зеркало из https://github.com/microsoft/paris.git
Let's get this show on the road!
Starting out with a small Angular app, with which to test Paris during initial development.
This commit is contained in:
Родитель
c41c5f3c94
Коммит
272f1f48fc
|
@ -0,0 +1,33 @@
|
|||
# compiled output
|
||||
dist
|
||||
tmp
|
||||
sme
|
||||
|
||||
# dependencies
|
||||
node_modules
|
||||
bower_components
|
||||
|
||||
# IDEs and editors
|
||||
.idea
|
||||
.vscode
|
||||
.project
|
||||
.classpath
|
||||
*.launch
|
||||
.settings/
|
||||
|
||||
# misc
|
||||
.sass-cache
|
||||
connect.lock
|
||||
coverage/*
|
||||
libpeerconnection.log
|
||||
npm-debug.log
|
||||
testem.log
|
||||
typings
|
||||
|
||||
# e2e
|
||||
e2e/*.js
|
||||
e2e/*.map
|
||||
|
||||
#System Files
|
||||
.DS_Store
|
||||
Thumbs.db
|
|
@ -0,0 +1,15 @@
|
|||
# http://editorconfig.org
|
||||
|
||||
root = true
|
||||
|
||||
[*]
|
||||
charset = utf-8
|
||||
indent_style = tab
|
||||
indent_size = 4
|
||||
end_of_line = lf
|
||||
insert_final_newline = true
|
||||
trim_trailing_whitespace = true
|
||||
|
||||
[*.md]
|
||||
insert_final_newline = false
|
||||
trim_trailing_whitespace = false
|
|
@ -0,0 +1,15 @@
|
|||
## Submitting Pull Requests
|
||||
|
||||
**Please follow these basic steps to simplify pull request reviews - if you don't you'll probably just be asked to anyway.**
|
||||
|
||||
* Please rebase your branch against the current master
|
||||
* Run ```npm install``` to make sure your development dependencies are up-to-date
|
||||
* Please ensure that the test suite passes **and** that code is lint free before submitting a PR by running:
|
||||
* ```npm test```
|
||||
* If you've added new functionality, **please** include tests which validate its behaviour
|
||||
* Make reference to possible [issues](https://github.com/mgechev/angular2-seed/issues) on PR comment
|
||||
|
||||
## Submitting bug reports
|
||||
|
||||
* Please detail the affected browser(s) and operating system(s)
|
||||
* Please be sure to state which version of node **and** npm you're using
|
|
@ -0,0 +1,33 @@
|
|||
<!--
|
||||
IF YOU DON'T FILL OUT THE FOLLOWING INFORMATION WE MIGHT CLOSE YOUR ISSUE WITHOUT INVESTIGATING
|
||||
-->
|
||||
|
||||
**I'm submitting a ...** (check one with "x")
|
||||
```
|
||||
[ ] bug report => search github for a similar issue or PR before submitting
|
||||
[ ] feature request
|
||||
[ ] support request => Please do not submit support request here, instead see use [gitter](https://gitter.im/mgechev/angular2-seed) or [stackoverflow](https://stackoverflow.com/questions/tagged/angular2)
|
||||
```
|
||||
|
||||
**Current behavior**
|
||||
<!-- Describe how the bug manifests. -->
|
||||
|
||||
**Expected behavior**
|
||||
<!-- Describe what the behavior would be without the bug. -->
|
||||
|
||||
**Minimal reproduction of the problem with instructions**
|
||||
<!--
|
||||
If the current behavior is a bug or you can illustrate your feature request better with an example,
|
||||
please provide the *STEPS TO REPRODUCE* and if possible a *MINIMAL DEMO* of the problem.
|
||||
-->
|
||||
|
||||
**What is the motivation / use case for changing the behavior?**
|
||||
<!-- Describe the motivation or the concrete use case -->
|
||||
|
||||
**Please tell us about your environment:**
|
||||
<!-- Operating system, IDE, package manager, HTTP server, ... -->
|
||||
|
||||
* **Angular Seed Version:** `aaaaf75`
|
||||
<!-- Check which is the hash of the last commit from angular-seed that you have locally -->
|
||||
|
||||
* **Node:** `node --version` =
|
|
@ -57,3 +57,8 @@ typings/
|
|||
# dotenv environment variables file
|
||||
.env
|
||||
|
||||
#Builds folder
|
||||
dist/
|
||||
|
||||
#NPM package-lock
|
||||
package-lock.json
|
||||
|
|
|
@ -0,0 +1,13 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<module type="WEB_MODULE" version="4">
|
||||
<component name="NewModuleRootManager">
|
||||
<content url="file://$MODULE_DIR$">
|
||||
<excludeFolder url="file://$MODULE_DIR$/.tmp" />
|
||||
<excludeFolder url="file://$MODULE_DIR$/temp" />
|
||||
<excludeFolder url="file://$MODULE_DIR$/tmp" />
|
||||
<excludeFolder url="file://$MODULE_DIR$/dist" />
|
||||
</content>
|
||||
<orderEntry type="inheritedJdk" />
|
||||
<orderEntry type="sourceFolder" forTests="false" />
|
||||
</component>
|
||||
</module>
|
|
@ -0,0 +1,13 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<module type="WEB_MODULE" version="4">
|
||||
<component name="NewModuleRootManager">
|
||||
<content url="file://$MODULE_DIR$">
|
||||
<excludeFolder url="file://$MODULE_DIR$/.tmp" />
|
||||
<excludeFolder url="file://$MODULE_DIR$/dist" />
|
||||
<excludeFolder url="file://$MODULE_DIR$/temp" />
|
||||
<excludeFolder url="file://$MODULE_DIR$/tmp" />
|
||||
</content>
|
||||
<orderEntry type="inheritedJdk" />
|
||||
<orderEntry type="sourceFolder" forTests="false" />
|
||||
</component>
|
||||
</module>
|
|
@ -0,0 +1,9 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project version="4">
|
||||
<component name="ProjectCodeStyleSettingsManager">
|
||||
<option name="PER_PROJECT_SETTINGS">
|
||||
<value />
|
||||
</option>
|
||||
<option name="PREFERRED_PROJECT_CODE_STYLE" value="Default" />
|
||||
</component>
|
||||
</project>
|
|
@ -0,0 +1,7 @@
|
|||
<component name="ProjectDictionaryState">
|
||||
<dictionary name="yokolesn">
|
||||
<words>
|
||||
<w>deps</w>
|
||||
</words>
|
||||
</dictionary>
|
||||
</component>
|
|
@ -0,0 +1,6 @@
|
|||
<component name="InspectionProjectProfileManager">
|
||||
<profile version="1.0">
|
||||
<option name="myName" value="Project Default" />
|
||||
<inspection_tool class="TsLint" enabled="true" level="ERROR" enabled_by_default="true" />
|
||||
</profile>
|
||||
</component>
|
|
@ -0,0 +1,8 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project version="4">
|
||||
<component name="ProjectModuleManager">
|
||||
<modules>
|
||||
<module fileurl="file://$PROJECT_DIR$/.idea/Paris.iml" filepath="$PROJECT_DIR$/.idea/Paris.iml" />
|
||||
</modules>
|
||||
</component>
|
||||
</project>
|
|
@ -0,0 +1,6 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project version="4">
|
||||
<component name="VcsDirectoryMappings">
|
||||
<mapping directory="$PROJECT_DIR$" vcs="Git" />
|
||||
</component>
|
||||
</project>
|
|
@ -0,0 +1,14 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project version="4">
|
||||
<component name="WebResourcesPaths">
|
||||
<contentEntries>
|
||||
<entry url="file://$PROJECT_DIR$">
|
||||
<entryData>
|
||||
<resourceRoots>
|
||||
<path value="file://$PROJECT_DIR$/mock_server/node_modules" />
|
||||
</resourceRoots>
|
||||
</entryData>
|
||||
</entry>
|
||||
</contentEntries>
|
||||
</component>
|
||||
</project>
|
|
@ -0,0 +1,47 @@
|
|||
language: node_js
|
||||
node_js: stable
|
||||
|
||||
sudo: false
|
||||
|
||||
install: true # yarn bug
|
||||
|
||||
addons:
|
||||
firefox: "45.0"
|
||||
|
||||
os:
|
||||
- linux
|
||||
# - osx
|
||||
|
||||
before_install:
|
||||
- if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then brew update; fi
|
||||
- if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then brew outdated xctool || brew upgrade xctool; fi
|
||||
- if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then export CHROME_BIN=chromium-browser; fi # Karma CI
|
||||
- if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then brew cask install google-chrome; fi # Karma CI
|
||||
- if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then export DISPLAY=:99.0; fi
|
||||
|
||||
before_script:
|
||||
- npm i -g npm@^5.3.0 && npm --version
|
||||
- npm install
|
||||
- if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then sh -e /etc/init.d/xvfb start; fi
|
||||
- if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then nohup bash -c "webdriver-manager start 2>&1 &"; fi # Protractor CI
|
||||
|
||||
after_failure:
|
||||
- cat /home/travis/build/mgechev/angular-seed/npm-debug.log
|
||||
|
||||
branches:
|
||||
only: master
|
||||
|
||||
notifications:
|
||||
email: true
|
||||
webhooks:
|
||||
urls: https://webhooks.gitter.im/e/565e4b2fed3b96c1b964
|
||||
on_success: change # options: [always|never|change] default: always
|
||||
on_failure: always # options: [always|never|change] default: always
|
||||
on_start: never # options: [always|never|change] default: always
|
||||
|
||||
cache:
|
||||
directories: node_modules
|
||||
|
||||
script:
|
||||
- npm run tests.all
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
{
|
||||
"version": "0.2.0",
|
||||
"configurations": [
|
||||
{
|
||||
"name": "Launch Chrome against localhost, with sourcemaps",
|
||||
"type": "chrome",
|
||||
"preLaunchTask": "start",
|
||||
"request": "launch",
|
||||
"url": "http://localhost:5555",
|
||||
"sourceMaps": true,
|
||||
"webRoot": "${workspaceRoot}/src/client",
|
||||
"sourceMapPathOverrides": {
|
||||
"app/*": "${webRoot}/app/*"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "Attach to Chrome, with sourcemaps",
|
||||
"type": "chrome",
|
||||
"request": "attach",
|
||||
"port": 9222,
|
||||
"sourceMaps": true,
|
||||
"webRoot": "${workspaceRoot}/src/client",
|
||||
"sourceMapPathOverrides": {
|
||||
"app/*": "${webRoot}/app/*"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,9 @@
|
|||
// Place your settings in this file to overwrite default and user settings.
|
||||
{
|
||||
"typescript.tsdk": "node_modules/typescript/lib",
|
||||
"search.exclude": {
|
||||
"**/coverage_js": true,
|
||||
"**/coverage": true,
|
||||
"**/dist": true
|
||||
}
|
||||
}
|
|
@ -0,0 +1,28 @@
|
|||
{
|
||||
"version": "0.1.0",
|
||||
"command": "npm",
|
||||
"isShellCommand": true,
|
||||
"showOutput": "always",
|
||||
"suppressTaskName": true,
|
||||
"tasks": [
|
||||
{
|
||||
"taskName": "tslint",
|
||||
"args": [ "run", "lint" ],
|
||||
"problemMatcher": {
|
||||
"owner": "tslint",
|
||||
"fileLocation": [
|
||||
"relative",
|
||||
"${workspaceRoot}"
|
||||
],
|
||||
"severity": "warning",
|
||||
"pattern": {
|
||||
"regexp": "^(\\S.*)\\[(\\d+), (\\d+)\\]:\\s+(.*)$",
|
||||
"file": 1,
|
||||
"line": 2,
|
||||
"column": 3,
|
||||
"message": 4
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
|
@ -1,5 +1,8 @@
|
|||
# Paris
|
||||
|
||||
# Contributing
|
||||
Paris is a TypeScript library for implementing Domain-Driven Design in web apps.
|
||||
|
||||
## Contributing
|
||||
|
||||
This project welcomes contributions and suggestions. Most contributions require you to agree to a
|
||||
Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
|
||||
|
|
|
@ -0,0 +1,41 @@
|
|||
# AppVeyor file
|
||||
# http://www.appveyor.com/docs/appveyor-yml
|
||||
# This file: cloned from https://github.com/gruntjs/grunt/blob/master/appveyor.yml
|
||||
|
||||
# Build version format
|
||||
version: "{build}"
|
||||
|
||||
# Test against this version of Node.js
|
||||
environment:
|
||||
nodejs_version: "Stable"
|
||||
|
||||
build: off
|
||||
|
||||
clone_depth: 10
|
||||
|
||||
# Fix line endings on Windows
|
||||
init:
|
||||
- git config --global core.autocrlf true
|
||||
|
||||
install:
|
||||
- ps: Install-Product node $env:nodejs_version
|
||||
- npm install -g npm@3.10.8
|
||||
- ps: $env:path = $env:appdata + "\npm;" + $env:path
|
||||
- npm install && npm install karma-ie-launcher
|
||||
|
||||
test_script:
|
||||
# Output useful info for debugging.
|
||||
- node --version && npm --version
|
||||
# We test multiple Windows shells because of prior stdout buffering issues
|
||||
# filed against Grunt. https://github.com/joyent/node/issues/3584
|
||||
- ps: "npm --version # PowerShell" # Pass comment to PS for easier debugging
|
||||
- npm run tests.all
|
||||
|
||||
notifications:
|
||||
- provider: Webhook
|
||||
url: https://webhooks.gitter.im/e/cfd8ce5ddee6f3a0b0c9
|
||||
on_build_success: false
|
||||
on_build_failure: true
|
||||
on_build_status_changed: true
|
||||
|
||||
cache: node_modules -> package.json
|
|
@ -0,0 +1,28 @@
|
|||
import * as gulp from 'gulp';
|
||||
import * as util from 'gulp-util';
|
||||
import * as runSequence from 'run-sequence';
|
||||
|
||||
import Config from './tools/config';
|
||||
import { loadTasks, loadCompositeTasks } from './tools/utils';
|
||||
|
||||
|
||||
loadTasks(Config.SEED_TASKS_DIR);
|
||||
loadTasks(Config.PROJECT_TASKS_DIR);
|
||||
|
||||
loadCompositeTasks(Config.SEED_COMPOSITE_TASKS, Config.PROJECT_COMPOSITE_TASKS);
|
||||
|
||||
|
||||
// --------------
|
||||
// Clean dev/coverage that will only run once
|
||||
// this prevents karma watchers from being broken when directories are deleted
|
||||
let firstRun = true;
|
||||
gulp.task('clean.once', (done: any) => {
|
||||
if (firstRun) {
|
||||
firstRun = false;
|
||||
runSequence('check.tools', 'clean.dev', 'clean.coverage', done);
|
||||
} else {
|
||||
util.log('Skipping clean on rebuild');
|
||||
done();
|
||||
}
|
||||
});
|
||||
|
|
@ -0,0 +1,135 @@
|
|||
// Karma configuration
|
||||
// Generated on Wed Jul 15 2015 09:44:02 GMT+0200 (Romance Daylight Time)
|
||||
'use strict';
|
||||
|
||||
var argv = require('yargs').argv;
|
||||
var minimatch = require("minimatch");
|
||||
|
||||
|
||||
module.exports = function (config) {
|
||||
config.set({
|
||||
|
||||
// base path that will be used to resolve all patterns (eg. files, exclude)
|
||||
basePath: './',
|
||||
|
||||
|
||||
// frameworks to use
|
||||
// available frameworks: https://npmjs.org/browse/keyword/karma-adapter
|
||||
frameworks: ['jasmine'],
|
||||
|
||||
|
||||
// list of files / patterns to load in the browser
|
||||
files: [
|
||||
// Polyfills.
|
||||
'node_modules/core-js/client/shim.min.js',
|
||||
'node_modules/intl/dist/Intl.min.js',
|
||||
|
||||
'node_modules/traceur/bin/traceur.js',
|
||||
|
||||
// System.js for module loading
|
||||
'node_modules/systemjs/dist/system.src.js',
|
||||
|
||||
// Zone.js dependencies
|
||||
'node_modules/zone.js/dist/zone.js',
|
||||
'node_modules/zone.js/dist/long-stack-trace-zone.js',
|
||||
'node_modules/zone.js/dist/async-test.js',
|
||||
'node_modules/zone.js/dist/fake-async-test.js',
|
||||
'node_modules/zone.js/dist/sync-test.js',
|
||||
'node_modules/zone.js/dist/proxy.js',
|
||||
'node_modules/zone.js/dist/jasmine-patch.js',
|
||||
|
||||
// RxJs.
|
||||
{ pattern: 'node_modules/rxjs/**/*.js', included: false, watched: false },
|
||||
{ pattern: 'node_modules/rxjs/**/*.js.map', included: false, watched: false },
|
||||
|
||||
// paths loaded via module imports
|
||||
// Angular itself
|
||||
{ pattern: 'node_modules/@angular/**/*.js', included: false, watched: true },
|
||||
{ pattern: 'node_modules/@angular/**/*.js.map', included: false, watched: false },
|
||||
|
||||
'test-config.js',
|
||||
{ pattern: 'dist/dev/system-config.js', watched: true, included: true },
|
||||
|
||||
{ pattern: 'dist/dev/**/*.js', included: false, watched: true },
|
||||
{ pattern: 'dist/dev/**/*.html', included: false, watched: true, served: true },
|
||||
{ pattern: 'dist/dev/**/*.css', included: false, watched: true, served: true },
|
||||
|
||||
// suppress annoying 404 warnings for resources, images, etc.
|
||||
{ pattern: 'dist/dev/assets/**/*', watched: false, included: false, served: true },
|
||||
|
||||
'test-main.js'
|
||||
],
|
||||
|
||||
// must go along with above, suppress annoying 404 warnings.
|
||||
proxies: {
|
||||
'/assets/': '/base/dist/dev/assets/'
|
||||
},
|
||||
|
||||
// list of files to exclude
|
||||
exclude: [
|
||||
'node_modules/**/*spec.js'
|
||||
],
|
||||
|
||||
|
||||
// preprocess matching files before serving them to the browser
|
||||
// available preprocessors: https://npmjs.org/browse/keyword/karma-preprocessor
|
||||
|
||||
// test results reporter to use
|
||||
// possible values: 'dots', 'progress'
|
||||
// available reporters: https://npmjs.org/browse/keyword/karma-reporter
|
||||
reporters: ['mocha'],
|
||||
|
||||
|
||||
// web server port
|
||||
port: 9876,
|
||||
|
||||
|
||||
// enable / disable colors in the output (reporters and logs)
|
||||
colors: true,
|
||||
|
||||
|
||||
// level of logging
|
||||
// possible values: config.LOG_DISABLE || config.LOG_ERROR || config.LOG_WARN || config.LOG_INFO || config.LOG_DEBUG
|
||||
logLevel: config.LOG_INFO,
|
||||
|
||||
|
||||
// enable / disable watching file and executing tests whenever any file changes
|
||||
autoWatch: true,
|
||||
|
||||
|
||||
// start these browsers
|
||||
// available browser launchers: https://npmjs.org/browse/keyword/karma-launcher
|
||||
browsers: [
|
||||
'Chrome'
|
||||
],
|
||||
|
||||
|
||||
customLaunchers: {
|
||||
Chrome_travis_ci: {
|
||||
base: 'Chrome',
|
||||
flags: ['--no-sandbox']
|
||||
}
|
||||
},
|
||||
|
||||
// Continuous Integration mode
|
||||
// if true, Karma captures browsers, runs the tests and exits
|
||||
singleRun: false,
|
||||
|
||||
// Passing command line arguments to tests
|
||||
client: {
|
||||
files: argv.files ? minimatch.makeRe(argv.files).source : null
|
||||
}
|
||||
});
|
||||
|
||||
if (process.env.APPVEYOR) {
|
||||
config.browsers = ['IE'];
|
||||
config.singleRun = true;
|
||||
config.browserNoActivityTimeout = 90000; // Note: default value (10000) is not enough
|
||||
}
|
||||
|
||||
if (process.env.TRAVIS || process.env.CIRCLECI) {
|
||||
config.browsers = ['Chrome_travis_ci'];
|
||||
config.singleRun = true;
|
||||
config.browserNoActivityTimeout = 90000;
|
||||
}
|
||||
};
|
|
@ -0,0 +1,26 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIEZTCCA02gAwIBAgIJANgPP6bfBR8pMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNV
|
||||
BAYTAlVBMQswCQYDVQQIEwJVQTERMA8GA1UEBxMIVGVsIEF2aXYxDjAMBgNVBAoT
|
||||
BVlvc3NpMQwwCgYDVQQLEwNZb3gxEDAOBgNVBAMTB3lveC5jb20xHzAdBgkqhkiG
|
||||
9w0BCQEWEGNvbXBhbnlAZW1haWxjb20wHhcNMTcwMzIxMTUzNDQ5WhcNMTkxMjE2
|
||||
MTUzNDQ5WjB+MQswCQYDVQQGEwJVQTELMAkGA1UECBMCVUExETAPBgNVBAcTCFRl
|
||||
bCBBdml2MQ4wDAYDVQQKEwVZb3NzaTEMMAoGA1UECxMDWW94MRAwDgYDVQQDEwd5
|
||||
b3guY29tMR8wHQYJKoZIhvcNAQkBFhBjb21wYW55QGVtYWlsY29tMIIBIjANBgkq
|
||||
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu2SJj64r96jq2CY6DKA9c/lOrauakVsY
|
||||
ImamRzkNxFKew31fUkjXPKtyF+CqgnPlMhYyEYwp/1Cn6Zm77ipZ6Qd07zWONYMR
|
||||
ZiobTLUbKutv6E2BUE6FAqbKKLKnq7yYHG50eLwOm+Ra/zeQqEcIy7q2cggPB7h7
|
||||
HatuMXdLU2Fc03W9dw8+yaW91dzrdMY7vrLFRs25BxuIDUGmE8ZKDbw2vTfd+HDa
|
||||
XeMAwhCmxJOkFmsbY+f5Pfa5q/qHKXxcrhAE10yfmumbPLH3hhZ/q/2J6BNs2z1o
|
||||
eUtRfJtk4Df0aUwXuVjvW9qOAdMdTRetE6ozWSAQh4I0+v3TltwOSwIDAQABo4Hl
|
||||
MIHiMB0GA1UdDgQWBBQKOucr234+kzC536O/e5k0GpqfvTCBsgYDVR0jBIGqMIGn
|
||||
gBQKOucr234+kzC536O/e5k0GpqfvaGBg6SBgDB+MQswCQYDVQQGEwJVQTELMAkG
|
||||
A1UECBMCVUExETAPBgNVBAcTCFRlbCBBdml2MQ4wDAYDVQQKEwVZb3NzaTEMMAoG
|
||||
A1UECxMDWW94MRAwDgYDVQQDEwd5b3guY29tMR8wHQYJKoZIhvcNAQkBFhBjb21w
|
||||
YW55QGVtYWlsY29tggkA2A8/pt8FHykwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0B
|
||||
AQUFAAOCAQEAuZA0Y4V9BtzZ9k+9qDRllSC7nKd0FX7ljbYb+sNMUTSuEm6ttFZ8
|
||||
nnCI8UjUpIzhD9TtfNjWrmm7APFz1cwr4Vt47Wq+nxzTBcI0/brlSVyXhiw4Bx2C
|
||||
y4/4P6SIBseTV97iwlym1uR7aCythQ9CDZ5EXO2RTngK/uH6zuEGQQ9QkqmjnhK6
|
||||
Bmgovp5H8nCYswO6qgll31E2ygf5jkW8OL51pXldtO/mEZgWVe/5wEdhmVywYBmF
|
||||
eeRVqShkg99JnpOS7fzA7XWymWH5qZ3Jkyw3zmzibBXVKxBNNz5VYgsUFYD8E5tW
|
||||
4yxKABQvu3xEsgderL9YJg8XY9taHEZ30A==
|
||||
-----END CERTIFICATE-----
|
|
@ -0,0 +1,30 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: DES-EDE3-CBC,1596AB65A950E30B
|
||||
|
||||
I6yzIY6t6Euf7n7zkkG6mpMHmT7NEYxFLfJLkWXajjGT4DzSjvHI2t9S3eU1nU3p
|
||||
Xy3AYM18FOcrvE8HB2OWnQwC6oVJRRTt/cxRzyIKhMRQsk7K5WwVvFSA/r/Jh6Nu
|
||||
joBiVy26fV+SVdsFJ3kKfLT+T9eRfxbRS3bRgc3Wbc2wj4VgL6Nh74Jekqf7zncq
|
||||
xTPxHw/SlihZJxBYpbovPW/CBOzPHoiLE+5XFJuZNJTSjkYHHg4ZlFM4ohrScPVw
|
||||
zZ5tox/dAXa+sXACT7nxkuebhoqeyliCVjop4jDYA1KGDUyBl1yoOUfIubeLESFa
|
||||
O+fklAkC6afSErOE6LvWOS79/JYJbZvFYzXNDUIb4ZMviJtjwaGFtsFkNrxntFzM
|
||||
Rqqa7miSMQeuEnTulxLRgUIiDrKBulFDV5Hjevone4jjz5LUukrKQii5nI/lAzbm
|
||||
8RKWSnCATH0n7sGbS7yk54m3+fPz4c7spxKHCB8xVOV6B2VUBjepyQqD6Xaol8YD
|
||||
xDK2HTW5wdiBhJmWqDX98BxRGRZ9sh4O7Wq7z4VYkFtHHJddK6cxY+yrzLp125G1
|
||||
Bhgx+qzosNnw4na5syB/NStlwCSNpEd0tTuryCbvYjwc/tPgI1G5boJSaWctvOvV
|
||||
jTZC9XHufPXNRWzfDyoAtpvd+jDkZJ3NV5pARmeDepyKG/GC4v0SCi2mFmRuOjRa
|
||||
J3gkbsTkyuKbZ/JLyghg9+pGZrR6rVbSsCUHL4iI92rFM7loIhvEfboXP/sORIkO
|
||||
sCrJJA1NtN6YlmvyuNuY+7lsM2ewG1bwXg4nyWTbkClA9E0J0uCgWAsRL2m4Kkj2
|
||||
m8Sp/zn3rsD8Dd6x8d5SLsenS+rp9zYbj4Fbl7veO1t2P9D/KhF1ny+hful7Fiza
|
||||
jV4lULruixvPzBr3krS8Uy2gr+mOXXQ51kxSWk/PYPrTYauEujzwIkihuoz58Dga
|
||||
42AFWqXp0UWZMv1MYaRZZua5NzYXDviVAYHpw43ZwPtqH+BEPYzHs7Il1WR/nSIA
|
||||
0rPqswL5wGwiBNJIMuxdQrSK6I7io0MoE2i2PPLQzN7efUPP861ROVW9fHwxEzj2
|
||||
ulpO7eKD6yxe4PyTsIT61cvGVj4i3DwCUMYiyxut/ieqdbZrVvCvt0zzhQ8Ewgck
|
||||
+m6PSSW2lkY1jENRmGdcexU3tZu2nmDVsrI5puPkoae9Nl/HVTPXMZL80oMlQEbk
|
||||
F1/bZ5CtHDkWVf6agF9ll1whuGD6HZWcWgBg4QwJqKkobGTsi6oLe9OKx12qB6o/
|
||||
r63PaQ8lXAvcAsGr+FkA4rrbaR035pfWVWnSjzBHQWqgsCFeIRdsGUXrI63UztGU
|
||||
lWb5y1o+GKZm48QXfTufCHGYsJ54Ud2UEm5LIUsvgkaU1EHF2GQrf0aAZKqVgFR/
|
||||
5LtCCzgKzeo/bLyIyOTXi+UXMCN2I04WtXZ2rwfkCVsETAlXPKMdtR9MKlB0f7j3
|
||||
1Ag+v9lSQMxet+iA1Mdlc6+81QTtAyeUpgJRqlIcQwygMhNMhfzCE6WNayrX3C15
|
||||
MQrUCtc99XWYAZfuyd6VwlfoymEKdqIBBM1XsajWN5JqCJ1UsVD5Og==
|
||||
-----END RSA PRIVATE KEY-----
|
|
@ -0,0 +1,61 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIFRTCCAy2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAsMSowKAYDVQQDDCFIZXhh
|
||||
ZGl0ZSBIZXhhZGl0ZS1RYS1FbnYyIEFJUlMgQ0EwHhcNMTcwMjI2MDkzNjUxWhcN
|
||||
MjAwMjI2MDkzNjUxWjB2MR8wHQYDVQQDDBZoZXhhZGl0ZS1haXJzLmF1dG8ubGFi
|
||||
MRkwFwYDVQQKDBBIZXhhZGl0ZS1RYS1FbnYyMQswCQYDVQQGEwJVUzETMBEGA1UE
|
||||
CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzCCAiIwDQYJKoZI
|
||||
hvcNAQEBBQADggIPADCCAgoCggIBAMgkBu+LyV8xahI6HRclxBN6cvSmt+rTx3MB
|
||||
ah1CyRr6tuXg7aWhxy/9UIXtRgRC4jRFZiCQnR4KsXiMGlAL7MA+McKgSQTRgmdH
|
||||
V7CG0jzn1pwLuFgPAOlelhmgYmp1/gCXnS1V0HSlgigDGYiqqelOmyoATJDNlWXL
|
||||
V3DvhxeSuWBbTN9o+TYxypaI4tgUNg/iqrL5aKCan3HVaGGzaJZ/AyMYlylEw4PH
|
||||
P/oX+RNwzzebO/sqBUpqIZlQadmCzGm5QXGRVSWMmR6jVtqwluMGVJD9XkQr2pbp
|
||||
RD9/P1opwVMns1pmEieLbslMQnAHNuNEH9MC971LLyG9YukW/1Yz7/GG069BxHJC
|
||||
VqKtfAVwBzM7xo3gqjEoBooore+oMGLAZ88J0Ijr4ybXUCyMq5khTi7m0mXRUD3s
|
||||
HnQE9YCQJiF3ZEjzkrxBRv2B/sNsRlT6xsRwEmARwS2d24fISWmMwBbBt2NBpuo8
|
||||
fZPWM5Eiore0/yOArUr4zlOsKpOif/bOug4wZL97jaC+aIK85kj35zM6GTfp9bUt
|
||||
4G2/bMC+0ZcKmQ/76/tru+I8fa2mKsLU7VKumy1KkFGEOd+Av61eTbVGXsTaAgCF
|
||||
f4qjxEFz9dbsb+HBbsaoJDW0nIAzHQx4Z+pJttVuDAgni/WT6VSSMteZv3DZIduB
|
||||
s57hBMuPAgMBAAGjKDAmMCQGA1UdEQEB/wQaMBiCFmhleGFkaXRlLWFpcnMuYXV0
|
||||
by5sYWIwDQYJKoZIhvcNAQELBQADggIBAIsV7Nqa3+WALBstf2+Oyo5GbPLozk6M
|
||||
AvmjEFVBCjZTEIryEizhp6Ce8MFrqflKoBB1P6A6v/N78eMvzOx7rBIim5aUYbIV
|
||||
j8UWXFUPIfSZLaC6zlUO7KwLX6m3rCp1jj7PJQNWd1gm1RK8P4I48SB7A699JDDp
|
||||
fr8VxfIf311Lbdyk6490BLLVKFevwupyo878FL7wWd0B0K3vRmtmlu5A7K6i5pQ1
|
||||
KbB4ETtbSx697WcJUvrD1Afp7NhLYmoCe9NDmRkyAJ9WwQQJz49LPAhp2qn2rTwr
|
||||
LFVKkGnfU/NOf1+ghMR0ZH9KQa9cb1EFX1FbuuQcgnfMHc3kU2uoC0WKsWEmotl2
|
||||
PwggKVLXCMfERDJl8D/g4/VaTOLD7q0mPtRK2n/JUWifODJmSfHSZ+joszHqFcVj
|
||||
/1UPmzUZdvsBBY77NWf2BUcNEyUgGFUVk2NOru0dj409LWRD6cZdzTBZrZ87h9Ic
|
||||
vtLdSFg78qld3v5w94PhAfmia31FcKOWh4M1HFSzE48pP5jDj+LGrrMxxphL7CPc
|
||||
LNO914w3l/VUdpjz0UWp06zjuP0B30zTHR0+joIYPzlQeveTPQCvEQNcQqkSs4K1
|
||||
oW6maPYabkRk9u+qdjnv2FuxchLImYSi7JI6HJ3NvQenUqcdDdV4OT7yCaKxH42l
|
||||
v9SoVlDyG7yX
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIFOTCCAyGgAwIBAgIBATANBgkqhkiG9w0BAQsFADAsMSowKAYDVQQDDCFIZXhh
|
||||
ZGl0ZSBIZXhhZGl0ZS1RYS1FbnYyIEFJUlMgQ0EwHhcNMTcwMjI2MDkzNjQ3WhcN
|
||||
MjAwMjI2MDkzNjQ3WjAsMSowKAYDVQQDDCFIZXhhZGl0ZSBIZXhhZGl0ZS1RYS1F
|
||||
bnYyIEFJUlMgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDTNEk9
|
||||
94/MQ66Q1EdJ0WTtEiae5UkKMmCaGRi4DPSu0yevz425kMsEtILPjqNFEH/RgJGx
|
||||
mpTZKhUBtui5N/KR7xw4ZIJTT8a2QUGi9zPAH0FuGJwuSh2iRcdyl8gULuWyEax4
|
||||
j4nzjI70DVwWgZK4bVKRKn5Lp+LhBtGkV58TifipM2rgq5l7RmOdJRBvDTLv1sgx
|
||||
CklRQOzMAn4e9Sl/u4SvtuDGEcRL7yLGK/YmAQZvto700m09xE5jIKuRXDEPw+CR
|
||||
CR60i8/Y076AlZuTtMeJdQUyXLOCOV1omKw+lRxpQaQpq+42niQut6LUnu6bC7bV
|
||||
7+w7aEw5D0HMfmCwlkTNUwfYWXmDTa70Ru5r6X1VrdC3xqFXrAWvnuSuPVeKXMCW
|
||||
5r6PspAR2nG1bCw54jm9J1VzXQtYpgDmzdABZ0K2LY5vsi9w/JojU8wrOkdnjBcK
|
||||
D2T1QbkiEe6b3p+lETXEbuhZGkkYzMbG64m9sVTalv/X7UEhpWukb31L4ZRKzfb6
|
||||
DGOchuJetUg2X2LJi4a3aM4QCcfO+T4mTUjQ2CxZrEFtmnOGzUM21KJgOW/yKogL
|
||||
cNGssIo4ohmiPkOw0jNqXG7Rmk62DmjvD3LLtwX5P5JmTDV+T2ESKT6qK68Zp1fR
|
||||
6WjGKtv2oNLPll5qzjet79x8HcD6W1yGCo2wkQIDAQABo2YwZDASBgNVHRMBAf8E
|
||||
CDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUja554HrcHe97RwpO
|
||||
I37ZgHNTdwUwHwYDVR0jBBgwFoAUja554HrcHe97RwpOI37ZgHNTdwUwDQYJKoZI
|
||||
hvcNAQELBQADggIBACpV7oPLyf4S4kqUOa9LOREmc3YwmugbEeIdZ5YU0sNz/kNf
|
||||
FvhAiGjaW9OevuG3dGJLVNWhnZA3e38zcLDpojI/5qmNsmbnH8vBxTX/4WtdFi+N
|
||||
aSVnKREPjet7Vm2559Bw8X5nNlw0u76uStdB7gTsU8eZ9fpkIIxpYzYmbBP39SeK
|
||||
K5NK7fBUQ1vjYTc6MY5bBFMJfjZN7gEjhWOUhVdB4juLcHc42QF5wx62L+rWVYmE
|
||||
pckTkfo4JyBzg6v6FeLiXPw937U8esMBXHK7Tu9F5FpC4la1qJiEckKPr1P0kIgU
|
||||
z8brOuFeBXnXpn0JR4DG49W2SqzurTSnCW+3N6YGmIPUX+nh6Pa8w2ZqUO/P65a2
|
||||
d1Aehi0OCBFZFVIwXF+f8PLLZlD8g5Ki53NZNyBNcQlnpk2JDvRMr+cuYXfKlU1a
|
||||
dx84FlMnOAd3CPHMHSHgNJ0wZVm0t2eXrCthrlyqwei/0ozTmMZUBd5eCKLcgv/H
|
||||
SSV7AEMKWy+pa2uyXG+R9rrdMD86D7Bt1bZh1X7I21YUN0z8MBX0xzZVg5neCNuU
|
||||
FognmkuvCgnuHlIra+S6Tk+zLby2Fbwl0KEJvyTpKZTs4jBznoyOp1s/69fVOfsX
|
||||
ZZawwqkAqG48a6yVZ/DuFKysTVqlA0ZsjGLSEzUZN9Cu7P+NbdJrUpwU0OB4
|
||||
-----END CERTIFICATE-----
|
|
@ -0,0 +1,52 @@
|
|||
-----BEGIN PRIVATE KEY-----
|
||||
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDIJAbvi8lfMWoS
|
||||
Oh0XJcQTenL0prfq08dzAWodQska+rbl4O2loccv/VCF7UYEQuI0RWYgkJ0eCrF4
|
||||
jBpQC+zAPjHCoEkE0YJnR1ewhtI859acC7hYDwDpXpYZoGJqdf4Al50tVdB0pYIo
|
||||
AxmIqqnpTpsqAEyQzZVly1dw74cXkrlgW0zfaPk2McqWiOLYFDYP4qqy+Wigmp9x
|
||||
1Whhs2iWfwMjGJcpRMODxz/6F/kTcM83mzv7KgVKaiGZUGnZgsxpuUFxkVUljJke
|
||||
o1basJbjBlSQ/V5EK9qW6UQ/fz9aKcFTJ7NaZhIni27JTEJwBzbjRB/TAve9Sy8h
|
||||
vWLpFv9WM+/xhtOvQcRyQlairXwFcAczO8aN4KoxKAaKKK3vqDBiwGfPCdCI6+Mm
|
||||
11AsjKuZIU4u5tJl0VA97B50BPWAkCYhd2RI85K8QUb9gf7DbEZU+sbEcBJgEcEt
|
||||
nduHyElpjMAWwbdjQabqPH2T1jORIqK3tP8jgK1K+M5TrCqTon/2zroOMGS/e42g
|
||||
vmiCvOZI9+czOhk36fW1LeBtv2zAvtGXCpkP++v7a7viPH2tpirC1O1SrpstSpBR
|
||||
hDnfgL+tXk21Rl7E2gIAhX+Ko8RBc/XW7G/hwW7GqCQ1tJyAMx0MeGfqSbbVbgwI
|
||||
J4v1k+lUkjLXmb9w2SHbgbOe4QTLjwIDAQABAoICAB7N5L9j7YeYTHInvah9aJNy
|
||||
6lSbgH1FQVKDKjj8uYVMh3AUUZ+HqefJ/mXOolMvlC9laxWiDHy+OpiKP9aIL1Vb
|
||||
fT8uem6ibIbG5UlHRv6W1GJKL4JmNMa2hzXEiMFIDeM7craymZYKj2DnMTvmwKYn
|
||||
Mhyh1ScIbXEwffHk/A71x1B8XPWZ65maykqnIPsPCU8inRFU7/SgN+BGb31yJqvb
|
||||
OrlhJIr2iX0z4rX0kKKcX1h4rR+4VP4iHa/CP7h5uEqhd+Ap9UgFPuAHVevs+BxT
|
||||
Mhrq1GJ7uXY2ywlW5YJUIOxSlPlZ8nthq5iSAzvI8HrEVn2c3FKnSsbPpnSn1H7D
|
||||
IjiYISBbv0nJSne66Ew9scahQdaVmZa2B7d/w0zRpck58dTh2Hz/832+N2HiuLyX
|
||||
