Security Telemetry events sent to SIEM

Captures internal and external commands executed through Windows Command Prompt. This event requires theAntimalwaremodule to be installed on the endpoint and the Advanced Threat Control feature to be enabled in the applied policy.

{
    "ctc_version": "0.0.0.10",
    "user_sid": "S-1-5-21-364249659-4077724054-1036125100-1001",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "event_version": 1,
    "parent_process_path": "c:\\python-embed\\python-3.11.0-embed-amd64+pip22.3.1+runtime\\python.exe",
    "mdr_ep": -1,
    "parent_cmdline": "\"-I\" \"-c\" \"from multiprocessing.spawn import spawn_main; spawn_main(parent_pid=7900, pipe_handle=1992)\" \"--multiprocessing-fork\"",
    "cmdline": "cmd /c dir",
    "event_name": "cmd_command",
    "pid": 4460,
    "user_name": "TestAdmin",
    "process_path": "c:\\windows\\system32\\cmd.exe",
    "datetime": 1779361021844,
    "mitre_ids": [
        {
            "name": "Command and Scripting Interpreter",
            "id": "T1059",
            "subtechniques": [
                {
                    "name": "Windows Command Shell",
                    "id": "T1059.003"
                }
            ],
            "categories": [
                "Execution"
            ]
        }
    ],
    "os_version": "Windows 11",
    "parent_pid": 5272,
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666",
    "buffer": ""
}

Captures commands and scripts executed through PowerShell.

{
    "ctc_version": "0.0.0.10",
    "user_sid": "S-1-5-21-364249659-4077724054-1036125100-1001",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "event_version": 1,
    "parent_process_path": "c:\\python-embed\\python-3.11.0-embed-amd64+pip22.3.1+runtime\\python.exe",
    "mdr_ep": -1,
    "parent_cmdline": "\"-I\" \"-c\" \"from multiprocessing.spawn import spawn_main; spawn_main(parent_pid=7900, pipe_handle=1992)\" \"--multiprocessing-fork\"",
    "cmdline": "powershell -File C:\\Users\\TESTAD\~1\\AppData\\Local\\Temp\\tmpoc08thhf.ps1",
    "event_name": "ps_command",
    "pid": 2096,
    "user_name": "TestAdmin",
    "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
    "datetime": 1779361057468,
    "mitre_ids": [
        {
            "name": "Command and Scripting Interpreter",
            "id": "T1059",
            "subtechniques": [
                {
                    "name": "PowerShell",
                    "id": "T1059.001"
                }
            ],
            "categories": [
                "Execution"
            ]
        }
    ],
    "os_version": "Windows 11",
    "parent_pid": 5272,
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Captures PowerShell script blocks as they are processed, providing visibility into executed script content. To receive the event, you must first enable Script Block Logging on the endpoint.

{
    "ctc_version": "0.0.0.10",
    "data_source": "ETW monitoring",
    "application_name": "PowerShell",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "event_version": 1,
    "mdr_ep": -1,
    "event_name": "shell_block_logging",
    "pid": 2096,
    "content_name": "",
    "datetime": 1779361063494,
    "mitre_ids": [],
    "script": "$global:?",
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Captures content submitted to the Antimalware Scan Interface (AMSI), helping analyze scripts and other dynamic content. This event requires theAntimalwaremodule to be installed on the endpoint and the Fileless Attack Protection > Antimalware Scan Interface Security Provider option to be enabled in the applied policy.

{
    "ctc_version": "0.0.0.10",
    "resource_type": "application - powershell buffer",
    "data_source": "amsi_powershell_script",
    "application_name": "PowerShell_C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe_10.0.26100.5074",
    "buffer": "[long]($_.NPM / 1024)",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "event_version": 1,
    "mdr_ep": -1,
    "event_name": "amsi_buffer",
    "pid": 2096,
    "content_name": "",
    "datetime": 1779361063107,
    "mitre_ids": [
        {
            "name": "Command and Scripting Interpreter",
            "id": "T1059",
            "subtechniques": [
                {
                    "name": "PowerShell",
                    "id": "T1059.001"
                }
            ],
            "categories": [
                "Execution"
            ]
        },
        {
            "name": "Exploitation for Client Execution",
            "id": "T1203",
            "categories": [
                "Execution"
            ]
        }
    ],
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Identifies newly added services and provides information about their configuration. To receive the event, you must first enable the Audit Security System Extension policy on the endpoint.

{
    "ctc_version": "0.0.0.10",
    "name": "dede9e41-0586-4fc3-b75a-f9a9beaa528e",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "service_start_type": 0,
    "event_version": 1,
    "mdr_ep": -1,
    "cmdline": "",
    "event_name": "service_added",
    "service_path": "c:\\dede9e41-0586-4fc3-b75a-f9a9beaa528e.exe",
    "datetime": 1779359999067,
    "is_driver": 0,
    "mitre_ids": [],
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Tracks service status changes, such as when a service starts or stops. This event is available only for the Windows operating system.

