Let's get this show on the road!

Starting out with a small Angular app, with which to test Paris during initial development.
This commit is contained in:
Yossi Kolesnicov 2017-09-12 23:22:44 +03:00
Родитель c41c5f3c94
Коммит 272f1f48fc
236 изменённых файлов: 21599 добавлений и 1 удалений

33
.dockerignore Normal file
Просмотреть файл

@ -0,0 +1,33 @@
# compiled output
dist
tmp
sme
# dependencies
node_modules
bower_components
# IDEs and editors
.idea
.vscode
.project
.classpath
*.launch
.settings/
# misc
.sass-cache
connect.lock
coverage/*
libpeerconnection.log
npm-debug.log
testem.log
typings
# e2e
e2e/*.js
e2e/*.map
#System Files
.DS_Store
Thumbs.db

15
.editorconfig Normal file
Просмотреть файл

@ -0,0 +1,15 @@
# http://editorconfig.org
root = true
[*]
charset = utf-8
indent_style = tab
indent_size = 4
end_of_line = lf
insert_final_newline = true
trim_trailing_whitespace = true
[*.md]
insert_final_newline = false
trim_trailing_whitespace = false

15
.github/CONTRIBUTING.md поставляемый Normal file
Просмотреть файл

@ -0,0 +1,15 @@
## Submitting Pull Requests
**Please follow these basic steps to simplify pull request reviews - if you don't you'll probably just be asked to anyway.**
* Please rebase your branch against the current master
* Run ```npm install``` to make sure your development dependencies are up-to-date
* Please ensure that the test suite passes **and** that code is lint free before submitting a PR by running:
* ```npm test```
* If you've added new functionality, **please** include tests which validate its behaviour
* Make reference to possible [issues](https://github.com/mgechev/angular2-seed/issues) on PR comment
## Submitting bug reports
* Please detail the affected browser(s) and operating system(s)
* Please be sure to state which version of node **and** npm you're using

33
.github/ISSUE_TEMPLATE.md поставляемый Normal file
Просмотреть файл

@ -0,0 +1,33 @@
<!--
IF YOU DON'T FILL OUT THE FOLLOWING INFORMATION WE MIGHT CLOSE YOUR ISSUE WITHOUT INVESTIGATING
-->
**I'm submitting a ...** (check one with "x")
```
[ ] bug report => search github for a similar issue or PR before submitting
[ ] feature request
[ ] support request => Please do not submit support request here, instead see use [gitter](https://gitter.im/mgechev/angular2-seed) or [stackoverflow](https://stackoverflow.com/questions/tagged/angular2)
```
**Current behavior**
<!-- Describe how the bug manifests. -->
**Expected behavior**
<!-- Describe what the behavior would be without the bug. -->
**Minimal reproduction of the problem with instructions**
<!--
If the current behavior is a bug or you can illustrate your feature request better with an example,
please provide the *STEPS TO REPRODUCE* and if possible a *MINIMAL DEMO* of the problem.
-->
**What is the motivation / use case for changing the behavior?**
<!-- Describe the motivation or the concrete use case -->
**Please tell us about your environment:**
<!-- Operating system, IDE, package manager, HTTP server, ... -->
* **Angular Seed Version:** `aaaaf75`
<!-- Check which is the hash of the last commit from angular-seed that you have locally -->
* **Node:** `node --version` =

5
.gitignore поставляемый
Просмотреть файл

@ -57,3 +57,8 @@ typings/
# dotenv environment variables file
.env
#Builds folder
dist/
#NPM package-lock
package-lock.json

13
.idea/Paris.iml Normal file
Просмотреть файл

@ -0,0 +1,13 @@
<?xml version="1.0" encoding="UTF-8"?>
<module type="WEB_MODULE" version="4">
<component name="NewModuleRootManager">
<content url="file://$MODULE_DIR$">
<excludeFolder url="file://$MODULE_DIR$/.tmp" />
<excludeFolder url="file://$MODULE_DIR$/temp" />
<excludeFolder url="file://$MODULE_DIR$/tmp" />
<excludeFolder url="file://$MODULE_DIR$/dist" />
</content>
<orderEntry type="inheritedJdk" />
<orderEntry type="sourceFolder" forTests="false" />
</component>
</module>

13
.idea/Paris.ts.iml Normal file
Просмотреть файл

@ -0,0 +1,13 @@
<?xml version="1.0" encoding="UTF-8"?>
<module type="WEB_MODULE" version="4">
<component name="NewModuleRootManager">
<content url="file://$MODULE_DIR$">
<excludeFolder url="file://$MODULE_DIR$/.tmp" />
<excludeFolder url="file://$MODULE_DIR$/dist" />
<excludeFolder url="file://$MODULE_DIR$/temp" />
<excludeFolder url="file://$MODULE_DIR$/tmp" />
</content>
<orderEntry type="inheritedJdk" />
<orderEntry type="sourceFolder" forTests="false" />
</component>
</module>

Просмотреть файл

@ -0,0 +1,9 @@
<?xml version="1.0" encoding="UTF-8"?>
<project version="4">
<component name="ProjectCodeStyleSettingsManager">
<option name="PER_PROJECT_SETTINGS">
<value />
</option>
<option name="PREFERRED_PROJECT_CODE_STYLE" value="Default" />
</component>
</project>

Просмотреть файл

@ -0,0 +1,7 @@
<component name="ProjectDictionaryState">
<dictionary name="yokolesn">
<words>
<w>deps</w>
</words>
</dictionary>
</component>

Просмотреть файл

@ -0,0 +1,6 @@
<component name="InspectionProjectProfileManager">
<profile version="1.0">
<option name="myName" value="Project Default" />
<inspection_tool class="TsLint" enabled="true" level="ERROR" enabled_by_default="true" />
</profile>
</component>

8
.idea/modules.xml Normal file
Просмотреть файл

@ -0,0 +1,8 @@
<?xml version="1.0" encoding="UTF-8"?>
<project version="4">
<component name="ProjectModuleManager">
<modules>
<module fileurl="file://$PROJECT_DIR$/.idea/Paris.iml" filepath="$PROJECT_DIR$/.idea/Paris.iml" />
</modules>
</component>
</project>

6
.idea/vcs.xml Normal file
Просмотреть файл

@ -0,0 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<project version="4">
<component name="VcsDirectoryMappings">
<mapping directory="$PROJECT_DIR$" vcs="Git" />
</component>
</project>

14
.idea/webResources.xml Normal file
Просмотреть файл

@ -0,0 +1,14 @@
<?xml version="1.0" encoding="UTF-8"?>
<project version="4">
<component name="WebResourcesPaths">
<contentEntries>
<entry url="file://$PROJECT_DIR$">
<entryData>
<resourceRoots>
<path value="file://$PROJECT_DIR$/mock_server/node_modules" />
</resourceRoots>
</entryData>
</entry>
</contentEntries>
</component>
</project>

47
.travis.yml Normal file
Просмотреть файл

@ -0,0 +1,47 @@
language: node_js
node_js: stable
sudo: false
install: true # yarn bug
addons:
firefox: "45.0"
os:
- linux
# - osx
before_install:
- if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then brew update; fi
- if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then brew outdated xctool || brew upgrade xctool; fi
- if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then export CHROME_BIN=chromium-browser; fi # Karma CI
- if [[ "$TRAVIS_OS_NAME" == "osx" ]]; then brew cask install google-chrome; fi # Karma CI
- if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then export DISPLAY=:99.0; fi
before_script:
- npm i -g npm@^5.3.0 && npm --version
- npm install
- if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then sh -e /etc/init.d/xvfb start; fi
- if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then nohup bash -c "webdriver-manager start 2>&1 &"; fi # Protractor CI
after_failure:
- cat /home/travis/build/mgechev/angular-seed/npm-debug.log
branches:
only: master
notifications:
email: true
webhooks:
urls: https://webhooks.gitter.im/e/565e4b2fed3b96c1b964
on_success: change # options: [always|never|change] default: always
on_failure: always # options: [always|never|change] default: always
on_start: never # options: [always|never|change] default: always
cache:
directories: node_modules
script:
- npm run tests.all

28
.vscode/launch.json поставляемый Normal file
Просмотреть файл

@ -0,0 +1,28 @@
{
"version": "0.2.0",
"configurations": [
{
"name": "Launch Chrome against localhost, with sourcemaps",
"type": "chrome",
"preLaunchTask": "start",
"request": "launch",
"url": "http://localhost:5555",
"sourceMaps": true,
"webRoot": "${workspaceRoot}/src/client",
"sourceMapPathOverrides": {
"app/*": "${webRoot}/app/*"
}
},
{
"name": "Attach to Chrome, with sourcemaps",
"type": "chrome",
"request": "attach",
"port": 9222,
"sourceMaps": true,
"webRoot": "${workspaceRoot}/src/client",
"sourceMapPathOverrides": {
"app/*": "${webRoot}/app/*"
}
}
]
}

9
.vscode/settings.json поставляемый Normal file
Просмотреть файл

@ -0,0 +1,9 @@
// Place your settings in this file to overwrite default and user settings.
{
"typescript.tsdk": "node_modules/typescript/lib",
"search.exclude": {
"**/coverage_js": true,
"**/coverage": true,
"**/dist": true
}
}

28
.vscode/tasks.json поставляемый Normal file
Просмотреть файл

@ -0,0 +1,28 @@
{
"version": "0.1.0",
"command": "npm",
"isShellCommand": true,
"showOutput": "always",
"suppressTaskName": true,
"tasks": [
{
"taskName": "tslint",
"args": [ "run", "lint" ],
"problemMatcher": {
"owner": "tslint",
"fileLocation": [
"relative",
"${workspaceRoot}"
],
"severity": "warning",
"pattern": {
"regexp": "^(\\S.*)\\[(\\d+), (\\d+)\\]:\\s+(.*)$",
"file": 1,
"line": 2,
"column": 3,
"message": 4
}
}
}
]
}

Просмотреть файл

@ -1,5 +1,8 @@
# Paris
# Contributing
Paris is a TypeScript library for implementing Domain-Driven Design in web apps.
## Contributing
This project welcomes contributions and suggestions. Most contributions require you to agree to a
Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us

41
appveyor.yml Normal file
Просмотреть файл

@ -0,0 +1,41 @@
# AppVeyor file
# http://www.appveyor.com/docs/appveyor-yml
# This file: cloned from https://github.com/gruntjs/grunt/blob/master/appveyor.yml
# Build version format
version: "{build}"
# Test against this version of Node.js
environment:
nodejs_version: "Stable"
build: off
clone_depth: 10
# Fix line endings on Windows
init:
- git config --global core.autocrlf true
install:
- ps: Install-Product node $env:nodejs_version
- npm install -g npm@3.10.8
- ps: $env:path = $env:appdata + "\npm;" + $env:path
- npm install && npm install karma-ie-launcher
test_script:
# Output useful info for debugging.
- node --version && npm --version
# We test multiple Windows shells because of prior stdout buffering issues
# filed against Grunt. https://github.com/joyent/node/issues/3584
- ps: "npm --version # PowerShell" # Pass comment to PS for easier debugging
- npm run tests.all
notifications:
- provider: Webhook
url: https://webhooks.gitter.im/e/cfd8ce5ddee6f3a0b0c9
on_build_success: false
on_build_failure: true
on_build_status_changed: true
cache: node_modules -> package.json

28
gulpfile.ts Normal file
Просмотреть файл

@ -0,0 +1,28 @@
import * as gulp from 'gulp';
import * as util from 'gulp-util';
import * as runSequence from 'run-sequence';
import Config from './tools/config';
import { loadTasks, loadCompositeTasks } from './tools/utils';
loadTasks(Config.SEED_TASKS_DIR);
loadTasks(Config.PROJECT_TASKS_DIR);
loadCompositeTasks(Config.SEED_COMPOSITE_TASKS, Config.PROJECT_COMPOSITE_TASKS);
// --------------
// Clean dev/coverage that will only run once
// this prevents karma watchers from being broken when directories are deleted
let firstRun = true;
gulp.task('clean.once', (done: any) => {
if (firstRun) {
firstRun = false;
runSequence('check.tools', 'clean.dev', 'clean.coverage', done);
} else {
util.log('Skipping clean on rebuild');
done();
}
});

135
karma.conf.js Normal file
Просмотреть файл

@ -0,0 +1,135 @@
// Karma configuration
// Generated on Wed Jul 15 2015 09:44:02 GMT+0200 (Romance Daylight Time)
'use strict';
var argv = require('yargs').argv;
var minimatch = require("minimatch");
module.exports = function (config) {
config.set({
// base path that will be used to resolve all patterns (eg. files, exclude)
basePath: './',
// frameworks to use
// available frameworks: https://npmjs.org/browse/keyword/karma-adapter
frameworks: ['jasmine'],
// list of files / patterns to load in the browser
files: [
// Polyfills.
'node_modules/core-js/client/shim.min.js',
'node_modules/intl/dist/Intl.min.js',
'node_modules/traceur/bin/traceur.js',
// System.js for module loading
'node_modules/systemjs/dist/system.src.js',
// Zone.js dependencies
'node_modules/zone.js/dist/zone.js',
'node_modules/zone.js/dist/long-stack-trace-zone.js',
'node_modules/zone.js/dist/async-test.js',
'node_modules/zone.js/dist/fake-async-test.js',
'node_modules/zone.js/dist/sync-test.js',
'node_modules/zone.js/dist/proxy.js',
'node_modules/zone.js/dist/jasmine-patch.js',
// RxJs.
{ pattern: 'node_modules/rxjs/**/*.js', included: false, watched: false },
{ pattern: 'node_modules/rxjs/**/*.js.map', included: false, watched: false },
// paths loaded via module imports
// Angular itself
{ pattern: 'node_modules/@angular/**/*.js', included: false, watched: true },
{ pattern: 'node_modules/@angular/**/*.js.map', included: false, watched: false },
'test-config.js',
{ pattern: 'dist/dev/system-config.js', watched: true, included: true },
{ pattern: 'dist/dev/**/*.js', included: false, watched: true },
{ pattern: 'dist/dev/**/*.html', included: false, watched: true, served: true },
{ pattern: 'dist/dev/**/*.css', included: false, watched: true, served: true },
// suppress annoying 404 warnings for resources, images, etc.
