FileInspectionEvent

FileInspectionEvent
FileInspectionEvent

File Inspection Event.

JSON Example
{
    "inspection_time": 0,
    "server": {
        "vm_id": "string",
        "ip_address": "string",
        "fqdn": "string"
    },
    "client": {
        "vm_id": "string",
        "ip_address": "string",
        "fqdn": "string"
    },
    "sha256": "string",
    "sha1": "string",
    "md5": "string",
    "file_name": "string",
    "inspection_status": "string",
    "threat_score": 0,
    "verdict": "string",
    "error_message": "string",
    "error_code": "string",
    "is_blocked": false,
    "allow_listed": false,
    "transport_node_type": "string",
    "transport_node_id": "string"
}
inspection_time
Optional

Timestamp in milliseconds since epoch

server
Optional

Details about virtual machine.

client
Optional

Details about virtual machine.

string
sha256
Optional

SHA256 hash of the file.

string
sha1
Optional

SHA1 hash of the file.

string
md5
Optional

MD5 hash of the file.

string
file_name
Optional

Name of the file as observed in this instance of inspection.

inspection_status
Optional

Status of the inspection event.

Possible values are : IN_PROGRESS, COMPLETED, ERROR,
integer
threat_score
Optional

Threat score assigned to this inspection event. Threat score in the range of 0 to 100 for known verdict. A score of 100 is considered high potential threat. Score -1 indicates the verdict is UNINSPECTED because file is allowlisted. Any score outside the range of -1 to 100 will mean that verdict is UNKNOWN.

verdict
Optional

This property describes the behavior of the file at runtime. Meanings are described below BENIGN: This is a benign file with no malicious code TRUSTED: This is a TRUSTED file based on the behaviour of the file HIGHLY_TRUSTED: This is a file from a highly trusted source like for e.g microsft published the file SUSPICIOUS: This file contains suspicious code and on execution can turn out to be malware MALICIOUS: This file is a malicious file containing malware or bad code that can harm the system UNKNOWN: This file is not known and hence its behavior is UNKNOWN at this point in time. UNINSPECTED: This file is marked as allowlisted and hence the verdict is UNINSPECTED.

Possible values are : BENIGN, TRUSTED, HIGHLY_TRUSTED, SUSPICIOUS, MALICIOUS, UNKNOWN, UNINSPECTED,
string
error_message
Optional

Error message corresponding to this inspection event. This field will be populated only when there is some error in the inspection.

string
error_code
Optional

Error code corresponding to this inspection event. This field will be populated only when there is some error in the inspection.

boolean
is_blocked
Optional

This field conveys if the file is blocked by malware prevention service.

boolean
allow_listed
Optional

Specifies whether this file is present in allow list. If true, the file is present in the allow-list.

transport_node_type
Optional

Type of transport node by which file is downloaded.

Possible values are : HOST, GATEWAY, INVALID,
string
transport_node_id
Optional

ID of the transport node on which this file is detected. Transport nodes are hypervisor hosts or NSX Edges that participated in the NSX-T topology.