pmateus Lv2Posted 31 Jan 2024 23:53
  
Hi,
Please check the following log field descriptions:

•  time: The timestamp of the log event, in the format of yyyy-MM-dd HH:mm:ss.

•  type: The type of the log event, such as threat, operation, or system.

•  level: The severity level of the log event, such as low, medium, high, or critical.

•  src_ip: The source IP address of the log event

•  dst_ip: The destination IP address of the log event

•  src_port: The source port of the log event

•  dst_port: The destination port of the log event

•  protocol: The protocol of the log event, such as TCP, UDP, or ICMP.

•  action: The action taken by the Sangfor EDR agent, such as block, allow, quarantine, or alert.

•  user: The user name associated with the log event

•  host: The host name or IP address of the endpoint device where the log event occurred.

•  os: The operating system of the endpoint device, such as Windows, Linux, or Mac OS.

•  agent_version: The version of the Sangfor EDR agent installed on the endpoint device.

•  event_id: The unique identifier of the log event, for reference and correlation.

•  event_name: The name or description of the log event, such as ransomware detection, file operation, or agent update.

•  event_detail: The detailed information of the log event, such as the file name, path, hash, or URL involved in the event

Thanks,

I Can Help:

Change

Moderator on This Board

18
8
0

Started Topics

Followers

Follow

3
0
2

Started Topics

Followers

Follow

Trending Topics

Board Leaders