{ pattern: 'dist/dev/assets/**/*', watched: false, included: false, served: true },
'test-main.js'
],
// must go along with above, suppress annoying 404 warnings.
proxies: {
'/assets/': '/base/dist/dev/assets/'
},
// list of files to exclude
exclude: [
'node_modules/**/*spec.js'
],
// preprocess matching files before serving them to the browser
// available preprocessors: https://npmjs.org/browse/keyword/karma-preprocessor
// test results reporter to use
// possible values: 'dots', 'progress'
// available reporters: https://npmjs.org/browse/keyword/karma-reporter
reporters: ['mocha'],
// web server port
port: 9876,
// enable / disable colors in the output (reporters and logs)
colors: true,
// level of logging
// possible values: config.LOG_DISABLE || config.LOG_ERROR || config.LOG_WARN || config.LOG_INFO || config.LOG_DEBUG
logLevel: config.LOG_INFO,
// enable / disable watching file and executing tests whenever any file changes
autoWatch: true,
// start these browsers
// available browser launchers: https://npmjs.org/browse/keyword/karma-launcher
browsers: [
'Chrome'
],
customLaunchers: {
Chrome_travis_ci: {
base: 'Chrome',
flags: ['--no-sandbox']
}
},
// Continuous Integration mode
// if true, Karma captures browsers, runs the tests and exits
singleRun: false,
// Passing command line arguments to tests
client: {
files: argv.files ? minimatch.makeRe(argv.files).source : null
}
});
if (process.env.APPVEYOR) {
config.browsers = ['IE'];
config.singleRun = true;
config.browserNoActivityTimeout = 90000; // Note: default value (10000) is not enough
}
if (process.env.TRAVIS || process.env.CIRCLECI) {
config.browsers = ['Chrome_travis_ci'];
config.singleRun = true;
config.browserNoActivityTimeout = 90000;
}
};

Просмотреть файл

@ -0,0 +1,26 @@
-----BEGIN CERTIFICATE-----
MIIEZTCCA02gAwIBAgIJANgPP6bfBR8pMA0GCSqGSIb3DQEBBQUAMH4xCzAJBgNV
BAYTAlVBMQswCQYDVQQIEwJVQTERMA8GA1UEBxMIVGVsIEF2aXYxDjAMBgNVBAoT
BVlvc3NpMQwwCgYDVQQLEwNZb3gxEDAOBgNVBAMTB3lveC5jb20xHzAdBgkqhkiG
9w0BCQEWEGNvbXBhbnlAZW1haWxjb20wHhcNMTcwMzIxMTUzNDQ5WhcNMTkxMjE2
MTUzNDQ5WjB+MQswCQYDVQQGEwJVQTELMAkGA1UECBMCVUExETAPBgNVBAcTCFRl
bCBBdml2MQ4wDAYDVQQKEwVZb3NzaTEMMAoGA1UECxMDWW94MRAwDgYDVQQDEwd5
b3guY29tMR8wHQYJKoZIhvcNAQkBFhBjb21wYW55QGVtYWlsY29tMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu2SJj64r96jq2CY6DKA9c/lOrauakVsY
ImamRzkNxFKew31fUkjXPKtyF+CqgnPlMhYyEYwp/1Cn6Zm77ipZ6Qd07zWONYMR
ZiobTLUbKutv6E2BUE6FAqbKKLKnq7yYHG50eLwOm+Ra/zeQqEcIy7q2cggPB7h7
HatuMXdLU2Fc03W9dw8+yaW91dzrdMY7vrLFRs25BxuIDUGmE8ZKDbw2vTfd+HDa
XeMAwhCmxJOkFmsbY+f5Pfa5q/qHKXxcrhAE10yfmumbPLH3hhZ/q/2J6BNs2z1o
eUtRfJtk4Df0aUwXuVjvW9qOAdMdTRetE6ozWSAQh4I0+v3TltwOSwIDAQABo4Hl
MIHiMB0GA1UdDgQWBBQKOucr234+kzC536O/e5k0GpqfvTCBsgYDVR0jBIGqMIGn
gBQKOucr234+kzC536O/e5k0GpqfvaGBg6SBgDB+MQswCQYDVQQGEwJVQTELMAkG
A1UECBMCVUExETAPBgNVBAcTCFRlbCBBdml2MQ4wDAYDVQQKEwVZb3NzaTEMMAoG
A1UECxMDWW94MRAwDgYDVQQDEwd5b3guY29tMR8wHQYJKoZIhvcNAQkBFhBjb21w
YW55QGVtYWlsY29tggkA2A8/pt8FHykwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0B
AQUFAAOCAQEAuZA0Y4V9BtzZ9k+9qDRllSC7nKd0FX7ljbYb+sNMUTSuEm6ttFZ8
nnCI8UjUpIzhD9TtfNjWrmm7APFz1cwr4Vt47Wq+nxzTBcI0/brlSVyXhiw4Bx2C
y4/4P6SIBseTV97iwlym1uR7aCythQ9CDZ5EXO2RTngK/uH6zuEGQQ9QkqmjnhK6
Bmgovp5H8nCYswO6qgll31E2ygf5jkW8OL51pXldtO/mEZgWVe/5wEdhmVywYBmF
eeRVqShkg99JnpOS7fzA7XWymWH5qZ3Jkyw3zmzibBXVKxBNNz5VYgsUFYD8E5tW
4yxKABQvu3xEsgderL9YJg8XY9taHEZ30A==
-----END CERTIFICATE-----

Просмотреть файл

@ -0,0 +1,30 @@
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,1596AB65A950E30B
I6yzIY6t6Euf7n7zkkG6mpMHmT7NEYxFLfJLkWXajjGT4DzSjvHI2t9S3eU1nU3p
Xy3AYM18FOcrvE8HB2OWnQwC6oVJRRTt/cxRzyIKhMRQsk7K5WwVvFSA/r/Jh6Nu
joBiVy26fV+SVdsFJ3kKfLT+T9eRfxbRS3bRgc3Wbc2wj4VgL6Nh74Jekqf7zncq
xTPxHw/SlihZJxBYpbovPW/CBOzPHoiLE+5XFJuZNJTSjkYHHg4ZlFM4ohrScPVw
zZ5tox/dAXa+sXACT7nxkuebhoqeyliCVjop4jDYA1KGDUyBl1yoOUfIubeLESFa
O+fklAkC6afSErOE6LvWOS79/JYJbZvFYzXNDUIb4ZMviJtjwaGFtsFkNrxntFzM
Rqqa7miSMQeuEnTulxLRgUIiDrKBulFDV5Hjevone4jjz5LUukrKQii5nI/lAzbm
8RKWSnCATH0n7sGbS7yk54m3+fPz4c7spxKHCB8xVOV6B2VUBjepyQqD6Xaol8YD
xDK2HTW5wdiBhJmWqDX98BxRGRZ9sh4O7Wq7z4VYkFtHHJddK6cxY+yrzLp125G1
Bhgx+qzosNnw4na5syB/NStlwCSNpEd0tTuryCbvYjwc/tPgI1G5boJSaWctvOvV
jTZC9XHufPXNRWzfDyoAtpvd+jDkZJ3NV5pARmeDepyKG/GC4v0SCi2mFmRuOjRa
J3gkbsTkyuKbZ/JLyghg9+pGZrR6rVbSsCUHL4iI92rFM7loIhvEfboXP/sORIkO
sCrJJA1NtN6YlmvyuNuY+7lsM2ewG1bwXg4nyWTbkClA9E0J0uCgWAsRL2m4Kkj2
m8Sp/zn3rsD8Dd6x8d5SLsenS+rp9zYbj4Fbl7veO1t2P9D/KhF1ny+hful7Fiza
jV4lULruixvPzBr3krS8Uy2gr+mOXXQ51kxSWk/PYPrTYauEujzwIkihuoz58Dga
42AFWqXp0UWZMv1MYaRZZua5NzYXDviVAYHpw43ZwPtqH+BEPYzHs7Il1WR/nSIA
0rPqswL5wGwiBNJIMuxdQrSK6I7io0MoE2i2PPLQzN7efUPP861ROVW9fHwxEzj2
ulpO7eKD6yxe4PyTsIT61cvGVj4i3DwCUMYiyxut/ieqdbZrVvCvt0zzhQ8Ewgck
+m6PSSW2lkY1jENRmGdcexU3tZu2nmDVsrI5puPkoae9Nl/HVTPXMZL80oMlQEbk
F1/bZ5CtHDkWVf6agF9ll1whuGD6HZWcWgBg4QwJqKkobGTsi6oLe9OKx12qB6o/
r63PaQ8lXAvcAsGr+FkA4rrbaR035pfWVWnSjzBHQWqgsCFeIRdsGUXrI63UztGU
lWb5y1o+GKZm48QXfTufCHGYsJ54Ud2UEm5LIUsvgkaU1EHF2GQrf0aAZKqVgFR/
5LtCCzgKzeo/bLyIyOTXi+UXMCN2I04WtXZ2rwfkCVsETAlXPKMdtR9MKlB0f7j3
1Ag+v9lSQMxet+iA1Mdlc6+81QTtAyeUpgJRqlIcQwygMhNMhfzCE6WNayrX3C15
MQrUCtc99XWYAZfuyd6VwlfoymEKdqIBBM1XsajWN5JqCJ1UsVD5Og==
-----END RSA PRIVATE KEY-----

Просмотреть файл

@ -0,0 +1,61 @@
-----BEGIN CERTIFICATE-----
MIIFRTCCAy2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAsMSowKAYDVQQDDCFIZXhh
ZGl0ZSBIZXhhZGl0ZS1RYS1FbnYyIEFJUlMgQ0EwHhcNMTcwMjI2MDkzNjUxWhcN
MjAwMjI2MDkzNjUxWjB2MR8wHQYDVQQDDBZoZXhhZGl0ZS1haXJzLmF1dG8ubGFi
MRkwFwYDVQQKDBBIZXhhZGl0ZS1RYS1FbnYyMQswCQYDVQQGEwJVUzETMBEGA1UE
CAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzCCAiIwDQYJKoZI
hvcNAQEBBQADggIPADCCAgoCggIBAMgkBu+LyV8xahI6HRclxBN6cvSmt+rTx3MB
ah1CyRr6tuXg7aWhxy/9UIXtRgRC4jRFZiCQnR4KsXiMGlAL7MA+McKgSQTRgmdH
V7CG0jzn1pwLuFgPAOlelhmgYmp1/gCXnS1V0HSlgigDGYiqqelOmyoATJDNlWXL
V3DvhxeSuWBbTN9o+TYxypaI4tgUNg/iqrL5aKCan3HVaGGzaJZ/AyMYlylEw4PH
P/oX+RNwzzebO/sqBUpqIZlQadmCzGm5QXGRVSWMmR6jVtqwluMGVJD9XkQr2pbp
RD9/P1opwVMns1pmEieLbslMQnAHNuNEH9MC971LLyG9YukW/1Yz7/GG069BxHJC
VqKtfAVwBzM7xo3gqjEoBooore+oMGLAZ88J0Ijr4ybXUCyMq5khTi7m0mXRUD3s
HnQE9YCQJiF3ZEjzkrxBRv2B/sNsRlT6xsRwEmARwS2d24fISWmMwBbBt2NBpuo8
fZPWM5Eiore0/yOArUr4zlOsKpOif/bOug4wZL97jaC+aIK85kj35zM6GTfp9bUt
4G2/bMC+0ZcKmQ/76/tru+I8fa2mKsLU7VKumy1KkFGEOd+Av61eTbVGXsTaAgCF
f4qjxEFz9dbsb+HBbsaoJDW0nIAzHQx4Z+pJttVuDAgni/WT6VSSMteZv3DZIduB
s57hBMuPAgMBAAGjKDAmMCQGA1UdEQEB/wQaMBiCFmhleGFkaXRlLWFpcnMuYXV0
by5sYWIwDQYJKoZIhvcNAQELBQADggIBAIsV7Nqa3+WALBstf2+Oyo5GbPLozk6M
AvmjEFVBCjZTEIryEizhp6Ce8MFrqflKoBB1P6A6v/N78eMvzOx7rBIim5aUYbIV
j8UWXFUPIfSZLaC6zlUO7KwLX6m3rCp1jj7PJQNWd1gm1RK8P4I48SB7A699JDDp
fr8VxfIf311Lbdyk6490BLLVKFevwupyo878FL7wWd0B0K3vRmtmlu5A7K6i5pQ1
KbB4ETtbSx697WcJUvrD1Afp7NhLYmoCe9NDmRkyAJ9WwQQJz49LPAhp2qn2rTwr
LFVKkGnfU/NOf1+ghMR0ZH9KQa9cb1EFX1FbuuQcgnfMHc3kU2uoC0WKsWEmotl2
PwggKVLXCMfERDJl8D/g4/VaTOLD7q0mPtRK2n/JUWifODJmSfHSZ+joszHqFcVj
/1UPmzUZdvsBBY77NWf2BUcNEyUgGFUVk2NOru0dj409LWRD6cZdzTBZrZ87h9Ic
vtLdSFg78qld3v5w94PhAfmia31FcKOWh4M1HFSzE48pP5jDj+LGrrMxxphL7CPc
LNO914w3l/VUdpjz0UWp06zjuP0B30zTHR0+joIYPzlQeveTPQCvEQNcQqkSs4K1
oW6maPYabkRk9u+qdjnv2FuxchLImYSi7JI6HJ3NvQenUqcdDdV4OT7yCaKxH42l
v9SoVlDyG7yX
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFOTCCAyGgAwIBAgIBATANBgkqhkiG9w0BAQsFADAsMSowKAYDVQQDDCFIZXhh
ZGl0ZSBIZXhhZGl0ZS1RYS1FbnYyIEFJUlMgQ0EwHhcNMTcwMjI2MDkzNjQ3WhcN
MjAwMjI2MDkzNjQ3WjAsMSowKAYDVQQDDCFIZXhhZGl0ZSBIZXhhZGl0ZS1RYS1F
bnYyIEFJUlMgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDTNEk9
94/MQ66Q1EdJ0WTtEiae5UkKMmCaGRi4DPSu0yevz425kMsEtILPjqNFEH/RgJGx
mpTZKhUBtui5N/KR7xw4ZIJTT8a2QUGi9zPAH0FuGJwuSh2iRcdyl8gULuWyEax4
j4nzjI70DVwWgZK4bVKRKn5Lp+LhBtGkV58TifipM2rgq5l7RmOdJRBvDTLv1sgx
CklRQOzMAn4e9Sl/u4SvtuDGEcRL7yLGK/YmAQZvto700m09xE5jIKuRXDEPw+CR
CR60i8/Y076AlZuTtMeJdQUyXLOCOV1omKw+lRxpQaQpq+42niQut6LUnu6bC7bV
7+w7aEw5D0HMfmCwlkTNUwfYWXmDTa70Ru5r6X1VrdC3xqFXrAWvnuSuPVeKXMCW
5r6PspAR2nG1bCw54jm9J1VzXQtYpgDmzdABZ0K2LY5vsi9w/JojU8wrOkdnjBcK
D2T1QbkiEe6b3p+lETXEbuhZGkkYzMbG64m9sVTalv/X7UEhpWukb31L4ZRKzfb6
DGOchuJetUg2X2LJi4a3aM4QCcfO+T4mTUjQ2CxZrEFtmnOGzUM21KJgOW/yKogL
cNGssIo4ohmiPkOw0jNqXG7Rmk62DmjvD3LLtwX5P5JmTDV+T2ESKT6qK68Zp1fR
6WjGKtv2oNLPll5qzjet79x8HcD6W1yGCo2wkQIDAQABo2YwZDASBgNVHRMBAf8E
CDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUja554HrcHe97RwpO
I37ZgHNTdwUwHwYDVR0jBBgwFoAUja554HrcHe97RwpOI37ZgHNTdwUwDQYJKoZI
hvcNAQELBQADggIBACpV7oPLyf4S4kqUOa9LOREmc3YwmugbEeIdZ5YU0sNz/kNf
FvhAiGjaW9OevuG3dGJLVNWhnZA3e38zcLDpojI/5qmNsmbnH8vBxTX/4WtdFi+N
aSVnKREPjet7Vm2559Bw8X5nNlw0u76uStdB7gTsU8eZ9fpkIIxpYzYmbBP39SeK
K5NK7fBUQ1vjYTc6MY5bBFMJfjZN7gEjhWOUhVdB4juLcHc42QF5wx62L+rWVYmE
pckTkfo4JyBzg6v6FeLiXPw937U8esMBXHK7Tu9F5FpC4la1qJiEckKPr1P0kIgU
z8brOuFeBXnXpn0JR4DG49W2SqzurTSnCW+3N6YGmIPUX+nh6Pa8w2ZqUO/P65a2
d1Aehi0OCBFZFVIwXF+f8PLLZlD8g5Ki53NZNyBNcQlnpk2JDvRMr+cuYXfKlU1a
dx84FlMnOAd3CPHMHSHgNJ0wZVm0t2eXrCthrlyqwei/0ozTmMZUBd5eCKLcgv/H
SSV7AEMKWy+pa2uyXG+R9rrdMD86D7Bt1bZh1X7I21YUN0z8MBX0xzZVg5neCNuU
FognmkuvCgnuHlIra+S6Tk+zLby2Fbwl0KEJvyTpKZTs4jBznoyOp1s/69fVOfsX
ZZawwqkAqG48a6yVZ/DuFKysTVqlA0ZsjGLSEzUZN9Cu7P+NbdJrUpwU0OB4
-----END CERTIFICATE-----

Просмотреть файл

@ -0,0 +1,52 @@
-----BEGIN PRIVATE KEY-----
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDIJAbvi8lfMWoS
Oh0XJcQTenL0prfq08dzAWodQska+rbl4O2loccv/VCF7UYEQuI0RWYgkJ0eCrF4
jBpQC+zAPjHCoEkE0YJnR1ewhtI859acC7hYDwDpXpYZoGJqdf4Al50tVdB0pYIo
AxmIqqnpTpsqAEyQzZVly1dw74cXkrlgW0zfaPk2McqWiOLYFDYP4qqy+Wigmp9x
1Whhs2iWfwMjGJcpRMODxz/6F/kTcM83mzv7KgVKaiGZUGnZgsxpuUFxkVUljJke
o1basJbjBlSQ/V5EK9qW6UQ/fz9aKcFTJ7NaZhIni27JTEJwBzbjRB/TAve9Sy8h
vWLpFv9WM+/xhtOvQcRyQlairXwFcAczO8aN4KoxKAaKKK3vqDBiwGfPCdCI6+Mm
11AsjKuZIU4u5tJl0VA97B50BPWAkCYhd2RI85K8QUb9gf7DbEZU+sbEcBJgEcEt
nduHyElpjMAWwbdjQabqPH2T1jORIqK3tP8jgK1K+M5TrCqTon/2zroOMGS/e42g
vmiCvOZI9+czOhk36fW1LeBtv2zAvtGXCpkP++v7a7viPH2tpirC1O1SrpstSpBR
hDnfgL+tXk21Rl7E2gIAhX+Ko8RBc/XW7G/hwW7GqCQ1tJyAMx0MeGfqSbbVbgwI
J4v1k+lUkjLXmb9w2SHbgbOe4QTLjwIDAQABAoICAB7N5L9j7YeYTHInvah9aJNy
6lSbgH1FQVKDKjj8uYVMh3AUUZ+HqefJ/mXOolMvlC9laxWiDHy+OpiKP9aIL1Vb
fT8uem6ibIbG5UlHRv6W1GJKL4JmNMa2hzXEiMFIDeM7craymZYKj2DnMTvmwKYn
Mhyh1ScIbXEwffHk/A71x1B8XPWZ65maykqnIPsPCU8inRFU7/SgN+BGb31yJqvb
OrlhJIr2iX0z4rX0kKKcX1h4rR+4VP4iHa/CP7h5uEqhd+Ap9UgFPuAHVevs+BxT
Mhrq1GJ7uXY2ywlW5YJUIOxSlPlZ8nthq5iSAzvI8HrEVn2c3FKnSsbPpnSn1H7D
IjiYISBbv0nJSne66Ew9scahQdaVmZa2B7d/w0zRpck58dTh2Hz/832+N2HiuLyX
oCZJ3WM7kIAe8p//1VMWndFR2bcTbTA0UCVu3KJKC6Jyyhbnk1AGNsi7kl+En9C+
u5nLucrdjfd1wH3WOkgdY3FU3Qs65mXC6OMvHRWyJdG+sdOGREqdYE2CFVURwfWH
t40gfqLRn3yy+ziDZifBcLgZ6gH13TYNw/YH74D/dxziKLbROK4YNczKnP2Y50r1
rWM8e+9fwgNKGVzew3Kj0zCJtRrsceV8AocAs/PGsKJGNATdnnkmYtlzyc2qexDW
1LIN9h1S7s7RG4QN/crBAoIBAQD35Bh6CrpfwXPrk+nLMnt/GDSyx3EihRHaDDqV
lw5woQlkWrIaMxGpGenXXoH82bk/juohriiaEMnJM2lxzr++WWAos/RNVG6P7bPc
DmfG2GT4Ta9aGiQs/LzcW2I3dfqUbUNYGIExY/r0XAY+i7LdpWZS5KHTd4O73zD1
QnejSVqRxOQrYeT8NHqOvjdtw+ccHA0VUKgBBlCdjcf+FHbyU91iAlp3fQSHlU8v
AYSvk7h4kEcsochG1CavqU63qbcGTQWRhmaC0SBUguH5A4BYVjkVWnae2YDGoWQS
+Yg2dnvQfSOGVJ5GV1EQ+5J2Vsfof/lsL9NJQEoTjoyiI5FhAoIBAQDOsA7lTVJ1
jMn+B0vYaf68hmx6HMjadrvg6ZkPgNk5Uja5Sv3uSTX5c/9PdDBbudUcoikuui1N
5JQnUK+0pMnOJcl2aAb1xmvoG7LlQiA9294hxvqZMzMzWKGGkUACy6H34iD2j9F0
621FcS2XCysZx6xioIGglKeBmAGlNebFVe5TqFXy2CSwdYarCZ1VGQKRYTHeIj6J
oOMENNB6ZJ5fX7aY01FZT1GSWmdnL9iwimSNNAhjQLO+YFhmoKaQQ7l1toFRBkH5
dKmSja0n6kOzzTA64jzuVPbAPROWChj9LFb5H4M9BH702JSBZ2nichtSbnLOqfOs
JnQekpQSn1LvAoIBAQDf9ZoPmOWtYZAjhG0zghaFSw9BfmM+ds8cGvRK9kC7jSJ5