oCZJ3WM7kIAe8p//1VMWndFR2bcTbTA0UCVu3KJKC6Jyyhbnk1AGNsi7kl+En9C+
|
||||
u5nLucrdjfd1wH3WOkgdY3FU3Qs65mXC6OMvHRWyJdG+sdOGREqdYE2CFVURwfWH
|
||||
t40gfqLRn3yy+ziDZifBcLgZ6gH13TYNw/YH74D/dxziKLbROK4YNczKnP2Y50r1
|
||||
rWM8e+9fwgNKGVzew3Kj0zCJtRrsceV8AocAs/PGsKJGNATdnnkmYtlzyc2qexDW
|
||||
1LIN9h1S7s7RG4QN/crBAoIBAQD35Bh6CrpfwXPrk+nLMnt/GDSyx3EihRHaDDqV
|
||||
lw5woQlkWrIaMxGpGenXXoH82bk/juohriiaEMnJM2lxzr++WWAos/RNVG6P7bPc
|
||||
DmfG2GT4Ta9aGiQs/LzcW2I3dfqUbUNYGIExY/r0XAY+i7LdpWZS5KHTd4O73zD1
|
||||
QnejSVqRxOQrYeT8NHqOvjdtw+ccHA0VUKgBBlCdjcf+FHbyU91iAlp3fQSHlU8v
|
||||
AYSvk7h4kEcsochG1CavqU63qbcGTQWRhmaC0SBUguH5A4BYVjkVWnae2YDGoWQS
|
||||
+Yg2dnvQfSOGVJ5GV1EQ+5J2Vsfof/lsL9NJQEoTjoyiI5FhAoIBAQDOsA7lTVJ1
|
||||
jMn+B0vYaf68hmx6HMjadrvg6ZkPgNk5Uja5Sv3uSTX5c/9PdDBbudUcoikuui1N
|
||||
5JQnUK+0pMnOJcl2aAb1xmvoG7LlQiA9294hxvqZMzMzWKGGkUACy6H34iD2j9F0
|
||||
621FcS2XCysZx6xioIGglKeBmAGlNebFVe5TqFXy2CSwdYarCZ1VGQKRYTHeIj6J
|
||||
oOMENNB6ZJ5fX7aY01FZT1GSWmdnL9iwimSNNAhjQLO+YFhmoKaQQ7l1toFRBkH5
|
||||
dKmSja0n6kOzzTA64jzuVPbAPROWChj9LFb5H4M9BH702JSBZ2nichtSbnLOqfOs
|
||||
JnQekpQSn1LvAoIBAQDf9ZoPmOWtYZAjhG0zghaFSw9BfmM+ds8cGvRK9kC7jSJ5
|
||||
Il/Kv9zy1FCqnd3+3Y46WBo796cDGqvUNbjMc6hUh1cTLxJHU0LYkj9vTyx/QD5o
|
||||
/3avhvKsGmNfCsj/pn2P3+96Bhmiz9uJLiMOGxSsn6SEu79g2JeSAyGuVDDWu40y
|
||||
KZqjfzxsh9U6ZayaZOXGRamkWkyPMG9hCRlo+oBEi3R1+f5V+gM/o6v4ofyIzINb
|
||||
ma5UKo5RP5b8GZDe6lxLOwcO5Uh0ZBA7ikwyt/Ea3juQiTymY4eu7V0Gr59a5U0T
|
||||
nhucX5Lnpje9iixW8iyGaCimj8bqZUUHykBQtKXBAoIBAFurlH+5IqiGUBR+EfKj
|
||||
WFsvV691UtQqMzwW/07z++RDhYf7LdLg37KK8yK/Sq90JYQ0nAVgh7Vzew5Q6A07
|
||||
xVHMSqVckDGz1qo0lsy93mTxPn1GrmECZ2QPnFx90aErxeOWhL42nVS5ElbpUqoa
|
||||
RvyBJgD8ZWHebMi6rYgj9v1xFmo+UBiMKwGkrpzvf7t9gzkNnbuC/q+2DtoPvqN6
|
||||
Ow/b+LWhjAQLfQdnV1NZ0kbCqsRB3rJ+wPnf63VhLV7w2rHNx18zYlGMn6Ujdzgr
|
||||
2+lESW7kZtfiESrELAqw4dJwNwb5JhELDG/2Gy+luT25FEskN4FXuX6R85CXvFri
|
||||
FTsCggEAc6+QIK08PokuEahwloqHq4lg/0tCLAJ5lQTAvIeZaVvEFb0ZfFXP10EB
|
||||
uK18j3re6+L/in0VHmmFLabieCoMDjoQZRgiyUcViK+dDw4/Fi2fJMUyb5PMivt6
|
||||
DQMqiZTneAh64efz0x298hmaxjlbRedvXrUX1lKceq9JieyDxExyryW+ec045KxD
|
||||
j+OYtLb2Q+EnCaw5TcvI7+pZLIHVbvQihr/dESbMysim43/E/C5D3Hlf0xpG5f1r
|
||||
D57kjAEuRNjEjO4+bekLds1jHKWGJV3HLmilJLzMXL6XlERiNywhbRj+NwKc+m6I
|
||||
x9XWsNIBcfQ7w+HKrnw9p0tl8RpCgQ==
|
||||
-----END PRIVATE KEY-----
|
|
@ -0,0 +1,38 @@
|
|||
{
|
||||
"count": 765438,
|
||||
"results": [
|
||||
{
|
||||
"id": "123",
|
||||
"title": "Something bad happened",
|
||||
"status": 1,
|
||||
"machine": "yossi-pc",
|
||||
"host": {
|
||||
"id": "yossi_comp",
|
||||
"name": "Yossi's comp",
|
||||
"domain": "HEXADITE"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "234",
|
||||
"title": "A process rewrote Windows!",
|
||||
"status": 2,
|
||||
"machine": "yossi-pc",
|
||||
"host": {
|
||||
"id": "yossi_comp",
|
||||
"name": "Yossi's comp",
|
||||
"domain": "HEXADITE"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "345",
|
||||
"title": "A process did something. You won't believe what happened next!",
|
||||
"status": 1,
|
||||
"machine": "test-lab",
|
||||
"host": {
|
||||
"id": "yossi_comp",
|
||||
"name": "Yossi's comp",
|
||||
"domain": "HEXADITE"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"id": "123",
|
||||
"title": "Something bad happened",
|
||||
"status": 1,
|
||||
"machine": "yossi-pc",
|
||||
"host": {
|
||||
"id": "yossi_comp",
|
||||
"name": "Yossi's comp",
|
||||
"domain": "HEXADITE"
|
||||
}
|
||||
}
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"results": [
|
||||
{
|
||||
"id": 1,
|
||||
"name": "Open",
|
||||
"category": "primary"
|
||||
},
|
||||
{
|
||||
"id": 2,
|
||||
"name": "Investigated",
|
||||
"category": "success"
|
||||
},
|
||||
{
|
||||
"id": 3,
|
||||
"name": "Failed",
|
||||
"category": "error"
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"data": [
|
||||
{
|
||||
"count": 9,
|
||||
"value": "Max-PC"
|
||||
},
|
||||
{
|
||||
"count": 4,
|
||||
"value": "NAS"
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": "Skynet"
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,41 @@
|
|||
{
|
||||
"count": 1,
|
||||
"next": null,
|
||||
"previous": null,
|
||||
"results": [
|
||||
{
|
||||
"id": 397,
|
||||
"host_ip": null,
|
||||
"host_name": "WIN7-X64-1.auto.lab",
|
||||
"group": "auto.lab",
|
||||
"investigation_id": 19,
|
||||
"approval_status": 1,
|
||||
"execution_status": 130,
|
||||
"name": "Wait for Host Resource",
|
||||
"category": "Network",
|
||||
"created": 1465211571519,
|
||||
"status": 5,
|
||||
"details": "Waits for host (auto.lab)WIN7-X64-1@None resource.",
|
||||
"comment_count": 0,
|
||||
"duration": 0,
|
||||
"pending_duration": 0.0
|
||||
},
|
||||
{
|
||||
"id": 39732,
|
||||
"host_ip": null,
|
||||
"host_name": "WIN7-X64-2",
|
||||
"group": "auto.lab",
|
||||
"investigation_id": 19,
|
||||
"approval_status": 1,
|
||||
"execution_status": 130,
|
||||
"name": "Wait for Host Resource",
|
||||
"category": "Network",
|
||||
"created": 1465211571519,
|
||||
"status": 5,
|
||||
"details": "Waits for host (auto.sdfdsfddslab)WIN7-X64-1@None resource.",
|
||||
"comment_count": 0,
|
||||
"duration": 331,
|
||||
"pending_duration": 0.0
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,372 @@
|
|||
{
|
||||
"count": 127,
|
||||
"next": "https://172.16.2.201/api/investigation/all?ordering=-start_date&page=2&page_size=15&start_date=week",
|
||||
"previous": null,
|
||||
"results": [
|
||||
{
|
||||
"id": 17,
|
||||
"names": [
|
||||
"User Initiated - Endpoint Investigation"
|
||||
],
|
||||
"start_date": "2017-02-13T09:46:02.284385Z",
|
||||
"end_date": null,
|
||||
"affected_hosts": [
|
||||
"WIN10-X86.auto.lab",
|
||||
"YOSSI-PC.domains.lab",
|
||||
"Asdfdsfdsfdsfsdfsdf.auto.lab",
|
||||
"sdfsdf0-=23232323r3243.auto.lab",
|
||||
"234823fdsfdsdsfsd.auto.lab",
|
||||
"aSDFDSFSDFSDF__asdfdsfsd.auto.lab"
|
||||
],
|
||||
"affected_groups": [
|
||||
"New Group"
|
||||
],
|
||||
"affected_users": [
|
||||
"AUTO\\bingo",
|
||||
"AUTO\\max-admin"
|
||||
],
|
||||
"total_actions": 7,
|
||||
"remediation_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "List all drivers installed on (New Group)WIN10-X86@2.0.0.8.",
|
||||
"is_remediation": false,
|
||||
"id": 433,
|
||||
"name": "Get Driver List"
|
||||
},
|
||||
"important": true,
|
||||
"detection_system": 66,
|
||||
"error_description": "",
|
||||
"status": 0,
|
||||
"user": "",
|
||||
"comments": 0,
|
||||
"threat_types": [],
|
||||
"running_time": 43.462507,
|
||||
"host_groups": [
|
||||
"New Group"
|
||||
],
|
||||
"requested_status": null,
|
||||
"reasons": null,
|
||||
"created_by": [
|
||||
"administrator"
|
||||
],
|
||||
"is_cleanup_applied": false
|
||||
},
|
||||
{
|
||||
"id": 16,
|
||||
"names": [
|
||||
"User Initiated - Suspicious User Logon"
|
||||
],
|
||||
"start_date": "2017-02-13T09:23:52.902470Z",
|
||||
"end_date": null,
|
||||
"affected_hosts": [],
|
||||
"affected_groups": [],
|
||||
"affected_users": [],
|
||||
"total_actions": 2,
|
||||
"remediation_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Ask for approval to start investigations on [(u'Win10-x86.Auto.Lab', '2.0.0.8'), (u'win8-x86.Auto.Lab', '2.0.0.14'), (u'win81-x64.Auto.Lab', '2.0.0.3'), (u'win10-x64.Auto.Lab', '2.0.0.12')]",
|
||||
"is_remediation": false,
|
||||
"id": 426,
|
||||
"name": "Start investigation on multiple endpoints"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": 44,
|
||||
"error_description": "",
|
||||
"status": 2,
|
||||
"user": "",
|
||||
"comments": 0,
|
||||
"threat_types": [],
|
||||
"running_time": 1372.94382,
|
||||
"host_groups": [],
|
||||
"requested_status": null,
|
||||
"reasons": null,
|
||||
"created_by": [
|
||||
"administrator"
|
||||
],
|
||||
"is_cleanup_applied": false
|
||||
},
|
||||
{
|
||||
"id": 18,
|
||||
"names": [
|
||||
"User Initiated - Endpoint Investigation"
|
||||
],
|
||||
"start_date": "2017-04-12T08:24:00.243260Z",
|
||||
"end_date": null,
|
||||
"affected_hosts": [
|
||||
"YOSSI-TEST.domains.lab"
|
||||
],
|
||||
"affected_groups": [
|
||||
null
|
||||
],
|
||||
"affected_users": [],
|
||||
"total_actions": 2,
|
||||
"remediation_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Check if is covered YOSSI-TEST.aaa",
|
||||
"is_remediation": false,
|
||||
"id": 871,
|
||||
"name": "Check Endpoint Coverage"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": 14,
|
||||
"error_description": "(None)YOSSI-TEST@None is not found in Active Directory,Endpoint YOSSI-TEST NOT found in DNS",
|
||||
"status": 2,
|
||||
"user": "",
|
||||
"number_of_comments": 0,
|
||||
"threat_types": null,
|
||||
"running_time": 871.02117,
|
||||
"host_groups": [
|
||||
null
|
||||
],
|
||||
"requested_status": null,
|
||||
"external_sources": [
|
||||
13
|
||||
],
|
||||
"reasons": [
|
||||
"Endpoint does not exist in the Active Directory"
|
||||
],
|
||||
"created_by": [
|
||||
"administrator"
|
||||
],
|
||||
"tags": [],
|
||||
"is_cleanup_applied": false
|
||||
},
|
||||
{
|
||||
"id": 15,
|
||||
"names": [
|
||||
"User Initiated - Endpoint Investigation"
|
||||
],
|
||||
"start_date": "2017-02-13T09:22:23.215976Z",
|
||||
"end_date": "2017-02-13T09:22:35.396399Z",
|
||||
"affected_hosts": [
|
||||
"BINGO.domains.lab"
|
||||
],
|
||||
"affected_groups": [
|
||||
null
|
||||
],
|
||||
"affected_users": [],
|
||||
"total_actions": 2,
|
||||
"remediation_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Check if bingo is covered.",
|
||||
"is_remediation": false,
|
||||
"id": 424,
|
||||
"name": "Check Endpoint Coverage"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": 44,
|
||||
"error_description": "",
|
||||
"status": 4,
|
||||
"user": "administrator",
|
||||
"comments": 1,
|
||||
"threat_types": [],
|
||||
"running_time": 12.180423,
|
||||
"host_groups": [
|
||||
null
|
||||
],
|
||||
"requested_status": 4,
|
||||
"reasons": [
|
||||
"The investigation is malfunctioning"
|
||||
],
|
||||
"created_by": [
|
||||
"administrator"
|
||||
],
|
||||
"is_cleanup_applied": false
|
||||
},
|
||||
{
|
||||
"id": 14,
|
||||
"names": [
|
||||
"Bay Dynamics Suspicious User Critical"
|
||||
],
|
||||
"start_date": "2017-02-12T07:06:24.868210Z",
|
||||
"end_date": "2017-02-12T07:11:27.054782Z",
|
||||
"affected_hosts": [],
|
||||
"affected_groups": [],
|
||||
"affected_users": [],
|
||||
"total_actions": 1,
|
||||
"remediation_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Ask for approval for DLP investigation for user [u'lateral']",
|
||||
"is_remediation": false,
|
||||
"id": 422,
|
||||
"name": "Initiate DLP Investigation"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": 65,
|
||||
"error_description": "External Source product Limit User Privileges is not defined,Missing service source Limit User Privileges, can not run the DLP investigation",
|
||||
"status": 1,
|
||||
"user": "",
|
||||
"comments": 1,
|
||||
"threat_types": [],
|
||||
"running_time": 302.186572,
|
||||
"host_groups": [],
|
||||
"requested_status": null,
|
||||
"reasons": [
|
||||
"External source is not defined",
|
||||
"Pending action exceeded timeout"
|
||||
],
|
||||
"created_by": [
|
||||
null
|
||||
],
|
||||
"is_cleanup_applied": false
|
||||
},
|
||||
{
|
||||
"id": 9,
|
||||
"names": [
|
||||
"User Initiated - Endpoint Investigation"
|
||||
],
|
||||
"start_date": "2017-02-09T09:27:54.326390Z",
|
||||
"end_date": "2017-02-09T09:48:31.120821Z",
|
||||
"affected_hosts": [
|
||||
"WIN7-ULT-X86.domains.lab"
|
||||
],
|
||||
"affected_groups": [
|
||||
"New Group"
|
||||
],
|
||||
"affected_users": [
|
||||
"AUTO\\bingo",
|
||||
"AUTO\\lateral"
|
||||
],
|
||||
"total_actions": 29,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\desktop\\trojan.exe\".",
|
||||
"id": 275,
|
||||
"name": "Quarantine a File"
|
||||
}
|
||||
],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Waits for (New Group)WIN7-ULT-X86@2.0.0.22 resource.",
|
||||
"is_remediation": false,
|
||||
"id": 276,
|
||||
"name": "Wait for Endpoint Resource"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": 44,
|
||||
"error_description": "Error reaching network endpoint (New Group)WIN7-ULT-X86@2.0.0.22 ,[Errno Connection error (2.0.0.22:445)] [Errno 113] No route to host",
|
||||
"status": 3,
|
||||
"user": "",
|
||||
"comments": 1,
|
||||
"threat_types": [
|
||||
0
|
||||
],
|
||||
"running_time": 1236.794431,
|
||||
"host_groups": [
|
||||
"New Group"
|
||||
],
|
||||
"requested_status": null,
|
||||
"reasons": [
|
||||
"Pending action exceeded timeout",
|
||||
"Endpoint is not reachable"
|
||||
],
|
||||
"created_by": [
|
||||
"administrator"
|
||||
],
|
||||
"is_cleanup_applied": false
|
||||
},
|
||||
{
|
||||
"id": 3,
|
||||
"names": [
|
||||
"User Initiated - Endpoint Investigation"
|
||||
],
|
||||
"start_date": "2017-02-08T14:27:18.300693Z",
|
||||
"end_date": "2017-02-08T14:33:42.445535Z",
|
||||
"affected_hosts": [
|
||||
"WIN7-ULT-X86.domains.lab"
|
||||
],
|
||||
"affected_groups": [
|
||||
"New Group"
|
||||
],
|
||||
"affected_users": [
|
||||
"AUTO\\bingo",
|
||||
"AUTO\\lateral"
|
||||
],
|
||||
"total_actions": 115,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\exploit.exe\".",
|
||||
"id": 157,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\rootkit.exe\".",
|
||||
"id": 155,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\hoax.exe\".",
|
||||
"id": 114,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\adware.exe\".",
|
||||
"id": 113,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\יוניקוד.exe\".",
|
||||
"id": 108,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\trojan.exe\".",
|
||||
"id": 100,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\new_mal.exe\".",
|
||||
"id": 104,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\heuristic.exe\".",
|
||||
"id": 103,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\generic.exe\".",
|
||||
"id": 110,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\worm.exe\".",
|
||||
"id": 106,
|
||||
"name": "Quarantine a File"
|
||||
}
|
||||
],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Wait on a complete report for 6d192dc5e1a3c539b1f302fb9f896ffdb688be3e.",
|
||||
"is_remediation": false,
|
||||
"id": 159,
|
||||
"name": "Wait for Cloud Analysis Report"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": 44,
|
||||
"error_description": "",
|
||||
"status": 6,
|
||||
"user": "",
|
||||
"comments": 10,
|
||||
"threat_types": [
|
||||
0,
|
||||
1
|
||||
],
|
||||
"running_time": 384.144842,
|
||||
"host_groups": [
|
||||
"New Group"
|
||||
],
|
||||
"requested_status": null,
|
||||
"reasons": null,
|
||||
"created_by": [
|
||||
"administrator"
|
||||
],
|
||||
"is_cleanup_applied": false
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,372 @@
|
|||
{
|
||||
"count": 127,
|
||||
"next": "https://172.16.2.201/api/investigation/all?ordering=-start_date&page=2&page_size=15&start_date=week",
|
||||
"previous": null,
|
||||
"results": [
|
||||
{
|
||||
"id": 17,
|
||||
"names": [
|
||||
"User Initiated - Endpoint Investigation"
|
||||
],
|
||||
"start_date": "2017-02-13T09:46:02.284385Z",
|
||||
"end_date": null,
|
||||
"affected_hosts": [
|
||||
"WIN10-X86.auto.lab",
|
||||
"YOSSI-PC.domains.lab",
|
||||
"Asdfdsfdsfdsfsdfsdf.auto.lab",
|
||||
"sdfsdf0-=23232323r3243.auto.lab",
|
||||
"234823fdsfdsdsfsd.auto.lab",
|
||||
"aSDFDSFSDFSDF__asdfdsfsd.auto.lab"
|
||||
],
|
||||
"affected_groups": [
|
||||
"New Group"
|
||||
],
|
||||
"affected_users": [
|
||||
"AUTO\\bingo",
|
||||
"AUTO\\max-admin"
|
||||
],
|
||||
"total_actions": 7,
|
||||
"remediation_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "List all drivers installed on (New Group)WIN10-X86@2.0.0.8.",
|
||||
"is_remediation": false,
|
||||
"id": 433,
|
||||
"name": "Get Driver List"
|
||||
},
|
||||
"important": true,
|
||||
"detection_system": 66,
|
||||
"error_description": "",
|
||||
"status": 0,
|
||||
"user": "",
|
||||
"comments": 0,
|
||||
"threat_types": [],
|
||||
"running_time": 43.462507,
|
||||
"host_groups": [
|
||||
"New Group"
|
||||
],
|
||||
"requested_status": null,
|
||||
"reasons": null,
|
||||
"created_by": [
|
||||
"administrator"
|
||||
],
|
||||
"is_cleanup_applied": false
|
||||
},
|
||||
{
|
||||
"id": 16,
|
||||
"names": [
|
||||
"User Initiated - Suspicious User Logon"
|
||||
],
|
||||
"start_date": "2017-02-13T09:23:52.902470Z",
|
||||
"end_date": null,
|
||||
"affected_hosts": [],
|
||||
"affected_groups": [],
|
||||
"affected_users": [],
|
||||
"total_actions": 2,
|
||||
"remediation_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Ask for approval to start investigations on [(u'Win10-x86.Auto.Lab', '2.0.0.8'), (u'win8-x86.Auto.Lab', '2.0.0.14'), (u'win81-x64.Auto.Lab', '2.0.0.3'), (u'win10-x64.Auto.Lab', '2.0.0.12')]",
|
||||
"is_remediation": false,
|
||||
"id": 426,
|
||||
"name": "Start investigation on multiple endpoints"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": 44,
|
||||
"error_description": "",
|
||||
"status": 2,
|
||||
"user": "",
|
||||
"comments": 0,
|
||||
"threat_types": [],
|
||||
"running_time": 1372.94382,
|
||||
"host_groups": [],
|
||||
"requested_status": null,
|
||||
"reasons": null,
|
||||
"created_by": [
|
||||
"administrator"
|
||||
],
|
||||
"is_cleanup_applied": false
|
||||
},
|
||||
{
|
||||
"id": 18,
|
||||
"names": [
|
||||
"User Initiated - Endpoint Investigation"
|
||||
],
|
||||
"start_date": "2017-04-12T08:24:00.243260Z",
|
||||
"end_date": null,
|
||||
"affected_hosts": [
|
||||
"YOSSI-TEST.domains.lab"
|
||||
],
|
||||
"affected_groups": [
|
||||
null
|
||||
],
|
||||
"affected_users": [],
|
||||
"total_actions": 2,
|
||||
"remediation_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Check if is covered YOSSI-TEST.aaa",
|
||||
"is_remediation": false,
|
||||
"id": 871,
|
||||
"name": "Check Endpoint Coverage"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": 14,
|
||||
"error_description": "(None)YOSSI-TEST@None is not found in Active Directory,Endpoint YOSSI-TEST NOT found in DNS",
|
||||
"status": 2,
|
||||
"user": "",
|
||||
"number_of_comments": 0,
|
||||
"threat_types": null,
|
||||
"running_time": 871.02117,
|
||||
"host_groups": [
|
||||
null
|
||||
],
|
||||
"requested_status": null,
|
||||
"external_sources": [
|
||||
13
|
||||
],
|
||||
"reasons": [
|
||||
"Endpoint does not exist in the Active Directory"
|
||||
],
|
||||
"created_by": [
|
||||
"administrator"
|
||||
],
|
||||
"tags": [],
|
||||
"is_cleanup_applied": false
|
||||
},
|
||||
{
|
||||
"id": 15,
|
||||
"names": [
|
||||
"User Initiated - Endpoint Investigation"
|
||||
],
|
||||
"start_date": "2017-02-13T09:22:23.215976Z",
|
||||
"end_date": "2017-02-13T09:22:35.396399Z",
|
||||
"affected_hosts": [
|
||||
"BINGO.domains.lab"
|
||||
],
|
||||
"affected_groups": [
|
||||
null
|
||||
],
|
||||
"affected_users": [],
|
||||
"total_actions": 2,
|
||||
"remediation_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Check if bingo is covered.",
|
||||
"is_remediation": false,
|
||||
"id": 424,
|
||||
"name": "Check Endpoint Coverage"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": 44,
|
||||
"error_description": "",
|
||||
"status": 4,
|
||||
"user": "administrator",
|
||||
"comments": 1,
|
||||
"threat_types": [],
|
||||
"running_time": 12.180423,
|
||||
"host_groups": [
|
||||
null
|
||||
],
|
||||
"requested_status": 4,
|
||||
"reasons": [
|
||||
"The investigation is malfunctioning"
|
||||
],
|
||||
"created_by": [
|
||||
"administrator"
|
||||
],
|
||||
"is_cleanup_applied": false
|
||||
},
|
||||
{
|
||||
"id": 14,
|
||||
"names": [
|
||||
"Bay Dynamics Suspicious User Critical"
|
||||
],
|
||||
"start_date": "2017-02-12T07:06:24.868210Z",
|
||||
"end_date": "2017-02-12T07:11:27.054782Z",
|
||||
"affected_hosts": [],
|
||||
"affected_groups": [],
|
||||
"affected_users": [],
|
||||
"total_actions": 1,
|
||||
"remediation_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Ask for approval for DLP investigation for user [u'lateral']",
|
||||
"is_remediation": false,
|
||||
"id": 422,
|
||||
"name": "Initiate DLP Investigation"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": 65,
|
||||
"error_description": "External Source product Limit User Privileges is not defined,Missing service source Limit User Privileges, can not run the DLP investigation",
|
||||
"status": 1,
|
||||
"user": "",
|
||||
"comments": 1,
|
||||
"threat_types": [],
|
||||
"running_time": 302.186572,
|
||||
"host_groups": [],
|
||||
"requested_status": null,
|
||||
"reasons": [
|
||||
"External source is not defined",
|
||||
"Pending action exceeded timeout"
|
||||
],
|
||||
"created_by": [
|
||||
null
|
||||
],
|
||||
"is_cleanup_applied": false
|
||||
},
|
||||
{
|
||||
"id": 9,
|
||||
"names": [
|
||||
"User Initiated - Endpoint Investigation"
|
||||
],
|
||||
"start_date": "2017-02-09T09:27:54.326390Z",
|
||||
"end_date": "2017-02-09T09:48:31.120821Z",
|
||||
"affected_hosts": [
|
||||
"WIN7-ULT-X86.domains.lab"
|
||||
],
|
||||
"affected_groups": [
|
||||
"New Group"
|
||||
],
|
||||
"affected_users": [
|
||||
"AUTO\\bingo",
|
||||
"AUTO\\lateral"
|
||||
],
|
||||
"total_actions": 29,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\desktop\\trojan.exe\".",
|
||||
"id": 275,
|
||||
"name": "Quarantine a File"
|
||||
}
|
||||
],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Waits for (New Group)WIN7-ULT-X86@2.0.0.22 resource.",
|
||||
"is_remediation": false,
|
||||
"id": 276,
|
||||
"name": "Wait for Endpoint Resource"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": 44,
|
||||
"error_description": "Error reaching network endpoint (New Group)WIN7-ULT-X86@2.0.0.22 ,[Errno Connection error (2.0.0.22:445)] [Errno 113] No route to host",
|
||||
"status": 3,
|
||||
"user": "",
|
||||
"comments": 1,
|
||||
"threat_types": [
|
||||
0
|
||||
],
|
||||
"running_time": 1236.794431,
|
||||
"host_groups": [
|
||||
"New Group"
|
||||
],
|
||||
"requested_status": null,
|
||||
"reasons": [
|
||||
"Pending action exceeded timeout",
|
||||
"Endpoint is not reachable"
|
||||
],
|
||||
"created_by": [
|
||||
"administrator"
|
||||
],
|
||||
"is_cleanup_applied": false
|
||||
},
|
||||
{
|
||||
"id": 3,
|
||||
"names": [
|
||||
"User Initiated - Endpoint Investigation"
|
||||
],
|
||||
"start_date": "2017-02-08T14:27:18.300693Z",
|
||||
"end_date": "2017-02-08T14:33:42.445535Z",
|
||||
"affected_hosts": [
|
||||
"WIN7-ULT-X86.domains.lab"
|
||||
],
|
||||
"affected_groups": [
|
||||
"New Group"
|
||||
],
|
||||
"affected_users": [
|
||||
"AUTO\\bingo",
|
||||
"AUTO\\lateral"
|
||||
],
|
||||
"total_actions": 115,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\exploit.exe\".",
|
||||
"id": 157,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\rootkit.exe\".",
|
||||
"id": 155,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\hoax.exe\".",
|
||||
"id": 114,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\adware.exe\".",
|
||||
"id": 113,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\יוניקוד.exe\".",
|
||||
"id": 108,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\trojan.exe\".",
|
||||
"id": 100,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\new_mal.exe\".",
|
||||
"id": 104,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\heuristic.exe\".",
|
||||
"id": 103,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\generic.exe\".",
|
||||
"id": 110,
|
||||
"name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\worm.exe\".",
|
||||
"id": 106,
|
||||
"name": "Quarantine a File"
|
||||
}
|
||||
],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Wait on a complete report for 6d192dc5e1a3c539b1f302fb9f896ffdb688be3e.",
|
||||
"is_remediation": false,
|
||||
"id": 159,
|
||||
"name": "Wait for Cloud Analysis Report"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": 44,
|
||||
"error_description": "",
|
||||
"status": 6,
|
||||
"user": "",
|
||||
"comments": 10,
|
||||
"threat_types": [
|
||||
0,
|
||||
1
|
||||
],
|
||||
"running_time": 384.144842,
|
||||
"host_groups": [
|
||||
"New Group"
|
||||
],
|
||||
"requested_status": null,
|
||||
"reasons": null,
|
||||
"created_by": [
|
||||
"administrator"
|
||||
],
|
||||
"is_cleanup_applied": false
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"count": 3,
|
||||
"last_investigation": {
|
||||
"description": "Suspicios Connection",
|
||||
"id": 123
|
||||
}
|
||||
}
|
|
@ -0,0 +1,142 @@
|
|||
{
|
||||
"id": 77827,
|
||||
"name": "heuristic.exe",
|
||||
"host": "WIN7_X64_1.auto.lab",
|
||||
"entity_status": 0,
|
||||
"mime_type": "application/x-msdownload",
|
||||
"size": 118272,
|
||||
"md5": "75bf743733d2b4c58e847a2ca7caad88",
|
||||
"sha1": "06804407dfb97b8396f92dd3198d2badcc0c6440",
|
||||
"created_time": "2016-11-14T15:58:05Z",
|
||||
"directory_path": "c:\\users\\administrator\\downloads\\malwares",
|
||||
"report": {
|
||||
"status": 1,
|
||||
"providers": [
|
||||
{
|
||||
"status": "infected",
|
||||
"source": "HexaAV Cloud",
|
||||
"private_id": 75675,
|
||||
"detected_by": "Ahnlab, ESET, VirusBlokAda, Zillya!, F-prot, BitDefender, Agnitum, McAfee, Avira, ThreatTrack, Ikarus, K7, AVG"
|
||||
},
|
||||
{
|
||||
"status": "infected",
|
||||
"source": "te.checkpoint.com",
|
||||
"summary": [
|
||||
"Malware detected ( Gen:Variant.Zusy.190302 )",
|
||||
"Behaves like a known malware ( Generic.MALWARE.6e69 )"
|
||||
]
|
||||
},
|
||||
{
|
||||
"status": "infected",
|
||||
"source": "wildfire.paloaltonetworks.com",
|
||||
"summary": [
|
||||
"Connected to a malicious IP",
|
||||
"Created an executable file in the Windows system folder",
|
||||
"Contains malicious file attributes",
|
||||
"Injected code into another process",
|
||||
"Modified the network hosts file",
|
||||
"Created or modified a file",
|
||||
"Modified Internet Explorer security settings",
|
||||
"Contains an invalid checksum",
|
||||
"Modified proxy settings for Internet Explorer",
|
||||
"Modified the Windows Registry to enable auto-start",
|
||||
"Contains sections with size discrepancies",
|
||||
"Attempted to sleep for a long period",
|
||||
"Copied itself",
|
||||
"Created an executable file in the Windows folder",
|
||||
"Started a process",
|
||||
"Modified the Windows Registry",
|
||||
"Modified connections settings for Internet Explorer",
|
||||
"Enumerated running processes",
|
||||
"Created or modified a file in the Windows system folder"
|
||||
]
|
||||
},
|
||||
{
|
||||
"status": "infected",
|
||||
"source": "www.metascan-online.com",
|
||||
"link": "https://www.metascan-online.com/scanresult/hash/06804407DFB97B8396F92DD3198D2BADCC0C6440",
|
||||
"detected_by": "F-prot, Antiy, McAfee, Baidu, VirusBlokAda, Zillya!, ClamAV, BitDefender, Agnitum, F-secure, VirIT, CYREN, Jiangmin, Avira, ThreatTrack, Fortinet, Microsoft, Ahnlab, ESET, NANO, Lavasoft, Filseclab, Ikarus, K7, AVG",
|
||||
"categories": "heuristic"
