Security Telemetry events sent to SIEM

This page provides detailed information about the Security Telemetry events that you can forward to your SIEM solution. Events are organized into categories based on the endpoint activity they record.

Each event includes a description and information about the fields it provides. Some events require additional configuration to generate telemetry.

Process

Create

Identifies newly started processes and helps trace program execution on the endpoint.

Field name	Description
cmdline	The command line that started the process.
company_id	Indicates the company ID in GravityZone.
ctc_version	The version of CTC security signatures.
datetime	The date and time in Unix epoch time format.
elevation	The numeric ID associated with the elevation level of the process.
elevation_sz	Indicates whether the process ran with elevated privileges. Possible values: `elevated` `restricted`
event_name	The event name.
event_version	The event version.
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint.
integrity	The numeric ID associated with the integrity level.
integrity_sz	The process integrity level. Possible values: `untrusted` `low` `medium` `high` `system` These values are the equivalent of mandatory integrity levels described here.
machine_name	The host name of the endpoint.
mitre_ids	This field contains the following information related to Mitre attack and techniques: `name` - The Mitre technique name, as documented on the official website. For example: `Command and Scripting Interpreter`. `id` - The Mitre Technique ID, as documented on the official website. For example: `T1074`. `subtechniques` - This field contains the following information related to Mitre subtechniques: `name` - The Mitre subtechnique name `id` - The Mitre subtechnique ID. For example: `T1595.002`. `categories` - This field contains the following information: `categories` - The Mitre category, the Mitre mapping of kill chain phases
os_family	The operating system family. Possible values: `windows`, `linux`, `macos`.
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
os_type	Indicates whether the operating system fulfills the role of a client or a server.
os_version	The operating system version. For example: `Windows 11`.
parent_cmdline	The command line that started the parent process.
parent_elevation	The numeric ID associated with the elevation level of the parent process
parent_elevation_sz	Indicates whether the parent process ran with elevated privileges. Possible values: `elevated` `restricted`
parent_integrity	The numeric ID associated with the integrity level of the parent process
parent_integrity_sz	The integrity level of the parent process. Possible values: `untrusted` `low` `medium` `high` `system` These values are the equivalent of mandatory integrity levels described here.
parent_pid	The parent process identifier
parent_process_path	The path of the parent process
parent_user_name	The username listed for the parent process
pid	The process identifier
process_md5	The MD5 hash of the process
process_path	The process path
process_sha	The SHA256 hash of the process
product_version	BEST product version
user_name	The user who started the process.
user_sid	The ID associated with the user account that started the process.

[
    {
        "parent_user_name": "1022H2X64-N74\\testadmin",
        "integrity_sz": "high",
        "integrity": 12288,
        "ctc_version": "2.13.4.3",
        "parent_integrity": 12288,
        "parent_elevation": 1,
        "process_sha": "81de431987304676134138705fc1c21188ad7f27edf6b77a6551aa693194485e",
        "user_sid": "S-1-5-21-2405739389-2309292873-14435642-1001",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "parent_process_path": "c:\\python36\\pythonw.exe",
        "parent_cmdline": "C:\\framework\\main.py frk",
        "cmdline": "\"C:\\putty9ebd95c0-5eb4-49b6-82ee-e7c7a879a373.exe\"",
        "event_name": "process_create",
        "pid": 7912,
        "process_md5": "b6c12d88eeb910784d75a5e4df954001",
        "elevation_sz": "elevated",
        "elevation": 1,
        "parent_elevation_sz": "elevated",
        "user_name": "1022H2X64-N74\\testadmin",
        "parent_integrity_sz": "high",
        "process_path": "c:\\putty9ebd95c0-5eb4-49b6-82ee-e7c7a879a373.exe",
        "datetime": 1715023630446,
        "mitre_ids": [],
        "os_version": "Windows 10",
        "parent_pid": 2932,
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Terminate

Identifies processes that end or are forcibly stopped.