Il/Kv9zy1FCqnd3+3Y46WBo796cDGqvUNbjMc6hUh1cTLxJHU0LYkj9vTyx/QD5o
/3avhvKsGmNfCsj/pn2P3+96Bhmiz9uJLiMOGxSsn6SEu79g2JeSAyGuVDDWu40y
KZqjfzxsh9U6ZayaZOXGRamkWkyPMG9hCRlo+oBEi3R1+f5V+gM/o6v4ofyIzINb
ma5UKo5RP5b8GZDe6lxLOwcO5Uh0ZBA7ikwyt/Ea3juQiTymY4eu7V0Gr59a5U0T
nhucX5Lnpje9iixW8iyGaCimj8bqZUUHykBQtKXBAoIBAFurlH+5IqiGUBR+EfKj
WFsvV691UtQqMzwW/07z++RDhYf7LdLg37KK8yK/Sq90JYQ0nAVgh7Vzew5Q6A07
xVHMSqVckDGz1qo0lsy93mTxPn1GrmECZ2QPnFx90aErxeOWhL42nVS5ElbpUqoa
RvyBJgD8ZWHebMi6rYgj9v1xFmo+UBiMKwGkrpzvf7t9gzkNnbuC/q+2DtoPvqN6
Ow/b+LWhjAQLfQdnV1NZ0kbCqsRB3rJ+wPnf63VhLV7w2rHNx18zYlGMn6Ujdzgr
2+lESW7kZtfiESrELAqw4dJwNwb5JhELDG/2Gy+luT25FEskN4FXuX6R85CXvFri
FTsCggEAc6+QIK08PokuEahwloqHq4lg/0tCLAJ5lQTAvIeZaVvEFb0ZfFXP10EB
uK18j3re6+L/in0VHmmFLabieCoMDjoQZRgiyUcViK+dDw4/Fi2fJMUyb5PMivt6
DQMqiZTneAh64efz0x298hmaxjlbRedvXrUX1lKceq9JieyDxExyryW+ec045KxD
j+OYtLb2Q+EnCaw5TcvI7+pZLIHVbvQihr/dESbMysim43/E/C5D3Hlf0xpG5f1r
D57kjAEuRNjEjO4+bekLds1jHKWGJV3HLmilJLzMXL6XlERiNywhbRj+NwKc+m6I
x9XWsNIBcfQ7w+HKrnw9p0tl8RpCgQ==
-----END PRIVATE KEY-----

Просмотреть файл

@ -0,0 +1,38 @@
{
"count": 765438,
"results": [
{
"id": "123",
"title": "Something bad happened",
"status": 1,
"machine": "yossi-pc",
"host": {
"id": "yossi_comp",
"name": "Yossi's comp",
"domain": "HEXADITE"
}
},
{
"id": "234",
"title": "A process rewrote Windows!",
"status": 2,
"machine": "yossi-pc",
"host": {
"id": "yossi_comp",
"name": "Yossi's comp",
"domain": "HEXADITE"
}
},
{
"id": "345",
"title": "A process did something. You won't believe what happened next!",
"status": 1,
"machine": "test-lab",
"host": {
"id": "yossi_comp",
"name": "Yossi's comp",
"domain": "HEXADITE"
}
}
]
}

Просмотреть файл

@ -0,0 +1,11 @@
{
"id": "123",
"title": "Something bad happened",
"status": 1,
"machine": "yossi-pc",
"host": {
"id": "yossi_comp",
"name": "Yossi's comp",
"domain": "HEXADITE"
}
}

Просмотреть файл

@ -0,0 +1,19 @@
{
"results": [
{
"id": 1,
"name": "Open",
"category": "primary"
},
{
"id": 2,
"name": "Investigated",
"category": "success"
},
{
"id": 3,
"name": "Failed",
"category": "error"
}
]
}

Просмотреть файл

@ -0,0 +1,16 @@
{
"data": [
{
"count": 9,
"value": "Max-PC"
},
{
"count": 4,
"value": "NAS"
},
{
"count": 2,
"value": "Skynet"
}
]
}

Просмотреть файл

@ -0,0 +1,41 @@
{
"count": 1,
"next": null,
"previous": null,
"results": [
{
"id": 397,
"host_ip": null,
"host_name": "WIN7-X64-1.auto.lab",
"group": "auto.lab",
"investigation_id": 19,
"approval_status": 1,
"execution_status": 130,
"name": "Wait for Host Resource",
"category": "Network",
"created": 1465211571519,
"status": 5,
"details": "Waits for host (auto.lab)WIN7-X64-1@None resource.",
"comment_count": 0,
"duration": 0,
"pending_duration": 0.0
},
{
"id": 39732,
"host_ip": null,
"host_name": "WIN7-X64-2",
"group": "auto.lab",
"investigation_id": 19,
"approval_status": 1,
"execution_status": 130,
"name": "Wait for Host Resource",
"category": "Network",
"created": 1465211571519,
"status": 5,
"details": "Waits for host (auto.sdfdsfddslab)WIN7-X64-1@None resource.",
"comment_count": 0,
"duration": 331,
"pending_duration": 0.0
}
]
}

Просмотреть файл

@ -0,0 +1,372 @@
{
"count": 127,
"next": "https://172.16.2.201/api/investigation/all?ordering=-start_date&page=2&page_size=15&start_date=week",
"previous": null,
"results": [
{
"id": 17,
"names": [
"User Initiated - Endpoint Investigation"
],
"start_date": "2017-02-13T09:46:02.284385Z",
"end_date": null,
"affected_hosts": [
"WIN10-X86.auto.lab",
"YOSSI-PC.domains.lab",
"Asdfdsfdsfdsfsdfsdf.auto.lab",
"sdfsdf0-=23232323r3243.auto.lab",
"234823fdsfdsdsfsd.auto.lab",
"aSDFDSFSDFSDF__asdfdsfsd.auto.lab"
],
"affected_groups": [
"New Group"
],
"affected_users": [
"AUTO\\bingo",
"AUTO\\max-admin"
],
"total_actions": 7,
"remediation_actions": [],
"failed_actions": [],
"last_action": {
"details": "List all drivers installed on (New Group)WIN10-X86@2.0.0.8.",
"is_remediation": false,
"id": 433,
"name": "Get Driver List"
},
"important": true,
"detection_system": 66,
"error_description": "",
"status": 0,
"user": "",
"comments": 0,
"threat_types": [],
"running_time": 43.462507,
"host_groups": [
"New Group"
],
"requested_status": null,
"reasons": null,
"created_by": [
"administrator"
],
"is_cleanup_applied": false
},
{
"id": 16,
"names": [
"User Initiated - Suspicious User Logon"
],
"start_date": "2017-02-13T09:23:52.902470Z",
"end_date": null,
"affected_hosts": [],
"affected_groups": [],
"affected_users": [],
"total_actions": 2,
"remediation_actions": [],
"failed_actions": [],
"last_action": {
"details": "Ask for approval to start investigations on [(u'Win10-x86.Auto.Lab', '2.0.0.8'), (u'win8-x86.Auto.Lab', '2.0.0.14'), (u'win81-x64.Auto.Lab', '2.0.0.3'), (u'win10-x64.Auto.Lab', '2.0.0.12')]",
"is_remediation": false,
"id": 426,
"name": "Start investigation on multiple endpoints"
},
"important": false,
"detection_system": 44,
"error_description": "",
"status": 2,
"user": "",
"comments": 0,
"threat_types": [],
"running_time": 1372.94382,
"host_groups": [],
"requested_status": null,
"reasons": null,
"created_by": [
"administrator"
],
"is_cleanup_applied": false
},
{
"id": 18,
"names": [
"User Initiated - Endpoint Investigation"
],
"start_date": "2017-04-12T08:24:00.243260Z",
"end_date": null,
"affected_hosts": [
"YOSSI-TEST.domains.lab"
],
"affected_groups": [
null
],
"affected_users": [],
"total_actions": 2,
"remediation_actions": [],
"failed_actions": [],
"last_action": {
"details": "Check if is covered YOSSI-TEST.aaa",
"is_remediation": false,
"id": 871,
"name": "Check Endpoint Coverage"
},
"important": false,
"detection_system": 14,
"error_description": "(None)YOSSI-TEST@None is not found in Active Directory,Endpoint YOSSI-TEST NOT found in DNS",
"status": 2,
"user": "",
"number_of_comments": 0,
"threat_types": null,
"running_time": 871.02117,
"host_groups": [
null
],
"requested_status": null,
"external_sources": [
13
],
"reasons": [
"Endpoint does not exist in the Active Directory"
],
"created_by": [
"administrator"
],
"tags": [],
"is_cleanup_applied": false
},
{
"id": 15,
"names": [
"User Initiated - Endpoint Investigation"
],
"start_date": "2017-02-13T09:22:23.215976Z",
"end_date": "2017-02-13T09:22:35.396399Z",
"affected_hosts": [
"BINGO.domains.lab"
],
"affected_groups": [
null
],
"affected_users": [],
"total_actions": 2,
"remediation_actions": [],
"failed_actions": [],
"last_action": {
"details": "Check if bingo is covered.",
"is_remediation": false,
"id": 424,
"name": "Check Endpoint Coverage"
},
"important": false,
"detection_system": 44,
"error_description": "",
"status": 4,
"user": "administrator",
"comments": 1,
"threat_types": [],
"running_time": 12.180423,
"host_groups": [
null
],
"requested_status": 4,
"reasons": [
"The investigation is malfunctioning"
],
"created_by": [
"administrator"
],
"is_cleanup_applied": false
},
{
"id": 14,
"names": [
"Bay Dynamics Suspicious User Critical"
],
"start_date": "2017-02-12T07:06:24.868210Z",
"end_date": "2017-02-12T07:11:27.054782Z",
"affected_hosts": [],
"affected_groups": [],
"affected_users": [],
"total_actions": 1,
"remediation_actions": [],
"failed_actions": [],
"last_action": {
"details": "Ask for approval for DLP investigation for user [u'lateral']",
"is_remediation": false,
"id": 422,
"name": "Initiate DLP Investigation"
},
"important": false,
"detection_system": 65,
"error_description": "External Source product Limit User Privileges is not defined,Missing service source Limit User Privileges, can not run the DLP investigation",
"status": 1,
"user": "",
"comments": 1,
"threat_types": [],
"running_time": 302.186572,
"host_groups": [],
"requested_status": null,
"reasons": [
"External source is not defined",
"Pending action exceeded timeout"
],
"created_by": [
null
],
"is_cleanup_applied": false
},
{
"id": 9,
"names": [
"User Initiated - Endpoint Investigation"
],
"start_date": "2017-02-09T09:27:54.326390Z",
"end_date": "2017-02-09T09:48:31.120821Z",
"affected_hosts": [
"WIN7-ULT-X86.domains.lab"
],
"affected_groups": [
"New Group"
],
"affected_users": [
"AUTO\\bingo",
"AUTO\\lateral"
],
"total_actions": 29,
"remediation_actions": [
{
"details": "Quarantine \"c:\\users\\bingo\\desktop\\trojan.exe\".",
"id": 275,
"name": "Quarantine a File"
}
],
"failed_actions": [],
"last_action": {
"details": "Waits for (New Group)WIN7-ULT-X86@2.0.0.22 resource.",
"is_remediation": false,
"id": 276,
"name": "Wait for Endpoint Resource"
},
"important": false,
"detection_system": 44,
"error_description": "Error reaching network endpoint (New Group)WIN7-ULT-X86@2.0.0.22 ,[Errno Connection error (2.0.0.22:445)] [Errno 113] No route to host",
"status": 3,
"user": "",
"comments": 1,
"threat_types": [
0
],
"running_time": 1236.794431,
"host_groups": [
"New Group"
],
"requested_status": null,
"reasons": [
"Pending action exceeded timeout",
"Endpoint is not reachable"
],
"created_by": [
"administrator"
],
"is_cleanup_applied": false
},
{
"id": 3,
"names": [
"User Initiated - Endpoint Investigation"
],
"start_date": "2017-02-08T14:27:18.300693Z",
"end_date": "2017-02-08T14:33:42.445535Z",
"affected_hosts": [
"WIN7-ULT-X86.domains.lab"
],
"affected_groups": [
"New Group"
],
"affected_users": [
"AUTO\\bingo",
"AUTO\\lateral"
],
"total_actions": 115,
"remediation_actions": [
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\exploit.exe\".",
"id": 157,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\rootkit.exe\".",
"id": 155,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\hoax.exe\".",
"id": 114,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\adware.exe\".",
"id": 113,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\יוניקוד.exe\".",
"id": 108,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\trojan.exe\".",
"id": 100,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\new_mal.exe\".",
"id": 104,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\heuristic.exe\".",
"id": 103,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\generic.exe\".",
"id": 110,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\worm.exe\".",
"id": 106,
"name": "Quarantine a File"
}
],
"failed_actions": [],
"last_action": {
"details": "Wait on a complete report for 6d192dc5e1a3c539b1f302fb9f896ffdb688be3e.",
"is_remediation": false,
"id": 159,
"name": "Wait for Cloud Analysis Report"
},
"important": false,
"detection_system": 44,
"error_description": "",
"status": 6,
"user": "",
"comments": 10,
"threat_types": [
0,
1
],
"running_time": 384.144842,
"host_groups": [
"New Group"
],
"requested_status": null,
"reasons": null,
"created_by": [
"administrator"
],
"is_cleanup_applied": false
}
]
}

Просмотреть файл

@ -0,0 +1,372 @@
{
"count": 127,
"next": "https://172.16.2.201/api/investigation/all?ordering=-start_date&page=2&page_size=15&start_date=week",
"previous": null,
"results": [
{
"id": 17,
"names": [
"User Initiated - Endpoint Investigation"
],
"start_date": "2017-02-13T09:46:02.284385Z",
"end_date": null,
"affected_hosts": [
"WIN10-X86.auto.lab",
"YOSSI-PC.domains.lab",
"Asdfdsfdsfdsfsdfsdf.auto.lab",
"sdfsdf0-=23232323r3243.auto.lab",
"234823fdsfdsdsfsd.auto.lab",
"aSDFDSFSDFSDF__asdfdsfsd.auto.lab"
],
"affected_groups": [
"New Group"
],
"affected_users": [
"AUTO\\bingo",
"AUTO\\max-admin"
],
"total_actions": 7,
"remediation_actions": [],
"failed_actions": [],
"last_action": {
"details": "List all drivers installed on (New Group)WIN10-X86@2.0.0.8.",
