractive

  • cachedremoteinteractive

  • cachedunlock

  • invalid

To learn more about these logon types, refer to Logon types and descriptions.

machine_name

The host name

os_family

The type of operating system. Possible values:

  • windows

  • linux

  • macos

os_platform

The type of OS architecture, x86, x64, or arm64.

os_type

Indicates whether the operating system fulfils the role of a client or a server.

os_version

The operating system version. For example: Windows 11.

product_version

BEST product version

user_name

The user that performed the login

{
        "ctc_version": "2.13.4.3",
        "logon_type_sz": "interactive",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "log_on",
        "user_name": "6e925f53-8d3c-4716-b",
        "logon_type": 2,
        "datetime": 1715025164820,
        "ip_source": "::1",
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }

Logoff

To receive logoff events successfully, you must first enable the Audit Logoff policy on the endpoint. Follow the steps depicted here. At step 3, open the Audit Logoff policy instead.

Field name

Description

company_id

Indicates the company ID in GravityZone.

ctc_version

The version of CTC security signatures

datetime

The date and time in Unix epoch time format

event_name

Event name

event_version

Event version

hardware_id

An ID, generated by BEST, that uniquely identifies an endpoint.

machine_name

The host name

os_family

The type of operating system. Possible values:

  • windows

  • linux

  • macos

os_platform

The type of OS architecture, x86, x64, or arm64.

os_type

Indicates whether the operating system fulfils the role of a client or a server.

os_version

The operating system version. For example: Windows 11.

product_version

BEST product version

user_name

The user that logged off

 {
        "ctc_version": "2.13.4.3",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "log_out",
        "user_name": "6e925f53-8d3c-4716-b",
        "datetime": 1715025164820,
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }

Create file

Field name

Description

company_id

Indicates the company ID in GravityZone.

ctc_version

The version of CTC security signatures

datetime

The date and time in Unix epoch time format

event_name

Event name

event_version

Event version

hardware_id

An ID, generated by BEST, that uniquely identifies an endpoint.

machine_name

The host name

md5

The MD5 hash of the file

os_family

The type of operating system. Possible values:

  • windows

  • linux

  • macos

os_platform

The type of OS architecture, x86, x64, or arm64.

os_type

Indicates whether the operating system fulfils the role of a client or a server.

os_version

The operating system version. For example: Windows 11.

path

The file path

pid

The process identifier

process_sha

The SHA256 hash of the process that generated the file

process_md5

The MD5 hash of the process that generated the file

process_path

The process path

product_version

BEST product version

sha

The SHA256 hash of the file

source_path

When a file is copied to a new location, this field indicates the initial file path. Otherwise, the field is empty.

user_name

The user who started the process that generated the file.

[
    {
        "ctc_version": "2.13.4.3",
        "process_sha": "9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3",
        "source_path": "",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "file_create",
        "pid": 6572,
        "process_md5": "2e5a8590cf6848968fc23de3fa1e25f1",
        "user_name": "",
        "md5": "",
        "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
        "datetime": 1715023843379,
        "path": "c:\\create904acfb1-f484-4282-89a1-7ff5d93dd3ef.txt",
        "os_version": "Windows 10",
        "sha": "",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Delete file

Field name

Description

company_id

Indicates the company ID in GravityZone.

ctc_version

The version of CTC security signatures

datetime

The date and time in Unix epoch time format

event_name

Event name

event_version

Event version

hardware_id

An ID, generated by BEST, that uniquely identifies an endpoint.

is_remote

Indicates whether the change made on a file happened via remote connection

machine_name

The host name

os_family

The type of operating system. Possible values:

  • windows

  • linux

  • macos

os_platform

The type of OS architecture, x86, x64, or arm64.

os_type

Indicates whether the operating system fulfils the role of a client or a server.

os_version

The operating system version. For example: Windows 11.

path

The file path of the deleted file

pid

The process identifier

process_sha

The SHA256 hash of the process that deleted the file

process_md5

The MD5 hash of the process that deleted the file

process_path

The process path

product_version

BEST product version

user_name

The user who started the process that deleted the file

[
    {
        "ctc_version": "2.13.4.3",
        "process_sha": "9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "file_delete",
        "pid": 4872,
        "process_md5": "2e5a8590cf6848968fc23de3fa1e25f1",
        "user_name": "",
        "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
        "is_remote": 0,
        "datetime": 1715023867586,
        "path": "c:\\create904acfb1-f484-4282-89a1-7ff5d93dd3ef.txt",
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Modify file

Field name

Description

bytes_written

A buffer (up to 64K) of the first bytes written

company_id

Indicates the company ID in GravityZone.