|
||||
},
|
||||
{
|
||||
"status": "infected",
|
||||
"source": "www.virustotal.com",
|
||||
"link": "https://www.virustotal.com/file/47247c3a133f49434f795c94adb95ebc2356de885d6e90f22f46932b2a76832d/analysis/1463325035/",
|
||||
"detected_by": "Bkav, MicroWorld-eScan, Malwarebytes, Zillya, K7AntiVirus, K7GW, TheHacker, F-Prot, ESET-NOD32, Avast, ClamAV, GData, Kaspersky, BitDefender, NANO-Antivirus, Ad-Aware, Emsisoft, F-Secure, VIPRE, Cyren, Jiangmin, Antiy-AVL, Arcabit, Microsoft, AhnLab-V3, ALYac, AVware, VBA32, Panda, Rising, Yandex, Ikarus, Fortinet, AVG, Qihoo-360",
|
||||
"categories": "heuristic"
|
||||
}
|
||||
]
|
||||
},
|
||||
"modified_time": "2016-04-21T09:42:48Z",
|
||||
"relations": [
|
||||
{
|
||||
"count": 1,
|
||||
"relation_types": [
|
||||
{
|
||||
"count": 1,
|
||||
"entities": [
|
||||
{
|
||||
"remediation_actions": null,
|
||||
"entity_status": 5,
|
||||
"id": 77896,
|
||||
"name": "heuristic.exe.1.quarantined.zip"
|
||||
}
|
||||
],
|
||||
"relation_name": "Quarantine",
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"sha256": "47247c3a133f49434f795c94adb95ebc2356de885d6e90f22f46932b2a76832d",
|
||||
"digital_signature": null,
|
||||
"behavior": {
|
||||
"files": {
|
||||
"deleted": [],
|
||||
"modified": [],
|
||||
"created": [
|
||||
"C:\\47247c3a133f49434f795c94adb95ebc2356de885d6e90f22f46932b2a76832d",
|
||||
"C:\\WINDOWS\\system32\\najort5g.exe",
|
||||
"C:\\WINDOWS\\najort5g.exe"
|
||||
]
|
||||
},
|
||||
"services": {
|
||||
"deleted": [],
|
||||
"modified": [],
|
||||
"created": []
|
||||
},
|
||||
"registry": {
|
||||
"deleted": [],
|
||||
"modified": [],
|
||||
"created": []
|
||||
},
|
||||
"network": {
|
||||
"http": [],
|
||||
"tcp": [],
|
||||
"dns": []
|
||||
}
|
||||
},
|
||||
"is_compressed": false,
|
||||
"is_packed": false,
|
||||
"is_read_only": false,
|
||||
"is_downloaded": false,
|
||||
"is_hidden": false,
|
||||
"investigation": {
|
||||
"investigation_id": 43,
|
||||
"title": "User Initiated - Endpoint Investigation"
|
||||
},
|
||||
"path": "c:\\users\\administrator\\downloads\\malwares\\heuristic.exe",
|
||||
"host_os": "Windows 7 Enterprise",
|
||||
"host_group": "New Group",
|
||||
"remediation_actions": null,
|
||||
"product_vendor": "",
|
||||
"status_details": null,
|
||||
"action": {
|
||||
"status": "approved",
|
||||
"type": "user",
|
||||
"user": "administrator",
|
||||
"action_type": 0
|
||||
},
|
||||
"acl_rule": null
|
||||
}
|
|
@ -0,0 +1,44 @@
|
|||
{
|
||||
"name": {
|
||||
"count": 1236,
|
||||
"values": [
|
||||
{
|
||||
"count": 2,
|
||||
"value": "compatprovider.dll"
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": "api-ms-win-core-errorhandling-l1-1-0.dll"
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": "compatprovider.dll.mui"
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": "api-ms-win-core-privateprofile-l1-1-0.dll"
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": "api-ms-win-core-rtlsupport-l1-1-0.dll"
|
||||
}
|
||||
]
|
||||
},
|
||||
"entity_status": {
|
||||
"count": 3,
|
||||
"values": [
|
||||
{
|
||||
"count": 1374,
|
||||
"value": 3
|
||||
},
|
||||
{
|
||||
"count": 7,
|
||||
"value": 4
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": 0
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"data": [
|
||||
{
|
||||
"count": 8,
|
||||
"value": "conhost.exe"
|
||||
},
|
||||
{
|
||||
"count": 3,
|
||||
"value": "cmd.exe"
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": "csrss.exe"
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,25 @@
|
|||
{
|
||||
"remediated": [
|
||||
{
|
||||
"entities": [
|
||||
{
|
||||
"host": "WIN7-X86-JAKE.auto.lab",
|
||||
"errors": [],
|
||||
"name": "$r6bq1c4.exe | c:\\$recycle.bin\\s-1-5-21-1697185450-2076875350-1481720747-500\\$r6bq1c4.exe",
|
||||
"action_type": 0,
|
||||
"threat_type": "Heuristic",
|
||||
"id": 182329
|
||||
},
|
||||
{
|
||||
"host": "WIN7-X86-JAKE.auto.lab",
|
||||
"errors": [],
|
||||
"name": "minimalware.exe | c:\\users\\bingo\\desktop\\minimalware.exe",
|
||||
"action_type": 0,
|
||||
"threat_type": "Trojan",
|
||||
"id": 182324
|
||||
}
|
||||
],
|
||||
"entity_type": 1
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,77 @@
|
|||
{
|
||||
"count": 52,
|
||||
"next": "http://172.110.0.200:8080/api/investigations/5/entities?page=2&type_id=2",
|
||||
"previous": null,
|
||||
"results": [
|
||||
{
|
||||
"name": "lsm.exe",
|
||||
"pid": 532,
|
||||
"entity_status": 1,
|
||||
"host": "WIN7-ULT-X86.auto.lab",
|
||||
"id": 5960
|
||||
},
|
||||
{
|
||||
"name": "cmd.exe",
|
||||
"pid": 3716,
|
||||
"entity_status": 1,
|
||||
"host": "WIN7-ULT-X86.auto.lab",
|
||||
"id": 5930
|
||||
},
|
||||
{
|
||||
"name": "dwm.exe",
|
||||
"pid": 3412,
|
||||
"entity_status": 1,
|
||||
"host": "WIN7-ULT-X86.auto.lab",
|
||||
"id": 5914
|
||||
},
|
||||
{
|
||||
"name": "cmd.exe",
|
||||
"pid": 3708,
|
||||
"entity_status": 1,
|
||||
"host": "WIN7-ULT-X86.auto.lab",
|
||||
"id": 5909
|
||||
},
|
||||
{
|
||||
"name": "conhost.exe",
|
||||
"pid": 1488,
|
||||
"entity_status": 1,
|
||||
"host": "WIN7-ULT-X86.auto.lab",
|
||||
"id": 5897
|
||||
},
|
||||
{
|
||||
"name": "winlogon.exe",
|
||||
"pid": 464,
|
||||
"entity_status": 1,
|
||||
"host": "WIN7-ULT-X86.auto.lab",
|
||||
"id": 5893
|
||||
},
|
||||
{
|
||||
"name": "MiniMalware3.exe",
|
||||
"pid": 2012,
|
||||
"entity_status": 4,
|
||||
"host": "WIN7-ULT-X86.auto.lab",
|
||||
"id": 5888
|
||||
},
|
||||
{
|
||||
"name": "taskhost.exe",
|
||||
"pid": 2692,
|
||||
"entity_status": 1,
|
||||
"host": "WIN7-ULT-X86.auto.lab",
|
||||
"id": 5864
|
||||
},
|
||||
{
|
||||
"name": "MiniMalware2.exe",
|
||||
"pid": 2852,
|
||||
"entity_status": 1,
|
||||
"host": "WIN7-ULT-X86.auto.lab",
|
||||
"id": 5859
|
||||
},
|
||||
{
|
||||
"name": "iexplore.exe",
|
||||
"pid": 1136,
|
||||
"entity_status": 1,
|
||||
"host": "WIN7-ULT-X86.auto.lab",
|
||||
"id": 5812
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"group": "HR",
|
||||
"id": 40,
|
||||
"ip": "192.168.2.121",
|
||||
"logged_in_users": [
|
||||
"Administrator"
|
||||
],
|
||||
"name": "Computer_2_121",
|
||||
"os": {
|
||||
"architecture": "64 Bit",
|
||||
"name": "Windows Server 2008 R2",
|
||||
"service_pack": null
|
||||
},
|
||||
"protection_level_type": 2,
|
||||
"protection_level_name": "Semi Psychedelic"
|
||||
}
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"data": [
|
||||
{
|
||||
"count": 9,
|
||||
"value": "Max-PC"
|
||||
},
|
||||
{
|
||||
"count": 4,
|
||||
"value": "NAS"
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": "Skynet"
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,187 @@
|
|||
{
|
||||
"group": {
|
||||
"count": 3,
|
||||
"values": [
|
||||
{
|
||||
"count": 895,
|
||||
"value": "Enterprise"
|
||||
},
|
||||
{
|
||||
"count": 452,
|
||||
"value": "Italy"
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": null
|
||||
}
|
||||
]
|
||||
},
|
||||
"name": {
|
||||
"count": 1349,
|
||||
"values": [
|
||||
{
|
||||
"count": 1,
|
||||
"value": "WIN7_X64_1.auto.lab"
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": "WIN7_X64_12.auto.lab"
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": "WIN7_X64_1111"
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": "D0398"
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": "D0366"
|
||||
}
|
||||
]
|
||||
},
|
||||
"investigation_id": {
|
||||
"count": 1331,
|
||||
"values": [
|
||||
{
|
||||
"count": 10,
|
||||
"value": 21411
|
||||
},
|
||||
{
|
||||
"count": 5,
|
||||
"value": 21643
|
||||
},
|
||||
{
|
||||
"count": 3,
|
||||
"value": 19814
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": 21251
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": 20969
|
||||
}
|
||||
]
|
||||
},
|
||||
"ip": {
|
||||
"count": 994,
|
||||
"values": [
|
||||
{
|
||||
"count": 298,
|
||||
"value": null
|
||||
},
|
||||
{
|
||||
"count": 3,
|
||||
"value": "172.22.71.22"
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": "10.0.111.2"
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": "10.0.111.5"
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": "10.113.75.94"
|
||||
}
|
||||
]
|
||||
},
|
||||
"is_unprotected": {
|
||||
"count": 1,
|
||||
"values": [
|
||||
{
|
||||
"count": 1349,
|
||||
"value": false
|
||||
}
|
||||
]
|
||||
},
|
||||
"protection_level_type": {
|
||||
"count": 3,
|
||||
"values": [
|
||||
{
|
||||
"count": 1347,
|
||||
"value": 1
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": 0
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": 4
|
||||
}
|
||||
]
|
||||
},
|
||||
"protection_level_name": {
|
||||
"count": 3,
|
||||
"values": [
|
||||
{
|
||||
"count": 1347,
|
||||
"value": "Semi Automated - Require Approval"
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": "Not Found"
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": "Not Protected"
|
||||
}
|
||||
]
|
||||
},
|
||||
"os": {
|
||||
"count": 15,
|
||||
"values": [
|
||||
{
|
||||
"count": 664,
|
||||
"value": "Windows 7 Enterprise"
|
||||
},
|
||||
{
|
||||
"count": 432,
|
||||
"value": "Windows 7 Professional"
|
||||
},
|
||||
{
|
||||
"count": 125,
|
||||
"value": "Windows 10 Enterprise"
|
||||
},
|
||||
{
|
||||
"count": 43,
|
||||
"value": "Windows XP Professional"
|
||||
},
|
||||
{
|
||||
"count": 34,
|
||||
"value": "Windows 8.1 Enterprise"
|
||||
}
|
||||
]
|
||||
},
|
||||
"id": {
|
||||
"count": 1349,
|
||||
"values": [
|
||||
{
|
||||
"count": 1,
|
||||
"value": 8734
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": 8988
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": 9047
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": 9272
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": 8691
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
|
@ -0,0 +1,59 @@
|
|||
{
|
||||
"count": 5,
|
||||
"next": null,
|
||||
"previous": null,
|
||||
"results": [
|
||||
{
|
||||
"id": 59,
|
||||
"name": "WIN7-ULT-X86.auto.lab",
|
||||
"ip": null,
|
||||
"group": 39,
|
||||
"investigation": 17,
|
||||
"os": {
|
||||
"id": 8,
|
||||
"name": "Windows 7 Ultimate",
|
||||
"version": "6.1",
|
||||
"service_pack": "Service Pack 1",
|
||||
"architecture": null,
|
||||
"family": 0
|
||||
},
|
||||
"protection_level_name": "Semi Automated - Require Approval",
|
||||
"protection_level_type": 1,
|
||||
"is_unmanaged": true,
|
||||
"logged_in_users": ["yossi"],
|
||||
"last_seen": null,
|
||||
"status": 4,
|
||||
"last_investigated": "2017-01-23T12:38:39.598Z",
|
||||
"investigation_count": 2,
|
||||
"ou": "CN=WIN7-ULT-X86,OU=Hexadite-PC,DC=Auto,DC=Lab",
|
||||
"is_unprotected": false,
|
||||
"allow_cancel": true
|
||||
},
|
||||
{
|
||||
"id": 222,
|
||||
"name": "BINGO.auto.lab",
|
||||
"ip": null,
|
||||
"group": 39,
|
||||
"investigation": 17,
|
||||
"os": {
|
||||
"id": 8,
|
||||
"name": "Windows 7 Ultimate",
|
||||
"version": "6.1",
|
||||
"service_pack": "Service Pack 1",
|
||||
"architecture": null,
|
||||
"family": 0
|
||||
},
|
||||
"protection_level_name": "Semi Automated - Require Approval",
|
||||
"protection_level_type": 1,
|
||||
"is_unmanaged": false,
|
||||
"logged_in_users": ["yossi"],
|
||||
"last_seen": null,
|
||||
"status": 3,
|
||||
"last_investigated": "2017-01-23T12:38:39.598Z",
|
||||
"investigation_count": 2,
|
||||
"ou": "CN=WIN7-ULT-X86,OU=Hexadite-PC,DC=Auto,DC=Lab",
|
||||
"is_unprotected": false,
|
||||
"allow_cancel": false
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,242 @@
|
|||
{
|
||||
"status": {
|
||||
"count": 7,
|
||||
"values": [
|
||||
{
|
||||
"count": 211,
|
||||
"value": 1
|
||||
},
|
||||
{
|
||||
"count": 35,
|
||||
"value": 4
|
||||
},
|
||||
{
|
||||
"count": 9,
|
||||
"value": 2
|
||||
},
|
||||
{
|
||||
"count": 7,
|
||||
"value": 5
|
||||
},
|
||||
{
|
||||
"count": 6,
|
||||
"value": 6
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": 0
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": 7
|
||||
}
|
||||
]
|
||||
},
|
||||
"tags": {
|
||||
"count": 11,
|
||||
"values": [
|
||||
{
|
||||
"count": 3,
|
||||
"value": "important"
|
||||
},
|
||||
{
|
||||
"count": 4,
|
||||
"value": "not important"
|
||||
},
|
||||
{
|
||||
"count": 4,
|
||||
"value": "bla bla bla"
|
||||
}
|
||||
]
|
||||
},
|
||||
"reasons": {
|
||||
"count": 19,
|
||||
"values": [
|
||||
{
|
||||
"count": 19,
|
||||
"value": "Endpoint does not exist in the Active Directory"
|
||||
},
|
||||
{
|
||||
"count": 14,
|
||||
"value": "Windows Defender ATP shouldn't analyze this endpoint"
|
||||
},
|
||||
{
|
||||
"count": 14,
|
||||
"value": "Endpoint is not covered by any Asset Group"
|
||||
},
|
||||
{
|
||||
"count": 11,
|
||||
"value": "Endpoint name does not match the resolved name"
|
||||
},
|
||||
{
|
||||
"count": 11,
|
||||
"value": "This is a duplicated Investigation"
|
||||
}
|
||||
]
|
||||
},
|
||||
"user": {
|
||||
"count": 3,
|
||||
"values": [
|
||||
{
|
||||
"count": 94,
|
||||
"value": null
|
||||
},
|
||||
{
|
||||
"count": 32,
|
||||
"value": "administrator"
|
||||
},
|
||||
{
|
||||
"count": 3,
|
||||
"value": "max-admin"
|
||||
}
|
||||
]
|
||||
},
|
||||
"created_by": {
|
||||
"count": 3,
|
||||
"values": [
|
||||
{
|
||||
"count": 61,
|
||||
"value": null
|
||||
},
|
||||
{
|
||||
"count": 53,
|
||||
"value": "administrator"
|
||||
},
|
||||
{
|
||||
"count": 16,
|
||||
"value": "max-admin"
|
||||
}
|
||||
]
|
||||
},
|
||||
"important": {
|
||||
"count": 2,
|
||||
"values": [
|
||||
{
|
||||
"count": 128,
|
||||
"value": false
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": true
|
||||
}
|
||||
]
|
||||
},
|
||||
"hosts": {
|
||||
"count": 20,
|
||||
"values": [
|
||||
{
|
||||
"count": 51,
|
||||
"value": null
|
||||
},
|
||||
{
|
||||
"count": 27,
|
||||
"value": "WIN7-X64-NO-SP.auto.lab"
|
||||
},
|
||||
{
|
||||
"count": 18,
|
||||
"value": "XP-X86-SP3"
|
||||
},
|
||||
{
|
||||
"count": 8,
|
||||
"value": "WIN8-X86"
|
||||
},
|
||||
{
|
||||
"count": 7,
|
||||
"value": "WIN7_X64_1.auto.lab"
|
||||
}
|
||||
]
|
||||
},
|
||||
"comments": {
|
||||
"count": 2,
|
||||
"values": [
|
||||
{
|
||||
"count": 86,
|
||||
"value": false
|
||||
},
|
||||
{
|
||||
"count": 43,
|
||||
"value": true
|
||||
}
|
||||
]
|
||||
},
|
||||
"host_groups": {
|
||||
"count": 3,
|
||||
"values": [
|
||||
{
|
||||
"count": 75,
|
||||
"value": null
|
||||
},
|
||||
{
|
||||
"count": 31,
|
||||
"value": "Unmanaged"
|
||||
},
|
||||
{
|
||||
"count": 24,
|
||||
"value": "auto.lab"
|
||||
}
|
||||
]
|
||||
},
|
||||
"detection_system": {
|
||||
"count": 5,
|
||||
"values": [
|
||||
{
|
||||
"count": 73,
|
||||
"value": 66
|
||||
}
|
||||
]
|
||||
},
|
||||
"threat_types": {
|
||||
"count": 6,
|
||||
"values": [
|
||||
{
|
||||
"count": 124,
|
||||
"value": null
|
||||
},
|
||||
{
|
||||
"count": 3,
|
||||
"value": 5
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": 10
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": 0
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": 6
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"value": 7
|
||||
}
|
||||
]
|
||||
},
|
||||
"names": {
|
||||
"count": 8,
|
||||
"values": [
|
||||
{
|
||||
"count": 1520,
|
||||
"value": "User Initiated - Endpoint Investigation"
|
||||
},
|
||||
{
|
||||
"count": 20,
|
||||
"value": "Phishing Mail"
|
||||
},
|
||||
{
|
||||
"count": 19,
|
||||
"value": "Cloud Initiated - Changed File Analysis"
|
||||
},
|
||||
{
|
||||
"count": 1620,
|
||||
"value": "Hunter Scheduler - Endpoint Investigation"
|
||||
},
|
||||
{
|
||||
"count": 9,
|
||||
"value": "User Initiated - Suspicious User Logon"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"data": [
|
||||
{
|
||||
"count": 9,
|
||||
"value": "Some value333"
|
||||
},
|
||||
{
|
||||
"count": 4,
|
||||
"value": "Some long value for your benefit"
|
||||
},
|
||||
{
|
||||
"count": 2,
|
||||
"value": "Chuck Norris"
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,142 @@
|
|||
{
|
||||
"id": 2,
|
||||
"start_date": "2017-01-31T16:40:42.075387Z",
|
||||
"end_date": "2017-01-31T16:47:27.132345Z",
|
||||
"status": 1,
|
||||
"comments": 0,
|
||||
"tags": null,
|
||||
"actions": {
|
||||
"remediated": 0,
|
||||
"total": 105,
|
||||
"running": 0,
|
||||
"pending": 0
|
||||
},
|
||||
"hosts": [
|
||||
{
|
||||
"status": 2,
|
||||
"is_unmanaged": false,
|
||||
"ip": "2.0.0.6",
|
||||
"reason": null,
|
||||
"logged_in_users": [
|
||||
"AUTO\\bingo"
|
||||
],
|
||||
"id": 8,
|
||||
"group": 1,
|
||||
"name": "WIN7_X64_1.auto.lab",
|
||||
"protection_level_name": "Semi Automated - Require Approval",
|
||||
"protection_level_type": 1,
|
||||
"os": "Windows 7 Enterprise"
|
||||
},
|
||||
{
|
||||
"status": 3,
|
||||
"is_unmanaged": false,
|
||||
"ip": "2.0.0.3",
|
||||
"reason": null,
|
||||
"logged_in_users": [
|
||||
"AUTO\\bingo"
|
||||
],
|
||||
"id": 7,
|
||||
"group": 1,
|
||||
"name": "WIN81-X64",
|
||||
"protection_level_name": "Semi Automated - Require Approval",
|
||||
"protection_level_type": 1,
|
||||
"os": "Windows 8.1 Enterprise"
|
||||
},
|
||||
{
|
||||
"status": 1,
|
||||
"is_unmanaged": false,
|
||||
"ip": "2.0.0.14",
|
||||
"reason": null,
|
||||
"logged_in_users": [
|
||||
"AUTO\\bingo"
|
||||
],
|
||||
"id": 6,
|
||||
"group": 1,
|
||||
"name": "WIN8-X86",
|
||||
"protection_level_name": "Semi Automated - Require Approval",
|
||||
"protection_level_type": 1,
|
||||
"os": "Windows 8 Enterprise"
|
||||
},
|
||||
{
|
||||
"status": 1,
|
||||
"is_unmanaged": false,
|
||||
"ip": "2.0.0.22",
|
||||
"reason": null,
|
||||
"logged_in_users": [
|
||||
"AUTO\\bingo"
|
||||
],
|
||||
"id": 5,
|
||||
"group": 1,
|
||||
"name": "WIN7-ULT-X86.auto.lab",
|
||||
"protection_level_name": "Semi Automated - Require Approval",
|
||||
"protection_level_type": 1,
|
||||
"os": "Windows 7 Ultimate"
|
||||
}
|
||||
],
|
||||
"title": "User Initiated - Suspicious Email Address",
|
||||
"requested_status": null,
|
||||
"dismissed": false,
|
||||
"important": false,
|
||||
"user": null,
|
||||
"external_sources": {
|
||||
"mitigation_source": [],
|
||||
"data_source": [
|
||||
10,
|
||||
47
|
||||
]
|
||||
},
|
||||
"alert_count": 1,
|
||||
"entity_count": 6901,
|
||||
"attention_required": 0,
|
||||
"running_time": 405.056958,
|
||||
"pending_action_types": {
|
||||
"data": [
|
||||
{
|
||||
"action": 13,
|
||||
"count": 0
|
||||
},
|
||||
{
|
||||
"action": 12,
|
||||
"count": 0
|
||||
},
|
||||
{
|
||||
"action": 8,
|
||||
"count": 0
|
||||
}
|
||||
]
|
||||
},
|
||||
"threat_types": [],
|
||||
"alert": {
|
||||
"received_time": "2017-01-31T16:40:42.014Z",
|
||||
"template_name": "User Initiated - Suspicious Email Address",
|
||||
"variables": {
|
||||
"email_addresses": [
|
||||
"bingo@auto.lab"
|
||||
]
|
||||
},
|
||||
"source": "internal_source:User Initiated",
|
||||
"detection_system": 50,
|
||||
"id": 2
|
||||
},
|
||||
"pending_since": null,
|
||||
"alert_to_remediation_time": 0,
|
||||
"errors": [],
|
||||
"pending_actions": [
|
||||
{
|
||||
"waiting_time": 15.467473,
|
||||
"entities": [],
|
||||
"end_time": "2017-01-31T16:41:30.071Z",
|
||||
"entity_name": null,
|
||||
"action_type": 12,
|
||||
"decision": "Approved",
|
||||
"action_id": 104,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-01-31T16:41:14.604Z",
|
||||
"action_name": "Start investigation on multiple endpoints"
|
||||
}
|
||||
],
|
||||
"reasons": null,
|
||||
"pending_type": null,
|
||||
"remediation_pending_time": 0,
|
||||
"resource_pending_time": 15
|
||||
}
|
|
@ -0,0 +1,59 @@
|
|||
{
|
||||
"id": 123,
|
||||
"start_date": 1434365326935,
|
||||
"end_date": 1434369346935,
|
||||
"status": 0,
|
||||
"actions": {
|
||||
"total": 123,
|
||||
"remediated": 3,
|
||||
"pendingTime": 1200
|
||||
},
|
||||
"detection": {
|
||||
"detection_system_id": 1,
|
||||
"timestamp": 1434365326935,
|
||||
"alert": {
|
||||
"alertId": 345793,
|
||||
"entity": {
|
||||
"type": 1,
|
||||
"name": "c:\\1.txt"
|
||||
},
|
||||
"host": {
|
||||
"id": 435,
|
||||
"name": "BARAK-PC"
|
||||
}
|
||||
}
|
||||
},
|
||||
"external_sources": {
|
||||
"data": [
|
||||
{
|
||||
"id": 1,
|
||||
"data": "2 rules added to block ip 192.15.3.5 to 123.52.6.7 on any port"
|
||||
}
|
||||
],
|
||||
"remediation": [
|
||||
{
|
||||
"id": 5,
|
||||
"data": "I fixed it mommy!"
|
||||
}
|
||||
]
|
||||
},
|
||||
"entities": [
|
||||
{
|
||||
"id": 1,
|
||||
"results": [
|
||||
{ "count": 25, "result": "remediated" },
|
||||
{ "count": 30, "result": "failed" },
|
||||
{ "count": 45, "result": "benign" }
|
||||
]
|
||||
}
|
||||
],
|
||||
"hosts": {
|
||||
"total": 120,
|
||||
"groups": 4,
|
||||
"results": {
|
||||
"remediated": 3,
|
||||
"failed": 6,
|
||||
"benign": 10
|
||||
}
|
||||
}
|
||||
}
|
|
@ -0,0 +1,112 @@
|
|||
{
|
||||
"id": 14,
|
||||
"start_date": "2017-02-12T07:06:24.868210Z",
|
||||
"end_date": "2017-02-12T07:11:27.054782Z",
|
||||
"status": 1,
|
||||
"comments": 1,
|
||||
"actions": {
|
||||
"remediated": 0,
|
||||
"total": 1,
|
||||
"running": 0,
|
||||
"pending": 0
|
||||
},
|
||||
"hosts": [],
|
||||
"title": "Bay Dynamics Suspicious User Critical",
|
||||
"requested_status": null,
|
||||
"dismissed": false,
|
||||
"important": false,
|
||||
"user": null,
|
||||
"external_sources": {
|
||||
"mitigation_source": [3],
|
||||
"data_source": []
|
||||
},
|
||||
"alert_count": 1,
|
||||
"entity_count": 1,
|
||||
"attention_required": 0,
|
||||
"running_time": 302.186572,
|
||||
"pending_action_types": {
|
||||
"data": [
|
||||
{
|
||||
"action": 13,
|
||||
"count": 0
|
||||
},
|
||||
{
|
||||
"action": 12,
|
||||
"count": 0
|
||||
},
|
||||
{
|
||||
"action": 8,
|
||||
"count": 0
|
||||
}
|
||||
]
|
||||
},
|
||||
"threat_types": [],
|
||||
"alert": {
|
||||
"AlertId": "636219966081943637_-467964911",
|
||||
"WcdMachineId": null,
|
||||
"SenseMachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
|
||||
"MachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
|
||||
"ComputerDnsName": "cont-jonathanw.contoso.org",
|
||||
"Severity": 256,
|
||||
"Status": 4,
|
||||
"LastEventTime": "2017-04-17T16:37:47.8018798Z",
|
||||
"FirstEventTime": "2017-04-17T13:12:20.2461196Z",
|
||||
"FirstSeen": "2017-04-17T16:50:07.754788Z",
|
||||
"Classification": 0,
|
||||
"Determination": 0,
|
||||
"DomainName": "CONTOSO",
|
||||
"AccountName": "jonathan.wolcott",
|
||||
"AccountSid": "S-1-5-21-2649156466-80624164-2033095608-1113",
|
||||
"AssignedTo": "Analyst@WDATPContosoFld.onmicrosoft.com",
|
||||
"Category": "PrivilegeEscalation",
|
||||
"Title": "Process privilege escalation due to kernel exploit",
|
||||
"ActorName": null,
|
||||
"TiProvider": null,
|
||||
"GroupId": null,
|
||||
"GroupKey": null,
|
||||
"MachineCount": 1,
|
||||
"UserCount": 1,
|
||||
"AssignedToCount": 1,
|
||||
"AlertCount": 0,
|
||||
"IoaDefinitionId": "6f36a53b-7229-471e-9c91-ea473a50b95d",
|
||||
"InternalMachineId": 8,
|
||||
"ContainedAlerts": null,
|
||||
"IsSealedGroup": null,
|
||||
"DetectionSource": 1,
|
||||
"ThreatFamilyName": null,
|
||||
"SuppressionRuleId": null
|
||||
},
|
||||
"pending_since": null,
|
||||
"alert_to_remediation_time": 0,
|
||||
"is_cleanup_applied": false,
|
||||
"errors": [
|
||||
29,
|
||||
37
|
||||
],
|
||||
"pending_actions": [
|
||||
{
|
||||
"waiting_time": 302.054359,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 1,
|
||||
"entity_type": 10
|
||||
}
|
||||
],
|
||||
"end_time": "2017-02-12T07:11:26.981Z",
|
||||
"entity_name": "lateral",
|
||||
"action_type": 9,
|
||||
"decision": "Timed out",
|
||||
"action_id": 422,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-02-12T07:06:24.926Z",
|
||||
"action_name": "Initiate DLP Investigation"
|
||||
}
|
||||
],
|
||||
"reasons": [
|
||||
"External source is not defined",
|
||||
"Pending action exceeded timeout"
|
||||
],
|
||||
"pending_type": null,
|
||||
"remediation_pending_time": 0,
|
||||
"resource_pending_time": 302
|
||||
}
|
|
@ -0,0 +1,307 @@
|
|||
{
|
||||
"id": 3,
|
||||
"start_date": "2017-02-08T14:27:18.300693Z",
|
||||
"end_date": "2017-02-08T14:33:42.445535Z",
|
||||
"status": 6,
|
||||
"comments": 10,
|
||||
"actions": {
|
||||
"remediated": 10,
|
||||
"total": 115,
|
||||
"running": 0,
|
||||
"pending": 0
|
||||
},
|
||||
"hosts": [
|
||||
{
|
||||
"status": 2,
|
||||
"is_unmanaged": false,
|
||||
"ip": "2.0.0.22",
|
||||
"reason": null,
|
||||
"logged_in_users": [
|
||||
"AUTO\\bingo",
|
||||
"AUTO\\lateral"
|
||||
],
|
||||
"id": 3,
|
||||
"group": 1,
|
||||
"name": "WIN7-ULT-X86.auto.lab",
|
||||
"protection_level_name": "Semi Automated - Require Approval",
|
||||
"protection_level_type": 1,
|
||||
"os": "Windows 7 Ultimate"
|
||||
}
|
||||
],
|
||||
"title": "User Initiated - Endpoint Investigation",
|
||||
"requested_status": null,
|
||||
"dismissed": false,
|
||||
"important": false,
|
||||
"user": null,
|
||||
"external_sources": {
|
||||
"mitigation_source": [],
|
||||
"data_source": [
|
||||
3222
|
||||
]
|
||||
},
|
||||
"alert_count": 2,
|
||||
"entity_count": 1645,
|
||||
"attention_required": 0,
|
||||
"running_time": 384.144842,
|
||||
"pending_action_types": {
|
||||
"data": [
|
||||
{
|
||||
"action": 13,
|
||||
"count": 0
|
||||
},
|
||||
{
|
||||
"action": 12,
|
||||
"count": 0
|
||||
},
|
||||
{
|
||||
"action": 8,
|
||||
"count": 0
|
||||
}
|
||||
]
|
||||
},
|
||||
"threat_types": [
|
||||
{
|
||||
"count": 1,
|
||||
"threat_type": 0
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"threat_type": 1
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"threat_type": 3
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"threat_type": 5
|
||||
},
|
||||
{
|
||||
"count": 4,
|
||||
"threat_type": 6
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"threat_type": 7
|
||||
},
|
||||
{
|
||||
"count": 1,
|
||||
"threat_type": 9
|
||||
}
|
||||
],
|
||||
"alert": {
|
||||
"AlertId": "636219966081943637_-467964911",
|
||||
"WcdMachineId": null,
|
||||
"SenseMachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
|
||||
"MachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
|
||||
"ComputerDnsName": "cont-jonathanw.contoso.org",
|
||||
"Severity": 256,
|
||||
"Status": 4,
|
||||
"LastEventTime": "2017-04-17T16:37:47.8018798Z",
|
||||
"FirstEventTime": "2017-04-17T13:12:20.2461196Z",
|
||||
"FirstSeen": "2017-04-17T16:50:07.754788Z",
|
||||
"Classification": 0,
|
||||
"Determination": 0,
|
||||
"DomainName": "CONTOSO",
|
||||
"AccountName": "jonathan.wolcott",
|
||||
"AccountSid": "S-1-5-21-2649156466-80624164-2033095608-1113",
|
||||
"AssignedTo": "Analyst@WDATPContosoFld.onmicrosoft.com",
|
||||
"Category": "PrivilegeEscalation",
|
||||
"Title": "Process privilege escalation due to kernel exploit",
|
||||
"ActorName": null,
|
||||
"TiProvider": null,
|
||||
"GroupId": null,
|
||||
"GroupKey": null,
|
||||
"MachineCount": 1,
|
||||
"UserCount": 1,
|
||||
"AssignedToCount": 1,
|
||||
"AlertCount": 0,
|
||||