Field name	Description
company_id	Indicates the company ID in GravityZone.
ctc_version	The version of CTC security signatures
datetime	The date and time in Unix epoch time format.
event_name	The event name.
event_version	The event version.
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint
machine_name	The host name of the endpoint.
os_family	The operating system family. Possible values: `windows`, `linux`, `macos`.
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
os_type	Indicates whether the operating system fulfills the role of a client or a server.
os_version	The operating system version. For example: `Windows 11`.
pid	The process identifier
product_version	BEST product version

[
    {
        "ctc_version": "2.13.4.3",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "terminate_process",
        "pid": 7912,
        "datetime": 1715023652647,
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

File

Create

Identifies new files created on the endpoint or on connected removable devices.

Field name	Description
company_id	Indicates the company ID in GravityZone.
ctc_version	The version of CTC security signatures
datetime	The date and time in Unix epoch time format
event_name	The event name.
event_version	The event version.
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint.
machine_name	The host name of the endpoint.
md5	The MD5 hash of the file
os_family	The operating system family. Possible values: `windows`, `linux`, `macos`.
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
os_type	Indicates whether the operating system fulfills the role of a client or a server.
os_version	The operating system version. For example: `Windows 11`.
path	The path
pid	The process identifier
process_sha	The SHA256 hash of the process that generated the file
process_md5	The MD5 hash of the process that generated the file
process_path	The process path
product_version	BEST product version
sha	The SHA256 hash of the file
source_path	When a file is copied to a new location, this field indicates the initial file path. Otherwise, the field is empty.
user_name	The user who started the process that generated the file.

[
    {
        "ctc_version": "2.13.4.3",
        "process_sha": "9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3",
        "source_path": "",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "file_create",
        "pid": 6572,
        "process_md5": "2e5a8590cf6848968fc23de3fa1e25f1",
        "user_name": "",
        "md5": "",
        "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
        "datetime": 1715023843379,
        "path": "c:\\create904acfb1-f484-4282-89a1-7ff5d93dd3ef.txt",
        "os_version": "Windows 10",
        "sha": "",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Delete

Identifies files deleted from local, remote, or removable storage accessible to the endpoint.

Field name	Description
company_id	Indicates the company ID in GravityZone.
ctc_version	The version of CTC security signatures
datetime	The date and time in Unix epoch time format
event_name	The event name.
event_version	The event version.
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint.
is_remote	Indicates whether the change made on a file happened via remote connection
machine_name	The host name of the endpoint.
os_family	The operating system family. Possible values: `windows`, `linux`, `macos`.
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
os_type	Indicates whether the operating system fulfills the role of a client or a server.
os_version	The operating system version. For example: `Windows 11`.
path	The path of the deleted file
pid	The process identifier
process_sha	The SHA256 hash of the process that deleted the file
process_md5	The MD5 hash of the process that deleted the file
process_path	The process path
product_version	BEST product version
user_name	The user who started the process that deleted the file

[
    {
        "ctc_version": "2.13.4.3",
        "process_sha": "9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "file_delete",
        "pid": 4872,
        "process_md5": "2e5a8590cf6848968fc23de3fa1e25f1",
        "user_name": "",
        "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
        "is_remote": 0,
        "datetime": 1715023867586,
        "path": "c:\\create904acfb1-f484-4282-89a1-7ff5d93dd3ef.txt",
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Modify

Identifies changes to file content or properties and helps investigate potential tampering.

