Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About rsreese
rsreese
Explorer
Member since:
01-16-2012
01-20-2024
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 1 |
| Member Since | 01-16-2012 |
Activity Feed
- Got Karma for XML Field extraction from Syslog messages. 02-24-2025 10:48 AM
- Karma Re: Display different single value icon based on result for gcusello. 01-20-2024 07:24 AM
- Posted Re: Display different single value icon based on result on Dashboards & Visualizations. 01-19-2024 12:57 PM
- Posted Re: Add icons to xml dashboard and change the icon based on the count on Security. 01-18-2024 06:59 PM
- Posted Display different single value icon based on result on Dashboards & Visualizations. 01-18-2024 01:45 PM
- Karma Re: XML Field extraction from Syslog messages for cpetterborg. 06-05-2020 12:49 AM
- Karma Re: XML Field extraction from Syslog messages for cpetterborg. 06-05-2020 12:49 AM
- Karma Re: How can I correctly parse time from the XML field? for richgalloway. 06-05-2020 12:49 AM
- Posted How can I correctly parse time from the XML field? on Splunk Search. 08-18-2017 08:40 AM
- Tagged How can I correctly parse time from the XML field? on Splunk Search. 08-18-2017 08:40 AM
- Tagged How can I correctly parse time from the XML field? on Splunk Search. 08-18-2017 08:40 AM
- Tagged How can I correctly parse time from the XML field? on Splunk Search. 08-18-2017 08:40 AM
- Tagged How can I correctly parse time from the XML field? on Splunk Search. 08-18-2017 08:40 AM
- Posted Re: XML Field extraction from Syslog messages on Splunk Search. 08-18-2017 08:23 AM
- Posted Re: XML Field extraction from Syslog messages on Splunk Search. 08-18-2017 08:22 AM
- Posted Re: XML Field extraction from Syslog messages on Splunk Search. 08-07-2017 10:39 AM
- Posted Re: XML Field extraction from Syslog messages on Splunk Search. 08-06-2017 01:25 PM
- Posted Re: XML Field extraction from Syslog messages on Splunk Search. 08-06-2017 10:41 AM
- Posted Re: XML Field extraction from Syslog messages on Splunk Search. 08-06-2017 06:47 AM
- Posted Re: XML Field extraction from Syslog messages on Splunk Search. 08-06-2017 06:27 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 |
01-19-2024
12:57 PM
Those CSS examples would work quite well but are they supported in Dashboard Studio or only Classic Dashboards? In Dashboard Studio, it's not clear how you can use a different icons for different values in a single field.
... View more
01-18-2024
06:59 PM
This answer does not seem to work on a Splunk 9.x Classic Dashboard. Receiving the error below when attempting to save the answer code in an example dashboard: Error parsing XML on line 37: Extra content at the end of the document
... View more
01-18-2024
01:45 PM
While it's possible to change the color of a single value icon based on a result, is it possible display an entirely different icon for different results or ranges? Not readily seeing an option in the Dashboard Studio. https://docs.splunk.com/Documentation/Splunk/9.0.2/DashStudio/chartsSV#Single_value_icon
... View more
Labels
- Labels:
-
Dashboard Studio
08-18-2017
08:40 AM
I am attempting to extract Time using TIME_FORMAT and TIME_PREFIX in props.conf. Would like to understand how to correctly parse the Time from the GMTTime XML field. The original message is read from a file and sent using a universal forwarder. The inputs.conf on the universal forwarder looks like this:
[monitor:///opt/xml/events.txt]