ctc_version

The version of CTC security signatures

datetime

The date and time in Unix epoch time format

entropy

The file entropy value

event_name

Event name

event_version

Event version

extra_keys

Keys for extra information to be displayed in the generated incident

extra_values

Values corresponding to the extra_keys field.

hardware_id

An ID, generated by BEST, that uniquely identifies an endpoint.

is_remote

Indicates whether the change made on a file happened via remote connection

machine_name

The host name

md5

The MD5 hash of the file

os_family

The type of operating system. Possible values:

  • windows

  • linux

  • macos

os_platform

The type of OS architecture, x86, x64, or arm64.

os_type

Indicates whether the operating system fulfils the role of a client or a server.

os_version

The operating system version. For example: Windows 11.

path

The file path

pid

The process identifier

process_sha

The SHA256 hash of the process that generated the file

process_md5

The MD5 hash of the process that generated the file

process_path

The process path

product_version

BEST product version

sha

The SHA256 hash of the file

type

The ID associated with the file type. Possible values:

  • 0: correlates with executable file type

  • 1: correlates with document file type

  • 2: correlates with archive file type

  • 3: correlates with script file type

  • 4: correlates with media file type

  • 5: correlates with possibleimportantformat file type

  • 999: correlates with unknown file type

type_sz

The file type. Possible values:

  • executable

  • document

  • archive

  • script

  • media

  • possibleimportantformat

  • unknown

possibleimportantformat is an umbrella term. It keeps records of files that may be important for security investigation later on due to a possible data exfiltration. The targeted file extensions are: .3dm, .3ds, .3g2, .3gp, .7z, .aac, .accdb, .ai, .aif, .asd, .asf, .avi, .bmp, .bz2, .cbr, .cda, .csv, .db, .dbf, .dds, .doc, .docx, .dwg, .dxf, .email, .eml, .emlx, .eps, .fdb, .flac, .flv, .frm, .gif, .gpx, .gslides", .gz, .h264, .heic, .ico, .iff, .jpg, .kexi, .key, .kml, .kmz, .log, .lz, .m3u, .m4a, .m4v, .max, .md, .mdb, .mde, .mdf, .mid, .midi, .mkv, .mov, .mp3, .mp4, .mpa, .mpeg, .mpg, .msg, .obj, .odp, .ods, .odt, .oft, .ogg, .opus, .ost, .pdb, .pdf, .pez, .png, .pot, .pps, .ppt, .pptx, .psd, .pspimage, .pst, .rar, .rm, .rtf, .sqlite, .srt, .svg, .swf, .tar, .tar.gz, .tar.xz, .tex, .tga, .thm, .tif, .tiff, .vcf, .vob, .wav, .wdb, .wma, .wmv, .wpd, .wps, .xlr, .xls, .xls, .xlsm, .xlsx, .xz, .yuv, .zip, and .zipx.

user_name

The user who started the process that modified the file.

{
        "bytes_written": 0,
        "ctc_version": "2.13.4.3",
        "process_sha": "9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3",
        "extra_keys": [],
        "type_sz": "Unknown",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "entropy": 0,
        "event_name": "file_modify",
        "pid": 7580,
        "process_md5": "2e5a8590cf6848968fc23de3fa1e25f1",
        "user_name": "",
        "md5": "",
        "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
        "is_remote": 0,
        "datetime": 1715024067932,
        "path": "c:\\programdata\\modify2f808a64-a09d-49ff-885c-efd4cdc264bc.txt",
        "extra_values": [],
        "os_version": "Windows 10",
        "sha": "",
        "type": 999,
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }

Read from file

Field name

Description

bytes_read

The number of bytes read from file

company_id

Indicates the company ID in GravityZone.

ctc_version

The version of CTC security signatures

datetime

The date and time in Unix epoch time format

entropy

The file entropy value

event_name

Event name

event_version

Event version

extra_keys

Keys for extra information to be displayed in the generated incident

extra_values

Values corresponding to the extra_keys field.

hardware_id

An ID, generated by BEST, that uniquely identifies an endpoint.

is_remote

Indicates whether the file was read via remote connection

machine_name

The host name

os_family

The type of operating system. Possible values:

  • windows

  • linux

  • macos

os_platform

The type of OS architecture, x86, x64, or arm64.

os_type

Indicates whether the operating system fulfils the role of a client or a server.

os_version

The operating system version. For example: Windows 11.

path

The file path

pid

The process identifier

process_md5

The MD5 hash of the process

process_path

The process path

process_sha

The SHA256 hash of the process

product_version

BEST product version

type

The ID associated with the file type. Possible values:

  • 0: correlates with executable file type

  • 1: correlates with document file type

  • 2: correlates with archive file type

  • 3: correlates with script file type

  • 4: correlates with media file type

  • 5: correlates with possibleimportantformat file type

  • 999: correlates with unknown file type

type_sz

The file type. Possible values:

  • executable

  • document

  • archive

  • script

  • media

  • possibleimportantformat

  • unknown

possibleimportantformat is an umbrella term. It keeps records of files that may be important for security investigation later on due to a possible data exfiltration. The targeted file extensions are: .3dm, .3ds, .3g2, .3gp, .7z, .aac, .accdb, .ai, .aif, .asd, .asf, .avi, .bmp, .bz2, .cbr, .cda, .csv, .db, .dbf, .dds, .doc, .docx, .dwg, .dxf, .email, .eml, .emlx, .eps, .fdb, .flac, .flv, .frm, .gif, .gpx, .gslides", .gz, .h264, .heic, .ico, .iff, .jpg, .kexi, .key, .kml, .kmz, .log, .lz, .m3u, .m4a, .m4v, .max, .md, .mdb, .mde, .mdf, .mid, .midi, .mkv, .mov, .mp3, .mp4, .mpa, .mpeg, .mpg, .msg, .obj, .odp, .ods, .odt, .oft, .ogg, .opus, .ost, .pdb, .pdf, .pez, .png, .pot, .pps, .ppt, .pptx, .psd, .pspimage, .pst, .rar, .rm, .rtf, .sqlite, .srt, .svg, .swf, .tar, .tar.gz, .tar.xz, .tex, .tga, .thm, .tif, .tiff, .vcf, .vob, .wav, .wdb, .wma, .wmv, .wpd, .wps, .xlr, .xls, .xls, .xlsm, .xlsx, .xz, .yuv, .zip, and .zipx.

user_name

The user who started the process that read from file

[
    {
        "ctc_version": "2.13.4.3",
        "process_sha": "9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3",
        "extra_keys": [],
        "type_sz": "Unknown",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "entropy": 0,
        "event_name": "file_read",
        "pid": 8756,
        "process_md5": "2e5a8590cf6848968fc23de3fa1e25f1",
        "user_name": "",
        "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
        "is_remote": 0,
        "datetime": 1715024308353,
        "path": "c:\\programdata\\readfileaf8f7981-30ed-4661-8ced-a34ad484c872.txt",
        "bytes_read": 4096,
        "extra_values": [],
        "os_version": "Windows 10",
        "type": 999,
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Move file

Field name

Description

company_id

Indicates the company ID in GravityZone.

ctc_version

The version of CTC security signatures

datetime

The date and time in Unix epoch time format

event_name

Event name

event_version

Event version

hardware_id

An ID, generated by BEST, that uniquely identifies an endpoint.

machine_name

The host name

md5

The MD5 hash of the file

new_path

The new file path

os_family

The type of operating system. Possible values:

  • windows

  • linux

  • macos

os_platform

The type of OS architecture, x86, x64, or arm64.

os_type

Indicates whether the operating system fulfils the role of a client or a server.

os_version

The operating system version. For example: Windows 11.

path

The initial file path

pid

The process identifier

process_sha

The SHA256 hash of the process that moved the file

process_md5

The MD5 hash of the process that moved the file

process_path

The process path

product_version

BEST product version

sha

The SHA256 hash of the file that was moved

user_name

The user who started the process that moved the file.

[
    {
        "ctc_version": "2.13.4.3",
        "process_sha": "9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "new_path": "c:\\movee9da5e14-0334-466e-b2e1-e6a801dba9fb.txt",
        "event_name": "file_move",
        "pid": 1724,
        "process_md5": "2e5a8590cf6848968fc23de3fa1e25f1",
        "user_name": "",
        "md5": "",
        "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
        "datetime": 1715024186114,
        "path": "c:\\windows\\movee9da5e14-0334-466e-b2e1-e6a801dba9fb.txt",
        "os_version": "Windows 10",
        "sha": "",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Registry create key

Field name

Description

company_id

Indicates the company ID in GravityZone.

ctc_version

The version of CTC security signatures

datetime

The date and time in Unix epoch time format

event_name

Event name

event_version

Event version

hardware_id

An ID, generated by BEST, that uniquely identifies an endpoint.

key_path

The path to the registry key

machine_name

The host name

operation

The type of operation performed on the registry key. Possible values:

  • create

  • write

  • delete

os_family

The type of operating system. Possible values:

  • windows

  • linux

  • macos

os_platform

The type of OS architecture, x86, x64, or arm64.

os_type

Indicates whether the operating system fulfils the role of a client or a server.

os_version

The operating system version. For example: Windows 11.

pid

The process identifier

product_version

BEST product version

user_name

The user who started the process that created the registry key.

