Sophos Central Exemple de message d'événement
Les exemples d'événements suivants proviennent du protocole Sophos Central lorsque vous utilisez le protocole Sophos Central.
Evénement-Noeud final
Dans l'exemple de message d'événement suivant, l'événement indique les résultats d'une action qui renvoie les détails de cet événement généré par Sophos Central .
{"source":"n/a","when":"2024-04-23T16:22:10.159Z","severity":"low","type":"Event::Endpoint::UpdateRebootRequired","location":"AA1AAAA-1234AAA1","id":"111111aa-1a0a-11aa-a111-1111a1a01a11","group":"UPDATING","endpoint_id":"111111aa-1a0a-11aa-a111-1111aaaaaaa","endpoint_type":"server","customer_id":"111111aa-1a0a-11aa-a111-1111a1a01a11","created_at":"2024-04-23T16:22:10.170Z","source_info":{"ip":"10.0.0.1"},"name":"Reboot to complete update; computer stays protected in the meantime"}| Nom de zone QRadar | Nom de zone de contenu mise en évidence |
|---|---|
| ID d'événement | type |
| IP source | source_info.ip |
| Heure de l'unité | created at |
| Gravité | severity |
Alerte-Noeud final
Dans l'exemple de message d'événement suivant, l'événement indique les résultats d'une action qui renvoie les détails de cette alerte générée par Sophos Central .
{"javaUUID":"111111aa-1a0a-11aa-a111-1111a1a01a11","source":"EndpointDevice-\\test","description":"Manual PUA cleanup required: 'PsKill' at 'C:\\test\\test\\Desktop\\testSuite.zip'","severity":"medium","when":"2024-05-17T08:27:35.081Z","data":{"core_remedy_items":{"totalItems":1,"items":[{"result":"FAILED_TO_DELETE","sophosPid":"","suspendResult":"NOT_APPLICABLE","processPath":"","descriptor":"C:\\test\\test\\Desktop\\testSuite.zip\\test.exe","type":"file"}]},"created_at":1715934458355,"endpoint_id":"111111aa-1a0a-11aa-a111-1111a1a01a11","endpoint_java_id":"111111aa-1a0a-11aa-a111-1111a1a01a11","endpoint_platform":"windows","endpoint_type":"computer","event_service_id":{"type":3,"data":"+t8G5vc+TxiW3IX3C/RrhQ=="},"inserted_at":1715934458355,"source_app_id":"TEST","source_info":{"ip":"10.0.0.1"},"threat_id":{"timestamp":1715934441,"date":1715934441000},"threat_status":"CLEANUP_FAILED","user_match_id":{"timestamp":1697208869,"date":1697208869000},"user_match_uuid":{"type":3,"data":"aaaaaaaa/aaaa111111"}},"type":"Event::Endpoint::CorePuaCleanFailed","location":"EndpointDevice-","id":"111111aa-1a0a-11aa-a111-1111a1a01a11","actionable":false,"customer_id":"111111aa-1a0a-11aa-a111-1111a1a01a11","created_at":"2024-05-17T08:27:38.371Z","threat":"PsKill","threat_cleanable":false,"event_service_event_id":"111111aa-1a0a-11aa-a111-1111a1a01a11"}| Nom de zone QRadar | Nom de zone de contenu mise en évidence |
|---|---|
| ID d'événement | type |
| IP source | data. source_info.ip |
| Heure de l'unité | created at |
| Gravité | severity |