"IoaDefinitionId": "6f36a53b-7229-471e-9c91-ea473a50b95d",
|
||||
"InternalMachineId": 8,
|
||||
"ContainedAlerts": null,
|
||||
"IsSealedGroup": null,
|
||||
"DetectionSource": 1,
|
||||
"ThreatFamilyName": null,
|
||||
"SuppressionRuleId": null
|
||||
},
|
||||
"pending_since": null,
|
||||
"alert_to_remediation_time": 211.247341,
|
||||
"is_cleanup_applied": false,
|
||||
"errors": [],
|
||||
"pending_actions": [
|
||||
{
|
||||
"waiting_time": 48.320925,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 4504,
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"end_time": "2017-02-08T14:31:40.875Z",
|
||||
"entity_name": "יוניקוד.exe",
|
||||
"action_type": 0,
|
||||
"decision": "Approved",
|
||||
"action_id": 108,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-02-08T14:30:52.554Z",
|
||||
"action_name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"waiting_time": 47.359767,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 4534,
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"end_time": "2017-02-08T14:31:40.911Z",
|
||||
"entity_name": "generic.exe",
|
||||
"action_type": 0,
|
||||
"decision": "Approved",
|
||||
"action_id": 110,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-02-08T14:30:53.551Z",
|
||||
"action_name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"waiting_time": 46.176443,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 4528,
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"end_time": "2017-02-08T14:31:40.949Z",
|
||||
"entity_name": "adware.exe",
|
||||
"action_type": 0,
|
||||
"decision": "Approved",
|
||||
"action_id": 113,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-02-08T14:30:54.773Z",
|
||||
"action_name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"waiting_time": 51.168596,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 4529,
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"end_time": "2017-02-08T14:31:40.716Z",
|
||||
"entity_name": "trojan.exe",
|
||||
"action_type": 0,
|
||||
"decision": "Approved",
|
||||
"action_id": 100,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-02-08T14:30:49.548Z",
|
||||
"action_name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"waiting_time": 49.985677,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 4503,
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"end_time": "2017-02-08T14:31:40.765Z",
|
||||
"entity_name": "heuristic.exe",
|
||||
"action_type": 0,
|
||||
"decision": "Approved",
|
||||
"action_id": 103,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-02-08T14:30:50.779Z",
|
||||
"action_name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"waiting_time": 49.308228,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 4509,
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"end_time": "2017-02-08T14:31:40.842Z",
|
||||
"entity_name": "worm.exe",
|
||||
"action_type": 0,
|
||||
"decision": "Approved",
|
||||
"action_id": 106,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-02-08T14:30:51.533Z",
|
||||
"action_name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"waiting_time": 49.921516,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 4536,
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"end_time": "2017-02-08T14:31:40.801Z",
|
||||
"entity_name": "new_mal.exe",
|
||||
"action_type": 0,
|
||||
"decision": "Approved",
|
||||
"action_id": 104,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-02-08T14:30:50.879Z",
|
||||
"action_name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"waiting_time": 46.120698,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 4537,
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"end_time": "2017-02-08T14:31:40.989Z",
|
||||
"entity_name": "hoax.exe",
|
||||
"action_type": 0,
|
||||
"decision": "Approved",
|
||||
"action_id": 114,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-02-08T14:30:54.868Z",
|
||||
"action_name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"waiting_time": 26.460095,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 4689,
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"end_time": "2017-02-08T14:33:28.089Z",
|
||||
"entity_name": "exploit.exe",
|
||||
"action_type": 0,
|
||||
"decision": "Approved",
|
||||
"action_id": 157,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-02-08T14:33:01.629Z",
|
||||
"action_name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"waiting_time": 29.232141,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 4690,
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"end_time": "2017-02-08T14:33:29.802Z",
|
||||
"entity_name": "rootkit.exe",
|
||||
"action_type": 0,
|
||||
"decision": "Approved",
|
||||
"action_id": 155,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-02-08T14:33:00.569Z",
|
||||
"action_name": "Quarantine a File"
|
||||
}
|
||||
],
|
||||
"reasons": null,
|
||||
"pending_type": null,
|
||||
"remediation_pending_time": 80,
|
||||
"resource_pending_time": 0
|
||||
}
|
|
@ -0,0 +1,109 @@
|
|||
{
|
||||
"id": 18,
|
||||
"start_date": "2017-04-12T08:24:00.243260Z",
|
||||
"end_date": null,
|
||||
"status": 2,
|
||||
"comments": 0,
|
||||
"actions": {
|
||||
"remediated": 0,
|
||||
"total": 2,
|
||||
"running": 0,
|
||||
"pending": 1
|
||||
},
|
||||
"hosts": [
|
||||
{
|
||||
"status": 3,
|
||||
"is_unmanaged": null,
|
||||
"ip": null,
|
||||
"reason": "The endpoint is not found",
|
||||
"logged_in_users": null,
|
||||
"id": 80,
|
||||
"group": null,
|
||||
"name": "YOSSI-TEST.auto.lab",
|
||||
"protection_level_name": "Not Found",
|
||||
"protection_level_type": 4,
|
||||
"os": null
|
||||
}
|
||||
],
|
||||
"title": "User Initiated - Endpoint Investigation",
|
||||
"requested_status": null,
|
||||
"dismissed": false,
|
||||
"important": false,
|
||||
"user": null,
|
||||
"external_sources": {
|
||||
"mitigation_source": [],
|
||||
"data_source": [
|
||||
13
|
||||
]
|
||||
},
|
||||
"alert_count": 1,
|
||||
"entity_count": 0,
|
||||
"attention_required": 1,
|
||||
"running_time": 1070.471335,
|
||||
"pending_action_types": {
|
||||
"data": [
|
||||
{
|
||||
"action": 13,
|
||||
"count": 0
|
||||
},
|
||||
{
|
||||
"action": 12,
|
||||
"count": 0
|
||||
},
|
||||
{
|
||||
"action": 8,
|
||||
"count": 1
|
||||
}
|
||||
]
|
||||
},
|
||||
"threat_types": [],
|
||||
"alert": {
|
||||
"AlertId": "636219966081943637_-467964911",
|
||||
"WcdMachineId": null,
|
||||
"SenseMachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
|
||||
"MachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
|
||||
"ComputerDnsName": "cont-jonathanw.contoso.org",
|
||||
"Severity": 256,
|
||||
"Status": 4,
|
||||
"LastEventTime": "2017-04-17T16:37:47.8018798Z",
|
||||
"FirstEventTime": "2017-04-17T13:12:20.2461196Z",
|
||||
"FirstSeen": "2017-04-17T16:50:07.754788Z",
|
||||
"Classification": 0,
|
||||
"Determination": 0,
|
||||
"DomainName": "CONTOSO",
|
||||
"AccountName": "jonathan.wolcott",
|
||||
"AccountSid": "S-1-5-21-2649156466-80624164-2033095608-1113",
|
||||
"AssignedTo": "Analyst@WDATPContosoFld.onmicrosoft.com",
|
||||
"Category": "PrivilegeEscalation",
|
||||
"Title": "Process privilege escalation due to kernel exploit",
|
||||
"ActorName": null,
|
||||
"TiProvider": null,
|
||||
"GroupId": null,
|
||||
"GroupKey": null,
|
||||
"MachineCount": 1,
|
||||
"UserCount": 1,
|
||||
"AssignedToCount": 1,
|
||||
"AlertCount": 0,
|
||||
"IoaDefinitionId": "6f36a53b-7229-471e-9c91-ea473a50b95d",
|
||||
"InternalMachineId": 8,
|
||||
"ContainedAlerts": null,
|
||||
"IsSealedGroup": null,
|
||||
"DetectionSource": 1,
|
||||
"ThreatFamilyName": null,
|
||||
"SuppressionRuleId": null
|
||||
},
|
||||
"pending_since": "2017-04-12T08:24:00.721169Z",
|
||||
"alert_to_remediation_time": 0,
|
||||
"is_cleanup_applied": false,
|
||||
"errors": [
|
||||
6
|
||||
],
|
||||
"pending_actions": [],
|
||||
"reasons": [
|
||||
"Endpoint does not exist in the Active Directory"
|
||||
],
|
||||
"pending_type": 6,
|
||||
"remediation_pending_time": 0,
|
||||
"resource_pending_time": 0,
|
||||
"tags": []
|
||||
}
|
|
@ -0,0 +1,160 @@
|
|||
{
|
||||
"id": 16,
|
||||
"start_date": "2017-05-14T07:51:23.917267Z",
|
||||
"end_date": null,
|
||||
"status": 2,
|
||||
"comments": 3,
|
||||
"actions": {
|
||||
"remediated": 8,
|
||||
"total": 38,
|
||||
"running": 0,
|
||||
"pending": 3
|
||||
},
|
||||
"hosts": [
|
||||
{
|
||||
"status": 0,
|
||||
"is_unmanaged": false,
|
||||
"ip": "2.0.0.1",
|
||||
"reason": null,
|
||||
"logged_in_users": [
|
||||
"AUTO\\Administrator"
|
||||
],
|
||||
"id": 253,
|
||||
"group": 1,
|
||||
"name": "WIN71X6401.auto.lab",
|
||||
"protection_level_name": "Semi Automated - Require Approval",
|
||||
"protection_level_type": 1,
|
||||
"os": "Windows 7 Enterprise"
|
||||
}
|
||||
],
|
||||
"title": "Suspicious - User",
|
||||
"requested_status": null,
|
||||
"dismissed": false,
|
||||
"important": false,
|
||||
"user": null,
|
||||
"external_sources": {
|
||||
"mitigation_source": [],
|
||||
"data_source": [
|
||||
13
|
||||
]
|
||||
},
|
||||
"alert_count": 1,
|
||||
"entity_count": 2114,
|
||||
"attention_required": 3,
|
||||
"running_time": 21626.848919,
|
||||
"pending_action_types": {
|
||||
"data": [
|
||||
{
|
||||
"action": 18,
|
||||
"count": 1
|
||||
}
|
||||
]
|
||||
},
|
||||
"threat_types": [
|
||||
{
|
||||
"count": 3,
|
||||
"threat_type": 0
|
||||
},
|
||||
{
|
||||
"count": 3,
|
||||
"threat_type": 10
|
||||
}
|
||||
],
|
||||
"alert": {
|
||||
"AlertId": "636219966081943637_-467964911",
|
||||
"WcdMachineId": null,
|
||||
"SenseMachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
|
||||
"MachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
|
||||
"ComputerDnsName": "cont-jonathanw.contoso.org",
|
||||
"Severity": 256,
|
||||
"Status": 4,
|
||||
"LastEventTime": "2017-04-17T16:37:47.8018798Z",
|
||||
"FirstEventTime": "2017-04-17T13:12:20.2461196Z",
|
||||
"FirstSeen": "2017-04-17T16:50:07.754788Z",
|
||||
"Classification": 0,
|
||||
"Determination": 0,
|
||||
"DomainName": "CONTOSO",
|
||||
"AccountName": "jonathan.wolcott",
|
||||
"AccountSid": "S-1-5-21-2649156466-80624164-2033095608-1113",
|
||||
"AssignedTo": "Analyst@WDATPContosoFld.onmicrosoft.com",
|
||||
"Category": "PrivilegeEscalation",
|
||||
"Title": "Process privilege escalation due to kernel exploit",
|
||||
"ActorName": null,
|
||||
"TiProvider": null,
|
||||
"GroupId": null,
|
||||
"GroupKey": null,
|
||||
"MachineCount": 1,
|
||||
"UserCount": 1,
|
||||
"AssignedToCount": 1,
|
||||
"AlertCount": 0,
|
||||
"IoaDefinitionId": "6f36a53b-7229-471e-9c91-ea473a50b95d",
|
||||
"InternalMachineId": 8,
|
||||
"ContainedAlerts": null,
|
||||
"IsSealedGroup": null,
|
||||
"DetectionSource": 1,
|
||||
"ThreatFamilyName": null,
|
||||
"SuppressionRuleId": null
|
||||
},
|
||||
"pending_since": "2017-05-14T07:57:12.818586Z",
|
||||
"alert_to_remediation_time": 207.064145,
|
||||
"is_cleanup_applied": false,
|
||||
"errors": [],
|
||||
"pending_actions": [
|
||||
{
|
||||
"waiting_time": 6.651541,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 110129,
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"end_time": "2017-05-14T07:57:09.400549Z",
|
||||
"entity_name": "trojan.exe",
|
||||
"action_type": 0,
|
||||
"decision": "Declined",
|
||||
"action_id": 5175,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-05-14T07:57:02.749008Z",
|
||||
"action_name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"waiting_time": 6.221275,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 109334,
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"end_time": "2017-05-14T07:55:11.407090Z",
|
||||
"entity_name": "trojan.exe",
|
||||
"action_type": 0,
|
||||
"decision": "Declined",
|
||||
"action_id": 5157,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-05-14T07:55:05.185815Z",
|
||||
"action_name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"waiting_time": 13.785844,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 4976,
|
||||
"entity_type": 2
|
||||
}
|
||||
],
|
||||
"end_time": "2017-05-14T07:55:04.767256Z",
|
||||
"entity_name": "trojan.exe",
|
||||
"action_type": 3,
|
||||
"decision": "Declined",
|
||||
"action_id": 5156,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-05-14T07:54:50.981412Z",
|
||||
"action_name": "Kill Process"
|
||||
}
|
||||
],
|
||||
"reasons": null,
|
||||
"pending_type": 3,
|
||||
"remediation_pending_time": 26,
|
||||
"resource_pending_time": 0,
|
||||
"tags": []
|
||||
}
|
|
@ -0,0 +1,115 @@
|
|||
{
|
||||
"id": 17,
|
||||
"start_date": "2017-04-30T09:46:02.284385Z",
|
||||
"end_date": null,
|
||||
"status": 0,
|
||||
"comments": 2,
|
||||
"actions": {
|
||||
"remediated": 0,
|
||||
"total": 41,
|
||||
"running": 2,
|
||||
"pending": 0
|
||||
},
|
||||
"tags": [
|
||||
{ "id": "test tag", "name": "test tag" }
|
||||
],
|
||||
"hosts": [
|
||||
{
|
||||
"status": 4,
|
||||
"is_unmanaged": false,
|
||||
"ip": "2.0.0.8",
|
||||
"reason": null,
|
||||
"logged_in_users": [
|
||||
"AUTO\\bingo",
|
||||
"AUTO\\max-admin"
|
||||
],
|
||||
"id": 16,
|
||||
"group": 1,
|
||||
"name": "WIN10-X86.DOMAIN.LAB",
|
||||
"protection_level_name": "Semi Automated - Require Approval",
|
||||
"protection_level_type": 1,
|
||||
"os": "Windows 10 Enterprise"
|
||||
},
|
||||
{
|
||||
"status": 2,
|
||||
"is_unmanaged": null,
|
||||
"ip": null,
|
||||
"reason": "The endpoint is not found",
|
||||
"logged_in_users": null,
|
||||
"id": 15,
|
||||
"group": null,
|
||||
"name": "BINGO.auto.lab",
|
||||
"protection_level_name": "Not Found",
|
||||
"protection_level_type": 4,
|
||||
"os": null
|
||||
}
|
||||
],
|
||||
"title": "User Initiated - Endpoint Investigation",
|
||||
"requested_status": null,
|
||||
"dismissed": false,
|
||||
"important": false,
|
||||
"user": null,
|
||||
"external_sources": {
|
||||
"mitigation_source": [53, 9],
|
||||
"data_source": [
|
||||
9
|
||||
]
|
||||
},
|
||||
"alert_count": 1,
|
||||
"entity_count": 6131,
|
||||
"attention_required": 0,
|
||||
"running_time": 75.179464,
|
||||
"pending_action_types": {
|
||||
"data": []
|
||||
},
|
||||
"threat_types": [
|
||||
{
|
||||
"count": 1,
|
||||
"threat_type": 0
|
||||
}
|
||||
],
|
||||
"alert": {
|
||||
"AlertId": "636219966081943637_-467964911",
|
||||
"WcdMachineId": null,
|
||||
"SenseMachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
|
||||
"MachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
|
||||
"ComputerDnsName": "cont-jonathanw.contoso.org",
|
||||
"Severity": 256,
|
||||
"Status": 4,
|
||||
"LastEventTime": "2017-04-17T16:37:47.8018798Z",
|
||||
"FirstEventTime": "2017-04-17T13:12:20.2461196Z",
|
||||
"FirstSeen": "2017-04-17T16:50:07.754788Z",
|
||||
"Classification": 0,
|
||||
"Determination": 0,
|
||||
"DomainName": "CONTOSO",
|
||||
"AccountName": "jonathan.wolcott",
|
||||
"AccountSid": "S-1-5-21-2649156466-80624164-2033095608-1113",
|
||||
"AssignedTo": "Analyst@WDATPContosoFld.onmicrosoft.com",
|
||||
"Category": "PrivilegeEscalation",
|
||||
"Title": "Process privilege escalation due to kernel exploit",
|
||||
"ActorName": null,
|
||||
"TiProvider": null,
|
||||
"GroupId": null,
|
||||
"GroupKey": null,
|
||||
"MachineCount": 1,
|
||||
"UserCount": 1,
|
||||
"AssignedToCount": 1,
|
||||
"AlertCount": 0,
|
||||
"IoaDefinitionId": "6f36a53b-7229-471e-9c91-ea473a50b95d",
|
||||
"InternalMachineId": 8,
|
||||
"ContainedAlerts": null,
|
||||
"IsSealedGroup": null,
|
||||
"DetectionSource": 1,
|
||||
"ThreatFamilyName": null,
|
||||
"SuppressionRuleId": null
|
||||
},
|
||||
"pending_since": null,
|
||||
"alert_to_remediation_time": 0,
|
||||
"is_cleanup_applied": true,
|
||||
"errors": [],
|
||||
"pending_actions": [],
|
||||
"reasons": null,
|
||||
"pending_type": null,
|
||||
"remediation_pending_time": 0,
|
||||
"resource_pending_time": 0
|
||||
}
|
|
@ -0,0 +1,148 @@
|
|||
{
|
||||
"id": 9,
|
||||
"start_date": "2017-02-09T09:27:54.326390Z",
|
||||
"end_date": "2017-02-09T09:48:31.120821Z",
|
||||
"status": 3,
|
||||
"comments": 1,
|
||||
"actions": {
|
||||
"remediated": 1,
|
||||
"total": 29,
|
||||
"running": 0,
|
||||
"pending": 0
|
||||
},
|
||||
"hosts": [
|
||||
{
|
||||
"status": 0,
|
||||
"is_unmanaged": false,
|
||||
"ip": "2.0.0.22",
|
||||
"reason": null,
|
||||
"logged_in_users": [
|
||||
"AUTO\\bingo",
|
||||
"AUTO\\lateral"
|
||||
],
|
||||
"id": 9,
|
||||
"group": 1,
|
||||
"name": "WIN7-ULT-X86.auto.lab",
|
||||
"protection_level_name": "Semi Automated - Require Approval",
|
||||
"protection_level_type": 1,
|
||||
"os": "Windows 7 Ultimate"
|
||||
}
|
||||
],
|
||||
"title": "User Initiated - Endpoint Investigation",
|
||||
"requested_status": null,
|
||||
"dismissed": false,
|
||||
"important": false,
|
||||
"user": null,
|
||||
"external_sources": {
|
||||
"mitigation_source": [],
|
||||
"data_source": [
|
||||
43
|
||||
]
|
||||
},
|
||||
"alert_count": 1,
|
||||
"entity_count": 1635,
|
||||
"attention_required": 0,
|
||||
"running_time": 1236.794431,
|
||||
"pending_action_types": {
|
||||
"data": [
|
||||
{
|
||||
"action": 13,
|
||||
"count": 0
|
||||
},
|
||||
{
|
||||
"action": 12,
|
||||
"count": 0
|
||||
},
|
||||
{
|
||||
"action": 8,
|
||||
"count": 0
|
||||
}
|
||||
]
|
||||
},
|
||||
"threat_types": [
|
||||
{
|
||||
"count": 1,
|
||||
"threat_type": 0
|
||||
}
|
||||
],
|
||||
"alert": {
|
||||
"AlertId": "636219966081943637_-467964911",
|
||||
"WcdMachineId": null,
|
||||
"SenseMachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
|
||||
"MachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
|
||||
"ComputerDnsName": "cont-jonathanw.contoso.org",
|
||||
"Severity": 256,
|
||||
"Status": 4,
|
||||
"LastEventTime": "2017-04-17T16:37:47.8018798Z",
|
||||
"FirstEventTime": "2017-04-17T13:12:20.2461196Z",
|
||||
"FirstSeen": "2017-04-17T16:50:07.754788Z",
|
||||
"Classification": 0,
|
||||
"Determination": 0,
|
||||
"DomainName": "CONTOSO",
|
||||
"AccountName": "jonathan.wolcott",
|
||||
"AccountSid": "S-1-5-21-2649156466-80624164-2033095608-1113",
|
||||
"AssignedTo": "Analyst@WDATPContosoFld.onmicrosoft.com",
|
||||
"Category": "PrivilegeEscalation",
|
||||
"Title": "Process privilege escalation due to kernel exploit",
|
||||
"ActorName": null,
|
||||
"TiProvider": null,
|
||||
"GroupId": null,
|
||||
"GroupKey": null,
|
||||
"MachineCount": 1,
|
||||
"UserCount": 1,
|
||||
"AssignedToCount": 1,
|
||||
"AlertCount": 0,
|
||||
"IoaDefinitionId": "6f36a53b-7229-471e-9c91-ea473a50b95d",
|
||||
"InternalMachineId": 8,
|
||||
"ContainedAlerts": null,
|
||||
"IsSealedGroup": null,
|
||||
"DetectionSource": 1,
|
||||
"ThreatFamilyName": null,
|
||||
"SuppressionRuleId": null
|
||||
},
|
||||
"pending_since": null,
|
||||
"alert_to_remediation_time": 206.592362,
|
||||
"is_cleanup_applied": false,
|
||||
"errors": [
|
||||
3,
|
||||
37
|
||||
],
|
||||
"pending_actions": [
|
||||
{
|
||||
"waiting_time": 360.718514,
|
||||
"entities": [
|
||||
{
|
||||
"entity_id": 12523,
|
||||
"entity_type": 1
|
||||
}
|
||||
],
|
||||
"end_time": "2017-02-09T09:37:21.637Z",
|
||||
"entity_name": "trojan.exe",
|
||||
"action_type": 0,
|
||||
"decision": "Skip",
|
||||
"action_id": 275,
|
||||
"user": "administrator",
|
||||
"start_time": "2017-02-09T09:31:20.918Z",
|
||||
"action_name": "Quarantine a File"
|
||||
},
|
||||
{
|
||||
"waiting_time": 305.053733,
|
||||
"entities": [],
|
||||
"end_time": "2017-02-09T09:48:31.031Z",
|
||||
"entity_name": null,
|
||||
"action_type": 8,
|
||||
"decision": "Timed out",
|
||||
"action_id": 276,
|
||||
"user": null,
|
||||
"start_time": "2017-02-09T09:43:25.977Z",
|
||||
"action_name": "Wait for Endpoint Resource"
|
||||
}
|
||||
],
|
||||
"reasons": [
|
||||
"Pending action exceeded timeout",
|
||||
"Endpoint is not reachable"
|
||||
],
|
||||
"pending_type": null,
|
||||
"remediation_pending_time": 360,
|
||||
"resource_pending_time": 305
|
||||
}
|
|
@ -0,0 +1,201 @@
|
|||
{
|
||||
"id": 1,
|
||||
"start_date": "2017-07-02T13:54:26.876955Z",
|
||||
"end_date": "2017-07-02T14:19:21.919703Z",
|
||||
"status": 4,
|
||||
"comments": 1,
|
||||
"actions": {
|
||||
"remediated": 0,
|
||||
"total": 7,
|
||||
"running": 0,
|
||||
"pending": 0,
|
||||
"queued": 0
|
||||
},
|
||||
"hosts": [
|
||||
{
|
||||
"status": 3,
|
||||
"is_unmanaged": false,
|
||||
"ip": "2.0.0.2",
|
||||
"reason": "Investigation terminated by user",
|
||||
"logged_in_users": null,
|
||||
"id": 1,
|
||||
"group": 1,
|
||||
"name": "WIN7-X64-1.auto.lab",
|
||||
"protection_level_name": "Semi Automated - Require Approval",
|
||||
"protection_level_type": 1,
|
||||
"os": "Windows 7 Enterprise"
|
||||
},
|
||||
{
|
||||
"status": 3,
|
||||
"is_unmanaged": false,
|
||||
"ip": "2.0.0.1",
|
||||
"reason": "Investigation terminated by user",
|
||||
"logged_in_users": [
|
||||
"AUTO\\Administrator"
|
||||
],
|
||||
"id": 2,
|
||||
"group": 1,
|
||||
"name": "WIN7_X64.auto.lab",
|
||||
"protection_level_name": "Semi Automated - Require Approval",
|
||||
"protection_level_type": 1,
|
||||
"os": "Windows 7 Enterprise"
|
||||
}
|
||||
],
|
||||
"title": "User Initiated - Endpoint Investigation",
|
||||
"requested_status": 4,
|
||||
"important": false,
|
||||
"user": {
|
||||
"id": 2,
|
||||
"password": "pbkdf2_sha256$30000$2tlrhvsrVprl$JM4flWX1gvff0O6818aq0VydQpTZHYbCxi2sYFRUglA=",
|
||||
"last_login": null,
|
||||
"is_superuser": true,
|
||||
"username": "administrator",
|
||||
"first_name": "administrator",
|
||||
"last_name": "",
|
||||
"email": "",
|
||||
"is_staff": true,
|
||||
"is_active": true,
|
||||
"date_joined": "2017-07-02T13:05:19.717994Z",
|
||||
"groups": [
|
||||
{
|
||||
"id": 1,
|
||||
"name": "Uni",
|
||||
"permissions": []
|
||||
},
|
||||
{
|
||||
"id": 2,
|
||||
"name": "AIRSAdmins",
|
||||
"permissions": []
|
||||
}
|
||||
],
|
||||
"user_permissions": []
|
||||
},
|
||||
"external_sources": {
|
||||
"mitigation_source": [],
|
||||
"data_source": [
|
||||
13
|
||||
]
|
||||
},
|
||||
"alert_count": 1,
|
||||
"entity_count": 0,
|
||||
"attention_required": 0,
|
||||
"running_time": 1495.042748,
|
||||
"pending_action_types": {
|
||||
"data": [
|
||||
{
|
||||
"action": 13,
|
||||
"count": 0
|
||||
},
|
||||
{
|
||||
"action": 12,
|
||||
"count": 0
|
||||
},
|
||||
{
|
||||
"action": 8,
|
||||
"count": 0
|
||||
}
|
||||
]
|
||||
},
|
||||
"threat_types": [],
|
||||
"alert": {
|
||||
"AlertId": "636219966081943637_-467964911",
|
||||
"WcdMachineId": null,
|
||||
"SenseMachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
|
||||
"MachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
|
||||
"ComputerDnsName": "cont-jonathanw.contoso.org",
|
||||
"Severity": 256,
|
||||
"Status": 4,
|
||||
"LastEventTime": "2017-04-17T16:37:47.8018798Z",
|
||||
"FirstEventTime": "2017-04-17T13:12:20.2461196Z",
|
||||
"FirstSeen": "2017-04-17T16:50:07.754788Z",
|
||||
"Classification": 0,
|
||||
"Determination": 0,
|
||||
"DomainName": "CONTOSO",
|
||||
"AccountName": "jonathan.wolcott",
|
||||
"AccountSid": "S-1-5-21-2649156466-80624164-2033095608-1113",
|
||||
"AssignedTo": "Analyst@WDATPContosoFld.onmicrosoft.com",
|
||||
"Category": "PrivilegeEscalation",
|
||||
"Title": "Process privilege escalation due to kernel exploit",
|
||||
"ActorName": null,
|
||||
"TiProvider": null,
|
||||
"GroupId": null,
|
||||
"GroupKey": null,
|
||||
"MachineCount": 1,
|
||||
"UserCount": 1,
|
||||
"AssignedToCount": 1,
|
||||
"AlertCount": 0,
|
||||
"IoaDefinitionId": "6f36a53b-7229-471e-9c91-ea473a50b95d",
|
||||
"InternalMachineId": 8,
|
||||
"ContainedAlerts": null,
|
||||
"IsSealedGroup": null,
|
||||
"DetectionSource": 1,
|
||||
"ThreatFamilyName": null,
|
||||
"SuppressionRuleId": null
|
||||
},
|
||||
"pending_since": null,
|
||||
"alert_to_remediation_time": 0,
|
||||
"is_cleanup_applied": false,
|
||||
"errors": [
|
||||
2,
|
||||
10
|
||||
],
|
||||
"pending_actions": [
|
||||
{
|
||||
"waiting_time": 64.636371,
|
||||
"entities": [],
|
||||
"end_time": "2017-07-02T13:55:32.496900Z",
|
||||
"entity_name": null,
|
||||
"action_type": 13,
|
||||
"decision": null,
|
||||
"action_id": 3,
|
||||
"user": null,
|
||||
"start_time": "2017-07-02T13:54:27.860529Z",
|
||||
"action_name": "Check Endpoint Coverage"
|
||||
},
|
||||
{
|
||||
"waiting_time": 64.653725,
|
||||
"entities": [],
|
||||
"end_time": "2017-07-02T13:55:32.494259Z",
|
||||
"entity_name": null,
|
||||
"action_type": 13,
|
||||
"decision": null,
|
||||
"action_id": 2,
|
||||
"user": null,
|
||||
"start_time": "2017-07-02T13:54:27.840534Z",
|
||||
"action_name": "Check Endpoint Coverage"
|
||||
},
|
||||
{
|
||||
"waiting_time": 1401.037551,
|
||||
"entities": [],
|
||||
"end_time": "2017-07-02T14:19:21.919703Z",
|
||||
"entity_name": null,
|
||||
"action_type": 8,
|
||||
"decision": "Skip",
|
||||
"action_id": 7,
|
||||
"user": null,
|
||||
"start_time": "2017-07-02T13:56:00.882152Z",
|
||||
"action_name": "Deploy Probe on endpoint"
|
||||
},
|
||||
{
|
||||
"waiting_time": 1404.699114,
|
||||
"entities": [],
|
||||
"end_time": "2017-07-02T14:19:21.919703Z",
|
||||
"entity_name": null,
|
||||
"action_type": 8,
|
||||
"decision": "Skip",
|
||||
"action_id": 6,
|
||||
"user": null,
|
||||
"start_time": "2017-07-02T13:55:57.220589Z",
|
||||
"action_name": "Deploy Probe on endpoint"
|
||||
}
|
||||
],
|
||||
"reasons": [
|
||||
"Endpoint cannot connect back to Windows Defender ATP",
|
||||
"Windows Defender ATP shouldn't analyze this endpoint",
|
||||
"Endpoint is not covered by any Asset Group"
|
||||
],
|
||||
"pending_type": null,
|
||||
"remediation_pending_time": 0,
|
||||
"resource_pending_time": 1469,
|
||||
"tags": []
|
||||
}
|
Разница между файлами не показана из-за своего большого размера
Загрузить разницу
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
"count": 0,
|
||||
"last_investigation": {
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"id": 3007
|
||||
}
|
||||
}
|
|
@ -0,0 +1,3 @@
|
|||
{
|
||||
"investigation_ids": [17]
|
||||
}
|
|
@ -0,0 +1,72 @@
|
|||
{
|
||||
"count": 2,
|
||||
"next": "https://172.2.0.200/api/investigation/all?status=5&perPage=10&page=2",
|
||||
"previous": null,
|
||||
"results": [
|
||||
{
|
||||
"id": 163,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-22T10:21:51.361Z",
|
||||
"end_date": "2015-04-22T10:27:35.177Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 26,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3963,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3961,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3959,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\\syswow64\".",
|
||||
"id": 3955,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3963,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3961,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3959,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3942,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3966,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": true,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "Some general error",