"is_remediation": false,
"id": 433,
"name": "Get Driver List"
},
"important": true,
"detection_system": 66,
"error_description": "",
"status": 0,
"user": "",
"comments": 0,
"threat_types": [],
"running_time": 43.462507,
"host_groups": [
"New Group"
],
"requested_status": null,
"reasons": null,
"created_by": [
"administrator"
],
"is_cleanup_applied": false
},
{
"id": 16,
"names": [
"User Initiated - Suspicious User Logon"
],
"start_date": "2017-02-13T09:23:52.902470Z",
"end_date": null,
"affected_hosts": [],
"affected_groups": [],
"affected_users": [],
"total_actions": 2,
"remediation_actions": [],
"failed_actions": [],
"last_action": {
"details": "Ask for approval to start investigations on [(u'Win10-x86.Auto.Lab', '2.0.0.8'), (u'win8-x86.Auto.Lab', '2.0.0.14'), (u'win81-x64.Auto.Lab', '2.0.0.3'), (u'win10-x64.Auto.Lab', '2.0.0.12')]",
"is_remediation": false,
"id": 426,
"name": "Start investigation on multiple endpoints"
},
"important": false,
"detection_system": 44,
"error_description": "",
"status": 2,
"user": "",
"comments": 0,
"threat_types": [],
"running_time": 1372.94382,
"host_groups": [],
"requested_status": null,
"reasons": null,
"created_by": [
"administrator"
],
"is_cleanup_applied": false
},
{
"id": 18,
"names": [
"User Initiated - Endpoint Investigation"
],
"start_date": "2017-04-12T08:24:00.243260Z",
"end_date": null,
"affected_hosts": [
"YOSSI-TEST.domains.lab"
],
"affected_groups": [
null
],
"affected_users": [],
"total_actions": 2,
"remediation_actions": [],
"failed_actions": [],
"last_action": {
"details": "Check if is covered YOSSI-TEST.aaa",
"is_remediation": false,
"id": 871,
"name": "Check Endpoint Coverage"
},
"important": false,
"detection_system": 14,
"error_description": "(None)YOSSI-TEST@None is not found in Active Directory,Endpoint YOSSI-TEST NOT found in DNS",
"status": 2,
"user": "",
"number_of_comments": 0,
"threat_types": null,
"running_time": 871.02117,
"host_groups": [
null
],
"requested_status": null,
"external_sources": [
13
],
"reasons": [
"Endpoint does not exist in the Active Directory"
],
"created_by": [
"administrator"
],
"tags": [],
"is_cleanup_applied": false
},
{
"id": 15,
"names": [
"User Initiated - Endpoint Investigation"
],
"start_date": "2017-02-13T09:22:23.215976Z",
"end_date": "2017-02-13T09:22:35.396399Z",
"affected_hosts": [
"BINGO.domains.lab"
],
"affected_groups": [
null
],
"affected_users": [],
"total_actions": 2,
"remediation_actions": [],
"failed_actions": [],
"last_action": {
"details": "Check if bingo is covered.",
"is_remediation": false,
"id": 424,
"name": "Check Endpoint Coverage"
},
"important": false,
"detection_system": 44,
"error_description": "",
"status": 4,
"user": "administrator",
"comments": 1,
"threat_types": [],
"running_time": 12.180423,
"host_groups": [
null
],
"requested_status": 4,
"reasons": [
"The investigation is malfunctioning"
],
"created_by": [
"administrator"
],
"is_cleanup_applied": false
},
{
"id": 14,
"names": [
"Bay Dynamics Suspicious User Critical"
],
"start_date": "2017-02-12T07:06:24.868210Z",
"end_date": "2017-02-12T07:11:27.054782Z",
"affected_hosts": [],
"affected_groups": [],
"affected_users": [],
"total_actions": 1,
"remediation_actions": [],
"failed_actions": [],
"last_action": {
"details": "Ask for approval for DLP investigation for user [u'lateral']",
"is_remediation": false,
"id": 422,
"name": "Initiate DLP Investigation"
},
"important": false,
"detection_system": 65,
"error_description": "External Source product Limit User Privileges is not defined,Missing service source Limit User Privileges, can not run the DLP investigation",
"status": 1,
"user": "",
"comments": 1,
"threat_types": [],
"running_time": 302.186572,
"host_groups": [],
"requested_status": null,
"reasons": [
"External source is not defined",
"Pending action exceeded timeout"
],
"created_by": [
null
],
"is_cleanup_applied": false
},
{
"id": 9,
"names": [
"User Initiated - Endpoint Investigation"
],
"start_date": "2017-02-09T09:27:54.326390Z",
"end_date": "2017-02-09T09:48:31.120821Z",
"affected_hosts": [
"WIN7-ULT-X86.domains.lab"
],
"affected_groups": [
"New Group"
],
"affected_users": [
"AUTO\\bingo",
"AUTO\\lateral"
],
"total_actions": 29,
"remediation_actions": [
{
"details": "Quarantine \"c:\\users\\bingo\\desktop\\trojan.exe\".",
"id": 275,
"name": "Quarantine a File"
}
],
"failed_actions": [],
"last_action": {
"details": "Waits for (New Group)WIN7-ULT-X86@2.0.0.22 resource.",
"is_remediation": false,
"id": 276,
"name": "Wait for Endpoint Resource"
},
"important": false,
"detection_system": 44,
"error_description": "Error reaching network endpoint (New Group)WIN7-ULT-X86@2.0.0.22 ,[Errno Connection error (2.0.0.22:445)] [Errno 113] No route to host",
"status": 3,
"user": "",
"comments": 1,
"threat_types": [
0
],
"running_time": 1236.794431,
"host_groups": [
"New Group"
],
"requested_status": null,
"reasons": [
"Pending action exceeded timeout",
"Endpoint is not reachable"
],
"created_by": [
"administrator"
],
"is_cleanup_applied": false
},
{
"id": 3,
"names": [
"User Initiated - Endpoint Investigation"
],
"start_date": "2017-02-08T14:27:18.300693Z",
"end_date": "2017-02-08T14:33:42.445535Z",
"affected_hosts": [
"WIN7-ULT-X86.domains.lab"
],
"affected_groups": [
"New Group"
],
"affected_users": [
"AUTO\\bingo",
"AUTO\\lateral"
],
"total_actions": 115,
"remediation_actions": [
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\exploit.exe\".",
"id": 157,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\rootkit.exe\".",
"id": 155,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\hoax.exe\".",
"id": 114,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\adware.exe\".",
"id": 113,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\יוניקוד.exe\".",
"id": 108,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\trojan.exe\".",
"id": 100,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\new_mal.exe\".",
"id": 104,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\heuristic.exe\".",
"id": 103,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\generic.exe\".",
"id": 110,
"name": "Quarantine a File"
},
{
"details": "Quarantine \"c:\\users\\bingo\\downloads\\malwares\\malwares\\worm.exe\".",
"id": 106,
"name": "Quarantine a File"
}
],
"failed_actions": [],
"last_action": {
"details": "Wait on a complete report for 6d192dc5e1a3c539b1f302fb9f896ffdb688be3e.",
"is_remediation": false,
"id": 159,
"name": "Wait for Cloud Analysis Report"
},
"important": false,
"detection_system": 44,
"error_description": "",
"status": 6,
"user": "",
"comments": 10,
"threat_types": [
0,
1
],
"running_time": 384.144842,
"host_groups": [
"New Group"
],
"requested_status": null,
"reasons": null,
"created_by": [
"administrator"
],
"is_cleanup_applied": false
}
]
}

Просмотреть файл

@ -0,0 +1,7 @@
{
"count": 3,
"last_investigation": {
"description": "Suspicios Connection",
"id": 123
}
}

Просмотреть файл

@ -0,0 +1,142 @@
{
"id": 77827,
"name": "heuristic.exe",
"host": "WIN7_X64_1.auto.lab",
"entity_status": 0,
"mime_type": "application/x-msdownload",
"size": 118272,
"md5": "75bf743733d2b4c58e847a2ca7caad88",
"sha1": "06804407dfb97b8396f92dd3198d2badcc0c6440",
"created_time": "2016-11-14T15:58:05Z",
"directory_path": "c:\\users\\administrator\\downloads\\malwares",
"report": {
"status": 1,
"providers": [
{
"status": "infected",
"source": "HexaAV Cloud",
"private_id": 75675,
"detected_by": "Ahnlab, ESET, VirusBlokAda, Zillya!, F-prot, BitDefender, Agnitum, McAfee, Avira, ThreatTrack, Ikarus, K7, AVG"
},
{
"status": "infected",
"source": "te.checkpoint.com",
"summary": [
"Malware detected ( Gen:Variant.Zusy.190302 )",
"Behaves like a known malware ( Generic.MALWARE.6e69 )"
]
},
{
"status": "infected",
"source": "wildfire.paloaltonetworks.com",
"summary": [
"Connected to a malicious IP",
"Created an executable file in the Windows system folder",
"Contains malicious file attributes",
"Injected code into another process",
"Modified the network hosts file",
"Created or modified a file",
"Modified Internet Explorer security settings",
"Contains an invalid checksum",
"Modified proxy settings for Internet Explorer",
"Modified the Windows Registry to enable auto-start",
"Contains sections with size discrepancies",
"Attempted to sleep for a long period",
"Copied itself",
"Created an executable file in the Windows folder",
"Started a process",
"Modified the Windows Registry",
"Modified connections settings for Internet Explorer",
"Enumerated running processes",
"Created or modified a file in the Windows system folder"
]
},
{
"status": "infected",
"source": "www.metascan-online.com",
"link": "https://www.metascan-online.com/scanresult/hash/06804407DFB97B8396F92DD3198D2BADCC0C6440",
"detected_by": "F-prot, Antiy, McAfee, Baidu, VirusBlokAda, Zillya!, ClamAV, BitDefender, Agnitum, F-secure, VirIT, CYREN, Jiangmin, Avira, ThreatTrack, Fortinet, Microsoft, Ahnlab, ESET, NANO, Lavasoft, Filseclab, Ikarus, K7, AVG",
"categories": "heuristic"
},
{
"status": "infected",
"source": "www.virustotal.com",
"link": "https://www.virustotal.com/file/47247c3a133f49434f795c94adb95ebc2356de885d6e90f22f46932b2a76832d/analysis/1463325035/",
"detected_by": "Bkav, MicroWorld-eScan, Malwarebytes, Zillya, K7AntiVirus, K7GW, TheHacker, F-Prot, ESET-NOD32, Avast, ClamAV, GData, Kaspersky, BitDefender, NANO-Antivirus, Ad-Aware, Emsisoft, F-Secure, VIPRE, Cyren, Jiangmin, Antiy-AVL, Arcabit, Microsoft, AhnLab-V3, ALYac, AVware, VBA32, Panda, Rising, Yandex, Ikarus, Fortinet, AVG, Qihoo-360",
"categories": "heuristic"
}
]
},
"modified_time": "2016-04-21T09:42:48Z",
"relations": [
{
"count": 1,
"relation_types": [
{
"count": 1,
"entities": [
{
"remediation_actions": null,
"entity_status": 5,
"id": 77896,
"name": "heuristic.exe.1.quarantined.zip"
}
],
"relation_name": "Quarantine",
"entity_type": 1
}
],
"entity_type": 1
}
],
"sha256": "47247c3a133f49434f795c94adb95ebc2356de885d6e90f22f46932b2a76832d",
"digital_signature": null,
"behavior": {
"files": {
"deleted": [],
"modified": [],
"created": [
"C:\\47247c3a133f49434f795c94adb95ebc2356de885d6e90f22f46932b2a76832d",
"C:\\WINDOWS\\system32\\najort5g.exe",
"C:\\WINDOWS\\najort5g.exe"
]
},
"services": {
"deleted": [],
"modified": [],
"created": []
},
"registry": {
"deleted": [],
"modified": [],
"created": []
},
"network": {
"http": [],
"tcp": [],
"dns": []
}
},
"is_compressed": false,
"is_packed": false,
"is_read_only": false,
"is_downloaded": false,
"is_hidden": false,
"investigation": {
"investigation_id": 43,
"title": "User Initiated - Endpoint Investigation"
},
"path": "c:\\users\\administrator\\downloads\\malwares\\heuristic.exe",
"host_os": "Windows 7 Enterprise",
"host_group": "New Group",
"remediation_actions": null,
"product_vendor": "",
"status_details": null,
"action": {
"status": "approved",
"type": "user",
"user": "administrator",
"action_type": 0
},
"acl_rule": null
}

Просмотреть файл

@ -0,0 +1,44 @@
{
"name": {
"count": 1236,
"values": [
{
"count": 2,
"value": "compatprovider.dll"
},
{
"count": 2,
"value": "api-ms-win-core-errorhandling-l1-1-0.dll"
},
{
"count": 2,
"value": "compatprovider.dll.mui"
},
{
"count": 2,
"value": "api-ms-win-core-privateprofile-l1-1-0.dll"
},
{
"count": 2,
"value": "api-ms-win-core-rtlsupport-l1-1-0.dll"
}
]
},