Field name	Description
bytes_written	A buffer (up to 64K) of the first bytes written
company_id	Indicates the company ID in GravityZone.
ctc_version	The version of CTC security signatures
datetime	The date and time in Unix epoch time format
entropy	The file entropy value
event_name	The event name
event_version	The event version.
extra_keys	Keys for extra information to be displayed in the generated incident
extra_values	Values corresponding to the extra_keys field.
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint.
is_remote	Indicates whether the change made on a file happened via remote connection
machine_name	The host name of the endpoint.
md5	The MD5 hash of the file
os_family	The operating system family. Possible values: `windows`, `linux`, `macos`.
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
os_type	Indicates whether the operating system fulfills the role of a client or a server.
os_version	The operating system version. For example: `Windows 11`.
path	The file path.
pid	The process identifier
process_sha	The SHA256 hash of the process that generated the file
process_md5	The MD5 hash of the process that generated the file
process_path	The process path
product_version	BEST product version
sha	The SHA256 hash of the file
type	The ID associated with the file type. Possible values: `0`: correlates with `executable` file type `1`: correlates with `document` file type `2`: correlates with `archive` file type `3`: correlates with `script` file type `4`: correlates with `media` file type `5`: correlates with `possibleimportantformat` file type `999`: correlates with `unknown` file type
type_sz	The file type. Possible values: `executable` `document` `archive` `script` `media` `possibleimportantformat` `unknown` `possibleimportantformat` is an umbrella term. It keeps records of files that may be important for security investigation later on due to possible data exfiltration. The targeted file extensions are: `.3dm`, `.3ds`, `.3g2`, `.3gp`, `.7z`, `.aac`, `.accdb`, `.ai`, `.aif`, `.asd`, `.asf`, `.avi`, `.bmp`, `.bz2`, `.cbr`, `.cda`, `.csv`, `.db`, `.dbf`, `.dds`, `.doc`, `.docx`, `.dwg`, `.dxf`, `.email`, `.eml`, `.emlx`, `.eps`, `.fdb`, `.flac`, `.flv`, `.frm`, `.gif`, `.gpx`, `.gslides"`, `.gz`, `.h264`, `.heic`, `.ico`, `.iff`, `.jpg`, `.kexi`, `.key`, `.kml`, `.kmz`, `.log`, `.lz`, `.m3u`, `.m4a`, `.m4v`, `.max`, `.md`, `.mdb`, `.mde`, `.mdf`, `.mid`, `.midi`, `.mkv`, `.mov`, `.mp3`, `.mp4`, `.mpa`, `.mpeg`, `.mpg`, `.msg`, `.obj`, `.odp`, `.ods`, `.odt`, `.oft`, `.ogg`, `.opus`, `.ost`, `.pdb`, `.pdf`, `.pez`, `.png`, `.pot`, `.pps`, `.ppt`, `.pptx`, `.psd`, `.pspimage`, `.pst`, `.rar`, `.rm`, `.rtf`, `.sqlite`, `.srt`, `.svg`, `.swf`, `.tar`, `.tar.gz`, `.tar.xz`, `.tex`, `.tga`, `.thm`, `.tif`, `.tiff`, `.vcf`, `.vob`, `.wav`, `.wdb`, `.wma`, `.wmv`, `.wpd`, `.wps`, `.xlr`, `.xls`, `.xls`, `.xlsm`, `.xlsx`, `.xz`, `.yuv`, `.zip`, and `.zipx`.
user_name	The user who started the process that modified the file.

{
        "bytes_written": 0,
        "ctc_version": "2.13.4.3",
        "process_sha": "9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3",
        "extra_keys": [],
        "type_sz": "Unknown",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "entropy": 0,
        "event_name": "file_modify",
        "pid": 7580,
        "process_md5": "2e5a8590cf6848968fc23de3fa1e25f1",
        "user_name": "",
        "md5": "",
        "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
        "is_remote": 0,
        "datetime": 1715024067932,
        "path": "c:\\programdata\\modify2f808a64-a09d-49ff-885c-efd4cdc264bc.txt",
        "extra_values": [],
        "os_version": "Windows 10",
        "sha": "",
        "type": 999,
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }

Move

Identifies files that are moved or renamed on the endpoint.