|
||||
"status": 0
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,48 @@
|
|||
{
|
||||
"count": 1,
|
||||
"next": null,
|
||||
"previous": null,
|
||||
"results": [
|
||||
{
|
||||
"id": 34,
|
||||
"name": "Symantec Virus Found",
|
||||
"start_date": "2015-07-12T12:05:33.043Z",
|
||||
"end_date": null,
|
||||
"affected_hosts": [
|
||||
"WIN7-X64-NO-SP.auto.lab"
|
||||
],
|
||||
"affected_groups": [
|
||||
"GROUP-1"
|
||||
],
|
||||
"affected_users": [],
|
||||
"total_actions": 9,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"C:\\Windows\\sus.exe\".",
|
||||
"id": 831,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"pending_actions": [
|
||||
{
|
||||
"details": "Quarantine \"C:\\Windows\\sus.exe\".",
|
||||
"id": 831,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Quarantine \"C:\\Windows\\sus.exe\".",
|
||||
"is_remediation": true,
|
||||
"id": 831,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
"important": true,
|
||||
"detection_system": "DS-1",
|
||||
"error_description": "",
|
||||
"status": 1,
|
||||
"user": "",
|
||||
"comments": 0
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,736 @@
|
|||
{
|
||||
"count": 163,
|
||||
"next": "https://172.2.0.200/api/investigation/all?status=10&perPage=10&page=2",
|
||||
"previous": null,
|
||||
"results": [
|
||||
{
|
||||
"id": 163,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-22T10:21:51.361Z",
|
||||
"end_date": "2015-04-22T10:27:35.177Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 26,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3963,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3961,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3959,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\\syswow64\".",
|
||||
"id": 3955,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3963,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3961,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3959,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3942,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3966,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 162,
|
||||
"name": "McAfee Endpoint Security Tampered",
|
||||
"start_date": "2015-04-22T10:16:42.756Z",
|
||||
"end_date": "2015-04-22T10:21:48.304Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 27,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3937,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:2088.",
|
||||
"id": 3936,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2088.",
|
||||
"id": 3934,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3932,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\\".",
|
||||
"id": 3928,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2088.",
|
||||
"id": 3934,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3932,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3915,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3940,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 161,
|
||||
"name": "McAfee Port Blocking",
|
||||
"start_date": "2015-04-22T10:09:55.962Z",
|
||||
"end_date": "2015-04-22T10:16:39.736Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 27,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3910,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"sus.exe\" pid:2188.",
|
||||
"id": 3909,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2188.",
|
||||
"id": 3907,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3905,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 3901,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2188.",
|
||||
"id": 3907,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3905,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3888,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3913,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 160,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-22T09:52:03.096Z",
|
||||
"end_date": "2015-04-22T09:55:36.314Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 26,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3883,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3881,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3879,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\\syswow64\".",
|
||||
"id": 3875,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3883,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3881,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3879,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3862,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3886,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 159,
|
||||
"name": "McAfee Endpoint Security Tampered",
|
||||
"start_date": "2015-04-22T09:45:02.829Z",
|
||||
"end_date": "2015-04-22T09:51:58.810Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 37,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3857,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3856,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:2904.",
|
||||
"id": 3855,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"sus.exe\" pid:2180.",
|
||||
"id": 3854,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2180.",
|
||||
"id": 3851,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2904.",
|
||||
"id": 3850,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3847,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3846,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\\".",
|
||||
"id": 3839,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 3838,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2180.",
|
||||
"id": 3851,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2904.",
|
||||
"id": 3850,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3847,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3846,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3825,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3860,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 158,
|
||||
"name": "McAfee Port Blocking",
|
||||
"start_date": "2015-04-22T09:25:05.847Z",
|
||||
"end_date": "2015-04-22T09:45:01.176Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 25,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 3814,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\".",
|
||||
"id": 3813,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Calculate hash values for 409 files.",
|
||||
"id": 3819,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Calculate hash values for 409 files.",
|
||||
"id": 3820,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3800,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3823,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 157,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-22T08:37:09.523Z",
|
||||
"end_date": "2015-04-22T08:40:50.088Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [],
|
||||
"total_actions": 39,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3795,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:1360.",
|
||||
"id": 3794,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1360.",
|
||||
"id": 3791,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\\syswow64\".",
|
||||
"id": 3788,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3782,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\\a0001094.exe\" with passphrase:None.",
|
||||
"id": 3783,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\\".",
|
||||
"id": 3775,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 2 files in directory \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\".",
|
||||
"id": 3774,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Calculate hash values for 341 files.",
|
||||
"id": 3793,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1360.",
|
||||
"id": 3791,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Calculate hash values for 341 files.",
|
||||
"id": 3787,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3782,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3761,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3798,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 156,
|
||||
"name": "McAfee Endpoint Security Tampered",
|
||||
"start_date": "2015-04-22T08:29:24.666Z",
|
||||
"end_date": "2015-04-22T08:37:06.417Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [],
|
||||
"total_actions": 44,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"C:\\WINDOWS\\najort5g.exe\" with passphrase:None.",
|
||||
"id": 3759,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"C:\\WINDOWS\".",
|
||||
"id": 3756,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3751,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"sus.exe\" pid:340.",
|
||||
"id": 3750,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:340.",
|
||||
"id": 3744,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\\".",
|
||||
"id": 3745,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3738,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\\a0001090.exe\" with passphrase:None.",
|
||||
"id": 3739,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 3731,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 2 files in directory \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\".",
|
||||
"id": 3730,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Calculate hash values for 343 files.",
|
||||
"id": 3749,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:340.",
|
||||
"id": 3744,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Calculate hash values for 343 files.",
|
||||
"id": 3743,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3738,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3717,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Quarantine \"C:\\WINDOWS\\najort5g.exe\" with passphrase:None.",
|
||||
"is_remediation": true,
|
||||
"id": 3759,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 7
|
||||
},
|
||||
{
|
||||
"id": 155,
|
||||
"name": "McAfee Port Blocking",
|
||||
"start_date": "2015-04-22T07:58:43.000Z",
|
||||
"end_date": "2015-04-22T08:29:20.430Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [],
|
||||
"total_actions": 10,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Lists all PEs in \"C:\\Documents and Settings\\username\\My Documents\\Downloads\".",
|
||||
"id": 3714,
|
||||
"name": "Find Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Get all executable files created in last 3600 seconds.",
|
||||
"id": 3715,
|
||||
"name": "Get Recently Created Files"
|
||||
},
|
||||
{
|
||||
"details": "List all running processes on ()XP-X64@2.0.0.12.",
|
||||
"id": 3711,
|
||||
"name": "Get Process List"
|
||||
},
|
||||
{
|
||||
"details": "Check for known persistency method on host ()XP-X64@2.0.0.12, filter=[None].",
|
||||
"id": 3712,
|
||||
"name": "Persistency Check"
|
||||
},
|
||||
{
|
||||
"details": "Lists all PEs in \"C:\\Documents and Settings\\username\\Local Settings\\Application Data\\Microsoft\\Outlook\".",
|
||||
"id": 3713,
|
||||
"name": "Find Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Get active connections list.",
|
||||
"id": 3708,
|
||||
"name": "Get All Active Connections"
|
||||
},
|
||||
{
|
||||
"details": "List all services installed on ()XP-X64@2.0.0.12.",
|
||||
"id": 3709,
|
||||
"name": "Get Service List"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3707,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Get all executable files created in last 3600 seconds.",
|
||||
"is_remediation": false,
|
||||
"id": 3715,
|
||||
"name": "Get Recently Created Files"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 154,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-22T07:09:09.295Z",
|
||||
"end_date": "2015-04-22T07:13:50.198Z",
|
||||
"affected_hosts": ["XP-X86-SP3"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 27,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3702,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"z5eQA8h9.exe\" pid:172.",
|
||||
"id": 3701,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:172.",
|
||||
"id": 3699,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3697,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\\system32\".",
|
||||
"id": 3693,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:172.",
|
||||
"id": 3699,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3697,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X86-SP3@2.0.0.10.",
|
||||
"id": 3680,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3705,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,153 @@
|
|||
{
|
||||
"count": 4,
|
||||
"next": null,
|
||||
"previous": null,
|
||||
"results": [
|
||||
{
|
||||
"id": 1811,
|
||||
"name": "Host Manual Investigation",
|
||||
"start_date": "2015-03-18T14:01:32.372Z",
|
||||
"end_date": "2015-03-18T14:01:37.164Z",
|
||||
"affected_hosts": [],
|
||||
"affected_groups": [],
|
||||
"affected_users": [],
|
||||
"total_actions": 3,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Check if [u'Hexa-PC5', u'192.168.0.5'] is covered by AIRS.",
|
||||
"id": 56483,
|
||||
"name": "Find Host"
|
||||
},
|
||||
{
|
||||
"details": "Check if [u'Hexa-PC5', u'192.168.0.5'] is covered by AIRS.",
|
||||
"id": 56484,
|
||||
"name": "Find Host"
|
||||
},
|
||||
{
|
||||
"details": "Check if [u'Hexa-PC5', u'192.168.0.5'] is covered by AIRS.",
|
||||
"id": 56485,
|
||||
"name": "Find Host"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Check if [u'Hexa-PC5', u'192.168.0.5'] is covered by AIRS.",
|
||||
"is_remediation": false,
|
||||
"id": 56485,
|
||||
"name": "Find Host"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "DS_2",
|
||||
"error_description": "\"Error investigating Hexa-PC5, is explicitly set to Not Covered\"",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 12,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-02-24T14:37:23.160Z",
|
||||
"end_date": "2015-02-24T14:37:38.551Z",
|
||||
"affected_hosts": [],
|
||||
"affected_groups": [],
|
||||
"affected_users": [],
|
||||
"total_actions": 3,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Check if [u'192.168.0.4', u'HEXA-PC1'] is covered by AIRS.",
|
||||
"id": 206,
|
||||
"name": "Find Host"
|
||||
},
|
||||
{
|
||||
"details": "Check if [u'192.168.0.4', u'HEXA-PC1'] is covered by AIRS.",
|
||||
"id": 207,
|
||||
"name": "Find Host"
|
||||
},
|
||||
{
|
||||
"details": "Check if [u'192.168.0.4', u'HEXA-PC1'] is covered by AIRS.",
|
||||
"id": 208,
|
||||
"name": "Find Host"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Check if [u'192.168.0.4', u'HEXA-PC1'] is covered by AIRS.",
|
||||
"is_remediation": false,
|
||||
"id": 208,
|
||||
"name": "Find Host"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "DS_1",
|
||||
"error_description": "\"Error investigating HEXA-PC1, is explicitly set to Not Covered\"",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 11,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-02-24T14:32:54.749Z",
|
||||
"end_date": "2015-02-24T14:33:12.295Z",
|
||||
"affected_hosts": [],
|
||||
"affected_groups": [],
|
||||
"affected_users": [],
|
||||
"total_actions": 3,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Check if [u'192.168.0.4', u'WIN7-ULT-X86'] is covered by AIRS.",
|
||||
"id": 203,
|
||||
"name": "Find Host"
|
||||
},
|
||||
{
|
||||
"details": "Check if [u'192.168.0.4', u'WIN7-ULT-X86'] is covered by AIRS.",
|
||||
"id": 204,
|
||||
"name": "Find Host"
|
||||
},
|
||||
{
|
||||
"details": "Check if [u'192.168.0.4', u'WIN7-ULT-X86'] is covered by AIRS.",
|
||||
"id": 205,
|
||||
"name": "Find Host"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Check if [u'192.168.0.4', u'WIN7-ULT-X86'] is covered by AIRS.",
|
||||
"is_remediation": false,
|
||||
"id": 205,
|
||||
"name": "Find Host"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "DS_1",
|
||||
"error_description": "\"Error investigating WIN7-ULT-X86, is explicitly set to Not Covered\"",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 1,
|
||||
"name": "Symantec Virus Found",
|
||||
"start_date": "2015-01-27T12:45:10.984Z",
|
||||
"end_date": "2015-01-27T12:45:11.626Z",
|
||||
"affected_hosts": [],
|
||||
"affected_groups": [],
|
||||
"affected_users": [],
|
||||
"total_actions": 1,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Check if [u'HEXA-PC1', u'192.168.0.4'] is covered by AIRS.",
|
||||
"id": 1,
|
||||
"name": "Find Host"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Check if [u'HEXA-PC1', u'192.168.0.4'] is covered by AIRS.",
|
||||
"is_remediation": false,
|
||||
"id": 1,
|
||||
"name": "Find Host"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "DS_2",
|
||||
"error_description": "\"Error investigating HEXA-PC1, is explicitly set to Not Covered\"",
|
||||
"status": 5
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,736 @@
|
|||
{
|
||||
"count": 2,
|
||||
"next": "https://172.2.0.200/api/investigation/all?status=5&perPage=10&page=2",
|
||||
"previous": null,
|
||||
"results": [
|
||||
{
|
||||
"id": 163,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-22T10:21:51.361Z",
|
||||
"end_date": "2015-04-22T10:27:35.177Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 26,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3963,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3961,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3959,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\\syswow64\".",
|
||||
"id": 3955,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3963,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3961,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3959,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3942,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3966,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "Some general error",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 162,
|
||||
"name": "McAfee Endpoint Security Tampered",
|
||||
"start_date": "2015-04-22T10:16:42.756Z",
|
||||
"end_date": "2015-04-22T10:21:48.304Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 27,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3937,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:2088.",
|
||||
"id": 3936,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2088.",
|
||||
"id": 3934,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3932,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\\".",
|
||||
"id": 3928,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2088.",
|
||||
"id": 3934,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3932,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3915,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3940,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": true,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 161,
|
||||
"name": "McAfee Port Blocking",
|
||||
"start_date": "2015-04-22T10:09:55.962Z",
|
||||
"end_date": "2015-04-22T10:16:39.736Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 27,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3910,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"sus.exe\" pid:2188.",
|
||||
"id": 3909,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2188.",
|
||||
"id": 3907,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3905,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 3901,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2188.",
|
||||
"id": 3907,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3905,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3888,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3913,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": true,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 160,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-22T09:52:03.096Z",
|
||||
"end_date": "2015-04-22T09:55:36.314Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 26,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3883,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3881,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3879,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\\syswow64\".",
|
||||
"id": 3875,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3883,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3881,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3879,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3862,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3886,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 159,
|
||||
"name": "McAfee Endpoint Security Tampered",
|
||||
"start_date": "2015-04-22T09:45:02.829Z",
|
||||
"end_date": "2015-04-22T09:51:58.810Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 37,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3857,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3856,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:2904.",
|
||||
"id": 3855,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"sus.exe\" pid:2180.",
|
||||
"id": 3854,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2180.",
|
||||
"id": 3851,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2904.",
|
||||
"id": 3850,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3847,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3846,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\\".",
|
||||
"id": 3839,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 3838,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2180.",
|
||||
"id": 3851,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2904.",
|
||||
"id": 3850,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3847,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3846,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3825,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3860,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 158,
|
||||
"name": "McAfee Port Blocking",
|
||||
"start_date": "2015-04-22T09:25:05.847Z",
|
||||
"end_date": "2015-04-22T09:45:01.176Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 25,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 3814,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\".",
|
||||
"id": 3813,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Calculate hash values for 409 files.",
|
||||
"id": 3819,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Calculate hash values for 409 files.",
|
||||
"id": 3820,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3800,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3823,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 157,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-22T08:37:09.523Z",
|
||||
"end_date": "2015-04-22T08:40:50.088Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [],
|
||||
"total_actions": 39,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3795,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:1360.",
|
||||
"id": 3794,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1360.",
|
||||
"id": 3791,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\\syswow64\".",
|
||||
"id": 3788,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3782,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\\a0001094.exe\" with passphrase:None.",
|
||||
"id": 3783,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\\".",
|
||||
"id": 3775,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 2 files in directory \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\".",
|
||||
"id": 3774,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Calculate hash values for 341 files.",
|
||||
"id": 3793,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1360.",
|
||||
"id": 3791,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Calculate hash values for 341 files.",
|
||||
"id": 3787,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3782,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3761,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3798,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 155,
|
||||
"name": "McAfee Port Blocking",
|
||||
"start_date": "2015-04-22T07:58:43.000Z",
|
||||
"end_date": "2015-04-22T08:29:20.430Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [],
|
||||
"total_actions": 10,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Lists all PEs in \"C:\\Documents and Settings\\username\\My Documents\\Downloads\".",
|
||||
"id": 3714,
|
||||
"name": "Find Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Get all executable files created in last 3600 seconds.",
|
||||
"id": 3715,
|
||||
"name": "Get Recently Created Files"
|
||||
},
|
||||
{
|
||||
"details": "List all running processes on ()XP-X64@2.0.0.12.",
|
||||
"id": 3711,
|
||||
"name": "Get Process List"
|
||||
},
|
||||
{
|
||||
"details": "Check for known persistency method on host ()XP-X64@2.0.0.12, filter=[None].",
|
||||
"id": 3712,
|
||||
"name": "Persistency Check"
|
||||
},
|
||||
{
|
||||
"details": "Lists all PEs in \"C:\\Documents and Settings\\username\\Local Settings\\Application Data\\Microsoft\\Outlook\".",
|
||||
"id": 3713,
|
||||
"name": "Find Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Get active connections list.",
|
||||
"id": 3708,
|
||||
"name": "Get All Active Connections"
|
||||
},
|
||||
{
|
||||
"details": "List all services installed on ()XP-X64@2.0.0.12.",
|
||||
"id": 3709,
|
||||
"name": "Get Service List"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3707,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Get all executable files created in last 3600 seconds.",
|
||||
"is_remediation": false,
|
||||
"id": 3715,
|
||||
"name": "Get Recently Created Files"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 154,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-22T07:09:09.295Z",
|
||||
"end_date": "2015-04-22T07:13:50.198Z",
|
||||
"affected_hosts": ["XP-X86-SP3"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 27,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3702,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"z5eQA8h9.exe\" pid:172.",
|
||||
"id": 3701,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:172.",
|
||||
"id": 3699,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3697,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\\system32\".",
|
||||
"id": 3693,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:172.",
|
||||
"id": 3699,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3697,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X86-SP3@2.0.0.10.",
|
||||
"id": 3680,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3705,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