"entity_status": {
"count": 3,
"values": [
{
"count": 1374,
"value": 3
},
{
"count": 7,
"value": 4
},
{
"count": 2,
"value": 0
}
]
}
}

Просмотреть файл

@ -0,0 +1,16 @@
{
"data": [
{
"count": 8,
"value": "conhost.exe"
},
{
"count": 3,
"value": "cmd.exe"
},
{
"count": 2,
"value": "csrss.exe"
}
]
}

Просмотреть файл

@ -0,0 +1,25 @@
{
"remediated": [
{
"entities": [
{
"host": "WIN7-X86-JAKE.auto.lab",
"errors": [],
"name": "$r6bq1c4.exe | c:\\$recycle.bin\\s-1-5-21-1697185450-2076875350-1481720747-500\\$r6bq1c4.exe",
"action_type": 0,
"threat_type": "Heuristic",
"id": 182329
},
{
"host": "WIN7-X86-JAKE.auto.lab",
"errors": [],
"name": "minimalware.exe | c:\\users\\bingo\\desktop\\minimalware.exe",
"action_type": 0,
"threat_type": "Trojan",
"id": 182324
}
],
"entity_type": 1
}
]
}

Просмотреть файл

@ -0,0 +1,77 @@
{
"count": 52,
"next": "http://172.110.0.200:8080/api/investigations/5/entities?page=2&type_id=2",
"previous": null,
"results": [
{
"name": "lsm.exe",
"pid": 532,
"entity_status": 1,
"host": "WIN7-ULT-X86.auto.lab",
"id": 5960
},
{
"name": "cmd.exe",
"pid": 3716,
"entity_status": 1,
"host": "WIN7-ULT-X86.auto.lab",
"id": 5930
},
{
"name": "dwm.exe",
"pid": 3412,
"entity_status": 1,
"host": "WIN7-ULT-X86.auto.lab",
"id": 5914
},
{
"name": "cmd.exe",
"pid": 3708,
"entity_status": 1,
"host": "WIN7-ULT-X86.auto.lab",
"id": 5909
},
{
"name": "conhost.exe",
"pid": 1488,
"entity_status": 1,
"host": "WIN7-ULT-X86.auto.lab",
"id": 5897
},
{
"name": "winlogon.exe",
"pid": 464,
"entity_status": 1,
"host": "WIN7-ULT-X86.auto.lab",
"id": 5893
},
{
"name": "MiniMalware3.exe",
"pid": 2012,
"entity_status": 4,
"host": "WIN7-ULT-X86.auto.lab",
"id": 5888
},
{
"name": "taskhost.exe",
"pid": 2692,
"entity_status": 1,
"host": "WIN7-ULT-X86.auto.lab",
"id": 5864
},
{
"name": "MiniMalware2.exe",
"pid": 2852,
"entity_status": 1,
"host": "WIN7-ULT-X86.auto.lab",
"id": 5859
},
{
"name": "iexplore.exe",
"pid": 1136,
"entity_status": 1,
"host": "WIN7-ULT-X86.auto.lab",
"id": 5812
}
]
}

Просмотреть файл

@ -0,0 +1,16 @@
{
"group": "HR",
"id": 40,
"ip": "192.168.2.121",
"logged_in_users": [
"Administrator"
],
"name": "Computer_2_121",
"os": {
"architecture": "64 Bit",
"name": "Windows Server 2008 R2",
"service_pack": null
},
"protection_level_type": 2,
"protection_level_name": "Semi Psychedelic"
}

Просмотреть файл

@ -0,0 +1,16 @@
{
"data": [
{
"count": 9,
"value": "Max-PC"
},
{
"count": 4,
"value": "NAS"
},
{
"count": 2,
"value": "Skynet"
}
]
}

Просмотреть файл

@ -0,0 +1,187 @@
{
"group": {
"count": 3,
"values": [
{
"count": 895,
"value": "Enterprise"
},
{
"count": 452,
"value": "Italy"
},
{
"count": 2,
"value": null
}
]
},
"name": {
"count": 1349,
"values": [
{
"count": 1,
"value": "WIN7_X64_1.auto.lab"
},
{
"count": 1,
"value": "WIN7_X64_12.auto.lab"
},
{
"count": 1,
"value": "WIN7_X64_1111"
},
{
"count": 1,
"value": "D0398"
},
{
"count": 1,
"value": "D0366"
}
]
},
"investigation_id": {
"count": 1331,
"values": [
{
"count": 10,
"value": 21411
},
{
"count": 5,
"value": 21643
},
{
"count": 3,
"value": 19814
},
{
"count": 2,
"value": 21251
},
{
"count": 2,
"value": 20969
}
]
},
"ip": {
"count": 994,
"values": [
{
"count": 298,
"value": null
},
{
"count": 3,
"value": "172.22.71.22"
},
{
"count": 2,
"value": "10.0.111.2"
},
{
"count": 2,
"value": "10.0.111.5"
},
{
"count": 2,
"value": "10.113.75.94"
}
]
},
"is_unprotected": {
"count": 1,
"values": [
{
"count": 1349,
"value": false
}
]
},
"protection_level_type": {
"count": 3,
"values": [
{
"count": 1347,
"value": 1
},
{
"count": 1,
"value": 0
},
{
"count": 1,
"value": 4
}
]
},
"protection_level_name": {
"count": 3,
"values": [
{
"count": 1347,
"value": "Semi Automated - Require Approval"
},
{
"count": 1,
"value": "Not Found"
},
{
"count": 1,
"value": "Not Protected"
}
]
},
"os": {
"count": 15,
"values": [
{
"count": 664,
"value": "Windows 7 Enterprise"
},
{
"count": 432,
"value": "Windows 7 Professional"
},
{
"count": 125,
"value": "Windows 10 Enterprise"
},
{
"count": 43,
"value": "Windows XP Professional"
},
{
"count": 34,
"value": "Windows 8.1 Enterprise"
}
]
},
"id": {
"count": 1349,
"values": [
{
"count": 1,
"value": 8734
},
{
"count": 1,
"value": 8988
},
{
"count": 1,
"value": 9047
},
{
"count": 1,
"value": 9272
},
{
"count": 1,
"value": 8691
}
]
}
}

Просмотреть файл

@ -0,0 +1,59 @@
{
"count": 5,
"next": null,
"previous": null,
"results": [
{
"id": 59,
"name": "WIN7-ULT-X86.auto.lab",
"ip": null,
"group": 39,
"investigation": 17,
"os": {
"id": 8,
"name": "Windows 7 Ultimate",
"version": "6.1",
"service_pack": "Service Pack 1",
"architecture": null,
"family": 0
},
"protection_level_name": "Semi Automated - Require Approval",
"protection_level_type": 1,
"is_unmanaged": true,
"logged_in_users": ["yossi"],
"last_seen": null,
"status": 4,
"last_investigated": "2017-01-23T12:38:39.598Z",
"investigation_count": 2,
"ou": "CN=WIN7-ULT-X86,OU=Hexadite-PC,DC=Auto,DC=Lab",
"is_unprotected": false,
"allow_cancel": true
},
{
"id": 222,
"name": "BINGO.auto.lab",
"ip": null,
"group": 39,
"investigation": 17,
"os": {
"id": 8,
"name": "Windows 7 Ultimate",
"version": "6.1",
"service_pack": "Service Pack 1",
"architecture": null,
"family": 0
},
"protection_level_name": "Semi Automated - Require Approval",
"protection_level_type": 1,
"is_unmanaged": false,
"logged_in_users": ["yossi"],
"last_seen": null,
"status": 3,
"last_investigated": "2017-01-23T12:38:39.598Z",
"investigation_count": 2,
"ou": "CN=WIN7-ULT-X86,OU=Hexadite-PC,DC=Auto,DC=Lab",
"is_unprotected": false,
"allow_cancel": false
}
]
}

Просмотреть файл

@ -0,0 +1,242 @@
{
"status": {
"count": 7,
"values": [
{
"count": 211,
"value": 1
},
{
"count": 35,
"value": 4
},
{
"count": 9,
"value": 2
},
{
"count": 7,
"value": 5
},
{
"count": 6,
"value": 6
},
{
"count": 1,
"value": 0
},
{
"count": 1,
"value": 7
}
]
},
"tags": {
"count": 11,
"values": [
{
"count": 3,
"value": "important"
},
{
"count": 4,
"value": "not important"
},
{
"count": 4,
"value": "bla bla bla"
}
]
},
"reasons": {
"count": 19,
"values": [
{
"count": 19,
"value": "Endpoint does not exist in the Active Directory"
},
{
"count": 14,
"value": "Windows Defender ATP shouldn't analyze this endpoint"
},
{
"count": 14,
"value": "Endpoint is not covered by any Asset Group"
},
{
"count": 11,
"value": "Endpoint name does not match the resolved name"
},
{
"count": 11,
"value": "This is a duplicated Investigation"
}
]
},
"user": {
"count": 3,
"values": [
{
"count": 94,
"value": null
},
{
"count": 32,
"value": "administrator"
},
{
"count": 3,
"value": "max-admin"
}
]
},
"created_by": {
"count": 3,
"values": [
{
"count": 61,
"value": null
},
{
"count": 53,
"value": "administrator"
},
{
"count": 16,
"value": "max-admin"
}
]
},
"important": {
"count": 2,
"values": [
{
"count": 128,
"value": false
},
{
"count": 1,
"value": true
}
]
},
"hosts": {
"count": 20,
"values": [
{
"count": 51,
"value": null
},
{
"count": 27,
"value": "WIN7-X64-NO-SP.auto.lab"
},
{
"count": 18,
"value": "XP-X86-SP3"
},
{
"count": 8,
"value": "WIN8-X86"
},
{
"count": 7,
"value": "WIN7_X64_1.auto.lab"
}
]
},
"comments": {
"count": 2,
"values": [
{
"count": 86,
"value": false
},
{
"count": 43,
"value": true
}
]
},
"host_groups": {
"count": 3,
"values": [
{
"count": 75,
"value": null
},
{
"count": 31,
"value": "Unmanaged"
},
{
"count": 24,
"value": "auto.lab"
}
]
},
"detection_system": {
"count": 5,
"values": [
{
"count": 73,
"value": 66
}
]
},
"threat_types": {
"count": 6,
"values": [
{
"count": 124,
"value": null
},
{
"count": 3,
"value": 5
},
{
"count": 2,
"value": 10
},
{
"count": 1,
"value": 0
},
{
"count": 1,
"value": 6
},
{
"count": 1,
"value": 7
}
]
},
"names": {
"count": 8,
"values": [
{
"count": 1520,
"value": "User Initiated - Endpoint Investigation"
},
{
"count": 20,
"value": "Phishing Mail"
},
{
"count": 19,
"value": "Cloud Initiated - Changed File Analysis"
},
{
"count": 1620,
"value": "Hunter Scheduler - Endpoint Investigation"
},
{
"count": 9,
"value": "User Initiated - Suspicious User Logon"
}
]
}
}

Просмотреть файл

@ -0,0 +1,16 @@
{
"data": [
{
"count": 9,
"value": "Some value333"
},
{
"count": 4,
"value": "Some long value for your benefit"
},
{
"count": 2,
"value": "Chuck Norris"
}
]
}

Просмотреть файл

@ -0,0 +1,142 @@
{
"id": 2,
"start_date": "2017-01-31T16:40:42.075387Z",
"end_date": "2017-01-31T16:47:27.132345Z",
"status": 1,
"comments": 0,
"tags": null,
"actions": {
"remediated": 0,
"total": 105,
"running": 0,
"pending": 0
},
"hosts": [
{
"status": 2,
"is_unmanaged": false,
"ip": "2.0.0.6",
"reason": null,
"logged_in_users": [
"AUTO\\bingo"
],
"id": 8,
"group": 1,
"name": "WIN7_X64_1.auto.lab",
"protection_level_name": "Semi Automated - Require Approval",
"protection_level_type": 1,
"os": "Windows 7 Enterprise"
},
{
"status": 3,
"is_unmanaged": false,
"ip": "2.0.0.3",
"reason": null,
"logged_in_users": [
"AUTO\\bingo"
],
"id": 7,
"group": 1,
"name": "WIN81-X64",
"protection_level_name": "Semi Automated - Require Approval",
"protection_level_type": 1,
"os": "Windows 8.1 Enterprise"
},
{
"status": 1,
"is_unmanaged": false,
"ip": "2.0.0.14",
"reason": null,
"logged_in_users": [
"AUTO\\bingo"
],
"id": 6,
"group": 1,
"name": "WIN8-X86",
"protection_level_name": "Semi Automated - Require Approval",
"protection_level_type": 1,
"os": "Windows 8 Enterprise"
},
{
"status": 1,
"is_unmanaged": false,
"ip": "2.0.0.22",
"reason": null,
"logged_in_users": [
"AUTO\\bingo"
],
"id": 5,
"group": 1,
"name": "WIN7-ULT-X86.auto.lab",
"protection_level_name": "Semi Automated - Require Approval",
"protection_level_type": 1,
"os": "Windows 7 Ultimate"
}
],
"title": "User Initiated - Suspicious Email Address",
"requested_status": null,
"dismissed": false,
"important": false,
"user": null,
"external_sources": {
"mitigation_source": [],
"data_source": [
10,
47
]
},
"alert_count": 1,
"entity_count": 6901,
"attention_required": 0,
"running_time": 405.056958,
"pending_action_types": {
"data": [
{
"action": 13,
"count": 0
},
{
"action": 12,
"count": 0
},
{
"action": 8,
"count": 0
}
]
},
"threat_types": [],
"alert": {
"received_time": "2017-01-31T16:40:42.014Z",
"template_name": "User Initiated - Suspicious Email Address",
"variables": {
"email_addresses": [
"bingo@auto.lab"
]
},
"source": "internal_source:User Initiated",
"detection_system": 50,
"id": 2
},
"pending_since": null,
"alert_to_remediation_time": 0,
"errors": [],
"pending_actions": [
{
"waiting_time": 15.467473,
"entities": [],
"end_time": "2017-01-31T16:41:30.071Z",
"entity_name": null,
"action_type": 12,
"decision": "Approved",
"action_id": 104,
"user": "administrator",
"start_time": "2017-01-31T16:41:14.604Z",
"action_name": "Start investigation on multiple endpoints"
}
],
"reasons": null,
"pending_type": null,
"remediation_pending_time": 0,
"resource_pending_time": 15
}

Просмотреть файл

@ -0,0 +1,59 @@
{
"id": 123,
"start_date": 1434365326935,
"end_date": 1434369346935,
"status": 0,
"actions": {
"total": 123,
"remediated": 3,
"pendingTime": 1200
},
"detection": {
"detection_system_id": 1,
"timestamp": 1434365326935,
"alert": {
"alertId": 345793,
"entity": {
"type": 1,
"name": "c:\\1.txt"
},
"host": {
"id": 435,
"name": "BARAK-PC"
}
}
},
"external_sources": {
"data": [
{
"id": 1,
"data": "2 rules added to block ip 192.15.3.5 to 123.52.6.7 on any port"
}
],
"remediation": [
{
"id": 5,
"data": "I fixed it mommy!"