Field name	Description
company_id	Indicates the company ID in GravityZone.
ctc_version	The version of CTC security signatures
datetime	The date and time in Unix epoch time format
event_name	The event name
event_version	The event version.
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint.
machine_name	The host name of the endpoint.
md5	The MD5 hash of the file
new_path	The new file path
os_family	The operating system family. Possible values: `windows`, `linux`, `macos`.
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
os_type	Indicates whether the operating system fulfills the role of a client or a server.
os_version	The operating system version. For example: `Windows 11`.
path	The initial file path
pid	The process identifier
process_sha	The SHA256 hash of the process that moved the file
process_md5	The MD5 hash of the process that moved the file
process_path	The process path
product_version	BEST product version
sha	The SHA256 hash of the file that was moved
user_name	The user who started the process that moved the file.

[
    {
        "ctc_version": "2.13.4.3",
        "process_sha": "9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "new_path": "c:\\movee9da5e14-0334-466e-b2e1-e6a801dba9fb.txt",
        "event_name": "file_move",
        "pid": 1724,
        "process_md5": "2e5a8590cf6848968fc23de3fa1e25f1",
        "user_name": "",
        "md5": "",
        "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
        "datetime": 1715024186114,
        "path": "c:\\windows\\movee9da5e14-0334-466e-b2e1-e6a801dba9fb.txt",
        "os_version": "Windows 10",
        "sha": "",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Read

Identifies access to file contents and helps investigate access to sensitive or suspicious files.

Field name	Description
bytes_read	The number of bytes read from file
company_id	Indicates the company ID in GravityZone.
ctc_version	The version of CTC security signatures
datetime	The date and time in Unix epoch time format
entropy	The file entropy value
event_name	The event name.
event_version	The event version.
extra_keys	Keys for extra information to be displayed in the generated incident
extra_values	Values corresponding to the extra_keys field.
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint.
is_remote	Indicates whether the file was read via remote connection
machine_name	The host name of the endpoint.
os_family	The operating system family. Possible values: `windows`, `linux`, `macos`.
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
os_type	Indicates whether the operating system fulfills the role of a client or a server.
os_version	The operating system version. For example: `Windows 11`.
path	The file path.
pid	The process identifier
process_md5	The MD5 hash of the process
process_path	The process path
process_sha	The SHA256 hash of the process
product_version	BEST product version
type	The ID associated with the file type. Possible values: `0`: correlates with `executable` file type `1`: correlates with `document` file type `2`: correlates with `archive` file type `3`: correlates with `script` file type `4`: correlates with `media` file type `5`: correlates with `possibleimportantformat` file type `999`: correlates with `unknown` file type
type_sz	The file type. Possible values: `executable` `document` `archive` `script` `media` `possibleimportantformat` `unknown` `possibleimportantformat` is an umbrella term. It keeps records of files that may be important for security investigation later on due to a possible data exfiltration. The targeted file extensions are: `.3dm`, `.3ds`, `.3g2`, `.3gp`, `.7z`, `.aac`, `.accdb`, `.ai`, `.aif`, `.asd`, `.asf`, `.avi`, `.bmp`, `.bz2`, `.cbr`, `.cda`, `.csv`, `.db`, `.dbf`, `.dds`, `.doc`, `.docx`, `.dwg`, `.dxf`, `.email`, `.eml`, `.emlx`, `.eps`, `.fdb`, `.flac`, `.flv`, `.frm`, `.gif`, `.gpx`, `.gslides"`, `.gz`, `.h264`, `.heic`, `.ico`, `.iff`, `.jpg`, `.kexi`, `.key`, `.kml`, `.kmz`, `.log`, `.lz`, `.m3u`, `.m4a`, `.m4v`, `.max`, `.md`, `.mdb`, `.mde`, `.mdf`, `.mid`, `.midi`, `.mkv`, `.mov`, `.mp3`, `.mp4`, `.mpa`, `.mpeg`, `.mpg`, `.msg`, `.obj`, `.odp`, `.ods`, `.odt`, `.oft`, `.ogg`, `.opus`, `.ost`, `.pdb`, `.pdf`, `.pez`, `.png`, `.pot`, `.pps`, `.ppt`, `.pptx`, `.psd`, `.pspimage`, `.pst`, `.rar`, `.rm`, `.rtf`, `.sqlite`, `.srt`, `.svg`, `.swf`, `.tar`, `.tar.gz`, `.tar.xz`, `.tex`, `.tga`, `.thm`, `.tif`, `.tiff`, `.vcf`, `.vob`, `.wav`, `.wdb`, `.wma`, `.wmv`, `.wpd`, `.wps`, `.xlr`, `.xls`, `.xls`, `.xlsm`, `.xlsx`, `.xz`, `.yuv`, `.zip`, and `.zipx`.
user_name	The user who started the process that read from file

