ProcessInspectionEvent

ProcessInspectionEvent
Process Inspection Event

Details of a particular process inspection event.

JSON Example 
{
    "event_type": "string",
    "inspection_time": 0,
    "buffer": "string",
    "buffer_category": "string",
    "analyst_task_uuid": "string",
    "inspection_status": "string",
    "threat_score": 0,
    "verdict": "string",
    "error_message": "string",
    "error_code": "string",
    "rule_id": "string",
    "os_type": "Windows 10.0.16299 Service Pack 0.0 Product Type 1"
}
string
event_type
Optional

Type of process inspection event.

EpochMsTimestamp
inspection_time
Optional

Timestamp in milliseconds since epoch.

string
buffer
Optional

First 4K bytes of the buffer inspected.

string
buffer_category
Optional

Category of the buffer inspected.

Enumeration: VBSCRIPT, POWERSHELL, JSCRIPT, BUFFER_CATEGORY_INVALID
string
analyst_task_uuid
Optional

Task UUID assigned by Lastline Analyst service.

InspectionStatus
inspection_status
Optional

Denotes the current analysis status of the inspection event.

Enumeration: IN_PROGRESS, COMPLETED, ERROR
integer
threat_score
Optional

Threat score assigned to this inspection event. Threat score in the range of 0 to 100 for known verdict. A score of 100 is considered high potential threat. Any score outside the range of 0 to 100 will mean that verdict is UNKNOWN.

Verdict
verdict
Optional

This property describes the behavior of the file at runtime. Following is the meaning of each verdict:

  • BENIGN: File with no malicious code.
  • TRUSTED: Behavioural analysis or prevalence indicates a trusted file.
  • HIGHLY_TRUSTED: File from a highly trusted source. For example, Microsoft published the file.
  • SUSPICIOUS: File contains suspicious code and on execution can turn out to be a malware.
  • MALICIOUS: File is a malicious file containing malware or bad code that can harm the system.
  • UNKNOWN: File behavior is UNKNOWN at this point in time or there is some error in the analysis pipeline and verdict could not be concluded.
  • UNINSPECTED: File is marked as excluded and hence was not inspected by the analysis pipeline.
Enumeration: BENIGN, TRUSTED, HIGHLY_TRUSTED, SUSPICIOUS, MALICIOUS, UNKNOWN, UNINSPECTED
string
error_message
Optional

Error message corresponding to this inspection event. This field will be populated only when there is some error in the inspection.

string
error_code
Optional

Error code corresponding to this inspection event. This field will be populated only when there is some error in the inspection.

string
rule_id
Optional

ID of the NSX policy rule due to which this process is detected.

string
os_type
Optional

Type of the operating system. If available, build number and service pack information will be present.