}
]
},
"entities": [
{
"id": 1,
"results": [
{ "count": 25, "result": "remediated" },
{ "count": 30, "result": "failed" },
{ "count": 45, "result": "benign" }
]
}
],
"hosts": {
"total": 120,
"groups": 4,
"results": {
"remediated": 3,
"failed": 6,
"benign": 10
}
}
}

Просмотреть файл

@ -0,0 +1,112 @@
{
"id": 14,
"start_date": "2017-02-12T07:06:24.868210Z",
"end_date": "2017-02-12T07:11:27.054782Z",
"status": 1,
"comments": 1,
"actions": {
"remediated": 0,
"total": 1,
"running": 0,
"pending": 0
},
"hosts": [],
"title": "Bay Dynamics Suspicious User Critical",
"requested_status": null,
"dismissed": false,
"important": false,
"user": null,
"external_sources": {
"mitigation_source": [3],
"data_source": []
},
"alert_count": 1,
"entity_count": 1,
"attention_required": 0,
"running_time": 302.186572,
"pending_action_types": {
"data": [
{
"action": 13,
"count": 0
},
{
"action": 12,
"count": 0
},
{
"action": 8,
"count": 0
}
]
},
"threat_types": [],
"alert": {
"AlertId": "636219966081943637_-467964911",
"WcdMachineId": null,
"SenseMachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
"MachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
"ComputerDnsName": "cont-jonathanw.contoso.org",
"Severity": 256,
"Status": 4,
"LastEventTime": "2017-04-17T16:37:47.8018798Z",
"FirstEventTime": "2017-04-17T13:12:20.2461196Z",
"FirstSeen": "2017-04-17T16:50:07.754788Z",
"Classification": 0,
"Determination": 0,
"DomainName": "CONTOSO",
"AccountName": "jonathan.wolcott",
"AccountSid": "S-1-5-21-2649156466-80624164-2033095608-1113",
"AssignedTo": "Analyst@WDATPContosoFld.onmicrosoft.com",
"Category": "PrivilegeEscalation",
"Title": "Process privilege escalation due to kernel exploit",
"ActorName": null,
"TiProvider": null,
"GroupId": null,
"GroupKey": null,
"MachineCount": 1,
"UserCount": 1,
"AssignedToCount": 1,
"AlertCount": 0,
"IoaDefinitionId": "6f36a53b-7229-471e-9c91-ea473a50b95d",
"InternalMachineId": 8,
"ContainedAlerts": null,
"IsSealedGroup": null,
"DetectionSource": 1,
"ThreatFamilyName": null,
"SuppressionRuleId": null
},
"pending_since": null,
"alert_to_remediation_time": 0,
"is_cleanup_applied": false,
"errors": [
29,
37
],
"pending_actions": [
{
"waiting_time": 302.054359,
"entities": [
{
"entity_id": 1,
"entity_type": 10
}
],
"end_time": "2017-02-12T07:11:26.981Z",
"entity_name": "lateral",
"action_type": 9,
"decision": "Timed out",
"action_id": 422,
"user": "administrator",
"start_time": "2017-02-12T07:06:24.926Z",
"action_name": "Initiate DLP Investigation"
}
],
"reasons": [
"External source is not defined",
"Pending action exceeded timeout"
],
"pending_type": null,
"remediation_pending_time": 0,
"resource_pending_time": 302
}

Просмотреть файл

@ -0,0 +1,307 @@
{
"id": 3,
"start_date": "2017-02-08T14:27:18.300693Z",
"end_date": "2017-02-08T14:33:42.445535Z",
"status": 6,
"comments": 10,
"actions": {
"remediated": 10,
"total": 115,
"running": 0,
"pending": 0
},
"hosts": [
{
"status": 2,
"is_unmanaged": false,
"ip": "2.0.0.22",
"reason": null,
"logged_in_users": [
"AUTO\\bingo",
"AUTO\\lateral"
],
"id": 3,
"group": 1,
"name": "WIN7-ULT-X86.auto.lab",
"protection_level_name": "Semi Automated - Require Approval",
"protection_level_type": 1,
"os": "Windows 7 Ultimate"
}
],
"title": "User Initiated - Endpoint Investigation",
"requested_status": null,
"dismissed": false,
"important": false,
"user": null,
"external_sources": {
"mitigation_source": [],
"data_source": [
3222
]
},
"alert_count": 2,
"entity_count": 1645,
"attention_required": 0,
"running_time": 384.144842,
"pending_action_types": {
"data": [
{
"action": 13,
"count": 0
},
{
"action": 12,
"count": 0
},
{
"action": 8,
"count": 0
}
]
},
"threat_types": [
{
"count": 1,
"threat_type": 0
},
{
"count": 1,
"threat_type": 1
},
{
"count": 1,
"threat_type": 3
},
{
"count": 1,
"threat_type": 5
},
{
"count": 4,
"threat_type": 6
},
{
"count": 1,
"threat_type": 7
},
{
"count": 1,
"threat_type": 9
}
],
"alert": {
"AlertId": "636219966081943637_-467964911",
"WcdMachineId": null,
"SenseMachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
"MachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
"ComputerDnsName": "cont-jonathanw.contoso.org",
"Severity": 256,
"Status": 4,
"LastEventTime": "2017-04-17T16:37:47.8018798Z",
"FirstEventTime": "2017-04-17T13:12:20.2461196Z",
"FirstSeen": "2017-04-17T16:50:07.754788Z",
"Classification": 0,
"Determination": 0,
"DomainName": "CONTOSO",
"AccountName": "jonathan.wolcott",
"AccountSid": "S-1-5-21-2649156466-80624164-2033095608-1113",
"AssignedTo": "Analyst@WDATPContosoFld.onmicrosoft.com",
"Category": "PrivilegeEscalation",
"Title": "Process privilege escalation due to kernel exploit",
"ActorName": null,
"TiProvider": null,
"GroupId": null,
"GroupKey": null,
"MachineCount": 1,
"UserCount": 1,
"AssignedToCount": 1,
"AlertCount": 0,
"IoaDefinitionId": "6f36a53b-7229-471e-9c91-ea473a50b95d",
"InternalMachineId": 8,
"ContainedAlerts": null,
"IsSealedGroup": null,
"DetectionSource": 1,
"ThreatFamilyName": null,
"SuppressionRuleId": null
},
"pending_since": null,
"alert_to_remediation_time": 211.247341,
"is_cleanup_applied": false,
"errors": [],
"pending_actions": [
{
"waiting_time": 48.320925,
"entities": [
{
"entity_id": 4504,
"entity_type": 1
}
],
"end_time": "2017-02-08T14:31:40.875Z",
"entity_name": "יוניקוד.exe",
"action_type": 0,
"decision": "Approved",
"action_id": 108,
"user": "administrator",
"start_time": "2017-02-08T14:30:52.554Z",
"action_name": "Quarantine a File"
},
{
"waiting_time": 47.359767,
"entities": [
{
"entity_id": 4534,
"entity_type": 1
}
],
"end_time": "2017-02-08T14:31:40.911Z",
"entity_name": "generic.exe",
"action_type": 0,
"decision": "Approved",
"action_id": 110,
"user": "administrator",
"start_time": "2017-02-08T14:30:53.551Z",
"action_name": "Quarantine a File"
},
{
"waiting_time": 46.176443,
"entities": [
{
"entity_id": 4528,
"entity_type": 1
}
],
"end_time": "2017-02-08T14:31:40.949Z",
"entity_name": "adware.exe",
"action_type": 0,
"decision": "Approved",
"action_id": 113,
"user": "administrator",
"start_time": "2017-02-08T14:30:54.773Z",
"action_name": "Quarantine a File"
},
{
"waiting_time": 51.168596,
"entities": [
{
"entity_id": 4529,
"entity_type": 1
}
],
"end_time": "2017-02-08T14:31:40.716Z",
"entity_name": "trojan.exe",
"action_type": 0,
"decision": "Approved",
"action_id": 100,
"user": "administrator",
"start_time": "2017-02-08T14:30:49.548Z",
"action_name": "Quarantine a File"
},
{
"waiting_time": 49.985677,
"entities": [
{
"entity_id": 4503,
"entity_type": 1
}
],
"end_time": "2017-02-08T14:31:40.765Z",
"entity_name": "heuristic.exe",
"action_type": 0,
"decision": "Approved",
"action_id": 103,
"user": "administrator",
"start_time": "2017-02-08T14:30:50.779Z",
"action_name": "Quarantine a File"
},
{
"waiting_time": 49.308228,
"entities": [
{
"entity_id": 4509,
"entity_type": 1
}
],
"end_time": "2017-02-08T14:31:40.842Z",
"entity_name": "worm.exe",
"action_type": 0,
"decision": "Approved",
"action_id": 106,
"user": "administrator",
"start_time": "2017-02-08T14:30:51.533Z",
"action_name": "Quarantine a File"
},
{
"waiting_time": 49.921516,
"entities": [
{
"entity_id": 4536,
"entity_type": 1
}
],
"end_time": "2017-02-08T14:31:40.801Z",
"entity_name": "new_mal.exe",
"action_type": 0,
"decision": "Approved",
"action_id": 104,
"user": "administrator",
"start_time": "2017-02-08T14:30:50.879Z",
"action_name": "Quarantine a File"
},
{
"waiting_time": 46.120698,
"entities": [
{
"entity_id": 4537,
"entity_type": 1
}
],
"end_time": "2017-02-08T14:31:40.989Z",
"entity_name": "hoax.exe",
"action_type": 0,
"decision": "Approved",
"action_id": 114,
"user": "administrator",
"start_time": "2017-02-08T14:30:54.868Z",
"action_name": "Quarantine a File"
},
{
"waiting_time": 26.460095,
"entities": [
{
"entity_id": 4689,
"entity_type": 1
}
],
"end_time": "2017-02-08T14:33:28.089Z",
"entity_name": "exploit.exe",
"action_type": 0,
"decision": "Approved",
"action_id": 157,
"user": "administrator",
"start_time": "2017-02-08T14:33:01.629Z",
"action_name": "Quarantine a File"
},
{
"waiting_time": 29.232141,
"entities": [
{
"entity_id": 4690,
"entity_type": 1
}
],
"end_time": "2017-02-08T14:33:29.802Z",
"entity_name": "rootkit.exe",
"action_type": 0,
"decision": "Approved",
"action_id": 155,
"user": "administrator",
"start_time": "2017-02-08T14:33:00.569Z",
"action_name": "Quarantine a File"
}
],
"reasons": null,
"pending_type": null,
"remediation_pending_time": 80,
"resource_pending_time": 0
}

Просмотреть файл

@ -0,0 +1,109 @@
{
"id": 18,
"start_date": "2017-04-12T08:24:00.243260Z",
"end_date": null,
"status": 2,
"comments": 0,
"actions": {
"remediated": 0,
"total": 2,
"running": 0,
"pending": 1
},
"hosts": [
{
"status": 3,
"is_unmanaged": null,
"ip": null,
"reason": "The endpoint is not found",
"logged_in_users": null,
"id": 80,
"group": null,
"name": "YOSSI-TEST.auto.lab",
"protection_level_name": "Not Found",
"protection_level_type": 4,
"os": null
}
],
"title": "User Initiated - Endpoint Investigation",
"requested_status": null,
"dismissed": false,
"important": false,
"user": null,
"external_sources": {
"mitigation_source": [],
"data_source": [
13
]
},
"alert_count": 1,
"entity_count": 0,
"attention_required": 1,
"running_time": 1070.471335,
"pending_action_types": {
"data": [
{
"action": 13,
"count": 0
},
{
"action": 12,
"count": 0
},
{
"action": 8,
"count": 1
}
]
},
"threat_types": [],
"alert": {
"AlertId": "636219966081943637_-467964911",
"WcdMachineId": null,
"SenseMachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
"MachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
"ComputerDnsName": "cont-jonathanw.contoso.org",
"Severity": 256,
"Status": 4,
"LastEventTime": "2017-04-17T16:37:47.8018798Z",
"FirstEventTime": "2017-04-17T13:12:20.2461196Z",
"FirstSeen": "2017-04-17T16:50:07.754788Z",
"Classification": 0,
"Determination": 0,
"DomainName": "CONTOSO",
"AccountName": "jonathan.wolcott",
"AccountSid": "S-1-5-21-2649156466-80624164-2033095608-1113",
"AssignedTo": "Analyst@WDATPContosoFld.onmicrosoft.com",
"Category": "PrivilegeEscalation",
"Title": "Process privilege escalation due to kernel exploit",
"ActorName": null,
"TiProvider": null,
"GroupId": null,
"GroupKey": null,
"MachineCount": 1,
"UserCount": 1,
"AssignedToCount": 1,
"AlertCount": 0,
"IoaDefinitionId": "6f36a53b-7229-471e-9c91-ea473a50b95d",
"InternalMachineId": 8,
"ContainedAlerts": null,
"IsSealedGroup": null,
"DetectionSource": 1,
"ThreatFamilyName": null,
"SuppressionRuleId": null
},
"pending_since": "2017-04-12T08:24:00.721169Z",
"alert_to_remediation_time": 0,
"is_cleanup_applied": false,
"errors": [
6
],
"pending_actions": [],
"reasons": [
"Endpoint does not exist in the Active Directory"
],
"pending_type": 6,
"remediation_pending_time": 0,
"resource_pending_time": 0,
"tags": []
}

Просмотреть файл

@ -0,0 +1,160 @@
{
"id": 16,
"start_date": "2017-05-14T07:51:23.917267Z",
"end_date": null,
"status": 2,
"comments": 3,
"actions": {
"remediated": 8,
"total": 38,
"running": 0,
"pending": 3
},
"hosts": [
{
"status": 0,
"is_unmanaged": false,
"ip": "2.0.0.1",
"reason": null,
"logged_in_users": [
"AUTO\\Administrator"
],
"id": 253,
"group": 1,
"name": "WIN71X6401.auto.lab",
"protection_level_name": "Semi Automated - Require Approval",
"protection_level_type": 1,
"os": "Windows 7 Enterprise"
}
],
"title": "Suspicious - User",
"requested_status": null,
"dismissed": false,
"important": false,
"user": null,
"external_sources": {
"mitigation_source": [],
"data_source": [
13
]
},
"alert_count": 1,
"entity_count": 2114,
"attention_required": 3,
"running_time": 21626.848919,
"pending_action_types": {
"data": [
{
"action": 18,
"count": 1
}
]
},
"threat_types": [
{
"count": 3,
"threat_type": 0
},
{
"count": 3,
"threat_type": 10
}
],
"alert": {
"AlertId": "636219966081943637_-467964911",
"WcdMachineId": null,
"SenseMachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
"MachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
"ComputerDnsName": "cont-jonathanw.contoso.org",
"Severity": 256,
"Status": 4,
"LastEventTime": "2017-04-17T16:37:47.8018798Z",
"FirstEventTime": "2017-04-17T13:12:20.2461196Z",
"FirstSeen": "2017-04-17T16:50:07.754788Z",
"Classification": 0,
"Determination": 0,
"DomainName": "CONTOSO",
"AccountName": "jonathan.wolcott",
"AccountSid": "S-1-5-21-2649156466-80624164-2033095608-1113",
"AssignedTo": "Analyst@WDATPContosoFld.onmicrosoft.com",
"Category": "PrivilegeEscalation",
"Title": "Process privilege escalation due to kernel exploit",
"ActorName": null,
"TiProvider": null,
"GroupId": null,
"GroupKey": null,
"MachineCount": 1,
"UserCount": 1,
"AssignedToCount": 1,
"AlertCount": 0,
"IoaDefinitionId": "6f36a53b-7229-471e-9c91-ea473a50b95d",
"InternalMachineId": 8,
"ContainedAlerts": null,
"IsSealedGroup": null,
"DetectionSource": 1,
"ThreatFamilyName": null,
"SuppressionRuleId": null
},
"pending_since": "2017-05-14T07:57:12.818586Z",
"alert_to_remediation_time": 207.064145,
"is_cleanup_applied": false,
"errors": [],
"pending_actions": [
{
"waiting_time": 6.651541,
"entities": [
{
"entity_id": 110129,
"entity_type": 1
}
],
"end_time": "2017-05-14T07:57:09.400549Z",
"entity_name": "trojan.exe",
"action_type": 0,
"decision": "Declined",
"action_id": 5175,
"user": "administrator",
"start_time": "2017-05-14T07:57:02.749008Z",
"action_name": "Quarantine a File"
},
{
"waiting_time": 6.221275,
"entities": [
{
"entity_id": 109334,
"entity_type": 1
}
],
"end_time": "2017-05-14T07:55:11.407090Z",
"entity_name": "trojan.exe",
"action_type": 0,
"decision": "Declined",
"action_id": 5157,
"user": "administrator",
"start_time": "2017-05-14T07:55:05.185815Z",
"action_name": "Quarantine a File"
},
{
"waiting_time": 13.785844,
"entities": [
{
"entity_id": 4976,
"entity_type": 2
}
],
"end_time": "2017-05-14T07:55:04.767256Z",
"entity_name": "trojan.exe",
"action_type": 3,
"decision": "Declined",
"action_id": 5156,
"user": "administrator",
"start_time": "2017-05-14T07:54:50.981412Z",
"action_name": "Kill Process"
}
],
"reasons": null,
"pending_type": 3,
"remediation_pending_time": 26,
"resource_pending_time": 0,
"tags": []
}

Просмотреть файл

@ -0,0 +1,115 @@
{
"id": 17,
"start_date": "2017-04-30T09:46:02.284385Z",
"end_date": null,
"status": 0,
"comments": 2,
"actions": {
"remediated": 0,
"total": 41,
"running": 2,
"pending": 0
},
"tags": [
{ "id": "test tag", "name": "test tag" }
],
"hosts": [
{
"status": 4,
"is_unmanaged": false,
"ip": "2.0.0.8",
"reason": null,
"logged_in_users": [
"AUTO\\bingo",
"AUTO\\max-admin"
],
"id": 16,
"group": 1,
"name": "WIN10-X86.DOMAIN.LAB",
"protection_level_name": "Semi Automated - Require Approval",
"protection_level_type": 1,
"os": "Windows 10 Enterprise"
},
{
"status": 2,
"is_unmanaged": null,
"ip": null,
"reason": "The endpoint is not found",
"logged_in_users": null,
"id": 15,
"group": null,
"name": "BINGO.auto.lab",
"protection_level_name": "Not Found",
"protection_level_type": 4,
"os": null
}
],
"title": "User Initiated - Endpoint Investigation",
"requested_status": null,
"dismissed": false,
"important": false,
"user": null,
"external_sources": {
"mitigation_source": [53, 9],
"data_source": [
9
]
},
"alert_count": 1,
"entity_count": 6131,
"attention_required": 0,
"running_time": 75.179464,
"pending_action_types": {
"data": []
},
"threat_types": [
{
"count": 1,
"threat_type": 0
}
],
"alert": {
"AlertId": "636219966081943637_-467964911",
"WcdMachineId": null,
"SenseMachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
"MachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
"ComputerDnsName": "cont-jonathanw.contoso.org",
"Severity": 256,
"Status": 4,
"LastEventTime": "2017-04-17T16:37:47.8018798Z",
"FirstEventTime": "2017-04-17T13:12:20.2461196Z",
"FirstSeen": "2017-04-17T16:50:07.754788Z",
"Classification": 0,
"Determination": 0,
"DomainName": "CONTOSO",
"AccountName": "jonathan.wolcott",
"AccountSid": "S-1-5-21-2649156466-80624164-2033095608-1113",
"AssignedTo": "Analyst@WDATPContosoFld.onmicrosoft.com",
"Category": "PrivilegeEscalation",
"Title": "Process privilege escalation due to kernel exploit",
"ActorName": null,
"TiProvider": null,
"GroupId": null,
"GroupKey": null,
"MachineCount": 1,
"UserCount": 1,
"AssignedToCount": 1,
"AlertCount": 0,
"IoaDefinitionId": "6f36a53b-7229-471e-9c91-ea473a50b95d",
"InternalMachineId": 8,
"ContainedAlerts": null,
"IsSealedGroup": null,
"DetectionSource": 1,
"ThreatFamilyName": null,
"SuppressionRuleId": null
},
"pending_since": null,
"alert_to_remediation_time": 0,
"is_cleanup_applied": true,
"errors": [],
"pending_actions": [],
"reasons": null,
"pending_type": null,
"remediation_pending_time": 0,
"resource_pending_time": 0
}

Просмотреть файл

@ -0,0 +1,148 @@
{
"id": 9,
"start_date": "2017-02-09T09:27:54.326390Z",
"end_date": "2017-02-09T09:48:31.120821Z",
"status": 3,
"comments": 1,
"actions": {
"remediated": 1,
"total": 29,
"running": 0,
"pending": 0
},
"hosts": [
{
"status": 0,
"is_unmanaged": false,
"ip": "2.0.0.22",
"reason": null,
"logged_in_users": [
"AUTO\\bingo",
"AUTO\\lateral"
],
"id": 9,
"group": 1,
"name": "WIN7-ULT-X86.auto.lab",
"protection_level_name": "Semi Automated - Require Approval",
"protection_level_type": 1,
"os": "Windows 7 Ultimate"
}
],
"title": "User Initiated - Endpoint Investigation",
"requested_status": null,
"dismissed": false,
"important": false,
"user": null,
"external_sources": {
"mitigation_source": [],
"data_source": [
43
]
},
"alert_count": 1,
"entity_count": 1635,
"attention_required": 0,
"running_time": 1236.794431,
"pending_action_types": {
"data": [
{
"action": 13,
"count": 0
},
{
"action": 12,
"count": 0
},
{
"action": 8,
"count": 0
}
]
},
"threat_types": [
{
"count": 1,
"threat_type": 0
}
],
"alert": {
"AlertId": "636219966081943637_-467964911",
"WcdMachineId": null,
"SenseMachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
"MachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
"ComputerDnsName": "cont-jonathanw.contoso.org",
"Severity": 256,
"Status": 4,
"LastEventTime": "2017-04-17T16:37:47.8018798Z",
"FirstEventTime": "2017-04-17T13:12:20.2461196Z",
"FirstSeen": "2017-04-17T16:50:07.754788Z",
"Classification": 0,
"Determination": 0,
"DomainName": "CONTOSO",
"AccountName": "jonathan.wolcott",
"AccountSid": "S-1-5-21-2649156466-80624164-2033095608-1113",
"AssignedTo": "Analyst@WDATPContosoFld.onmicrosoft.com",
"Category": "PrivilegeEscalation",
"Title": "Process privilege escalation due to kernel exploit",
"ActorName": null,
"TiProvider": null,
"GroupId": null,
"GroupKey": null,
"MachineCount": 1,
"UserCount": 1,
"AssignedToCount": 1,
"AlertCount": 0,
"IoaDefinitionId": "6f36a53b-7229-471e-9c91-ea473a50b95d",
"InternalMachineId": 8,
"ContainedAlerts": null,
"IsSealedGroup": null,
"DetectionSource": 1,
"ThreatFamilyName": null,
"SuppressionRuleId": null
},
"pending_since": null,
"alert_to_remediation_time": 206.592362,
"is_cleanup_applied": false,
"errors": [
3,
37
],
"pending_actions": [
{
"waiting_time": 360.718514,
"entities": [
{
"entity_id": 12523,
"entity_type": 1
}
],