[
    {
        "ctc_version": "2.13.4.3",
        "process_sha": "9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3",
        "extra_keys": [],
        "type_sz": "Unknown",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "entropy": 0,
        "event_name": "file_read",
        "pid": 8756,
        "process_md5": "2e5a8590cf6848968fc23de3fa1e25f1",
        "user_name": "",
        "process_path": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
        "is_remote": 0,
        "datetime": 1715024308353,
        "path": "c:\\programdata\\readfileaf8f7981-30ed-4661-8ced-a34ad484c872.txt",
        "bytes_read": 4096,
        "extra_values": [],
        "os_version": "Windows 10",
        "type": 999,
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Registry

The events in this category are available only for the Windows operating system.

Create key

Identifies newly created registry keys.

Field name	Description
company_id	Indicates the company ID in GravityZone.
ctc_version	The version of CTC security signatures.
datetime	The date and time in Unix epoch time format.
event_name	The event name.
event_version	The event version.
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint.
key_path	The path to the registry key.
machine_name	The host name of the endpoint.
operation	The type of operation performed on the registry key. Possible values: `create` `write` `delete`
os_family	The operating system family. Possible values: `windows`
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
os_type	Indicates whether the operating system fulfills the role of a client or a server.
os_version	The operating system version. For example: `Windows 11`.
pid	The process identifier.
product_version	BEST product version.
user_name	The user who started the process that created the registry key.

[
    {
        "ctc_version": "2.13.4.3",
        "key_path": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\test_keyaecf3fbc-038b-4cf6-a819-fffbf0080c54",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "reg_create_key",
        "pid": 9476,
        "user_name": "",
        "operation": "create",
        "datetime": 1715024773966,
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Delete key

Identifies removed registry keys.

Field name	Description
company_id	Indicates the company ID in GravityZone.
datetime	The date and time in Unix epoch time format
event_name	The event name
event_version	The event version.
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint.
key_path	The path to the registry key
machine_name	The host name of the endpoint.
operation	The type of operation performed on the registry key. Possible values: `create` `write` `delete`
os_family	The operating system family. Possible values: `windows`.
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
os_type	Indicates whether the operating system fulfills the role of a client or a server.
os_version	The operating system version. For example: `Windows 11`.
pid	The process identifier
product_version	BEST product version
user_name	The user who started the process that deleted the registry key.

[
    {
        "ctc_version": "2.13.4.3",
        "key_path": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\test_keyaecf3fbc-038b-4cf6-a819-fffbf0080c54",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "reg_delete_key",
        "pid": 3456,
        "user_name": "",
        "operation": "delete",
        "datetime": 1715024776201,
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Delete value

Identifies registry values removed from existing keys.

Field name	Description
company_id	Indicates the company ID in GravityZone.
ctc_version	The version of CTC security signatures
datetime	The date and time in Unix epoch time format
event_name	The event name.
event_version	The event version.
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint.
key_path	The path to the registry key
machine_name	The host name
operation	The type of operation performed on the registry key. Possible values: `create` `write` `delete`
os_family	The operating system family. Possible values: `windows`.
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
os_type	Indicates whether the operating system fulfills the role of a client or a server.
os_version	The operating system version. For example: `Windows 11`.
pid	The process identifier
product_version	BEST product version
user_name	The user who started the process that deleted the registry value.
value	The registry value

[
    {
        "ctc_version": "2.13.4.3",
        "key_path": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\test_key_c0fcd233-788d-4449-983f-e6e1de1026ce",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "reg_delete_value",
        "pid": 9996,
        "value": "4ce93d69-8da7-48de-b967-3bc4011302aa",
        "user_name": "",
        "operation": "delete",
        "datetime": 1715024962726,
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Modify value

Identifies changes to registry values.