disabled = false
sourcetype = epo
host = lab-epo
The original message looks like this:
<29>1 2017-08-18T02:50:19.0Z LAB-EPO EPOEvents - EventFwd [agentInfo@3401 tenantId="1"] <?xml version="1.0" encoding="UTF-8"?><EPOevent><MachineInfo><MachineName>LAB-WIN7-02</MachineName><AgentGUID>{b37ff914-XXXX-XXXX-8740-91aa851f0e3d}</AgentGUID><IPAddress>192.XXX.XXX.XXX</IPAddress><OSName>Windows 7</OSName><UserName>SYSTEM</UserName><TimeZoneBias>240</TimeZoneBias><RawMACAddress>XXXXXXXX</RawMACAddress></MachineInfo><SoftwareInfo ProductName="McAfee Endpoint Security" ProductVersion="10.5.0" ProductFamily="TVD"><CommonFields><Analyzer>ENDP_AM_1050</Analyzer><AnalyzerName>McAfee Endpoint Security</AnalyzerName><AnalyzerVersion>10.5.0</AnalyzerVersion><AnalyzerHostName>LAB-WIN7-02</AnalyzerHostName><AnalyzerEngineVersion>XXXX.7806</AnalyzerEngineVersion><AnalyzerDetectionMethod>On-Access Scan</AnalyzerDetectionMethod><AnalyzerDATVersion>3075.0</AnalyzerDATVersion></CommonFields><Event><EventID>1278</EventID><Severity>3</Severity><GMTTime>2017-08-18T14:48:53</GMTTime><CommonFields><ThreatCategory>av.detect</ThreatCategory><ThreatEventID>1278</ThreatEventID><ThreatSeverity>2</ThreatSeverity><ThreatName>EICAR test file</ThreatName><ThreatType>test</ThreatType><DetectedUTC>2017-08-18T14:48:53Z</DetectedUTC><ThreatActionTaken>IDS_ALERT_ACT_TAK_DEL</ThreatActionTaken><ThreatHandled>True</ThreatHandled><SourceHostName>LAB-WIN7-02</SourceHostName><SourceProcessName>C:\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\CHROME.EXE</SourceProcessName><TargetHostName>LAB-WIN7-02</TargetHostName><TargetUserName>LAB-WIN7-02\xadmin</TargetUserName><TargetFileName>C:\USERS\XADMIN\DOWNLOADS\Unconfirmed 408214.crdownload</TargetFileName></CommonFields><CustomFields target="EPExtendedEventMT"><BladeName>IDS_BLADE_NAME_SPB</BladeName><AnalyzerContentCreationDate>2017-08-16T13:00:00Z</AnalyzerContentCreationDate><AnalyzerGTIQuery>False</AnalyzerGTIQuery><ThreatDetectedOnCreation>False</ThreatDetectedOnCreation><TargetName>Unconfirmed 408214.crdownload</TargetName><TargetPath>C:\USERS\XADMIN\DOWNLOADS</TargetPath><TargetHash>44d88612fea8a8f36de82e1278abb02f</TargetHash><TargetFileSize>68</TargetFileSize><TargetModifyTime>2017-08-18T14:48:53Z</TargetModifyTime><TargetAccessTime>2017-08-18T14:48:53Z</TargetAccessTime><TargetCreateTime>2017-08-18T14:48:53Z</TargetCreateTime><Cleanable>False</Cleanable><TaskName>IDS_OAS_TASK_NAME</TaskName><FirstAttemptedAction>IDS_ALERT_THACT_ATT_CLE</FirstAttemptedAction><FirstActionStatus>False</FirstActionStatus><SecondAttemptedAction>IDS_ALERT_THACT_ATT_DEL</SecondAttemptedAction><SecondActionStatus>True</SecondActionStatus><AttackVectorType>4</AttackVectorType><DurationBeforeDetection>0</DurationBeforeDetection><NaturalLangDescription>IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=Unconfirmed 408214.crdownload|TargetPath=C:\USERS\XADMIN\DOWNLOADS|ThreatName=EICAR test file|SourceProcessName=C:\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\CHROME.EXE|ThreatType=test|TargetUserName=LAB-WIN7-02\xadmin</NaturalLangDescription><AccessRequested></AccessRequested><DetectionMessage>IDS_OAS_DEFAULT_THREAT_MESSAGE</DetectionMessage><AMCoreContentVersion>3075.0</AMCoreContentVersion></CustomFields></Event></SoftwareInfo></EPOevent>
The props.conf on the receiving indexer looks like this:
[epo]
SEDCMD-replace = s/\<29\>[^\>]*\>\n*//g
KV_MODE = xml
TIME_PREFIX = \<EPOevent.SoftwareInfo.Event.GMTTime\>
TIME_FORMAT = %Y-%m-%dT%H:%M:%S