"end_time": "2017-02-09T09:37:21.637Z",
"entity_name": "trojan.exe",
"action_type": 0,
"decision": "Skip",
"action_id": 275,
"user": "administrator",
"start_time": "2017-02-09T09:31:20.918Z",
"action_name": "Quarantine a File"
},
{
"waiting_time": 305.053733,
"entities": [],
"end_time": "2017-02-09T09:48:31.031Z",
"entity_name": null,
"action_type": 8,
"decision": "Timed out",
"action_id": 276,
"user": null,
"start_time": "2017-02-09T09:43:25.977Z",
"action_name": "Wait for Endpoint Resource"
}
],
"reasons": [
"Pending action exceeded timeout",
"Endpoint is not reachable"
],
"pending_type": null,
"remediation_pending_time": 360,
"resource_pending_time": 305
}

Просмотреть файл

@ -0,0 +1,201 @@
{
"id": 1,
"start_date": "2017-07-02T13:54:26.876955Z",
"end_date": "2017-07-02T14:19:21.919703Z",
"status": 4,
"comments": 1,
"actions": {
"remediated": 0,
"total": 7,
"running": 0,
"pending": 0,
"queued": 0
},
"hosts": [
{
"status": 3,
"is_unmanaged": false,
"ip": "2.0.0.2",
"reason": "Investigation terminated by user",
"logged_in_users": null,
"id": 1,
"group": 1,
"name": "WIN7-X64-1.auto.lab",
"protection_level_name": "Semi Automated - Require Approval",
"protection_level_type": 1,
"os": "Windows 7 Enterprise"
},
{
"status": 3,
"is_unmanaged": false,
"ip": "2.0.0.1",
"reason": "Investigation terminated by user",
"logged_in_users": [
"AUTO\\Administrator"
],
"id": 2,
"group": 1,
"name": "WIN7_X64.auto.lab",
"protection_level_name": "Semi Automated - Require Approval",
"protection_level_type": 1,
"os": "Windows 7 Enterprise"
}
],
"title": "User Initiated - Endpoint Investigation",
"requested_status": 4,
"important": false,
"user": {
"id": 2,
"password": "pbkdf2_sha256$30000$2tlrhvsrVprl$JM4flWX1gvff0O6818aq0VydQpTZHYbCxi2sYFRUglA=",
"last_login": null,
"is_superuser": true,
"username": "administrator",
"first_name": "administrator",
"last_name": "",
"email": "",
"is_staff": true,
"is_active": true,
"date_joined": "2017-07-02T13:05:19.717994Z",
"groups": [
{
"id": 1,
"name": "Uni",
"permissions": []
},
{
"id": 2,
"name": "AIRSAdmins",
"permissions": []
}
],
"user_permissions": []
},
"external_sources": {
"mitigation_source": [],
"data_source": [
13
]
},
"alert_count": 1,
"entity_count": 0,
"attention_required": 0,
"running_time": 1495.042748,
"pending_action_types": {
"data": [
{
"action": 13,
"count": 0
},
{
"action": 12,
"count": 0
},
{
"action": 8,
"count": 0
}
]
},
"threat_types": [],
"alert": {
"AlertId": "636219966081943637_-467964911",
"WcdMachineId": null,
"SenseMachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
"MachineId": "4799f85552c638acceda6bbdd1c27d81ed98f2bd",
"ComputerDnsName": "cont-jonathanw.contoso.org",
"Severity": 256,
"Status": 4,
"LastEventTime": "2017-04-17T16:37:47.8018798Z",
"FirstEventTime": "2017-04-17T13:12:20.2461196Z",
"FirstSeen": "2017-04-17T16:50:07.754788Z",
"Classification": 0,
"Determination": 0,
"DomainName": "CONTOSO",
"AccountName": "jonathan.wolcott",
"AccountSid": "S-1-5-21-2649156466-80624164-2033095608-1113",
"AssignedTo": "Analyst@WDATPContosoFld.onmicrosoft.com",
"Category": "PrivilegeEscalation",
"Title": "Process privilege escalation due to kernel exploit",
"ActorName": null,
"TiProvider": null,
"GroupId": null,
"GroupKey": null,
"MachineCount": 1,
"UserCount": 1,
"AssignedToCount": 1,
"AlertCount": 0,
"IoaDefinitionId": "6f36a53b-7229-471e-9c91-ea473a50b95d",
"InternalMachineId": 8,
"ContainedAlerts": null,
"IsSealedGroup": null,
"DetectionSource": 1,
"ThreatFamilyName": null,
"SuppressionRuleId": null
},
"pending_since": null,
"alert_to_remediation_time": 0,
"is_cleanup_applied": false,
"errors": [
2,
10
],
"pending_actions": [
{
"waiting_time": 64.636371,
"entities": [],
"end_time": "2017-07-02T13:55:32.496900Z",
"entity_name": null,
"action_type": 13,
"decision": null,
"action_id": 3,
"user": null,
"start_time": "2017-07-02T13:54:27.860529Z",
"action_name": "Check Endpoint Coverage"
},
{
"waiting_time": 64.653725,
"entities": [],
"end_time": "2017-07-02T13:55:32.494259Z",
"entity_name": null,
"action_type": 13,
"decision": null,
"action_id": 2,
"user": null,
"start_time": "2017-07-02T13:54:27.840534Z",
"action_name": "Check Endpoint Coverage"
},
{
"waiting_time": 1401.037551,
"entities": [],
"end_time": "2017-07-02T14:19:21.919703Z",
"entity_name": null,
"action_type": 8,
"decision": "Skip",
"action_id": 7,
"user": null,
"start_time": "2017-07-02T13:56:00.882152Z",
"action_name": "Deploy Probe on endpoint"
},
{
"waiting_time": 1404.699114,
"entities": [],
"end_time": "2017-07-02T14:19:21.919703Z",
"entity_name": null,
"action_type": 8,
"decision": "Skip",
"action_id": 6,
"user": null,
"start_time": "2017-07-02T13:55:57.220589Z",
"action_name": "Deploy Probe on endpoint"
}
],
"reasons": [
"Endpoint cannot connect back to Windows Defender ATP",
"Windows Defender ATP shouldn't analyze this endpoint",
"Endpoint is not covered by any Asset Group"
],
"pending_type": null,
"remediation_pending_time": 0,
"resource_pending_time": 1469,
"tags": []
}

Разница между файлами не показана из-за своего большого размера Загрузить разницу

Просмотреть файл

@ -0,0 +1,7 @@
{
"count": 0,
"last_investigation": {
"name": "McAfee Abnormal Host Behavior",
"id": 3007
}
}

Просмотреть файл

@ -0,0 +1,3 @@
{
"investigation_ids": [17]
}

Просмотреть файл

@ -0,0 +1,72 @@
{
"count": 2,
"next": "https://172.2.0.200/api/investigation/all?status=5&perPage=10&page=2",
"previous": null,
"results": [
{
"id": 163,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-22T10:21:51.361Z",
"end_date": "2015-04-22T10:27:35.177Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 26,
"remediation_actions": [
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3963,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3961,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3959,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\\syswow64\".",
"id": 3955,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3963,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3961,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3959,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3942,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3966,
"name": "Group Hash Analysis"
},
"important": true,
"detection_system": "e2e",
"error_description": "Some general error",
"status": 0
}
]
}

Просмотреть файл

@ -0,0 +1,48 @@
{
"count": 1,
"next": null,
"previous": null,
"results": [
{
"id": 34,
"name": "Symantec Virus Found",
"start_date": "2015-07-12T12:05:33.043Z",
"end_date": null,
"affected_hosts": [
"WIN7-X64-NO-SP.auto.lab"
],
"affected_groups": [
"GROUP-1"
],
"affected_users": [],
"total_actions": 9,
"remediation_actions": [
{
"details": "Quarantine \"C:\\Windows\\sus.exe\".",
"id": 831,
"name": "Quarantine A File"
}
],
"pending_actions": [
{
"details": "Quarantine \"C:\\Windows\\sus.exe\".",
"id": 831,
"name": "Quarantine A File"
}
],
"failed_actions": [],
"last_action": {
"details": "Quarantine \"C:\\Windows\\sus.exe\".",
"is_remediation": true,
"id": 831,
"name": "Quarantine A File"
},
"important": true,
"detection_system": "DS-1",
"error_description": "",
"status": 1,
"user": "",
"comments": 0
}
]
}

Просмотреть файл

@ -0,0 +1,736 @@
{
"count": 163,
"next": "https://172.2.0.200/api/investigation/all?status=10&perPage=10&page=2",
"previous": null,
"results": [
{
"id": 163,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-22T10:21:51.361Z",
"end_date": "2015-04-22T10:27:35.177Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 26,
"remediation_actions": [
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3963,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3961,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3959,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\\syswow64\".",
"id": 3955,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3963,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3961,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3959,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3942,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3966,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 162,
"name": "McAfee Endpoint Security Tampered",
"start_date": "2015-04-22T10:16:42.756Z",
"end_date": "2015-04-22T10:21:48.304Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 27,
"remediation_actions": [
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3937,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:2088.",
"id": 3936,
"name": "Kill Process"
},
{
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2088.",
"id": 3934,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3932,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\\".",
"id": 3928,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2088.",
"id": 3934,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3932,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3915,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3940,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 161,
"name": "McAfee Port Blocking",
"start_date": "2015-04-22T10:09:55.962Z",
"end_date": "2015-04-22T10:16:39.736Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 27,
"remediation_actions": [
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3910,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"sus.exe\" pid:2188.",
"id": 3909,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2188.",
"id": 3907,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3905,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 3901,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2188.",
"id": 3907,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3905,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3888,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3913,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 160,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-22T09:52:03.096Z",
"end_date": "2015-04-22T09:55:36.314Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 26,
"remediation_actions": [
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3883,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3881,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3879,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\\syswow64\".",
"id": 3875,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3883,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3881,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3879,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3862,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3886,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 159,
"name": "McAfee Endpoint Security Tampered",
"start_date": "2015-04-22T09:45:02.829Z",
"end_date": "2015-04-22T09:51:58.810Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 37,
"remediation_actions": [
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3857,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3856,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:2904.",
"id": 3855,
"name": "Kill Process"
},
{
"details": "Terminate(kill) process name:\"sus.exe\" pid:2180.",
"id": 3854,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2180.",
"id": 3851,
"name": "Release File Handle"
},
{
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2904.",
"id": 3850,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3847,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3846,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\\".",
"id": 3839,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 3838,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2180.",
"id": 3851,
"name": "Release File Handle"
},
{
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2904.",
"id": 3850,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3847,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3846,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3825,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3860,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 158,
"name": "McAfee Port Blocking",
"start_date": "2015-04-22T09:25:05.847Z",
"end_date": "2015-04-22T09:45:01.176Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 25,
"remediation_actions": [
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 3814,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine 1 files in directory \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\".",
"id": 3813,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Calculate hash values for 409 files.",
"id": 3819,
"name": "Get Files Hashes"
},
{
"details": "Calculate hash values for 409 files.",
"id": 3820,
"name": "Get Files Hashes"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3800,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3823,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 157,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-22T08:37:09.523Z",
"end_date": "2015-04-22T08:40:50.088Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": [],
"total_actions": 39,
"remediation_actions": [
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3795,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:1360.",
"id": 3794,
"name": "Kill Process"
},
{
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1360.",
"id": 3791,
"name": "Release File Handle"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\\syswow64\".",
"id": 3788,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3782,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\\a0001094.exe\" with passphrase:None.",
"id": 3783,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\\".",
"id": 3775,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine 2 files in directory \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\".",
"id": 3774,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Calculate hash values for 341 files.",
"id": 3793,
"name": "Get Files Hashes"
},
{
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1360.",
"id": 3791,
"name": "Release File Handle"
},
{
"details": "Calculate hash values for 341 files.",
"id": 3787,
"name": "Get Files Hashes"
},
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3782,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3761,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3798,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 156,
"name": "McAfee Endpoint Security Tampered",
"start_date": "2015-04-22T08:29:24.666Z",
"end_date": "2015-04-22T08:37:06.417Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": [],
"total_actions": 44,
"remediation_actions": [
{
"details": "Quarantine \"C:\\WINDOWS\\najort5g.exe\" with passphrase:None.",
"id": 3759,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"C:\\WINDOWS\".",
"id": 3756,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3751,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"sus.exe\" pid:340.",
"id": 3750,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:340.",
"id": 3744,
"name": "Release File Handle"
},
{
"details": "Quarantine 1 files in directory \"c:\\\".",
"id": 3745,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3738,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\\a0001090.exe\" with passphrase:None.",
"id": 3739,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 3731,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine 2 files in directory \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\".",
"id": 3730,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Calculate hash values for 343 files.",
"id": 3749,
"name": "Get Files Hashes"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:340.",
"id": 3744,
"name": "Release File Handle"
},
{
"details": "Calculate hash values for 343 files.",
"id": 3743,
"name": "Get Files Hashes"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3738,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3717,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Quarantine \"C:\\WINDOWS\\najort5g.exe\" with passphrase:None.",
"is_remediation": true,
"id": 3759,
"name": "Quarantine A File"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 7
},
{
"id": 155,
"name": "McAfee Port Blocking",
"start_date": "2015-04-22T07:58:43.000Z",
"end_date": "2015-04-22T08:29:20.430Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": [],
"total_actions": 10,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [
{
"details": "Lists all PEs in \"C:\\Documents and Settings\\username\\My Documents\\Downloads\".",
"id": 3714,
"name": "Find Files In Directory"
},
{
"details": "Get all executable files created in last 3600 seconds.",
"id": 3715,
"name": "Get Recently Created Files"
},
{
"details": "List all running processes on ()XP-X64@2.0.0.12.",
"id": 3711,
"name": "Get Process List"
},
{
"details": "Check for known persistency method on host ()XP-X64@2.0.0.12, filter=[None].",
"id": 3712,
"name": "Persistency Check"
},
{
"details": "Lists all PEs in \"C:\\Documents and Settings\\username\\Local Settings\\Application Data\\Microsoft\\Outlook\".",
"id": 3713,
"name": "Find Files In Directory"
},
{
"details": "Get active connections list.",
"id": 3708,
"name": "Get All Active Connections"
},
{
"details": "List all services installed on ()XP-X64@2.0.0.12.",
"id": 3709,
"name": "Get Service List"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3707,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Get all executable files created in last 3600 seconds.",
"is_remediation": false,
"id": 3715,
"name": "Get Recently Created Files"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 154,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-22T07:09:09.295Z",
"end_date": "2015-04-22T07:13:50.198Z",
"affected_hosts": ["XP-X86-SP3"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 27,
"remediation_actions": [
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3702,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"z5eQA8h9.exe\" pid:172.",
"id": 3701,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:172.",
"id": 3699,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3697,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\\system32\".",
"id": 3693,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:172.",
"id": 3699,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3697,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X86-SP3@2.0.0.10.",
"id": 3680,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3705,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
}
]
}

Просмотреть файл

@ -0,0 +1,153 @@
{
"count": 4,
"next": null,
"previous": null,
"results": [
{
"id": 1811,
"name": "Host Manual Investigation",
"start_date": "2015-03-18T14:01:32.372Z",
"end_date": "2015-03-18T14:01:37.164Z",
"affected_hosts": [],
"affected_groups": [],
"affected_users": [],
"total_actions": 3,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [
{
"details": "Check if [u'Hexa-PC5', u'192.168.0.5'] is covered by AIRS.",
"id": 56483,
"name": "Find Host"
},
{