Field name	Description
company_id	Indicates the company ID in GravityZone.
ctc_version	The version of CTC security signatures
data	The data that was written into the value
data_type	The ID associated with the registry data type. Possible values: `0`: correlates with `none` data type `1`: correlates with `string` data type `2`: correlates with `expandablestring` data type `3`: correlates with `binary` data type `4`: correlates with `dword` data type `5`: correlates with `dwordbigendian` data type `6`: correlates with `link` data type `7`: correlates with `multistring` data type `8`: correlates with `resourcelist` data type `9`: correlates with `resourcedescriptor` data type `10`: correlates with `resourcerequirements` data type `11`: correlates with `qword` data type
data_type_sz	The data format for the registry value. Possible values: `none` `string` `expandablestring` `binary` `dword` `dwordbigendian` `link` `multistring` `resourcelist` `resourcedescriptor` `resourcerequirements` `qword` To learn more about these data formats, refer to Registry value types.
datetime	The date and time in Unix epoch time format
event_name	The event name.
event_version	The event version.
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint.
key_path	The path to the registry key
machine_name	The host name of the endpoint.
operation	The type of operation performed on the registry key. Possible values: `create` `write` `delete`
os_family	The operating system family. Possible values: `windows`.
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
os_type	Indicates whether the operating system fulfills the role of a client or a server.
os_version	The operating system version. For example: `Windows 11`.
pid	The process identifier
product_version	BEST product version
user_name	The user who started the process that modified the registry value.
value	The registry value

[
    {
        "ctc_version": "2.13.4.3",
        "key_path": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\test_key_c0fcd233-788d-4449-983f-e6e1de1026ce",
        "data_type_sz": "dword",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "reg_modify_value",
        "pid": 2320,
        "value": "4ce93d69-8da7-48de-b967-3bc4011302aa",
        "user_name": "",
        "operation": "create",
        "data": "1",
        "datetime": 1715024938841,
        "data_type": 4,
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }
]

Network

Connection

Identifies network connections on the endpoint and helps investigate external or internal communications.

Connection events require the Network Attack Defense module to be installed on the target endpoints and enabled in the applied policy.

Field name	Description
bytes_sent	The number of bytes sent by the source endpoint
bytes_received	The number of bytes received by the destination endpoint
company_id	Indicates the company ID in GravityZone.
ctc_version	The version of CTC security signatures
datetime	The date and time in Unix epoch time format
direction	Indicates where the network connection originated, whether it was `inbound` or `outbound`.
event_name	The event name.
event_version	The event version.
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint.
ip_dest	The destination IP address
ip_source	The source IP address
machine_name	The host name of the endpoint.
operation	Indicates the type of network operation performed. For example: `connect`, `disconnect`.
os_family	The operating system family. Possible values: `windows`, `linux`, `macos`.
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
os_type	Indicates whether the operating system fulfills the role of a client or a server.
os_version	The operating system version. For example: `Windows 11`.
pid	The process identifier
port_dest	The destination port
port_source	The source port
process_path	The process path
product_version	BEST product version

 {
        "port_source": 54788,
        "port_dest": 8089,
        "bytes_sent": 0,
        "ctc_version": "2.13.4.3",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "ip_dest": "10.17.130.193",
        "event_name": "network_connection",
        "pid": 2932,
        "direction": "outbound",
        "operation": "disconnect",
        "bytes_received": 0,
        "process_path": "c:\\python36\\pythonw.exe",
        "datetime": 1715023721139,
        "ip_source": "10.25.102.114",
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }

DNS query

Identifies domain name resolution requests.