},
|
||||
{
|
||||
"id": 153,
|
||||
"name": "McAfee Endpoint Security Tampered",
|
||||
"start_date": "2015-04-22T07:00:29.018Z",
|
||||
"end_date": "2015-04-22T07:09:03.949Z",
|
||||
"affected_hosts": ["XP-X86-SP3"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 37,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3675,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3674,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:1596.",
|
||||
"id": 3673,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"sus.exe\" pid:1740.",
|
||||
"id": 3672,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1596.",
|
||||
"id": 3669,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:1740.",
|
||||
"id": 3668,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3665,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3664,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\\".",
|
||||
"id": 3657,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 3656,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1596.",
|
||||
"id": 3669,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:1740.",
|
||||
"id": 3668,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3665,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3664,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X86-SP3@2.0.0.10.",
|
||||
"id": 3643,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
|
||||
"is_remediation": false,
|
||||
"id": 3678,
|
||||
"name": "Group Hash Analysis"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 5
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,240 @@
|
|||
{
|
||||
"count": 3857,
|
||||
"next": "https://172.2.0.200/api/investigation/all?status=6&perPage=10&page=2",
|
||||
"previous": null,
|
||||
"results": [
|
||||
{
|
||||
"id": 135,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-21T14:28:42.870Z",
|
||||
"end_date": "2015-04-21T14:30:33.197Z",
|
||||
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 16,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Analyzing 695 files using AIRS Cloud srvice.",
|
||||
"is_remediation": false,
|
||||
"id": 3384,
|
||||
"name": "Analyze Multiple Files"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 6
|
||||
},
|
||||
{
|
||||
"id": 127,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-21T12:56:03.672Z",
|
||||
"end_date": "2015-04-21T12:58:05.840Z",
|
||||
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 16,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Analyzing 693 files using AIRS Cloud srvice.",
|
||||
"is_remediation": false,
|
||||
"id": 3112,
|
||||
"name": "Analyze Multiple Files"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 6
|
||||
},
|
||||
{
|
||||
"id": 120,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-21T10:35:58.521Z",
|
||||
"end_date": "2015-04-21T10:36:01.443Z",
|
||||
"affected_hosts": [],
|
||||
"affected_groups": [],
|
||||
"affected_users": [],
|
||||
"total_actions": 1,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "The alert is already being investigated (inv#118).",
|
||||
"is_remediation": false,
|
||||
"id": 2873,
|
||||
"name": "Alert Correlation"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 6
|
||||
},
|
||||
{
|
||||
"id": 119,
|
||||
"name": "McAfee Endpoint Security Tampered",
|
||||
"start_date": "2015-04-21T10:35:54.338Z",
|
||||
"end_date": "2015-04-21T10:44:36.168Z",
|
||||
"affected_hosts": ["WIN8-X86"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [
|
||||
"AUTO\\Administrator",
|
||||
"WIN8-X86\\DWM-1"
|
||||
],
|
||||
"total_actions": 14,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Analyzing 762 files using AIRS Cloud srvice.",
|
||||
"is_remediation": false,
|
||||
"id": 2899,
|
||||
"name": "Analyze Multiple Files"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 6
|
||||
},
|
||||
{
|
||||
"id": 110,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-21T08:44:56.457Z",
|
||||
"end_date": "2015-04-21T08:47:08.130Z",
|
||||
"affected_hosts": ["WIN7-X64-NO-SP.auto.lab"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 16,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Analyzing 681 files using AIRS Cloud srvice.",
|
||||
"is_remediation": false,
|
||||
"id": 2619,
|
||||
"name": "Analyze Multiple Files"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 6
|
||||
},
|
||||
{
|
||||
"id": 84,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-20T13:01:51.372Z",
|
||||
"end_date": "2015-04-20T13:01:52.003Z",
|
||||
"affected_hosts": [],
|
||||
"affected_groups": [],
|
||||
"affected_users": [],
|
||||
"total_actions": 1,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "The alert is already being investigated (inv#82).",
|
||||
"is_remediation": false,
|
||||
"id": 2041,
|
||||
"name": "Alert Correlation"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 6
|
||||
},
|
||||
{
|
||||
"id": 83,
|
||||
"name": "McAfee Endpoint Security Tampered",
|
||||
"start_date": "2015-04-20T13:01:40.821Z",
|
||||
"end_date": "2015-04-20T13:01:40.984Z",
|
||||
"affected_hosts": [],
|
||||
"affected_groups": [],
|
||||
"affected_users": [],
|
||||
"total_actions": 1,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "The alert is already being investigated (inv#82).",
|
||||
"is_remediation": false,
|
||||
"id": 2040,
|
||||
"name": "Alert Correlation"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 6
|
||||
},
|
||||
{
|
||||
"id": 79,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-19T15:23:23.021Z",
|
||||
"end_date": "2015-04-19T15:23:23.078Z",
|
||||
"affected_hosts": [],
|
||||
"affected_groups": [],
|
||||
"affected_users": [],
|
||||
"total_actions": 1,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "The alert is already being investigated (inv#77).",
|
||||
"is_remediation": false,
|
||||
"id": 1994,
|
||||
"name": "Alert Correlation"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 6
|
||||
},
|
||||
{
|
||||
"id": 78,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-19T15:23:18.238Z",
|
||||
"end_date": "2015-04-19T15:23:18.314Z",
|
||||
"affected_hosts": [],
|
||||
"affected_groups": [],
|
||||
"affected_users": [],
|
||||
"total_actions": 1,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "The alert is already being investigated (inv#75).",
|
||||
"is_remediation": false,
|
||||
"id": 1993,
|
||||
"name": "Alert Correlation"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 6
|
||||
},
|
||||
{
|
||||
"id": 76,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-19T15:21:57.648Z",
|
||||
"end_date": "2015-04-19T15:21:57.710Z",
|
||||
"affected_hosts": [],
|
||||
"affected_groups": [],
|
||||
"affected_users": [],
|
||||
"total_actions": 1,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "The alert is already being investigated (inv#75).",
|
||||
"is_remediation": false,
|
||||
"id": 1990,
|
||||
"name": "Alert Correlation"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 6
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,783 @@
|
|||
{
|
||||
"count": 21,
|
||||
"next": "https://172.2.0.200/api/investigation/all?status=7&perPage=10&page=2",
|
||||
"previous": null,
|
||||
"results": [
|
||||
{
|
||||
"id": 156,
|
||||
"name": "McAfee Endpoint Security Tampered",
|
||||
"start_date": "2015-04-22T08:29:24.666Z",
|
||||
"end_date": "2015-04-22T08:37:06.417Z",
|
||||
"affected_hosts": ["XP-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [],
|
||||
"total_actions": 44,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"C:\\WINDOWS\\najort5g.exe\" with passphrase:None.",
|
||||
"id": 3759,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"C:\\WINDOWS\".",
|
||||
"id": 3756,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3751,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"sus.exe\" pid:340.",
|
||||
"id": 3750,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:340.",
|
||||
"id": 3744,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\\".",
|
||||
"id": 3745,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3738,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\\a0001090.exe\" with passphrase:None.",
|
||||
"id": 3739,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 3731,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 2 files in directory \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\".",
|
||||
"id": 3730,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Calculate hash values for 343 files.",
|
||||
"id": 3749,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:340.",
|
||||
"id": 3744,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Calculate hash values for 343 files.",
|
||||
"id": 3743,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3738,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
|
||||
"id": 3717,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Quarantine \"C:\\WINDOWS\\najort5g.exe\" with passphrase:None.",
|
||||
"is_remediation": true,
|
||||
"id": 3759,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 7
|
||||
},
|
||||
{
|
||||
"id": 131,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-21T13:15:36.687Z",
|
||||
"end_date": "2015-04-21T13:20:14.179Z",
|
||||
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 36,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
|
||||
"id": 3247,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"file in space.exe\" pid:372.",
|
||||
"id": 3246,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:372.",
|
||||
"id": 3244,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
|
||||
"id": 3242,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Analyzing 689 files using AIRS Cloud srvice.",
|
||||
"id": 3269,
|
||||
"name": "Analyze Multiple Files"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:372.",
|
||||
"id": 3244,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
|
||||
"id": 3242,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyzing 689 files using AIRS Cloud srvice.",
|
||||
"is_remediation": false,
|
||||
"id": 3269,
|
||||
"name": "Analyze Multiple Files"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 7
|
||||
},
|
||||
{
|
||||
"id": 123,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-21T12:09:30.090Z",
|
||||
"end_date": "2015-04-21T12:21:29.607Z",
|
||||
"affected_hosts": ["WIN8-X86"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 33,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 2988,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"z5eQA8h9.exe\" pid:3628.",
|
||||
"id": 2987,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:3628.",
|
||||
"id": 2985,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 2983,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\\system32\".",
|
||||
"id": 2979,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:3628.",
|
||||
"id": 2985,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 2983,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Check 2 addresses whether are known as malicious",
|
||||
"id": 2970,
|
||||
"name": "Analyze Multiple IP Addresses"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
|
||||
"is_remediation": false,
|
||||
"id": 2997,
|
||||
"name": "Decide On File Quarantine"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 7
|
||||
},
|
||||
{
|
||||
"id": 121,
|
||||
"name": "McAfee Port Blocking",
|
||||
"start_date": "2015-04-21T11:56:49.023Z",
|
||||
"end_date": "2015-04-21T12:03:13.866Z",
|
||||
"affected_hosts": ["WIN8-X86"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [
|
||||
"AUTO\\Administrator",
|
||||
"WIN8-X86\\DWM-1"
|
||||
],
|
||||
"total_actions": 32,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 2922,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"sus.exe\" pid:908.",
|
||||
"id": 2921,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:908.",
|
||||
"id": 2919,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 2917,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 2913,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:908.",
|
||||
"id": 2919,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 2917,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get active connections list.",
|
||||
"id": 2902,
|
||||
"name": "Get All Active Connections"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()WIN8-X86@2.0.0.6.",
|
||||
"id": 2901,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
|
||||
"is_remediation": false,
|
||||
"id": 2931,
|
||||
"name": "Decide On File Quarantine"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 7
|
||||
},
|
||||
{
|
||||
"id": 116,
|
||||
"name": "McAfee Endpoint Security Tampered",
|
||||
"start_date": "2015-04-21T09:25:49.802Z",
|
||||
"end_date": "2015-04-21T09:31:03.850Z",
|
||||
"affected_hosts": ["WIN8-X86"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 28,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 2833,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:3196.",
|
||||
"id": 2832,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\users\\administrator\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:3196.",
|
||||
"id": 2830,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 2828,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\users\\administrator\".",
|
||||
"id": 2824,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Analyzing 3 files using AIRS Cloud srvice.",
|
||||
"id": 2837,
|
||||
"name": "Analyze Multiple Files"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\users\\administrator\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:3196.",
|
||||
"id": 2830,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 2828,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyzing 3 files using AIRS Cloud srvice.",
|
||||
"is_remediation": false,
|
||||
"id": 2837,
|
||||
"name": "Analyze Multiple Files"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 7
|
||||
},
|
||||
{
|
||||
"id": 104,
|
||||
"name": "McAfee Port Blocking",
|
||||
"start_date": "2015-04-21T07:57:19.474Z",
|
||||
"end_date": "2015-04-21T08:02:58.720Z",
|
||||
"affected_hosts": ["WIN8-X86"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [
|
||||
"AUTO\\Administrator",
|
||||
"WIN8-X86\\DWM-1"
|
||||
],
|
||||
"total_actions": 32,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 2429,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"sus.exe\" pid:2680.",
|
||||
"id": 2428,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2680.",
|
||||
"id": 2426,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 2424,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 2420,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2680.",
|
||||
"id": 2426,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 2424,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Get active connections list.",
|
||||
"id": 2409,
|
||||
"name": "Get All Active Connections"
|
||||
},
|
||||
{
|
||||
"details": "Get browsing history from ()WIN8-X86@2.0.0.6.",
|
||||
"id": 2408,
|
||||
"name": "Get Host Browsing History"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
|
||||
"is_remediation": false,
|
||||
"id": 2438,
|
||||
"name": "Decide On File Quarantine"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 7
|
||||
},
|
||||
{
|
||||
"id": 98,
|
||||
"name": "McAfee Port Blocking",
|
||||
"start_date": "2015-04-20T15:57:44.442Z",
|
||||
"end_date": "2015-04-20T16:03:23.725Z",
|
||||
"affected_hosts": ["WIN8-X86"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [
|
||||
"AUTO\\Administrator",
|
||||
"WIN8-X86\\DWM-1"
|
||||
],
|
||||
"total_actions": 47,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 2214,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 2213,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 2212,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"z5eQA8h9.exe\" pid:2632.",
|
||||
"id": 2211,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:1080.",
|
||||
"id": 2210,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\users\\administrator\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1080.",
|
||||
"id": 2207,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:2632.",
|
||||
"id": 2206,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 2203,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 2202,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\\system32\".",
|
||||
"id": 2195,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\users\\administrator\".",
|
||||
"id": 2194,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Calculate hash values for 754 files.",
|
||||
"id": 2217,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\users\\administrator\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1080.",
|
||||
"id": 2207,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:2632.",
|
||||
"id": 2206,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 2203,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 2202,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
|
||||
"is_remediation": false,
|
||||
"id": 2226,
|
||||
"name": "Decide On File Quarantine"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 7
|
||||
},
|
||||
{
|
||||
"id": 70,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-14T13:50:48.035Z",
|
||||
"end_date": "2015-04-14T14:24:55.655Z",
|
||||
"affected_hosts": ["WIN81-X64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [],
|
||||
"total_actions": 49,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"evil.exe\" pid:2032.",
|
||||
"id": 1850,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:2032.",
|
||||
"id": 1848,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\1.exe\" with passphrase:None.",
|
||||
"id": 1846,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
|
||||
"id": 1845,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"1.exe\" pid:3648.",
|
||||
"id": 1844,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\temp\\1.exe\" from process name:\"1.exe\" pid:3648.",
|
||||
"id": 1839,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\1.exe\" with passphrase:None.",
|
||||
"id": 1837,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\temp\".",
|
||||
"id": 1831,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
|
||||
"id": 1817,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"file in space.exe\" pid:3100.",
|
||||
"id": 1816,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:3100.",
|
||||
"id": 1814,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
|
||||
"id": 1812,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:2032.",
|
||||
"id": 1848,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
|
||||
"id": 1845,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\temp\\1.exe\" from process name:\"1.exe\" pid:3648.",
|
||||
"id": 1839,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\1.exe\" with passphrase:None.",
|
||||
"id": 1837,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:3100.",
|
||||
"id": 1814,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
|
||||
"id": 1812,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Terminate(kill) process name:\"evil.exe\" pid:2032.",
|
||||
"is_remediation": true,
|
||||
"id": 1850,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 9
|
||||
},
|
||||
{
|
||||
"id": 45,
|
||||
"name": "McAfee Port Blocking",
|
||||
"start_date": "2015-04-13T07:25:28.355Z",
|
||||
"end_date": null,
|
||||
"affected_hosts": ["win8-x86"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [
|
||||
"AUTO\\Administrator",
|
||||
"WIN8-X86\\DWM-1"
|
||||
],
|
||||
"total_actions": 10,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Lists all PEs in \"C:\\Users\\Administrator\\Downloads\".",
|
||||
"id": 1141,
|
||||
"name": "Find Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "List all running processes on ()win8-x86@2.0.0.6.",
|
||||
"id": 1140,
|
||||
"name": "Get Process List"
|
||||
},
|
||||
{
|
||||
"details": "Lists all PEs in \"C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\Outlook\".",
|
||||
"id": 1139,
|
||||
"name": "Find Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Get active connections list.",
|
||||
"id": 1137,
|
||||
"name": "Get All Active Connections"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Get all executable files created in last 3600 seconds.",
|
||||
"is_remediation": false,
|
||||
"id": 1143,
|
||||
"name": "Get Recently Created Files"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 9
|
||||
},
|
||||
{
|
||||
"id": 44,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-13T06:58:30.775Z",
|
||||
"end_date": "2015-04-13T07:06:22.590Z",
|
||||
"affected_hosts": ["win8-x86"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 38,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\\system32\".",
|
||||
"id": 1121,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 1120,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"sus.exe\" pid:1180.",
|
||||
"id": 1119,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:1180.",
|
||||
"id": 1117,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 1115,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 1111,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Calculate hash values for 762 files.",
|
||||
"id": 1124,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:1180.",
|
||||
"id": 1117,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 1115,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
|
||||
"is_remediation": false,
|
||||
"id": 1133,
|
||||
"name": "Decide On File Quarantine"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 9
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,632 @@
|
|||
{
|
||||
"count": 55,
|
||||
"next": "https://172.2.0.200/api/investigation/all?status=8&perPage=10&page=2",
|
||||
"previous": null,
|
||||
"results": [
|
||||
{
|
||||
"id": 139,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-21T14:52:35.459Z",
|
||||
"end_date": "2015-04-21T14:56:49.977Z",
|
||||
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 36,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
|
||||
"id": 3519,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"file in space.exe\" pid:3212.",
|
||||
"id": 3518,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:3212.",
|
||||
"id": 3516,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
|
||||
"id": 3514,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:3212.",
|
||||
"id": 3516,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
|
||||
"id": 3514,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyzing 691 files using AIRS Cloud srvice.",
|
||||
"is_remediation": false,
|
||||
"id": 3541,
|
||||
"name": "Analyze Multiple Files"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 8
|
||||
},
|
||||
{
|
||||
"id": 138,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-21T14:47:37.565Z",
|
||||
"end_date": "2015-04-21T14:52:30.475Z",
|
||||
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 36,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\3.exe\" with passphrase:None.",
|
||||
"id": 3483,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"3.exe\" pid:3616.",
|
||||
"id": 3482,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\3.exe\" from process name:\"3.exe\" pid:3616.",
|
||||
"id": 3480,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\3.exe\" with passphrase:None.",
|
||||
"id": 3478,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"C:\\temp\\3.exe\" from process name:\"3.exe\" pid:3616.",
|
||||
"id": 3480,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\3.exe\" with passphrase:None.",
|
||||
"id": 3478,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
|
||||
"is_remediation": false,
|
||||
"id": 3505,
|
||||
"name": "Decide On File Quarantine"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 8
|
||||
},
|
||||
{
|
||||
"id": 137,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-21T14:35:05.593Z",
|
||||
"end_date": "2015-04-21T14:47:30.436Z",
|
||||
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 49,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
|
||||
"id": 3468,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"evil.exe\" pid:3892.",
|
||||
"id": 3467,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:3892.",
|
||||
"id": 3465,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
|
||||
"id": 3463,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\1.exe\" with passphrase:None.",
|
||||
"id": 3434,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"1.exe\" pid:2168.",
|
||||
"id": 3433,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\1.exe\" from process name:\"1.exe\" pid:2168.",
|
||||
"id": 3431,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\1.exe\" with passphrase:None.",
|
||||
"id": 3429,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:3892.",
|
||||
"id": 3465,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
|
||||
"id": 3463,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\1.exe\" from process name:\"1.exe\" pid:2168.",
|
||||
"id": 3431,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\1.exe\" with passphrase:None.",
|
||||
"id": 3429,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Wait on a complete report for [u'e783eb65b6bffeb2b276a0fc5731c18d', u'0f0fbd2f2d0bc9f0c86709e1396d9679a284204e'].",
|
||||
"is_remediation": false,
|
||||
"id": 3469,
|
||||
"name": "Wait For Cloud Analysis Report"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 8
|
||||
},
|
||||
{
|
||||
"id": 136,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-21T14:30:36.129Z",
|
||||
"end_date": "2015-04-21T14:34:58.120Z",
|
||||
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 36,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\2.exe\" with passphrase:None.",
|
||||
"id": 3398,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"2.exe\" pid:996.",
|
||||
"id": 3397,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\2.exe\" from process name:\"2.exe\" pid:996.",
|
||||
"id": 3395,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\2.exe\" with passphrase:None.",
|
||||
"id": 3393,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"C:\\temp\\2.exe\" from process name:\"2.exe\" pid:996.",
|
||||
"id": 3395,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\2.exe\" with passphrase:None.",
|
||||
"id": 3393,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyzing 691 files using AIRS Cloud srvice.",
|
||||
"is_remediation": false,
|
||||
"id": 3420,
|
||||
"name": "Analyze Multiple Files"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 8
|
||||
},
|
||||
{
|
||||
"id": 134,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-21T14:24:07.281Z",
|
||||
"end_date": "2015-04-21T14:28:36.134Z",