{
    "ctc_version": "0.0.0.10",
    "name": "\"wuauserv\"",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "event_version": 1,
    "status": 1,
    "mdr_ep": -1,
    "result": 1,
    "event_name": "service_change_status",
    "datetime": 1779360019477,
    "is_driver": 0,
    "mitre_ids": [
        {
            "name": "Windows Management Instrumentation",
            "id": "T1047",
            "categories": [
                "Execution"
            ]
        },
        {
            "name": "Command and Scripting Interpreter",
            "id": "T1059",
            "subtechniques": [
                {
                    "name": "Visual Basic",
                    "id": "T1059.005"
                }
            ],
            "categories": [
                "Execution"
            ]
        },
        {
            "name": "Exploitation for Client Execution",
            "id": "T1203",
            "categories": [
                "Execution"
            ]
        },
        {
            "name": "Create or Modify System Process",
            "id": "T1543",
            "subtechniques": [
                {
                    "name": "Windows Service",
                    "id": "T1543.003"
                }
            ],
            "categories": [
                "Persistence",
                "Privilege Escalation"
            ]
        },
        {
            "name": "System Services",
            "id": "T1569",
            "subtechniques": [
                {
                    "name": "Service Execution",
                    "id": "T1569.002"
                }
            ],
            "categories": [
                "Execution"
            ]
        }
    ],
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Tracks changes to service configuration, such as its executable path or startup behavior. This event is available only for the Windows operating system.

{
    "new_service_start_type": 0,
    "ctc_version": "0.0.0.10",
    "name": "dede9e41-0586-4fc3-b75a-f9a9beaa528e",
    "new_service_path": "c:\\dede9e41-0586-4fc3-b75a-f9a9beaa528e.exe",
    "new_name": "",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "event_version": 1,
    "mdr_ep": -1,
    "event_name": "service_modify",
    "datetime": 1779360018251,
    "is_driver": 0,
    "mitre_ids": [
        {
            "name": "Command and Scripting Interpreter",
            "id": "T1059",
            "subtechniques": [
                {
                    "name": "Windows Command Shell",
                    "id": "T1059.003"
                }
            ],
            "categories": [
                "Execution"
            ]
        },
        {
            "name": "Exploitation for Client Execution",
            "id": "T1203",
            "categories": [
                "Execution"
            ]
        },
        {
            "name": "Create or Modify System Process",
            "id": "T1543",
            "subtechniques": [
                {
                    "name": "Windows Service",
                    "id": "T1543.003"
                }
            ],
            "categories": [
                "Persistence",
                "Privilege Escalation"
            ]
        }
    ],
    "os_version": "Windows 11",
    "new_cmdline": "",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Records when a new scheduled task is registered on an endpoint. To receive the event, you must first enable the Audit Other Object Access Events policy on the endpoint.

{
    "ctc_version": "0.0.0.10",
    "name": "\\b5260980-ac24-48ed-8",
    "target_path": "c:\\windows\\system32\\notepad.exe",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "event_version": 1,
    "mdr_ep": -1,
    "cmdline": "",
    "event_name": "scheduled_task_create",
    "pid": 2152,
    "process_path": "c:\\windows\\system32\\schtasks.exe",
    "datetime": 1779360034276,
    "mitre_ids": [
        {
            "name": "Scheduled Task/Job",
            "id": "T1053",
            "subtechniques": [
                {
                    "name": "Scheduled Task",
                    "id": "T1053.005"
                }
            ],
            "categories": [
                "Execution",
                "Persistence",
                "Privilege Escalation"
            ]
        },
        {
            "name": "Command and Scripting Interpreter",
            "id": "T1059",
            "categories": [
                "Execution"
            ]
        },
        {
            "name": "Exploitation for Client Execution",
            "id": "T1203",
            "categories": [
                "Execution"
            ]
        }
    ],
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Records when a scheduled task is removed. To receive the event, you must first enable the Audit Other Object Access Events policy on the endpoint.

{
    "ctc_version": "0.0.0.10",
    "name": "\\b5260980-ac24-48ed-8",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "event_version": 1,
    "mdr_ep": -1,
    "event_name": "scheduled_task_delete",
    "pid": 7268,
    "process_path": "c:\\windows\\system32\\schtasks.exe",
    "datetime": 1779360073854,
    "mitre_ids": [
        {
            "name": "Scheduled Task/Job",
            "id": "T1053",
            "subtechniques": [
                {
                    "name": "Scheduled Task",
                    "id": "T1053.005"
                }
            ],
            "categories": [
                "Execution",
                "Persistence",
                "Privilege Escalation"
            ]
        }
    ],
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Records changes to scheduled task definitions, actions, or configuration. To receive the event, you must first enable the Audit Other Object Access Events policy on the endpoint.