I have also tried:
[epo]
SEDCMD-replace = s/\<29\>[^\>]*\>\n*//g
KV_MODE = xml
TIME_PREFIX = \<GMTTime\>
TIME_FORMAT = %Y-%m-%dT%H:%M:%S
Via search, the event looks like the following after SEC_CMD as parse the message:
<EPOevent><MachineInfo><MachineName>LAB-WIN7-02</MachineName><AgentGUID>{b37ff914-XXXX-xxxx-XXXX-91aa851fXXXX}</AgentGUID><IPAddress>192.xXX.xxx.102</IPAddress><OSName>Windows 7</OSName><UserName>SYSTEM</UserName><TimeZoneBias>240</TimeZoneBias><RawMACAddress>000c29xxxxxx</RawMACAddress></MachineInfo><SoftwareInfo ProductName="McAfee Endpoint Security" ProductVersion="10.5.0" ProductFamily="TVD"><CommonFields><Analyzer>ENDP_AM_1050</Analyzer><AnalyzerName>McAfee Endpoint Security</AnalyzerName><AnalyzerVersion>10.5.0</AnalyzerVersion><AnalyzerHostName>LAB-WIN7-02</AnalyzerHostName><AnalyzerEngineVersion>5900.7806</AnalyzerEngineVersion><AnalyzerDetectionMethod>On-Access Scan</AnalyzerDetectionMethod><AnalyzerDATVersion>3075.0</AnalyzerDATVersion></CommonFields><Event><EventID>1278</EventID><Severity>3</Severity><GMTTime>2017-08-18T14:48:53</GMTTime><CommonFields><ThreatCategory>av.detect</ThreatCategory><ThreatEventID>1278</ThreatEventID><ThreatSeverity>2</ThreatSeverity><ThreatName>EICAR test file</ThreatName><ThreatType>test</ThreatType><DetectedUTC>2017-08-18T14:48:53Z</DetectedUTC><ThreatActionTaken>IDS_ALERT_ACT_TAK_DEL</ThreatActionTaken><ThreatHandled>True</ThreatHandled><SourceHostName>LAB-WIN7-02</SourceHostName><SourceProcessName>C:\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\CHROME.EXE</SourceProcessName><TargetHostName>LAB-WIN7-02</TargetHostName><TargetUserName>LAB-WIN7-02\xadmin</TargetUserName><TargetFileName>C:\USERS\XADMIN\DOWNLOADS\Unconfirmed 408214.crdownload</TargetFileName></CommonFields><CustomFields target="EPExtendedEventMT"><BladeName>IDS_BLADE_NAME_SPB</BladeName><AnalyzerContentCreationDate>2017-08-16T13:00:00Z</AnalyzerContentCreationDate><AnalyzerGTIQuery>False</AnalyzerGTIQuery><ThreatDetectedOnCreation>False</ThreatDetectedOnCreation><TargetName>Unconfirmed 408214.crdownload</TargetName><TargetPath>C:\USERS\XADMIN\DOWNLOADS</TargetPath><TargetHash>44d88612fea8a8f36de82e1278abb02f</TargetHash><TargetFileSize>68</TargetFileSize><TargetModifyTime>2017-08-18T14:48:53Z</TargetModifyTime><TargetAccessTime>2017-08-18T14:48:53Z</TargetAccessTime><TargetCreateTime>2017-08-18T14:48:53Z</TargetCreateTime><Cleanable>False</Cleanable><TaskName>IDS_OAS_TASK_NAME</TaskName><FirstAttemptedAction>IDS_ALERT_THACT_ATT_CLE</FirstAttemptedAction><FirstActionStatus>False</FirstActionStatus><SecondAttemptedAction>IDS_ALERT_THACT_ATT_DEL</SecondAttemptedAction><SecondActionStatus>True</SecondActionStatus><AttackVectorType>4</AttackVectorType><DurationBeforeDetection>0</DurationBeforeDetection><NaturalLangDescription>IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=Unconfirmed 408214.crdownload|TargetPath=C:\USERS\XADMIN\DOWNLOADS|ThreatName=EICAR test file|SourceProcessName=C:\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\CHROME.EXE|ThreatType=test|TargetUserName=LAB-WIN7-02\xadmin</NaturalLangDescription><AccessRequested></AccessRequested><DetectionMessage>IDS_OAS_DEFAULT_THREAT_MESSAGE</DetectionMessage>
<AMCoreContentVersion>3075.0</AMCoreContentVersion></CustomFields></Event></SoftwareInfo></EPOevent>
The indexer is still applying a timestamp of when it receives the message verse using GMTTime. Here is a formatted view of what splunk sees, e.g. the nested XML:
EPOevent.MachineInfo.AgentGUID
{b37ff914-83f4-4b48-8740-XXXXXXXXXX}
EPOevent.MachineInfo.IPAddress
192.xxx.xxx.XXX
EPOevent.MachineInfo.MachineName
LAB-WIN7-02
EPOevent.MachineInfo.OSName
Windows 7
EPOevent.MachineInfo.RawMACAddress
000c29fXXXXX
EPOevent.MachineInfo.TimeZoneBias
240
EPOevent.MachineInfo.UserName
SYSTEM
EPOevent.SoftwareInfo.CommonFields.Analyzer
ENDP_AM_1050
EPOevent.SoftwareInfo.CommonFields.AnalyzerDATVersion
3075.0
EPOevent.SoftwareInfo.CommonFields.AnalyzerDetectionMethod
On-Access Scan
EPOevent.SoftwareInfo.CommonFields.AnalyzerEngineVersion
5900.7806
EPOevent.SoftwareInfo.CommonFields.AnalyzerHostName
LAB-WIN7-02
EPOevent.SoftwareInfo.CommonFields.AnalyzerName
McAfee Endpoint Security
EPOevent.SoftwareInfo.CommonFields.AnalyzerVersion
10.5.0
EPOevent.SoftwareInfo.Event.CommonFields.DetectedUTC
2017-08-18T14:48:53Z
EPOevent.SoftwareInfo.Event.CommonFields.SourceHostName
LAB-WIN7-02
EPOevent.SoftwareInfo.Event.CommonFields.SourceProcessName
C:\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\CHROME.EXE
EPOevent.SoftwareInfo.Event.CommonFields.TargetFileName
C:\USERS\XADMIN\DOWNLOADS\Unconfirmed 408214.crdownload
EPOevent.SoftwareInfo.Event.CommonFields.TargetHostName
LAB-WIN7-02
EPOevent.SoftwareInfo.Event.CommonFields.TargetUserName
LAB-WIN7-02\xadmin
EPOevent.SoftwareInfo.Event.CommonFields.ThreatActionTaken
IDS_ALERT_ACT_TAK_DEL
EPOevent.SoftwareInfo.Event.CommonFields.ThreatCategory
av.detect
EPOevent.SoftwareInfo.Event.CommonFields.ThreatEventID
1278
EPOevent.SoftwareInfo.Event.CommonFields.ThreatHandled
True
EPOevent.SoftwareInfo.Event.CommonFields.ThreatName
EICAR test file
EPOevent.SoftwareInfo.Event.CommonFields.ThreatSeverity
2
EPOevent.SoftwareInfo.Event.CommonFields.ThreatType
test
EPOevent.SoftwareInfo.Event.CustomFields.AMCoreContentVersion
3075.0
EPOevent.SoftwareInfo.Event.CustomFields.AnalyzerContentCreationDate
2017-08-16T13:00:00Z
EPOevent.SoftwareInfo.Event.CustomFields.AnalyzerGTIQuery
False
EPOevent.SoftwareInfo.Event.CustomFields.AttackVectorType
4
EPOevent.SoftwareInfo.Event.CustomFields.BladeName
IDS_BLADE_NAME_SPB
EPOevent.SoftwareInfo.Event.CustomFields.Cleanable
False
EPOevent.SoftwareInfo.Event.CustomFields.DetectionMessage
IDS_OAS_DEFAULT_THREAT_MESSAGE
EPOevent.SoftwareInfo.Event.CustomFields.DurationBeforeDetection
0
EPOevent.SoftwareInfo.Event.CustomFields.FirstActionStatus
False
EPOevent.SoftwareInfo.Event.CustomFields.FirstAttemptedAction
IDS_ALERT_THACT_ATT_CLE
EPOevent.SoftwareInfo.Event.CustomFields.NaturalLangDescription
IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=Unconfirmed 408214.crdownload|TargetPath=C:\USERS\XADMIN\DOWNLOADS|ThreatName=EICAR test file|SourceProcessName=C:\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\CHROME.EXE|ThreatType=test|TargetUserName=LAB-WIN7-02\xadmin
EPOevent.SoftwareInfo.Event.CustomFields.SecondActionStatus
True
EPOevent.SoftwareInfo.Event.CustomFields.SecondAttemptedAction
IDS_ALERT_THACT_ATT_DEL
EPOevent.SoftwareInfo.Event.CustomFields.TargetAccessTime
2017-08-18T14:48:53Z
EPOevent.SoftwareInfo.Event.CustomFields.TargetCreateTime
2017-08-18T14:48:53Z
EPOevent.SoftwareInfo.Event.CustomFields.TargetFileSize
68
EPOevent.SoftwareInfo.Event.CustomFields.TargetHash
44d88612fea8a8f36de82e1278abb02f
EPOevent.SoftwareInfo.Event.CustomFields.TargetModifyTime
2017-08-18T14:48:53Z
EPOevent.SoftwareInfo.Event.CustomFields.TargetName
Unconfirmed 408214.crdownload
EPOevent.SoftwareInfo.Event.CustomFields.TargetPath