|
||||
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 33,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3359,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"z5eQA8h9.exe\" pid:3576.",
|
||||
"id": 3358,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:3576.",
|
||||
"id": 3356,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3354,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\\system32\".",
|
||||
"id": 3350,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:3576.",
|
||||
"id": 3356,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
|
||||
"id": 3354,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
|
||||
"is_remediation": false,
|
||||
"id": 3368,
|
||||
"name": "Decide On File Quarantine"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 8
|
||||
},
|
||||
{
|
||||
"id": 133,
|
||||
"name": "McAfee Endpoint Security Tampered",
|
||||
"start_date": "2015-04-21T14:19:36.188Z",
|
||||
"end_date": "2015-04-21T14:24:03.604Z",
|
||||
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 33,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3326,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:3580.",
|
||||
"id": 3325,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\users\\administrator\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:3580.",
|
||||
"id": 3323,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3321,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\users\\administrator\".",
|
||||
"id": 3317,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\users\\administrator\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:3580.",
|
||||
"id": 3323,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
|
||||
"id": 3321,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
|
||||
"is_remediation": false,
|
||||
"id": 3335,
|
||||
"name": "Decide On File Quarantine"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 8
|
||||
},
|
||||
{
|
||||
"id": 132,
|
||||
"name": "McAfee Port Blocking",
|
||||
"start_date": "2015-04-21T14:14:57.699Z",
|
||||
"end_date": "2015-04-21T14:19:31.811Z",
|
||||
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 33,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3293,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"sus.exe\" pid:2920.",
|
||||
"id": 3292,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2920.",
|
||||
"id": 3290,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3288,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 3284,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2920.",
|
||||
"id": 3290,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 3288,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
|
||||
"is_remediation": false,
|
||||
"id": 3302,
|
||||
"name": "Decide On File Quarantine"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 8
|
||||
},
|
||||
{
|
||||
"id": 130,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-21T13:11:02.515Z",
|
||||
"end_date": "2015-04-21T13:15:31.154Z",
|
||||
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 36,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\3.exe\" with passphrase:None.",
|
||||
"id": 3211,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"3.exe\" pid:1520.",
|
||||
"id": 3210,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\3.exe\" from process name:\"3.exe\" pid:1520.",
|
||||
"id": 3208,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\3.exe\" with passphrase:None.",
|
||||
"id": 3206,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"C:\\temp\\3.exe\" from process name:\"3.exe\" pid:1520.",
|
||||
"id": 3208,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\3.exe\" with passphrase:None.",
|
||||
"id": 3206,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
|
||||
"is_remediation": false,
|
||||
"id": 3233,
|
||||
"name": "Decide On File Quarantine"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 8
|
||||
},
|
||||
{
|
||||
"id": 129,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-21T13:02:50.327Z",
|
||||
"end_date": "2015-04-21T13:10:55.130Z",
|
||||
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 49,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
|
||||
"id": 3196,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"evil.exe\" pid:3796.",
|
||||
"id": 3195,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:3796.",
|
||||
"id": 3193,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
|
||||
"id": 3191,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\1.exe\" with passphrase:None.",
|
||||
"id": 3162,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"1.exe\" pid:2140.",
|
||||
"id": 3161,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\1.exe\" from process name:\"1.exe\" pid:2140.",
|
||||
"id": 3159,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\1.exe\" with passphrase:None.",
|
||||
"id": 3157,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:3796.",
|
||||
"id": 3193,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
|
||||
"id": 3191,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\1.exe\" from process name:\"1.exe\" pid:2140.",
|
||||
"id": 3159,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\1.exe\" with passphrase:None.",
|
||||
"id": 3157,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Wait on a complete report for [u'8b77c7cfcdf6588f65dcccf37891e4fc', u'5b4492aaf05640e1364897d41bb09b54bbcb44c4'].",
|
||||
"is_remediation": false,
|
||||
"id": 3197,
|
||||
"name": "Wait For Cloud Analysis Report"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 8
|
||||
},
|
||||
{
|
||||
"id": 128,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-21T12:58:08.365Z",
|
||||
"end_date": "2015-04-21T13:02:43.200Z",
|
||||
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 36,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\2.exe\" with passphrase:None.",
|
||||
"id": 3126,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"2.exe\" pid:1984.",
|
||||
"id": 3125,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\2.exe\" from process name:\"2.exe\" pid:1984.",
|
||||
"id": 3123,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\2.exe\" with passphrase:None.",
|
||||
"id": 3121,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"C:\\temp\\2.exe\" from process name:\"2.exe\" pid:1984.",
|
||||
"id": 3123,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\2.exe\" with passphrase:None.",
|
||||
"id": 3121,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Analyzing 694 files using AIRS Cloud srvice.",
|
||||
"is_remediation": false,
|
||||
"id": 3148,
|
||||
"name": "Analyze Multiple Files"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 8
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,351 @@
|
|||
{
|
||||
"count": 6,
|
||||
"next": null,
|
||||
"previous": null,
|
||||
"results": [
|
||||
{
|
||||
"id": 70,
|
||||
"name": "Symantec Virus Found syslog",
|
||||
"start_date": "2015-04-14T13:50:48.035Z",
|
||||
"end_date": "2015-04-14T14:24:55.655Z",
|
||||
"affected_hosts": ["WIN81-X64"],
|
||||
"affected_groups": [""],
|
||||
"user": "Yossi",
|
||||
"affected_users": [],
|
||||
"total_actions": 49,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"evil.exe\" pid:2032.",
|
||||
"id": 1850,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:2032.",
|
||||
"id": 1848,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\1.exe\" with passphrase:None.",
|
||||
"id": 1846,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
|
||||
"id": 1845,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"1.exe\" pid:3648.",
|
||||
"id": 1844,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\temp\\1.exe\" from process name:\"1.exe\" pid:3648.",
|
||||
"id": 1839,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\1.exe\" with passphrase:None.",
|
||||
"id": 1837,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\temp\".",
|
||||
"id": 1831,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
|
||||
"id": 1817,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"file in space.exe\" pid:3100.",
|
||||
"id": 1816,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:3100.",
|
||||
"id": 1814,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
|
||||
"id": 1812,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:2032.",
|
||||
"id": 1848,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
|
||||
"id": 1845,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\temp\\1.exe\" from process name:\"1.exe\" pid:3648.",
|
||||
"id": 1839,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\temp\\1.exe\" with passphrase:None.",
|
||||
"id": 1837,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:3100.",
|
||||
"id": 1814,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
|
||||
"id": 1812,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Terminate(kill) process name:\"evil.exe\" pid:2032.",
|
||||
"is_remediation": true,
|
||||
"id": 1850,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "Canceled by YOSSIK",
|
||||
"status": 9
|
||||
},
|
||||
{
|
||||
"id": 45,
|
||||
"name": "McAfee Port Blocking",
|
||||
"start_date": "2015-04-13T07:25:28.355Z",
|
||||
"end_date": null,
|
||||
"affected_hosts": ["win8-x86"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [
|
||||
"AUTO\\Administrator",
|
||||
"WIN8-X86\\DWM-1"
|
||||
],
|
||||
"total_actions": 10,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Lists all PEs in \"C:\\Users\\Administrator\\Downloads\".",
|
||||
"id": 1141,
|
||||
"name": "Find Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "List all running processes on ()win8-x86@2.0.0.6.",
|
||||
"id": 1140,
|
||||
"name": "Get Process List"
|
||||
},
|
||||
{
|
||||
"details": "Lists all PEs in \"C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\Outlook\".",
|
||||
"id": 1139,
|
||||
"name": "Find Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Get active connections list.",
|
||||
"id": 1137,
|
||||
"name": "Get All Active Connections"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Get all executable files created in last 3600 seconds.",
|
||||
"is_remediation": false,
|
||||
"id": 1143,
|
||||
"name": "Get Recently Created Files"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 9
|
||||
},
|
||||
{
|
||||
"id": 44,
|
||||
"name": "McAfee Abnormal Host Behavior",
|
||||
"start_date": "2015-04-13T06:58:30.775Z",
|
||||
"end_date": "2015-04-13T07:06:22.590Z",
|
||||
"affected_hosts": ["win8-x86"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 38,
|
||||
"remediation_actions": [
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\\system32\".",
|
||||
"id": 1121,
|
||||
"name": "Quarantine Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 1120,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Terminate(kill) process name:\"sus.exe\" pid:1180.",
|
||||
"id": 1119,
|
||||
"name": "Kill Process"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:1180.",
|
||||
"id": 1117,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 1115,
|
||||
"name": "Quarantine A File"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine 1 files in directory \"c:\\windows\".",
|
||||
"id": 1111,
|
||||
"name": "Quarantine Files In Directory"
|
||||
}
|
||||
],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Calculate hash values for 762 files.",
|
||||
"id": 1124,
|
||||
"name": "Get Files Hashes"
|
||||
},
|
||||
{
|
||||
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:1180.",
|
||||
"id": 1117,
|
||||
"name": "Release File Handle"
|
||||
},
|
||||
{
|
||||
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
|
||||
"id": 1115,
|
||||
"name": "Quarantine A File"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
|
||||
"is_remediation": false,
|
||||
"id": 1133,
|
||||
"name": "Decide On File Quarantine"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "e2e",
|
||||
"error_description": "",
|
||||
"status": 9
|
||||
},
|
||||
{
|
||||
"id": 38,
|
||||
"name": "Symantec Virus Found",
|
||||
"start_date": "2015-04-12T14:44:59.525Z",
|
||||
"end_date": null,
|
||||
"affected_hosts": ["xp-x86-sp3"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": ["AUTO\\Administrator"],
|
||||
"total_actions": 13,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Lists all PEs in \"C:\\Users\\Administrator\\Downloads\".",
|
||||
"id": 1010,
|
||||
"name": "Find Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "List all services installed on ()xp-x86-sp3@2.0.0.10.",
|
||||
"id": 1009,
|
||||
"name": "Get Service List"
|
||||
},
|
||||
{
|
||||
"details": "Lists all PEs in \"C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\Outlook\".",
|
||||
"id": 1008,
|
||||
"name": "Find Files In Directory"
|
||||
},
|
||||
{
|
||||
"details": "List all running processes on ()xp-x86-sp3@2.0.0.10.",
|
||||
"id": 1006,
|
||||
"name": "Get Process List"
|
||||
},
|
||||
{
|
||||
"details": "Check for known persistency method on host ()xp-x86-sp3@2.0.0.10, filter=[None].",
|
||||
"id": 1005,
|
||||
"name": "Persistency Check"
|
||||
},
|
||||
{
|
||||
"details": "Get active connections list.",
|
||||
"id": 1004,
|
||||
"name": "Get All Active Connections"
|
||||
},
|
||||
{
|
||||
"details": "Check \"C:\\testfile.txt\" exists on ()xp-x86-sp3@2.0.0.10.",
|
||||
"id": 1003,
|
||||
"name": "File Exists"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Get all executable files created in last 3600 seconds.",
|
||||
"is_remediation": false,
|
||||
"id": 1011,
|
||||
"name": "Get Recently Created Files"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "sanity",
|
||||
"error_description": "",
|
||||
"status": 9
|
||||
},
|
||||
{
|
||||
"id": 35,
|
||||
"name": "Symantec Virus Found",
|
||||
"start_date": "2015-04-12T13:37:09.216Z",
|
||||
"end_date": null,
|
||||
"affected_hosts": ["xp-x86-sp3"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [],
|
||||
"total_actions": 3,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [],
|
||||
"last_action": {
|
||||
"details": "Get hostname from host",
|
||||
"is_remediation": false,
|
||||
"id": 960,
|
||||
"name": "Get Hostname From Host"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "sanity",
|
||||
"error_description": "",
|
||||
"status": 9
|
||||
},
|
||||
{
|
||||
"id": 34,
|
||||
"name": "Symantec Virus Found",
|
||||
"start_date": "2015-04-12T13:15:29.034Z",
|
||||
"end_date": "2015-04-12T13:44:55.290Z",
|
||||
"affected_hosts": ["xp-x64"],
|
||||
"affected_groups": [""],
|
||||
"affected_users": [],
|
||||
"total_actions": 6,
|
||||
"remediation_actions": [],
|
||||
"pending_actions": [],
|
||||
"failed_actions": [
|
||||
{
|
||||
"details": "Get hostname from host",
|
||||
"id": 954,
|
||||
"name": "Get Hostname From Host"
|
||||
}
|
||||
],
|
||||
"last_action": {
|
||||
"details": "Get hostname from host",
|
||||
"is_remediation": false,
|
||||
"id": 957,
|
||||
"name": "Get Hostname From Host"
|
||||
},
|
||||
"important": false,
|
||||
"detection_system": "sanity",
|
||||
"error_description": "",
|
||||
"status": 9
|
||||
}
|
||||
]
|
||||
}
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
"0":31,
|
||||
"1":81,
|
||||
"2":22,
|
||||
"3":41,
|
||||
"4":2,
|
||||
"5":5,
|
||||
"6":3855,
|
||||
"7":12,
|
||||
"8":12,
|
||||
"9":8,
|
||||
"10":3,
|
||||
"11": 1
|
||||
}
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"id": "YOSSI-PC",
|
||||
"name": "yossi-pc",
|
||||
"domain": "hexadite"
|
||||
}
|
|
@ -0,0 +1,98 @@
|
|||
const express = require('express');
|
||||
const fs = require("fs");
|
||||
const bodyParser = require('body-parser');
|
||||
const https = require("https");
|
||||
|
||||
|
||||
var routeModules = [
|
||||
//require("./modules/investigations.routes"),
|
||||
//require("./modules/alerts.routes"),
|
||||
//require("./modules/machines.routes")
|
||||
];
|
||||
|
||||
var common = require("./mock_common");
|
||||
|
||||
var app = express();
|
||||
|
||||
var jsonParser = bodyParser.json();
|
||||
var busboy = require('connect-busboy');
|
||||
|
||||
function customHeaders(req, res, next) {
|
||||
// Switch off the default 'X-Powered-By: Express' header
|
||||
app.disable('connection');
|
||||
res.removeHeader("connection");
|
||||
next();
|
||||
}
|
||||
|
||||
routeModules.forEach(function (routeModule) {
|
||||
routeModule.init(app, jsonParser);
|
||||
});
|
||||
|
||||
app.use(customHeaders);
|
||||
app.use(jsonParser);
|
||||
app.use(busboy());
|
||||
|
||||
|
||||
/**
|
||||
* All other API calls return the corresponding file inside the api_mock_data folder
|
||||
*/
|
||||
app.use(function (req, res) {
|
||||
// All delete requests are OK
|
||||
if (req.method === "DELETE") {
|
||||
setTimeout(function () {
|
||||
res.status(200).end();
|
||||
}, 1000);
|
||||
}
|
||||
else if (req.method === "PATCH" || req.method === "PUT") {
|
||||
setTimeout(function () {
|
||||
var obj = req.body;
|
||||
res.status(200).json(obj);
|
||||
}, 600);
|
||||
}
|
||||
else {
|
||||
var mockDataFileUrl = req.originalUrl.replace(/^\/api\//, common.MOCK_DATA_FOLDER).replace(/\.json/, "").replace(/\?.+/, "");
|
||||
var apiMatch = req.originalUrl.match(/^\/api\/([\w-_\d\/]+)\/([\w\d-_]+)?$/);
|
||||
|
||||
if (apiMatch){
|
||||
var entity = apiMatch[1],
|
||||
entityId = apiMatch[2];
|
||||
|
||||
// If the URL ends with '/', we expect all the data in the folder, which is mocked by the 'all.json' file inside it:
|
||||
mockDataFileUrl = common.MOCK_DATA_FOLDER + entity + "/" + entity.replace(/\//g, "_") + (entityId ? "_item" : "_all") + ".mock";
|
||||
}
|
||||
|
||||
if (req.method === "POST") {
|
||||
common.getFileData(mockDataFileUrl, function (error, data) {
|
||||
if (error) {
|
||||
setTimeout(function () {
|
||||
var obj = req.body;
|
||||
obj.id = Math.round(Math.random() * Math.pow(10, 10));
|
||||
res.status(200).json(obj);
|
||||
}, 1000);
|
||||
}
|
||||
else {
|
||||
common.getResponseCallback(res)(null, data);
|
||||
}
|
||||
});
|
||||
}
|
||||
else {
|
||||
common.getFileData(mockDataFileUrl, common.getResponseCallback(res));
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
|
||||
//https.createServer(options, app).listen(port);
|
||||
|
||||
// http2
|
||||
// .createServer(options, app)
|
||||
// .listen(port, function(err){
|
||||
// if (err)
|
||||
// throw new Error(err);
|
||||
//
|
||||
// /* eslint-disable no-console */
|
||||
// console.log('Listening on port: ' + port + '.');
|
||||
// /* eslint-enable no-console */
|
||||
// });
|
||||
|
||||
module.exports = app;
|
|
@ -0,0 +1,72 @@
|
|||
fs = require("fs");
|
||||
|
||||
var MOCK_DATA_FOLDER = "./data/";
|
||||
|
||||
var exports = module.exports = {
|
||||
getFileData: getFileData,
|
||||
getIdentifiableItem: getIdentifiableItem,
|
||||
getResponseCallback: getResponseCallback,
|
||||
MOCK_DATA_FOLDER: MOCK_DATA_FOLDER,
|
||||
sendError: sendError
|
||||
};
|
||||
|
||||
function sendError(status, errorText){
|
||||
if (!status)
|
||||
status = 500;
|
||||
|
||||
if (!errorText)
|
||||
errorText = "SERVER ERROR";
|
||||
|
||||
return function(req, res){
|
||||
res.status(status).send(errorText);
|
||||
};
|
||||
}
|
||||
|
||||
function getResponseCallback(res){
|
||||
return function(err, data){
|
||||
if (err)
|
||||
res.status(404).end();
|
||||
else
|
||||
res.status(200).json(data);
|
||||
}
|
||||
}
|
||||
/**
|
||||
* Returns a function to handler requests with an ID, which all map to the same mock data file.
|
||||
* @param path {String} The path of the single JSON file to return for any ID
|
||||
* @param idProperty The ID property to add to the result JSON data (the value is the 'id' param in the URL)
|
||||
* @returns {Function}
|
||||
*/
|
||||
function getIdentifiableItem(path, idProperty){
|
||||
var itemMockDataFolder = MOCK_DATA_FOLDER + path;
|
||||
return function(req, res){
|
||||
getFileData(itemMockDataFolder, function(err, itemData){
|
||||
if (err) {
|
||||
res.status(404).end()
|
||||
}
|
||||
else {
|
||||
var id = parseInt(req.params.id, 10);
|
||||
itemData[idProperty || "id"] = !isNaN(id) ? id : req.params.id;
|
||||
res.json(itemData);
|
||||
}
|
||||
});
|
||||
};
|
||||
}
|
||||
|
||||
function getFileData(filePath, callback){
|
||||
fs.readFile(filePath + ".json", "utf8", function(err, data){
|
||||
if (err) {
|
||||
console.error("ERROR reading file: ", filePath);
|
||||
callback(err);
|
||||
}
|
||||
else {
|
||||
try {
|
||||
var fileData = JSON.parse(data);
|
||||
callback(null, fileData);
|
||||
}
|
||||
catch(e){
|
||||
console.error("ERROR parsing json: " + filePath + data + ": " + e.message);
|
||||
callback("ERROR parsing json: " + filePath);
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
|
@ -0,0 +1,25 @@
|
|||
common = require("../../mock_common");
|
||||
|
||||
var adminRouteModules = [
|
||||
require("./admin_keys.routes"),
|
||||
require("./admin_settings.routes")
|
||||
];
|
||||
|
||||
module.exports.init = function(app){
|
||||
adminRouteModules.forEach(function(routeModule){
|
||||
routeModule.init(app);
|
||||
});
|
||||
|
||||
app.post("/api/admin/license/activate", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "admin/license/all", common.getResponseCallback(res));
|
||||
});
|
||||
|
||||
app.post("/api/admin/quarantine_password/unveil", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "admin/quarantine_password/unveil", common.getResponseCallback(res));
|
||||
});
|
||||
|
||||
app.get("/api/admin/systeminfo/all", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "admin/systeminfo/all", common.getResponseCallback(res));
|
||||
});
|
||||
|
||||
};
|
|
@ -0,0 +1,28 @@
|
|||
common = require("../../mock_common");
|
||||
fs = require("fs");
|
||||
|
||||
module.exports.init = function(app){
|
||||
app.get("/api/admin/keys/csr/request", function(req, res){
|
||||
var responseCbk = common.getResponseCallback(res);
|
||||
fs.readFile(common.MOCK_DATA_FOLDER + "admin/keys/csr/request.txt", "utf8", function(err, data){
|
||||
if (err)
|
||||
responseCbk(err);
|
||||
else {
|
||||
responseCbk(null, data);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
app.post("/api/admin/keys/csr/request", function(req, res){
|
||||
setTimeout(function() {
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "admin/keys/csr/request", common.getResponseCallback(res));
|
||||
}, 3000);
|
||||
});
|
||||
|
||||
app.post("/api/admin/keys/csr/response", function(req, res){
|
||||
setTimeout(function() {
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "admin/keys/csr/response", common.getResponseCallback(res));
|
||||
}, 2000);
|
||||
});
|
||||
|
||||
};
|
|
@ -0,0 +1,54 @@
|
|||
common = require("../../mock_common");
|
||||
|
||||
module.exports.init = function(app){
|
||||
app.put("/api/admin/settings/organization/all", function(req, res){
|
||||
res.status(200).json({ detail: "BAD BAD NOT GOOD"});
|
||||
});
|
||||
|
||||
app.post("/api/admin/settings/domains/validate_groups", function(req, res){
|
||||
res.status(200).json({"valid":false,"errors":["Group with name AirsAdminssdfsdss does not exist"]});
|
||||
});
|
||||
|
||||
app.post("/api/admin/domains", function(req, res){
|
||||
setTimeout(function(){
|
||||
var obj = req.body;
|
||||
obj.id = Math.round(Math.random() * Math.pow(10, 10));
|
||||
res.status(200).json(obj);
|
||||
}, 1000);
|
||||
});
|
||||
|
||||
app.get("/api/admin/domains/", function(req, res){
|
||||
setTimeout(function(){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "admin/domains", common.getResponseCallback(res));
|
||||
}, 1000);
|
||||
});
|
||||
app.get("/api/admin/settings/domains/dns", function(req, res){
|
||||
setTimeout(function(){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "admin/dns", common.getResponseCallback(res));
|
||||
}, 1000);
|
||||
});
|
||||
|
||||
app.post("/api/admin/settings/:settingsGroup/validate_:settingId", function(req, res){
|
||||
setTimeout(function(){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "admin/settings/validate_setting", common.getResponseCallback(res));
|
||||
}, 2000);
|
||||
});
|
||||
|
||||
app.post("/api/admin/settings/verify_user", function(req, res){
|
||||
setTimeout(function(){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "admin/settings/verify_user", common.getResponseCallback(res));
|
||||
}, 1000);
|
||||
});
|
||||
|
||||
app.get("/api/admin/settings/:settingsGroup/:settingId", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "admin/settings/values/settings." + req.params.settingsGroup, function(err, data){
|
||||
if (err)
|
||||
res.status(404).end();
|
||||
else{
|
||||
setTimeout(function(){
|
||||
res.status(200).json(req.params.settingId === "all" ? { "data": data } : data[req.params.settingId]);
|
||||
}, 400);
|
||||
}
|
||||
});
|
||||
});
|
||||
};
|
|
@ -0,0 +1,20 @@
|
|||
common = require("../mock_common");
|
||||
var url = require('url');
|
||||
|
||||
module.exports.init = function(app){
|
||||
app.get("/api/alerts", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "alerts/alerts_mock", common.getResponseCallback(res));
|
||||
});
|
||||
|
||||
app.get("/api/alerts/filters", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "alerts/alerts_filters", common.getResponseCallback(res));
|
||||
});
|
||||
|
||||
app.get("/api/alerts/count_by_type", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "alerts/count_by_type", common.getResponseCallback(res));
|
||||
});
|
||||
|
||||
app.get("/api/alerts/:id", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "alerts/alert_mock", common.getResponseCallback(res));
|
||||
});
|
||||
};
|
|
@ -0,0 +1,72 @@
|
|||
common = require("../mock_common");
|
||||
|
||||
var investigationStatuses = {
|
||||
"3": "fully_remediated",
|
||||
"9": "terminated_by_airs",
|
||||
"14": "benign",
|
||||
"15": "terminated_by_user",
|
||||
"16": "pending_user",
|
||||
"17": "running",
|
||||
"18": "pending_resource"
|
||||
};
|
||||
|
||||
module.exports.init = function(app){
|
||||
app.get("/api/investigations/:id(\\d+)", function(req, res){
|
||||
var investigationStatus = investigationStatuses[String(req.params.id)],
|
||||
investigationMockUrl = investigationStatus ? "investigations_by_status/investigation." + investigationStatus + ".mock" : "investigation_mock";
|
||||
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/" + investigationMockUrl, common.getResponseCallback(res));
|
||||
});
|
||||
|
||||
app.get("/api/investigations/filters", function(req, res){
|
||||
setTimeout(function(){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/investigation_filters_mock", common.getResponseCallback(res));
|
||||
}, 500)
|
||||
});
|
||||
|
||||
app.get("/api/investigations/:investigationId/export", function(req, res){
|
||||
setTimeout(function(){
|
||||