DNS query events require the Network Attack Defense module to be installed on the target endpoints and enabled in the applied policy. Enabling DNS query events can generate a significant volume of logs and may increase associated SIEM costs.

Field name	Description
event_name	The event name
event_version	The event version
datetime	The date and time in Unix epoch time format
ctc_version	The version of CTC security signatures
product_version	BEST product version
process_name	Name of the process that initiated the DNS query
process_path	The path of the process that initiated the DNS query.
response_code	DNS response status code returned by the resolver, indicating the outcome of the query.
response_count	The number of resource records returned in the DNS response for the queried domain. Represents the count of answer records included in the response.
transport_protocol	The transport-layer protocol used to send the DNS query
pid	The identifier of the process that initiated the DNS query on the endpoint.
pid_timestamp	The process creation time.
ip_source	The source IP address
query_type	DNS record type requested in the query. For example: `AAAA`, `MX`, `CNAME`
domain	Fully Qualified Domain Name (FQDN) requested in the DNS query
resolver_ip	The IP address of the DNS server (resolver) to which the query was sent.
resolver_port	Destination port on the DNS resolver used to transmit the query
os_type	Indicates whether the operating system fulfills the role of a client or a server.
direction	Indicates where the network connection originated, whether it was `inbound` or `outbound`.
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
mac_source	MAC address of the network interface on the endpoint that initiated the DNS query.
mac_dest	MAC address of the network device at the destination
os_family	The operating system family. Possible values: `windows`, `macos`.
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint.
company_id	Indicates the company ID in GravityZone.
os_version	The operating system version. For example: `Windows 11`.
machine_name	The host name of the endpoint.
mitre_ids	This field contains the following information related to Mitre attack and techniques: `name` - The Mitre technique name, as documented on the official website. For example: `Command and Scripting Interpreter`. `id` - The Mitre Technique ID, as documented on the official website. For example: `T1074`. `subtechniques` - This field contains the following information related to Mitre subtechniques: `name` - The Mitre subtechnique name `id` - The Mitre subtechnique ID. For example: `T1595.002`. `categories` - This field contains the following information: `categories` - The Mitre category, the Mitre mapping of kill chain phases
resulted_ip_list	List of IP addresses returned in the DNS response for the queried domain. May include multiple IPv4 and/or IPv6 addresses.
response_data	Raw or parsed DNS response data associated with the query. May include returned records (`AAAA`, `TXT`, `CNAME`, etc.), TTL values, response codes, or additional resource records.

{
		"port_source": 51186,
		"ctc_version": "2.25.2.2",
		"pid_timestamp": 1762773234392,
		"query_type": "AAAA",
		"extra_keys": [],
		"machine_name": "2K19-M64",
		"ring": "slow",
		"event_version": 1,
		"resulted_ip_list": [],
		"response_count": 0,
		"event_name": "dns_query",
		"pid": 1596,
		"mac_source": "00:50:56:8e:2e:7b",
		"direction": "outbound",
		"response_data": [],
		"resolver_port": 53,
		"resolver_ip": "172.23.22.13",
		"datetime": 1762776513635,
		"extra_values": [],
		"domain": "server-01.prod.example.com",
		"mitre_ids": [
			{
				"name": "Command and Scripting Interpreter",
				"id": "T1059",
				"categories": [
					"Execution"
				]
			},
			{
				"name": "Application Layer Protocol",
				"id": "T1071",
				"subtechniques": [
					{
						"name": "DNS",
						"id": "T1071.004"
					}
				],
				"categories": [
					"Command and Control"
				]
			},
			{
				"name": "System Services",
				"id": "T1569",
				"subtechniques": [
					{
						"name": "Service Execution",
						"id": "T1569.002"
					}
				],
				"categories": [
					"Execution"
				]
			},
			{
				"name": "Non-Standard Port",
				"id": "T1571",
				"categories": [
					"Command and Control"
				]
			}
		],
		"ip_source": "10.25.100.178",
		"transport_protocol": "dns",
		"os_version": "Windows Server 2019",
		"response_code": 0,
		"process_name": "svchost.exe",
		"company_id": "5b9bc2701da197f07a8b4567",
		"hardware_id": "138F0E42-F7C0-1721-E545-4DE8DDCCB47E-0050568E2E7B",
		"os_family": "windows",
		"os_platform": "x64",
		"os_type": "server",
		"product_version": "0.3.201.673"
	}

Account management and authentication

Logon

Logs successful user authentication and records when an account accesses an endpoint. To receive the event, you must first enable the Audit Logon policy on the endpoint.