C:\USERS\XADMIN\DOWNLOADS
EPOevent.SoftwareInfo.Event.CustomFields.TaskName
IDS_OAS_TASK_NAME
EPOevent.SoftwareInfo.Event.CustomFields.ThreatDetectedOnCreation
False
EPOevent.SoftwareInfo.Event.CustomFields{@target}
EPExtendedEventMT
EPOevent.SoftwareInfo.Event.EventID
1278
EPOevent.SoftwareInfo.Event.GMTTime
2017-08-18T14:48:53
EPOevent.SoftwareInfo.Event.Severity
3
EPOevent.SoftwareInfo{@ProductFamily}
TVD
EPOevent.SoftwareInfo{@ProductName}
McAfee Endpoint Security
EPOevent.SoftwareInfo{@ProductVersion}
10.5.0
timestamp
none
Time
_time
2017-08-18T10:50:32.000-04:00
Default
host
lab-epo
index
main
linecount
1
punct
<><><>--</><>{----}</><>...</><>_</><></><></><></
source
/opt/xml/events.txt
sourcetype
epo
splunk_server
lab-splunk-01
... View more
08-18-2017
08:23 AM
Can you promote this and your SED_CMD as an answer so I may accept it as that worked for extracting the XML message?
... View more
08-18-2017
08:22 AM
Can you please promote your recommendation to use SED_CMD at the indexer in order to parse the XML event so I may accept it as an answer?
... View more
08-07-2017
10:39 AM
This is what I am looking for. I am going to instead write the output to disk and have the universal forwarder push it to an indexer. Would I apply your recommendations at the universal forwarder or indexer?
... View more
08-06-2017
01:25 PM
The message is not pure XML. At a minimum, the message contains the following header before the XML tag:
<29>1 2017-08-05T03:49:40.0Z LAB-EPO EPOEvents - EventFwd [agentInfo@3401 tenantId="1"]
... View more
08-06-2017
10:41 AM
Are you saying that I should forward from Logstash, to rsyslog, and then push to splunk using this feature? I am failing to see how this is going to help parse the XML portion from the message for field extraction? Assume the XML still needs to be parsed from the syslog header which from what I have read would require spath or something as well as defining a new sourcetype.
... View more
08-06-2017
06:47 AM
The original message is sent from a system running McAfee ePO. ePO will only send events over syslog via SSL and the only way I have been able to successful terminate (receive those events) is having Logstash act as the receiver. Logstash then forwards those messages to Splunk over syslog.
I was thinking the sourcetype could be associated with something unique such as ePO or Logstash and then spath or similar would pull out the XML portion for field extraction. I have tried a few different things but am quite new to Splunk.
... View more
08-06-2017
06:27 AM
How would I go about extracting the XML portion from the SYSLOG/LOGSTASH header and then sending that to the HTTP Event Collector and telling it to parse as XML?
... View more
08-05-2017
06:32 AM
1 Karma
I am receiving XML formated messages via Logstash which are then forwarded to splunk over syslog. xmlkv allows for parsing of all of the fields during search but need all of the fields to always be parsed. Currently the source host is 172.16.0.100 and type is syslog. The source host should be 172.16.0.150 or LAB-EPO and type should be whatever allows for all of the fields in the XML schema starting with to be parsed. What is the ideal method to perform field extraction as well as changing the source host and type to something like EPOEvents?
I was thinking the sourcetype could be associated with something unique such as ePO or Logstash and then spath or similar would pull out the XML portion for field extraction.