res.status(500).send("Couldn't export investigation.");
|
||||
}, 3000);
|
||||
});
|
||||
|
||||
app.get("/api/investigations/all", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/all", sendResponse);
|
||||
|
||||
function setToPageSize(data){
|
||||
if (data && req.query.page_size)
|
||||
data.results = data.results.slice(0, req.query.page_size);
|
||||
}
|
||||
|
||||
function sendResponse(error, data){
|
||||
setToPageSize(data);
|
||||
if (error)
|
||||
res.status(200).json({ count: 0, results: [] });
|
||||
else
|
||||
res.status(200).json(data);
|
||||
}
|
||||
});
|
||||
|
||||
app.get("/api/investigations/:id/hosts/filters/search", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/hosts/investigation_hosts_filter_search", common.getResponseCallback(res));
|
||||
});
|
||||
|
||||
app.get("/api/investigations/:id/actions", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/actions/investigation_actions_mock", common.getResponseCallback(res));
|
||||
});
|
||||
|
||||
app.get("/api/investigations/:id/actions/filters", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/actions/investigation_actions_filters", common.getResponseCallback(res));
|
||||
});
|
||||
|
||||
app.get("/api/investigations/:id/actions/filters/search", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/actions/investigation_actions_filter_search", common.getResponseCallback(res));
|
||||
});
|
||||
|
||||
app.patch("/api/investigations/:id", function(req, res){
|
||||
// Adding timeout to simulate server time:
|
||||
res.setTimeout(1000, function(){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/patch_investigation", common.getResponseCallback(res));
|
||||
});
|
||||
});
|
||||
};
|
|
@ -0,0 +1,19 @@
|
|||
common = require("../mock_common");
|
||||
|
||||
module.exports.init = function(app){
|
||||
app.get("/api/machines/all", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "machines/machines_mock", common.getResponseCallback(res));
|
||||
});
|
||||
|
||||
app.get("/api/machines/filters", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "machines/machines_filters", common.getResponseCallback(res));
|
||||
});
|
||||
|
||||
app.get("/api/machines/count_by_type", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "machines/count_by_type", common.getResponseCallback(res));
|
||||
});
|
||||
|
||||
app.get("/api/machines/:id", function(req, res){
|
||||
common.getFileData(common.MOCK_DATA_FOLDER + "machines/machine_mock", common.getResponseCallback(res));
|
||||
});
|
||||
};
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"name": "mockAPI",
|
||||
"version": "0.0.0",
|
||||
"dependencies": {
|
||||
"body-parser": "^1.14.1",
|
||||
"connect-busboy": "0.0.2",
|
||||
"express": "5.0.0-alpha.5",
|
||||
"express-ws": "^3.0.0",
|
||||
"http2": "latest"
|
||||
}
|
||||
}
|
|
@ -0,0 +1,14 @@
|
|||
const port = 5001;
|
||||
|
||||
var httpApp = require('./http-server');
|
||||
var server = require('./ws-server');
|
||||
|
||||
|
||||
server.on('request', httpApp);
|
||||
|
||||
server.listen(port, function (err) {
|
||||
if (err)
|
||||
throw new Error(err);
|
||||
|
||||
console.log('Listening on port: ' + port + '.');
|
||||
});
|
|
@ -0,0 +1,53 @@
|
|||
'use strict';
|
||||
|
||||
var WsServer = require('ws').Server;
|
||||
var server = require('http').createServer();
|
||||
|
||||
// Create web socket server on top of a regular http server
|
||||
var wss = new WsServer({
|
||||
server: server,
|
||||
path: '/ws'
|
||||
});
|
||||
|
||||
var modules = [
|
||||
];
|
||||
|
||||
var availableStreams = new Map(modules.map(function(module){
|
||||
var s = module.stream;
|
||||
return [s.streamName, s]
|
||||
}));
|
||||
|
||||
wss.on('connection', function connection(ws) {
|
||||
var registeredStreams = [];
|
||||
|
||||
ws.on('message', function incoming(message) {
|
||||
var parsedMessage = JSON.parse(message);
|
||||
|
||||
console.log('got message: ' + message);
|
||||
var streamName = parsedMessage.stream;
|
||||
var stream = streamName ? availableStreams.get(streamName) : null;
|
||||
|
||||
if (parsedMessage.action === 'register'){
|
||||
if (stream){
|
||||
stream.startStream(ws);
|
||||
registeredStreams.push(stream);
|
||||
}
|
||||
}
|
||||
|
||||
if (parsedMessage.action === 'unregister'){
|
||||
if (stream){
|
||||
stream.stopStream();
|
||||
}
|
||||
}
|
||||
|
||||
});
|
||||
|
||||
ws.on('error', function error(err){
|
||||
registeredStreams.forEach(function(stream){
|
||||
console.log('stopping stream ' + stream);
|
||||
stream.stopStream();
|
||||
})
|
||||
});
|
||||
});
|
||||
|
||||
module.exports = server;
|
|
@ -0,0 +1,161 @@
|
|||
{
|
||||
"name": "Paris",
|
||||
"version": "1.0.0",
|
||||
"description": "Library for the implementation of Domain Driven Design in Angular/TypeScript apps",
|
||||
"repository": {
|
||||
"url": "https://github.com/microsoft/paris.ts"
|
||||
},
|
||||
"scripts": {
|
||||
"build.dev": "gulp build.dev --color --env-config dev",
|
||||
"build.dev.watch": "gulp build.dev.watch --color",
|
||||
"build.e2e": "gulp build.e2e --color",
|
||||
"build.prod": "gulp build.prod --color --env-config prod --build-type prod",
|
||||
"build.prod.exp": "gulp build.prod.aot --color --env-config prod --build-type prod",
|
||||
"build.prod.rollup.aot": "gulp build.prod.rollup.aot --color --env-config prod --build-type prod",
|
||||
"build.prod.aot": "gulp build.prod.aot --color --env-config prod --build-type prod",
|
||||
"build.test": "gulp build.test --color",
|
||||
"test.watch": "gulp test.watch --color",
|
||||
"generate.manifest": "gulp generate.manifest --color",
|
||||
"e2e": "protractor",
|
||||
"e2e.live": "protractor --elementExplorer",
|
||||
"gulp": "gulp",
|
||||
"i18n": "gulp i18n.build --build-type prod && ng-xi18n -p dist/tmp/tsconfig.json --i18nFormat xlf && gulp i18n.merge",
|
||||
"lint": "gulp tslint",
|
||||
"karma": "karma",
|
||||
"karma.start": "karma start",
|
||||
"postinstall": "gulp check.versions && gulp build.bundle.rxjs && gulp webdriver && gulp print.banner",
|
||||
"reinstall": "npm cache clean && npm install",
|
||||
"serve.coverage": "gulp serve.coverage --color",
|
||||
"serve.dev": "gulp serve.dev --color --env-config dev",
|
||||
"serve.e2e": "gulp serve.e2e --color",
|
||||
"serve.prod": "gulp serve.prod --color --env-config prod --build-type prod",
|
||||
"serve.prod.aot": "gulp serve.prod.aot --color --env-config prod --build-type prod",
|
||||
"serve.prod.exp": "gulp serve.prod.aot --color --env-config prod --build-type prod",
|
||||
"serve.prod.rollup.aot": "gulp serve.prod.rollup.aot --color --env-config prod --build-type prod",
|
||||
"sme.prod": "gulp sme.prod --color --env-config prod --build-type prod --preserve-source-maps",
|
||||
"sme.prod.aot": "gulp sme.prod.aot --color --env-config prod --build-type prod --preserve-source-maps",
|
||||
"sme.prod.rollup.aot": "gulp sme.prod.rollup.aot --color --env-config prod --build-type prod --preserve-source-maps",
|
||||
"start": "gulp serve.dev --color",
|
||||
"start.deving": "gulp start.deving --color",
|
||||
"tasks.list": "gulp --tasks-simple --color",
|
||||
"test": "gulp test --color",
|
||||
"e2e.ci": "gulp build.prod.rollup.aot --color && gulp build.e2e --color && gulp e2e --color",
|
||||
"tests.all": "npm test && npm run e2e.ci",
|
||||
"webdriver-start": "node ./node_modules/protractor/bin/webdriver-manager start",
|
||||
"webdriver-update": "node ./node_modules/protractor/bin/webdriver-manager update",
|
||||
"compodoc": "./node_modules/.bin/compodoc -p src/client/tsconfig.json",
|
||||
"serve.compodoc": "./node_modules/.bin/compodoc -s"
|
||||
},
|
||||
"author": "Yossi Kolesnicov",
|
||||
"license": "MIT",
|
||||
"devDependencies": {
|
||||
"@angular/compiler-cli": "^5.0.0-beta.6",
|
||||
"@angular/platform-server": "^5.0.0-beta.6",
|
||||
"@compodoc/compodoc": "^1.0.0-beta.7",
|
||||
"@types/async": "^2.0.32",
|
||||
"@types/browser-sync": "^0.0.36",
|
||||
"@types/express": "^4.0.33",
|
||||
"@types/gulp": "^4.0.0",
|
||||
"@types/gulp-filter": "^3.0.29",
|
||||
"@types/gulp-htmlmin": "^1.3.30",
|
||||
"@types/gulp-load-plugins": "^0.0.30",
|
||||
"@types/gulp-protractor": "^1.0.30",
|
||||
"@types/gulp-sass": "^0.0.30",
|
||||
"@types/gulp-util": "^3.0.29",
|
||||
"@types/jasmine": "^2.5.52",
|
||||
"@types/node": "^8.0.25",
|
||||
"@types/rimraf": "2.0.2",
|
||||
"@types/run-sequence": "^0.0.29",
|
||||
"@types/selenium-webdriver": "^3.0.3",
|
||||
"@types/systemjs": "^0.20.2",
|
||||
"@types/yargs": "^8.0.2",
|
||||
"async": "^2.1.1",
|
||||
"autoprefixer": "^7.0.1",
|
||||
"browser-sync": "^2.17.3",
|
||||
"codelyzer": "^3.1.2",
|
||||
"connect-history-api-fallback": "^1.3.0",
|
||||
"cssnano": "^3.7.7",
|
||||
"deep-extend": "^0.5.0",
|
||||
"event-stream": "^3.3.4",
|
||||
"express": "~4.15.2",
|
||||
"express-history-api-fallback": "^2.0.0",
|
||||
"gulp": "^3.9.1",
|
||||
"gulp-cached": "^1.1.0",
|
||||
"gulp-cheerio": "^0.6.2",
|
||||
"gulp-concat": "^2.6.0",
|
||||
"gulp-concat-css": "^2.3.0",
|
||||
"gulp-filter": "^5.0.0",
|
||||
"gulp-htmlmin": "^3.0.0",
|
||||
"gulp-inject": "^4.1.0",
|
||||
"gulp-inline-ng2-template": "^4.0.0",
|
||||
"gulp-load-plugins": "^1.3.0",
|
||||
"gulp-plumber": "~1.1.0",
|
||||
"gulp-postcss": "^7.0.0",
|
||||
"gulp-progeny": "^0.4.0",
|
||||
"gulp-protractor": "^3.0.0",
|
||||
"gulp-rename": "^1.2.2",
|
||||
"gulp-replace": "^0.6.1",
|
||||
"gulp-sass": "^3.0.0",
|
||||
"gulp-sourcemaps": "2.6.0",
|
||||
"gulp-template": "^4.0.0",
|
||||
"gulp-tslint": "^8.0.0",
|
||||
"gulp-typescript": "~3.2.2",
|
||||
"gulp-uglify": "^3.0.0",
|
||||
"gulp-util": "^3.0.7",
|
||||
"gulp-watch": "^4.3.10",
|
||||
"http-proxy-middleware": "^0.17.4",
|
||||
"is-ci": "^1.0.9",
|
||||
"isstream": "^0.1.2",
|
||||
"jasmine-core": "~2.6.1",
|
||||
"jasmine-spec-reporter": "^4.1.0",
|
||||
"karma": "~1.7.1",
|
||||
"karma-chrome-launcher": "~2.2.0",
|
||||
"karma-coverage": "^1.1.1",
|
||||
"karma-jasmine": "~1.1.0",
|
||||
"karma-mocha-reporter": "^2.2.0",
|
||||
"karma-remap-istanbul": "^0.6.0",
|
||||
"merge-stream": "^1.0.0",
|
||||
"minimatch": "^3.0.3",
|
||||
"open": "0.0.5",
|
||||
"protractor": "^4.0.14",
|
||||
"remap-istanbul": "^0.9.5",
|
||||
"rimraf": "^2.5.4",
|
||||
"rollup": "^0.43.0",
|
||||
"rollup-plugin-commonjs": "^8.0.2",
|
||||
"rollup-plugin-includepaths": "0.2.2",
|
||||
"rollup-plugin-node-resolve": "^3.0.0",
|
||||
"run-sequence": "^1.2.2",
|
||||
"semver": "^5.3.0",
|
||||
"serve-static": "^1.11.1",
|
||||
"slash": "~1.0.0",
|
||||
"source-map-explorer": "^1.4.0",
|
||||
"supports-color": "^3.1.2",
|
||||
"systemjs-builder": "0.16.9",
|
||||
"temp": "^0.8.3",
|
||||
"tildify": "^1.2.0",
|
||||
"traceur": "^0.0.111",
|
||||
"ts-node": "^3.0.4",
|
||||
"tslint": "^5.0.0",
|
||||
"tslib": "latest",
|
||||
"typescript": "2.4.2",
|
||||
"walk": "^2.3.9",
|
||||
"yargs": "^8.0.1"
|
||||
},
|
||||
"dependencies": {
|
||||
"@angular/animations": "^5.0.0-beta.6",
|
||||
"@angular/common": "^5.0.0-beta.6",
|
||||
"@angular/compiler": "^5.0.0-beta.6",
|
||||
"@angular/core": "^5.0.0-beta.6",
|
||||
"@angular/forms": "^5.0.0-beta.6",
|
||||
"@angular/http": "^5.0.0-beta.6",
|
||||
"@angular/platform-browser": "^5.0.0-beta.6",
|
||||
"@angular/platform-browser-dynamic": "^5.0.0-beta.6",
|
||||
"@angular/router": "^5.0.0-beta.6",
|
||||
"@angular/service-worker": "^1.0.0-beta.16",
|
||||
"core-js": "^2.4.1",
|
||||
"intl": "^1.2.5",
|
||||
"rxjs": "^5.4.2",
|
||||
"systemjs": "0.20.14",
|
||||
"zone.js": "0.8.12"
|
||||
}
|
||||
}
|
|
@ -0,0 +1,49 @@
|
|||
const config = {
|
||||
baseUrl: 'http://localhost:5555/',
|
||||
|
||||
specs: [
|
||||
'./dist/e2e/**/*.e2e-spec.js'
|
||||
],
|
||||
|
||||
exclude: [],
|
||||
|
||||
// 'jasmine' by default will use the latest jasmine framework
|
||||
framework: 'jasmine',
|
||||
|
||||
// allScriptsTimeout: 110000,
|
||||
|
||||
jasmineNodeOpts: {
|
||||
// showTiming: true,
|
||||
showColors: true,
|
||||
isVerbose: false,
|
||||
includeStackTrace: false,
|
||||
// defaultTimeoutInterval: 400000
|
||||
},
|
||||
|
||||
directConnect: true,
|
||||
|
||||
capabilities: {
|
||||
browserName: 'chrome'
|
||||
},
|
||||
|
||||
onPrepare: function() {
|
||||
browser.ignoreSynchronization = false;
|
||||
},
|
||||
|
||||
|
||||
/**
|
||||
* Angular 2 configuration
|
||||
*
|
||||
* useAllAngular2AppRoots: tells Protractor to wait for any angular2 apps on the page instead of just the one matching
|
||||
* `rootEl`
|
||||
*/
|
||||
useAllAngular2AppRoots: true
|
||||
};
|
||||
|
||||
if (process.env.TRAVIS) {
|
||||
config.capabilities = {
|
||||
browserName: 'firefox'
|
||||
};
|
||||
}
|
||||
|
||||
exports.config = config;
|
|
@ -0,0 +1,16 @@
|
|||
import {Entity} from "../paris/entity/entity.decorator";
|
||||
import {Identifiable} from "./base/identifiable.model";
|
||||
import {EntityField} from "../paris/entity/entity-field.decorator";
|
||||
|
||||
@Entity({
|
||||
singularName: "Alert Status",
|
||||
pluralName: "Alert Statuses",
|
||||
endpoint: "alerts/status",
|
||||
loadAll: true
|
||||
})
|
||||
export class AlertStatusModel extends Identifiable<number> {
|
||||
@EntityField({
|
||||
name: "Category"
|
||||
})
|
||||
category:string;
|
||||
}
|
|
@ -0,0 +1,33 @@
|
|||
import {Entity} from "../paris/entity/entity.decorator";
|
||||
import {Identifiable} from "./base/identifiable.model";
|
||||
import {EntityField} from "../paris/entity/entity-field.decorator";
|
||||
import {MachineModel} from "./machine.model";
|
||||
import {AlertStatusModel} from "./alert-status.model";
|
||||
|
||||
@Entity({
|
||||
singularName: "Alert",
|
||||
pluralName: "Alerts",
|
||||
endpoint: "alerts"
|
||||
})
|
||||
export class AlertModel extends Identifiable<string> {
|
||||
@EntityField({
|
||||
name: "Name",
|
||||
data: "title"
|
||||
})
|
||||
name?: string;
|
||||
|
||||
@EntityField({
|
||||
name: "Status"
|
||||
})
|
||||
status:AlertStatusModel;
|
||||
|
||||
@EntityField({
|
||||
name: "Machine"
|
||||
})
|
||||
machine?:MachineModel;
|
||||
|
||||
@EntityField({
|
||||
name: "Host"
|
||||
})
|
||||
host?:MachineModel;
|
||||
}
|
|
@ -0,0 +1,23 @@
|
|||
import {EntityField} from "../../paris/entity/entity-field.decorator";
|
||||
import {IIdentifiable} from "../../paris/models/identifiable.model";
|
||||
|
||||
export abstract class Identifiable<T extends string | number> implements IIdentifiable{
|
||||
@EntityField({
|
||||
name: "ID"
|
||||
})
|
||||
id:T;
|
||||
|
||||
@EntityField({
|
||||
name: "Name"
|
||||
})
|
||||
name?:string;
|
||||
|
||||
constructor(data:IdentifiableData<T>){
|
||||
Object.assign(this, data);
|
||||
}
|
||||
}
|
||||
|
||||
export interface IdentifiableData<T extends string | number>{
|
||||
id:T,
|
||||
name?:string
|
||||
}
|
|
@ -0,0 +1,15 @@
|
|||
import {Identifiable} from "./base/identifiable.model";
|
||||
import {Entity} from "../paris/entity/entity.decorator";
|
||||
import {EntityField} from "../paris/entity/entity-field.decorator";
|
||||
|
||||
@Entity({
|
||||
singularName: "Machine",
|
||||
pluralName: "Machines",
|
||||
endpoint: "machines"
|
||||
})
|
||||
export class MachineModel extends Identifiable<string> {
|
||||
@EntityField({
|
||||
name: "Domain"
|
||||
})
|
||||
domain:string;
|
||||
}
|
|
@ -0,0 +1,15 @@
|
|||
import { NgModule } from '@angular/core';
|
||||
import { RouterModule } from '@angular/router';
|
||||
|
||||
@NgModule({
|
||||
imports: [
|
||||
RouterModule.forRoot([
|
||||
/* define app module routes here, e.g., to lazily load a module
|
||||
(do not place feature module routes here, use an own -routing.module.ts in the feature instead)
|
||||
*/
|
||||
])
|
||||
],
|
||||
exports: [RouterModule]
|
||||
})
|
||||
export class AppRoutingModule { }
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
:host {
|
||||
flex: 1 1 100%;
|
||||
display: flex;
|
||||
flex-flow: column;
|
||||
padding: 1rem;
|
||||
}
|
||||
|
||||
table{
|
||||
border: solid 1px #ddd;
|
||||
}
|
||||
|
||||
table td, table th{
|
||||
text-align: left;
|
||||
padding: 6px 10px;
|
||||
}
|
||||
|
||||
thead tr{
|
||||
background: #106cc8;
|
||||
color: White;
|
||||
}
|
||||
|
||||
tr + tr{
|
||||
border-top: solid 1px #eaeaea;
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
<div *ngIf="alert">
|
||||
<h2>Alert</h2>
|
||||
<table>
|
||||
<tr>
|
||||
<th>Title</th>
|
||||
<td>{{alert.name}}</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th>Status</th>
|
||||
<td>{{alert.status.name}}</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th>Machine</th>
|
||||
<td>{{alert.machine.domain}}\{{alert.machine.name}}</td>
|
||||
</tr>
|
||||
</table>
|
||||
</div>
|
||||
<hr />
|
||||
<div *ngIf="alerts">
|
||||
<h2>Alerts DataSet</h2>
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>ID</th>
|
||||
<th>Name</th>
|
||||
<th>Status</th>
|
||||
<th>Machine</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr *ngFor="let alert of alerts">
|
||||
<td>{{alert.id}}</td>
|
||||
<td>{{alert.name}}</td>
|
||||
<td>{{alert.status.name}}</td>
|
||||
<td>{{alert.machine.name}} ({{alert.machine.domain || 'No Domain'}})</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
|
@ -0,0 +1,41 @@
|
|||
import {Component} from '@angular/core';
|
||||
import './operators';
|
||||
import {RepositoryManagerService} from "./paris/repository/repository-manager.service";
|
||||
import {AlertModel} from "./@model/alert.model";
|
||||
import {MachineModel} from "./@model/machine.model";
|
||||
import {Repository} from "./paris/repository/repository";
|
||||
import {DataSet} from "./paris/data/dataset";
|
||||
|
||||
/**
|
||||
* This class represents the main application component.
|
||||
*/
|
||||
@Component({
|
||||
moduleId: module.id,
|
||||
selector: 'sd-app',
|
||||
templateUrl: 'app.component.html',
|
||||
styleUrls: ['app.component.css'],
|
||||
})
|
||||
export class AppComponent {
|
||||
alert:AlertModel;
|
||||
machine:MachineModel;
|
||||
alerts:Array<AlertModel>;
|
||||
|
||||
constructor(repositoriesManagerService: RepositoryManagerService) {
|
||||
let alertsRepo:Repository<AlertModel> = repositoriesManagerService.getRepository(AlertModel);
|
||||
alertsRepo.getItemById("123")
|
||||
.subscribe((alert:AlertModel) => {
|
||||
console.log("alert: ", alert);
|
||||
this.alert = alert;
|
||||
}, error => console.error("ERROR", error));
|
||||
|
||||
alertsRepo.getItemsDataSet().subscribe((alerts:DataSet<AlertModel>) => {
|
||||
console.log("Alerts: ", alerts);
|
||||
this.alerts = alerts.results;
|
||||
});
|
||||
|
||||
let machinesRepo:Repository<MachineModel> = repositoriesManagerService.getRepository(MachineModel);
|
||||
|
||||
machinesRepo.getItemById("yossi-pc")
|
||||
.subscribe((machine:MachineModel) => console.log("Machine: ", machine));
|
||||
}
|
||||
}
|
|
@ -0,0 +1,35 @@
|
|||
import {NgModule} from '@angular/core';
|
||||
import {BrowserModule} from '@angular/platform-browser';
|
||||
import {APP_BASE_HREF} from '@angular/common';
|
||||
import {AppComponent} from './app.component';
|
||||
import {AppRoutingModule} from './app-routing.module';
|
||||
import {ParisModule} from "./paris/paris.module";
|
||||
import {HttpClient, HttpClientModule} from "@angular/common/http";
|
||||
import {DataStoreService} from "./paris/services/data-store/data-store.service";
|
||||
import {dataStoreServiceFactory} from "./paris/services/data-store/data-store.service.provider";
|
||||
import {ParisConfigService} from "./paris.config.service";
|
||||
import {ParisConfig} from "./paris/config/paris-config";
|
||||
|
||||
const parisConfig:ParisConfig = {
|
||||
apiRoot: "api"
|
||||
};
|
||||
|
||||
@NgModule({
|
||||
imports: [
|
||||
BrowserModule,
|
||||
HttpClientModule,
|
||||
AppRoutingModule,
|
||||
ParisModule.forRoot(parisConfig)
|
||||
],
|
||||
declarations: [AppComponent],
|
||||
providers: [
|
||||
{
|
||||
provide: APP_BASE_HREF,
|
||||
useValue: '<%= APP_BASE %>'
|
||||
}
|
||||
],
|
||||
bootstrap: [AppComponent]
|
||||
|
||||
})
|
||||
export class AppModule {
|
||||
}
|
|
@ -0,0 +1,31 @@
|
|||
// import { TRANSLATIONS, TRANSLATIONS_FORMAT, LOCALE_ID } from '@angular/core';
|
||||
//
|
||||
// export class TranslationProviders {
|
||||
//
|
||||
// public getTranslationFile = (): Promise<any> => {
|
||||
// let noProviders: Object[] = [];
|
||||
//
|
||||
// // Define a way to retrieve the local information
|
||||
// let locale: string = 'en-US';
|
||||
//
|
||||
// // Set the directory to the translation files
|
||||
// let file: string = `../assets/locale/messages.${locale}.xlf`;
|
||||
//
|
||||
// if(!locale || locale === 'en-US') return Promise.resolve(noProviders);
|
||||
//
|
||||
// return new Promise(function (resolve, reject) {
|
||||
// let xhr = new XMLHttpRequest;
|
||||
// xhr.open('GET', file);
|
||||
// xhr.onload = (data: any) => resolve(
|
||||
// [
|
||||
// { provide: TRANSLATIONS, useValue: data.target.response },
|
||||
// { provide: TRANSLATIONS_FORMAT, useValue: 'xlf' },
|
||||
// { provide: LOCALE_ID, useValue: locale }
|
||||
// ]
|
||||
// );
|
||||
// xhr.onerror = () => reject(noProviders);
|
||||
// xhr.send();
|
||||
// });
|
||||
// }
|
||||
// };
|
||||
//
|
|
@ -0,0 +1,23 @@
|
|||
/**
|
||||
* Bootstraps the application and makes the ROUTER_PROVIDERS and the APP_BASE_HREF available to it.
|
||||
* @see https://angular.io/docs/ts/latest/api/platform-browser-dynamic/index/bootstrap-function.html
|
||||
*/
|
||||
import { enableProdMode } from '@angular/core';
|
||||
import { platformBrowser } from '@angular/platform-browser';
|
||||
|
||||
import { AppModuleNgFactory } from './app.module.ngfactory';
|
||||
|
||||
enableProdMode();
|
||||
|
||||
platformBrowser().bootstrapModuleFactory(AppModuleNgFactory);
|
||||
|
||||
// In order to start the Service Worker located at "/worker-basic.min.js"
|
||||
// uncomment this line. More about Service Workers here
|
||||
// https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API/Using_Service_Workers
|
||||
//
|
||||
// if ('serviceWorker' in navigator) {
|
||||
// (<any>navigator).serviceWorker.register('/worker-basic.min.js').then((registration: any) =>
|
||||
// console.log('ServiceWorker registration successful with scope: ', registration.scope))
|
||||
// .catch((err: any) =>
|
||||
// console.log('ServiceWorker registration failed: ', err));
|
||||
// }
|
|
@ -0,0 +1,35 @@
|
|||
/**
|
||||
* Bootstraps the application and makes the ROUTER_PROVIDERS and the APP_BASE_HREF available to it.
|
||||
* @see https://angular.io/docs/ts/latest/api/platform-browser-dynamic/index/bootstrap-function.html
|
||||
*/
|
||||
import { enableProdMode } from '@angular/core';
|
||||
// The browser platform with a compiler
|
||||
import { platformBrowserDynamic } from '@angular/platform-browser-dynamic';
|
||||
// Load i18n providers
|
||||
// import { TranslationProviders } from './i18n.providers';
|
||||
|
||||
// The app module
|
||||
import { AppModule } from './app.module';
|
||||
|
||||
if (String('<%= BUILD_TYPE %>') === 'prod') { enableProdMode(); }
|
||||
|
||||
// Compile and launch the module with i18n providers
|
||||
// let TP = new TranslationProviders();
|
||||
// TP.getTranslationFile().then((providers: any) => {
|
||||
// const options: any = { providers };
|
||||
platformBrowserDynamic().bootstrapModule(AppModule/*, options*/);
|
||||
// });
|
||||
|
||||
// In order to start the Service Worker located at "/worker-basic.[min.]js"
|
||||
// uncomment this line. More about Service Workers here
|
||||
// https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API/Using_Service_Workers
|
||||
//
|
||||
// if ('serviceWorker' in navigator) {
|
||||
// let workerScript = '/worker-basic';
|
||||
// if (String('<%= BUILD_TYPE %>') === 'prod') { workerScript = workerScript + '.min'; }
|
||||
// workerScript = workerScript + '.js';
|
||||
// (<any>navigator).serviceWorker.register(workerScript).then((registration: any) =>
|
||||
// console.log('ServiceWorker registration successful with scope: ', registration.scope))
|
||||
// .catch((err: any) =>
|
||||
// console.log('ServiceWorker registration failed: ', err));
|
||||
// }
|
|
@ -0,0 +1,15 @@
|
|||
// rxjs
|
||||
import 'rxjs/add/observable/throw';
|
||||
import 'rxjs/add/operator/map';
|
||||
import 'rxjs/add/operator/catch';
|
||||
import 'rxjs/add/observable/of';
|
||||
import 'rxjs/add/observable/combineLatest';
|
||||
import 'rxjs/add/operator/do';
|
||||
import 'rxjs/add/operator/mergeMap';
|
||||
import 'rxjs/add/operator/share';
|
||||
import 'rxjs/add/operator/finally';
|
||||
|
||||
import "reflect-metadata";
|
||||
|
||||
// ngrx
|
||||
//import '@ngrx/core/add/operator/select';
|
|
@ -0,0 +1,7 @@
|
|||
import {Injectable} from "@angular/core";
|
||||
import {ParisConfig} from "./paris/config/paris-config";
|
||||
|
||||
@Injectable()
|
||||
export class ParisConfigService implements ParisConfig{
|
||||
apiRoot:string = "/api222"
|
||||
}
|
|
@ -0,0 +1,4 @@
|
|||
export interface ParisConfig{
|
||||
apiRoot?:string,
|
||||
allItemsProperty?:string
|
||||
}
|
|
@ -0,0 +1,4 @@
|
|||
export interface DataSet<T>{
|
||||
count:number,
|
||||
results:Array<T>
|
||||
}
|
|
@ -0,0 +1,9 @@
|
|||
import {IIdentifiable} from "../models/identifiable.model";
|
||||
|
||||
export interface DataEntityConstructor<T> extends DataEntityType{
|
||||
new(data:IIdentifiable): T
|
||||
}
|
||||
|
||||
export interface DataEntityType{
|
||||
new(data:IIdentifiable):any
|
||||
}
|
|
@ -0,0 +1,5 @@
|
|||
export class EntityAction{
|
||||
name:string;
|
||||
endpoint:string;
|
||||
multiple?:boolean = true;
|
||||
}
|
|
@ -0,0 +1,16 @@
|
|||
import {DataEntityType} from "./data-entity.base";
|
||||
import {Field} from "./entity-field";
|
||||
import {entityFieldsService} from "../services/entity-fields.service";
|
||||
|
||||
export function EntityField(fieldConfig:Field):PropertyDecorator {
|
||||
return function (entityPrototype: DataEntityType, propertyKey: string | symbol) {
|
||||
let propertyConstructor:DataEntityType = Reflect.getMetadata("design:type", entityPrototype, propertyKey);
|
||||
let fieldConfigCopy:Field = Object.assign({}, fieldConfig);
|
||||
if (!fieldConfigCopy.id)
|
||||
fieldConfigCopy.id = String(propertyKey);
|
||||
|
||||
fieldConfigCopy.type = propertyConstructor;
|
||||
|
||||
entityFieldsService.addEntityField(entityPrototype, fieldConfigCopy);
|
||||
}
|
||||
}
|
|
@ -0,0 +1,10 @@
|
|||
import {DataEntityType} from "./data-entity.base";
|
||||
|
||||
export interface Field{
|
||||
id?:string,
|
||||
name:string,
|
||||
data?:string,
|
||||
entity?:DataEntityType,
|
||||
type?:DataEntityType,
|
||||
defaultValue?:any
|
||||
}
|
Некоторые файлы не были показаны из-за слишком большого количества измененных файлов Показать больше
Загрузка…
Ссылка в новой задаче