Skip to content

Security Control

The attributes that identify security controls such as malware or policy violations.

Attributes

Section titled “Attributes”

disposition_id

  • Type: integer_t
  • Requirement: required
  • Values:
    • 0 - Unknown
    • 1 - Allowed
    • 2 - Blocked
    • 3 - Quarantined
    • 4 - Isolated
    • 5 - Deleted
    • 6 - Dropped
    • 7 - Custom Action: Executed custom action such as run a command script.
    • 8 - Approved
    • 9 - Restored
    • 10 - Exonerated: No longer suspicious (re-scored).
    • 11 - Corrected
    • 12 - Partially Corrected
    • 13 - Uncorrected
    • 14 - Delayed: Requires reboot to finish the operation.
    • 15 - Detected
    • 16 - No Action
    • 17 - Logged
    • 18 - Tagged: Marked with extended attributes.
    • 99 - Other

When security issues, such as malware or policy violations, are detected and possibly corrected, then disposition_id describes the action taken by the security product.

attacks

  • Type: attack
  • Requirement: recommended

An array of attacks associated with an event.

disposition

  • Type: string_t
  • Requirement: optional

The event disposition name, normalized to the caption of the disposition_id value. In the case of ‘Other’, it is defined by the event source.

malware

  • Type: malware
  • Requirement: optional

The list of malware identified by a finding.

Available In

Section titled “Available In”