Field name	Description
company_id	Indicates the company ID in GravityZone.
ctc_version	The version of CTC security signatures
datetime	The date and time in Unix epoch time format
event_name	The event name.
event_version	The event version.
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint.
ip_source	The source IP address
logon_type	The ID associated with the logon type. Possible values: `0`: correlates with `system` logon type `2`: correlates with `interactive` logon type `3`: correlates with `network` logon type `4`: correlates with `batch` logon type `5`: correlates with `service` logon type `7`: correlates with `unlock` logon type `8`: correlates with `networkcleartext` logon type `9`: correlates with `newcredentials` logon type `10`: correlates with `remoteinteractive` logon type `11`: correlates with `cachedinteractive` logon type `12`: correlates with `cachedremoteinteractive` logon type `13`: correlates with `cachedunlock` logon type `255`: correlates with `invalid` logon type
logon_type_sz	The type of login. Possible values: `system` `interactive` `network` `batch` `service` `unlock` `networkcleartext` `newcredentials` `remoteinteractive` `cachedinteractive` `cachedremoteinteractive` `cachedunlock` `invalid` To learn more about these logon types, refer to Logon types and descriptions.
machine_name	The host name of the endpoint.
os_family	The type of operating system. Possible values: `windows`, `linux`, `macos`.
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
os_type	Indicates whether the operating system fulfills the role of a client or a server.
os_version	The operating system version. For example: `Windows 11`.
product_version	BEST product version.
user_name	The user who performed the login.

{
        "ctc_version": "2.13.4.3",
        "logon_type_sz": "interactive",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "log_on",
        "user_name": "6e925f53-8d3c-4716-b",
        "logon_type": 2,
        "datetime": 1715025164820,
        "ip_source": "::1",
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }

Logout

Identifies when user sessions end. To receive the event, you must first enable the Audit Logoff policy on the endpoint. Follow the steps shown here and at step 3, open the Audit Logoff policy instead.

Field name	Description
company_id	Indicates the company ID in GravityZone.
ctc_version	The version of CTC security signatures
datetime	The date and time in Unix epoch time format
event_name	The event name.
event_version	Event version
hardware_id	An ID, generated by BEST, that uniquely identifies an endpoint.
machine_name	The host name of the endpoint.
os_family	The operating system family. Possible values: `windows`, `linux`, `macos`.
os_platform	The operating system architecture. Possible values: `x86`, `x64`, `arm64`.
os_type	Indicates whether the operating system fulfills the role of a client or a server.
os_version	The operating system version. For example: `Windows 11`.
product_version	BEST product version
user_name	The user who logged off

 {
        "ctc_version": "2.13.4.3",
        "machine_name": "1022H2X64-N74",
        "event_version": 1,
        "event_name": "log_out",
        "user_name": "6e925f53-8d3c-4716-b",
        "datetime": 1715025164820,
        "os_version": "Windows 10",
        "company_id": "5b9bc2701da197f07a8b4567",
        "hardware_id": "4D8E0E42-22F0-2D94-6823-C3863931877A-0050568E1657",
        "os_family": "windows",
        "os_platform": "x64",
        "os_type": "client",
        "product_version": "7.9.11.406"
    }

In this section:

Security Telemetry events sent to SIEM

Process

Create

Terminate

File

Create

Delete

Modify

Move

Read

Registry

Create key

Delete key

Delete value

Modify value

Network

Connection

DNS query

Account management and authentication

Logon

Logout

Search results