{
    "ctc_version": "0.0.0.10",
    "name": "\\b5260980-ac24-48ed-8",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "event_version": 1,
    "mdr_ep": -1,
    "event_name": "scheduled_task_modify",
    "pid": 1628,
    "process_path": "c:\\windows\\system32\\schtasks.exe",
    "datetime": 1779360044733,
    "new_target_path": "c:\\windows\\system32\\notepad.exe",
    "mitre_ids": [],
    "os_version": "Windows 11",
    "new_cmdline": "",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Identifies files added to a BITS job.

{
    "ctc_version": "0.0.0.10",
    "name": "BITS Transfer",
    "local_path": "C:\\temp\\bits2.txt",
    "remote_path": "https://www.microsoft.com/robots.txt",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "guid": "{4D69FB61-591D-4714-A6F4-579EB97AE530}",
    "creator": "1125H2X64-N68\\TestAdmin",
    "event_version": 1,
    "mdr_ep": -1,
    "event_name": "bits_job_file_added",
    "pid": 8428,
    "file_count": 2,
    "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
    "datetime": 1779360311695,
    "mitre_ids": [],
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Identifies newly created BITS jobs.

{
    "ctc_version": "0.0.0.10",
    "name": "BITS Transfer",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "guid": "{4D69FB61-591D-4714-A6F4-579EB97AE530}",
    "creator": "1125H2X64-N68\\TestAdmin",
    "event_version": 1,
    "mdr_ep": -1,
    "event_name": "bits_job_created",
    "pid": 8428,
    "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
    "datetime": 1779360310100,
    "mitre_ids": [],
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Identifies removed, canceled, or completed BITS jobs.

{
    "ctc_version": "0.0.0.10",
    "name": "BITS Transfer",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "guid": "{4D69FB61-591D-4714-A6F4-579EB97AE530}",
    "creator": "1125H2X64-N68\\TestAdmin",
    "event_version": 1,
    "mdr_ep": -1,
    "event_name": "bits_job_deleted",
    "pid": 8428,
    "file_count": 2,
    "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
    "datetime": 1779360316474,
    "mitre_ids": [],
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Identifies methods executed through Windows Management Instrumentation (WMI) and any processes they create.

{
    "method_name": "Create",
    "ctc_version": "0.0.0.10",
    "user_db_uid": 7,
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "is_local": true,
    "event_version": 1,
    "mdr_ep": -1,
    "class_name": "Win32_Process",
    "event_name": "wmi_exec_method",
    "pid": 2508,
    "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
    "datetime": 1779360169835,
    "mitre_ids": [
        {
            "name": "Obfuscated Files or Information",
            "id": "T1027",
            "subtechniques": [
                {
                    "name": "Fileless Storage",
                    "id": "T1027.011"
                }
            ],
            "categories": [
                "Defense Evasion"
            ]
        },
        {
            "name": "Windows Management Instrumentation",
            "id": "T1047",
            "categories": [
                "Execution"
            ]
        },
        {
            "name": "Command and Scripting Interpreter",
            "id": "T1059",
            "subtechniques": [
                {
                    "name": "PowerShell",
                    "id": "T1059.001"
                }
            ],
            "categories": [
                "Execution"
            ]
        },
        {
            "name": "Exploitation for Client Execution",
            "id": "T1203",
            "categories": [
                "Execution"
            ]
        },
        {
            "name": "Event Triggered Execution",
            "id": "T1546",
            "subtechniques": [
                {
                    "name": "Windows Management Instrumentation Event Subscription",
                    "id": "T1546.003"
                }
            ],
            "categories": [
                "Privilege Escalation",
                "Persistence"
            ]
        }
    ],
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Identifies Windows Management Instrumentation (WMI) activity, such as queries and operations performed on the endpoint.

{
    "ctc_version": "0.0.0.10",
    "group_id": 11457,
    "operation_id": 11458,
    "user_db_uid": 4,
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "action": "ExecQuery",
    "is_local": true,
    "event_version": 1,
    "mdr_ep": -1,
    "event_name": "wmi_new_activity",
    "pid": 2972,
    "operation": "Start IWbemServices::ExecQuery - ROOT\\StandardCimv2 : SELECT * FROM MSFT_NetAdapterStatisticsSettingData WHERE Name = 'Ethernet0'",
    "process_path": "c:\\windows\\system32\\svchost.exe",
    "datetime": 1779361047946,
    "mitre_ids": [
        {
            "name": "Windows Management Instrumentation",
            "id": "T1047",
            "categories": [
                "Execution"
            ]
        }
    ],
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Identifies bindings created between Windows Management Instrumentation (WMI) event components that may be used for persistence.