Aug 5 01:24:25 172.16.0.100 Aug 05 04:23:16 172.16.0.150 LOGSTASH[-]: <29>1 2017-08-05T04:24:40.0Z LAB-EPO EPOEvents - EventFwd [agentInfo@3401 tenantId="1"] <?xml version="1.0" encoding="UTF-8"?><EPOevent><MachineInfo><MachineName>LAB-WIN7-01</MachineName><AgentGUID>{dac2633a-7863-11e7-20ed-000c29ad4867}</AgentGUID><IPAddress>192.168.115.101</IPAddress><OSName>Windows 7</OSName><UserName>SYSTEM</UserName><TimeZoneBias>240</TimeZoneBias><RawMACAddress>000c29ad4867</RawMACAddress></MachineInfo><SoftwareInfo ProductName="McAfee Endpoint Security" ProductVersion="10.5.0" ProductFamily="TVD"><CommonFields><Analyzer>ENDP_AM_1050</Analyzer><AnalyzerName>McAfee Endpoint Security</AnalyzerName><AnalyzerVersion>10.5.0</AnalyzerVersion><AnalyzerHostName>LAB-WIN7-01</AnalyzerHostName><AnalyzerEngineVersion>5900.7806</AnalyzerEngineVersion><AnalyzerDetectionMethod>On-Access Scan</AnalyzerDetectionMethod><AnalyzerDATVersion>3062.0</AnalyzerDATVersion></CommonFields><Event><EventID>1278</EventID><Severity>3</Severity><GMTTime>2017-08-05T04:22:38</GMTTime><CommonFields><ThreatCategory>av.detect</ThreatCategory><ThreatEventID>1278</ThreatEventID><ThreatSeverity>2</ThreatSeverity><ThreatName>EICAR test file</ThreatName><ThreatType>test</ThreatType><DetectedUTC>2017-08-05T04:22:38Z</DetectedUTC><ThreatActionTaken>IDS_ALERT_ACT_TAK_DEL</ThreatActionTaken><ThreatHandled>True</ThreatHandled><SourceHostName>LAB-WIN7-01</SourceHostName><SourceProcessName>C:\Program Files (x86)\Google\Chrome\application\chrome.exe</SourceProcessName><TargetHostName>LAB-WIN7-01</TargetHostName><TargetUserName>LAB-WIN7-01\xadmin</TargetUserName><TargetFileName>C:\USERS\XADMIN\DOWNLOADS\Unconfirmed 888545.crdownload</TargetFileName></CommonFields><CustomFields target="EPExtendedEventMT"><BladeName>IDS_BLADE_NAME_SPB</BladeName><AnalyzerContentCreationDate>2017-08-03T12:35:00Z</AnalyzerContentCreationDate><AnalyzerGTIQuery>False</AnalyzerGTIQuery><ThreatDetectedOnCreation>False</ThreatDetectedOnCreation><TargetName>Unconfirmed 888545.crdownload</TargetName><TargetPath>C:\USERS\XADMIN\DOWNLOADS</TargetPath><TargetHash>44d88612fea8a8f36de82e1278abb02f</TargetHash><TargetFileSize>68</TargetFileSize><TargetModifyTime>2017-08-05T04:22:38Z</TargetModifyTime><TargetAccessTime>2017-08-05T04:22:38Z</TargetAccessTime><TargetCreateTime>2017-08-05T04:22:38Z</TargetCreateTime><Cleanable>False</Cleanable><TaskName>IDS_OAS_TASK_NAME</TaskName><FirstAttemptedAction>IDS_ALERT_THACT_ATT_CLE</FirstAttemptedAction><FirstActionStatus>False</FirstActionStatus><SecondAttemptedAction>IDS_ALERT_THACT_ATT_DEL</SecondAttemptedAction><SecondActionStatus>True</SecondActionStatus><AttackVectorType>4</AttackVectorType><DurationBeforeDetection>0</DurationBeforeDetection><NaturalLangDescription>IDS_NATURAL_LANG_OAS_DETECTION_DEL|TargetName=Unconfirmed 888545.crdownload|TargetPath=C:\USERS\XADMIN\DOWNLOADS|ThreatName=EICAR test file|SourceProcessName=C:\Program Files (x86)\Google\Chrome\application\chrome.exe|ThreatType=test|TargetUserName=LAB-WIN7-01\xadmin</NaturalLangDescription><AccessRequested></AccessRequested><DetectionMessage>IDS_OAS_DEFAULT_THREAT_MESSAGE</DetectionMessage><AMCoreContentVersion>3062.0</AMCoreContentVersion></CustomFields></Event></SoftwareInfo></EPOevent>
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-20-2024
10:44 AM
|