[
    {
        "ctc_version": "2.13.4.3",
        "key_path": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\test_keyaecf3fbc-038b-4cf6-a819-fffbf0080c54",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "reg_create_key",
        "pid": 9476,
        "user_name": "",
        "operation": "create",
        "datetime": 1715024773966,
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Registry delete key

Field name

Description

company_id

Indicates the company ID in GravityZone.

datetime

The date and time in Unix epoch time format

event_name

Event name

event_version

Event version

hardware_id

An ID, generated by BEST, that uniquely identifies an endpoint.

key_path

The path to the registry key

machine_name

The host name

operation

The type of operation performed on the registry key. Possible values:

  • create

  • write

  • delete

os_family

The type of operating system. Possible values:

  • windows

  • linux

  • macos

os_platform

The type of OS architecture, x86, x64, or arm64.

os_type

Indicates whether the operating system fulfils the role of a client or a server.

os_version

The operating system version. For example: Windows 11.

pid

The process identifier

product_version

BEST product version

user_name

The user who started the process that deleted the registry key.

[
    {
        "ctc_version": "2.13.4.3",
        "key_path": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\test_keyaecf3fbc-038b-4cf6-a819-fffbf0080c54",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "reg_delete_key",
        "pid": 3456,
        "user_name": "",
        "operation": "delete",
        "datetime": 1715024776201,
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Registry delete value

Field name

Description

company_id

Indicates the company ID in GravityZone.

ctc_version

The version of CTC security signatures

datetime

The date and time in Unix epoch time format

event_name

Event name

event_version

Event version

hardware_id

An ID, generated by BEST, that uniquely identifies an endpoint.

key_path

The path to the registry key

machine_name

The host name

operation

The type of operation performed on the registry key. Possible values:

  • create

  • write

  • delete

os_family

The type of operating system. Possible values:

  • windows

  • linux

  • macos

os_platform

The type of OS architecture, x86, x64, or arm64.

os_type

Indicates whether the operating system fulfils the role of a client or a server.

os_version

The operating system version. For example: Windows 11.

pid

The process identifier

product_version

BEST product version

user_name

The user who started the process that deleted the registry value.

value

The registry value

[
    {
        "ctc_version": "2.13.4.3",
        "key_path": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\test_key_c0fcd233-788d-4449-983f-e6e1de1026ce",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "reg_delete_value",
        "pid": 9996,
        "value": "4ce93d69-8da7-48de-b967-3bc4011302aa",
        "user_name": "",
        "operation": "delete",
        "datetime": 1715024962726,
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Registry modify value

Field name

Description

company_id

Indicates the company ID in GravityZone.

ctc_version

The version of CTC security signatures

data

The data that was written into the value

data_type

The ID associated with the registry data type. Possible values:

  • 0: correlates with none data type

  • 1: correlates with string data type

  • 2: correlates with expandablestring data type

  • 3: correlates with binary data type

  • 4: correlates with dword data type

  • 5: correlates with dwordbigendian data type

  • 6: correlates with link data type

  • 7: correlates with multistring data type

  • 8: correlates with resourcelist data type

  • 9: correlates with resourcedescriptor data type

  • 10: correlates with resourcerequirements data type

  • 11: correlates with qword data type

data_type_sz

The data format for the registry value. Possible values:

  • none

  • string

  • expandablestring

  • binary

  • dword

  • dwordbigendian

  • link

  • multistring

  • resourcelist

  • resourcedescriptor

  • resourcerequirements

  • qword

To learn more about these data formats, refer to Registry value types.

datetime

The date and time in Unix epoch time format

event_name

Event name

event_version

Event version

hardware_id

An ID, generated by BEST, that uniquely identifies an endpoint.

key_path

The path to the registry key

machine_name

The host name

operation

The type of operation performed on the registry key. Possible values:

  • create

  • write

  • delete

os_family

The type of operating system. Possible values:

  • windows

  • linux

  • macos

os_platform

The type of OS architecture, x86, x64, or arm64.

os_type

Indicates whether the operating system fulfils the role of a client or a server.

os_version

The operating system version. For example: Windows 11.

pid

The process identifier

product_version

BEST product version

user_name

The user who started the process that modified the registry value.

value

The registry value

[
    {
        "ctc_version": "2.13.4.3",
        "key_path": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\test_key_c0fcd233-788d-4449-983f-e6e1de1026ce",
        "data_type_sz": "dword",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "reg_modify_value",
        "pid": 2320,
        "value": "4ce93d69-8da7-48de-b967-3bc4011302aa",
        "user_name": "",
        "operation": "create",
        "data": "1",
        "datetime": 1715024938841,
        "data_type": 4,
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]