{
    "cause": "Binding EventFilter: \ninstance of __EventFilter\n{\n\tCreatorSID = {1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 59, 2, 182, 21, 150, 33, 13, 243, 172, 3, 194, 61, 233, 3, 0, 0};\n\tEventNamespace = \"root\\\\cimv2\";\n\tName = \"TestFilter302212\";\n\tQuery = \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\";\n\tQueryLanguage = \"WQL\";\n};\nPerm. Consumer: \ninstance of CommandLineEventConsumer\n{\n\tCommandLineTemplate = \"C:\\\\Windows\\\\System32\\\\notepad.exe\";\n\tCreatorSID = {1, 5, 0, 0, 0, 0, 0, 5, 21, 0, 0, 0, 59, 2, 182, 21, 150, 33, 13, 243, 172, 3, 194, 61, 233, 3, 0, 0};\n\tExecutablePath = \"C:\\\\Windows\\\\System32\\\\notepad.exe\";\n\tName = \"TestConsumer9c3b0c\";\n};\n",
    "filter": "",
    "ctc_version": "0.0.0.10",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "is_local": true,
    "event_version": 1,
    "mdr_ep": -1,
    "event_name": "wmi_new_binding",
    "pid": 0,
    "process_path": "<system>",
    "datetime": 1779360170948,
    "mitre_ids": [
        {
            "name": "Windows Management Instrumentation",
            "id": "T1047",
            "categories": [
                "Execution"
            ]
        }
    ],
    "os_version": "Windows 11",
    "consumer_name": "CommandLineEventConsumer=\"TestConsumer9c3b0c\"",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Identifies newly loaded driver modules and provides visibility into kernel-level activity.

{
    "ctc_version": "0.0.0.10",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "event_version": 1,
    "mdr_ep": -1,
    "module_path": "c:\\windows\\system32\\drivers\\null.sys",
    "event_name": "driver_load_module",
    "is_signed": false,
    "datetime": 1779359780468,
    "mitre_ids": [],
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666",
    "code_integrity_options": 0
}

Identifies when a hardware device or storage volume is mounted and made available to the operating system.

{
    "mount_point_path": "\\\\??\\volume{52a4d04f-0c25-11f1-a619-806e6f6e6963}",
    "file_system": "OTHER",
    "mounted_file_path": "",
    "ctc_version": "0.0.0.10",
    "name": "\\Device\\CdRom0",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "event_version": 1,
    "status": 0,
    "mdr_ep": -1,
    "event_name": "hardware_mount",
    "datetime": 1779360019993,
    "mitre_ids": [],
    "subject_logon_id": 0,
    "media_type": "OTHER",
    "hardware_type": "CDROM",
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Identifies when a hardware device or storage volume is disconnected or made unavailable to the operating system.

{
    "mount_point_path": "",
    "file_system": "OTHER",
    "mounted_file_path": "",
    "ctc_version": "0.0.0.10",
    "name": "\\Device\\Harddisk0\\DR0",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "event_version": 1,
    "status": 0,
    "mdr_ep": -1,
    "event_name": "hardware_unmount",
    "datetime": 1779360999090,
    "mitre_ids": [],
    "subject_logon_id": 0,
    "media_type": "OTHER",
    "hardware_type": "DISPLAY",
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Identifies requests to uninstall the security agent, helping investigate authorized removal or potential tampering. This event is available only for the Windows operating system.

{
    "ctc_version": "0.0.0.10",
    "failure_reason": "IncorrectPassword",
    "password_policy": "GravityZonePassword",
    "user_db_uid": 7,
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "event_version": 1,
    "mdr_ep": -1,
    "event_name": "agent_uninstall_request",
    "pid": 2060,
    "process_path": "c:\\windows\\system32\\cmd.exe",
    "request_type": "LocalUser",
    "datetime": 1779360999184,
    "mitre_ids": [],
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}

Identifies Windows audit policy changes. This event is available only for the Windows operating system.

{
    "ctc_version": "0.0.0.10",
    "user_sid": "",
    "machine_name": "1125H2X64-N68",
    "ring": "sf",
    "sub_category": 0,
    "event_version": 1,
    "mdr_ep": -1,
    "event_name": "audit_policy_changed",
    "audit_policy_change_status": [
        1
    ],
    "user_name": "",
    "datetime": 1779360157175,
    "mitre_ids": [],
    "subject_logon_id": 0,
    "os_version": "Windows 11",
    "company_id": "60743cea7edaff46df5871af",
    "hardware_id": "407F0E42-287B-1B9F-75BA-296E6846D9B7-0050568E9866",
    "os_family": "windows",
    "os_platform": "x64",
    "os_type": "client",
    "product_version": "0.3.101.666"
}