"details": "Check if [u'Hexa-PC5', u'192.168.0.5'] is covered by AIRS.",
"id": 56484,
"name": "Find Host"
},
{
"details": "Check if [u'Hexa-PC5', u'192.168.0.5'] is covered by AIRS.",
"id": 56485,
"name": "Find Host"
}
],
"last_action": {
"details": "Check if [u'Hexa-PC5', u'192.168.0.5'] is covered by AIRS.",
"is_remediation": false,
"id": 56485,
"name": "Find Host"
},
"important": false,
"detection_system": "DS_2",
"error_description": "\"Error investigating Hexa-PC5, is explicitly set to Not Covered\"",
"status": 5
},
{
"id": 12,
"name": "Symantec Virus Found syslog",
"start_date": "2015-02-24T14:37:23.160Z",
"end_date": "2015-02-24T14:37:38.551Z",
"affected_hosts": [],
"affected_groups": [],
"affected_users": [],
"total_actions": 3,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [
{
"details": "Check if [u'192.168.0.4', u'HEXA-PC1'] is covered by AIRS.",
"id": 206,
"name": "Find Host"
},
{
"details": "Check if [u'192.168.0.4', u'HEXA-PC1'] is covered by AIRS.",
"id": 207,
"name": "Find Host"
},
{
"details": "Check if [u'192.168.0.4', u'HEXA-PC1'] is covered by AIRS.",
"id": 208,
"name": "Find Host"
}
],
"last_action": {
"details": "Check if [u'192.168.0.4', u'HEXA-PC1'] is covered by AIRS.",
"is_remediation": false,
"id": 208,
"name": "Find Host"
},
"important": false,
"detection_system": "DS_1",
"error_description": "\"Error investigating HEXA-PC1, is explicitly set to Not Covered\"",
"status": 5
},
{
"id": 11,
"name": "Symantec Virus Found syslog",
"start_date": "2015-02-24T14:32:54.749Z",
"end_date": "2015-02-24T14:33:12.295Z",
"affected_hosts": [],
"affected_groups": [],
"affected_users": [],
"total_actions": 3,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [
{
"details": "Check if [u'192.168.0.4', u'WIN7-ULT-X86'] is covered by AIRS.",
"id": 203,
"name": "Find Host"
},
{
"details": "Check if [u'192.168.0.4', u'WIN7-ULT-X86'] is covered by AIRS.",
"id": 204,
"name": "Find Host"
},
{
"details": "Check if [u'192.168.0.4', u'WIN7-ULT-X86'] is covered by AIRS.",
"id": 205,
"name": "Find Host"
}
],
"last_action": {
"details": "Check if [u'192.168.0.4', u'WIN7-ULT-X86'] is covered by AIRS.",
"is_remediation": false,
"id": 205,
"name": "Find Host"
},
"important": false,
"detection_system": "DS_1",
"error_description": "\"Error investigating WIN7-ULT-X86, is explicitly set to Not Covered\"",
"status": 5
},
{
"id": 1,
"name": "Symantec Virus Found",
"start_date": "2015-01-27T12:45:10.984Z",
"end_date": "2015-01-27T12:45:11.626Z",
"affected_hosts": [],
"affected_groups": [],
"affected_users": [],
"total_actions": 1,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [
{
"details": "Check if [u'HEXA-PC1', u'192.168.0.4'] is covered by AIRS.",
"id": 1,
"name": "Find Host"
}
],
"last_action": {
"details": "Check if [u'HEXA-PC1', u'192.168.0.4'] is covered by AIRS.",
"is_remediation": false,
"id": 1,
"name": "Find Host"
},
"important": false,
"detection_system": "DS_2",
"error_description": "\"Error investigating HEXA-PC1, is explicitly set to Not Covered\"",
"status": 5
}
]
}

Просмотреть файл

@ -0,0 +1,736 @@
{
"count": 2,
"next": "https://172.2.0.200/api/investigation/all?status=5&perPage=10&page=2",
"previous": null,
"results": [
{
"id": 163,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-22T10:21:51.361Z",
"end_date": "2015-04-22T10:27:35.177Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 26,
"remediation_actions": [
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3963,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3961,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3959,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\\syswow64\".",
"id": 3955,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3963,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3961,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3959,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3942,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3966,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "Some general error",
"status": 5
},
{
"id": 162,
"name": "McAfee Endpoint Security Tampered",
"start_date": "2015-04-22T10:16:42.756Z",
"end_date": "2015-04-22T10:21:48.304Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 27,
"remediation_actions": [
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3937,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:2088.",
"id": 3936,
"name": "Kill Process"
},
{
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2088.",
"id": 3934,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3932,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\\".",
"id": 3928,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2088.",
"id": 3934,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3932,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3915,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3940,
"name": "Group Hash Analysis"
},
"important": true,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 161,
"name": "McAfee Port Blocking",
"start_date": "2015-04-22T10:09:55.962Z",
"end_date": "2015-04-22T10:16:39.736Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 27,
"remediation_actions": [
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3910,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"sus.exe\" pid:2188.",
"id": 3909,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2188.",
"id": 3907,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3905,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 3901,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2188.",
"id": 3907,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3905,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3888,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3913,
"name": "Group Hash Analysis"
},
"important": true,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 160,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-22T09:52:03.096Z",
"end_date": "2015-04-22T09:55:36.314Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 26,
"remediation_actions": [
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3883,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3881,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3879,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\\syswow64\".",
"id": 3875,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3883,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3881,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\syswow64\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3879,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3862,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3886,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 159,
"name": "McAfee Endpoint Security Tampered",
"start_date": "2015-04-22T09:45:02.829Z",
"end_date": "2015-04-22T09:51:58.810Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 37,
"remediation_actions": [
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3857,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3856,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:2904.",
"id": 3855,
"name": "Kill Process"
},
{
"details": "Terminate(kill) process name:\"sus.exe\" pid:2180.",
"id": 3854,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2180.",
"id": 3851,
"name": "Release File Handle"
},
{
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2904.",
"id": 3850,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3847,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3846,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\\".",
"id": 3839,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 3838,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2180.",
"id": 3851,
"name": "Release File Handle"
},
{
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:2904.",
"id": 3850,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3847,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3846,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3825,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3860,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 158,
"name": "McAfee Port Blocking",
"start_date": "2015-04-22T09:25:05.847Z",
"end_date": "2015-04-22T09:45:01.176Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 25,
"remediation_actions": [
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 3814,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine 1 files in directory \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\".",
"id": 3813,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Calculate hash values for 409 files.",
"id": 3819,
"name": "Get Files Hashes"
},
{
"details": "Calculate hash values for 409 files.",
"id": 3820,
"name": "Get Files Hashes"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3800,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3823,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 157,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-22T08:37:09.523Z",
"end_date": "2015-04-22T08:40:50.088Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": [],
"total_actions": 39,
"remediation_actions": [
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3795,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:1360.",
"id": 3794,
"name": "Kill Process"
},
{
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1360.",
"id": 3791,
"name": "Release File Handle"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\\syswow64\".",
"id": 3788,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3782,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\\a0001094.exe\" with passphrase:None.",
"id": 3783,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\\".",
"id": 3775,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine 2 files in directory \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\".",
"id": 3774,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Calculate hash values for 341 files.",
"id": 3793,
"name": "Get Files Hashes"
},
{
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1360.",
"id": 3791,
"name": "Release File Handle"
},
{
"details": "Calculate hash values for 341 files.",
"id": 3787,
"name": "Get Files Hashes"
},
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3782,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3761,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3798,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 155,
"name": "McAfee Port Blocking",
"start_date": "2015-04-22T07:58:43.000Z",
"end_date": "2015-04-22T08:29:20.430Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": [],
"total_actions": 10,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [
{
"details": "Lists all PEs in \"C:\\Documents and Settings\\username\\My Documents\\Downloads\".",
"id": 3714,
"name": "Find Files In Directory"
},
{
"details": "Get all executable files created in last 3600 seconds.",
"id": 3715,
"name": "Get Recently Created Files"
},
{
"details": "List all running processes on ()XP-X64@2.0.0.12.",
"id": 3711,
"name": "Get Process List"
},
{
"details": "Check for known persistency method on host ()XP-X64@2.0.0.12, filter=[None].",
"id": 3712,
"name": "Persistency Check"
},
{
"details": "Lists all PEs in \"C:\\Documents and Settings\\username\\Local Settings\\Application Data\\Microsoft\\Outlook\".",
"id": 3713,
"name": "Find Files In Directory"
},
{
"details": "Get active connections list.",
"id": 3708,
"name": "Get All Active Connections"
},
{
"details": "List all services installed on ()XP-X64@2.0.0.12.",
"id": 3709,
"name": "Get Service List"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3707,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Get all executable files created in last 3600 seconds.",
"is_remediation": false,
"id": 3715,
"name": "Get Recently Created Files"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 154,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-22T07:09:09.295Z",
"end_date": "2015-04-22T07:13:50.198Z",
"affected_hosts": ["XP-X86-SP3"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 27,
"remediation_actions": [
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3702,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"z5eQA8h9.exe\" pid:172.",
"id": 3701,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:172.",
"id": 3699,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3697,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\\system32\".",
"id": 3693,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:172.",
"id": 3699,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3697,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X86-SP3@2.0.0.10.",
"id": 3680,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3705,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
},
{
"id": 153,
"name": "McAfee Endpoint Security Tampered",
"start_date": "2015-04-22T07:00:29.018Z",
"end_date": "2015-04-22T07:09:03.949Z",
"affected_hosts": ["XP-X86-SP3"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 37,
"remediation_actions": [
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3675,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3674,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:1596.",
"id": 3673,
"name": "Kill Process"
},
{
"details": "Terminate(kill) process name:\"sus.exe\" pid:1740.",
"id": 3672,
"name": "Kill Process"
},
{
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1596.",
"id": 3669,
"name": "Release File Handle"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:1740.",
"id": 3668,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3665,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3664,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\\".",
"id": 3657,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 3656,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1596.",
"id": 3669,
"name": "Release File Handle"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:1740.",
"id": 3668,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\eq58r9.exe\" with passphrase:None.",
"id": 3665,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3664,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X86-SP3@2.0.0.10.",
"id": 3643,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Analyze and devide 3 hashes into 3 categories: whitelist, blacklist, unknown.",
"is_remediation": false,
"id": 3678,
"name": "Group Hash Analysis"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 5
}
]
}

Просмотреть файл

@ -0,0 +1,240 @@
{
"count": 3857,
"next": "https://172.2.0.200/api/investigation/all?status=6&perPage=10&page=2",
"previous": null,
"results": [
{
"id": 135,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-21T14:28:42.870Z",
"end_date": "2015-04-21T14:30:33.197Z",
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 16,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [],
"last_action": {
"details": "Analyzing 695 files using AIRS Cloud srvice.",
"is_remediation": false,
"id": 3384,
"name": "Analyze Multiple Files"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 6
},
{
"id": 127,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-21T12:56:03.672Z",
"end_date": "2015-04-21T12:58:05.840Z",
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 16,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [],
"last_action": {
"details": "Analyzing 693 files using AIRS Cloud srvice.",
"is_remediation": false,
"id": 3112,
"name": "Analyze Multiple Files"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 6
},
{
"id": 120,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-21T10:35:58.521Z",
"end_date": "2015-04-21T10:36:01.443Z",
"affected_hosts": [],
"affected_groups": [],
"affected_users": [],
"total_actions": 1,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [],
"last_action": {
"details": "The alert is already being investigated (inv#118).",
"is_remediation": false,
"id": 2873,
"name": "Alert Correlation"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 6
},
{
"id": 119,
"name": "McAfee Endpoint Security Tampered",
"start_date": "2015-04-21T10:35:54.338Z",
"end_date": "2015-04-21T10:44:36.168Z",
"affected_hosts": ["WIN8-X86"],
"affected_groups": [""],
"affected_users": [
"AUTO\\Administrator",
"WIN8-X86\\DWM-1"
],
"total_actions": 14,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [],
"last_action": {
"details": "Analyzing 762 files using AIRS Cloud srvice.",
"is_remediation": false,
"id": 2899,
"name": "Analyze Multiple Files"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 6
},
{
"id": 110,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-21T08:44:56.457Z",
"end_date": "2015-04-21T08:47:08.130Z",
"affected_hosts": ["WIN7-X64-NO-SP.auto.lab"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 16,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [],
"last_action": {
"details": "Analyzing 681 files using AIRS Cloud srvice.",
"is_remediation": false,
"id": 2619,
"name": "Analyze Multiple Files"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 6
},
{
"id": 84,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-20T13:01:51.372Z",
"end_date": "2015-04-20T13:01:52.003Z",
"affected_hosts": [],
"affected_groups": [],
"affected_users": [],
"total_actions": 1,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [],
"last_action": {
"details": "The alert is already being investigated (inv#82).",
"is_remediation": false,
"id": 2041,
"name": "Alert Correlation"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 6
},
{
"id": 83,
"name": "McAfee Endpoint Security Tampered",
"start_date": "2015-04-20T13:01:40.821Z",
"end_date": "2015-04-20T13:01:40.984Z",
"affected_hosts": [],
"affected_groups": [],
"affected_users": [],
"total_actions": 1,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [],
"last_action": {
"details": "The alert is already being investigated (inv#82).",
"is_remediation": false,
"id": 2040,
"name": "Alert Correlation"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 6
},
{
"id": 79,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-19T15:23:23.021Z",
"end_date": "2015-04-19T15:23:23.078Z",
"affected_hosts": [],
"affected_groups": [],
"affected_users": [],
"total_actions": 1,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [],
"last_action": {
"details": "The alert is already being investigated (inv#77).",
"is_remediation": false,
"id": 1994,
"name": "Alert Correlation"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 6
},
{
"id": 78,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-19T15:23:18.238Z",
"end_date": "2015-04-19T15:23:18.314Z",
"affected_hosts": [],
"affected_groups": [],
"affected_users": [],
"total_actions": 1,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [],
"last_action": {
"details": "The alert is already being investigated (inv#75).",
"is_remediation": false,
"id": 1993,
"name": "Alert Correlation"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 6
},
{
"id": 76,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-19T15:21:57.648Z",
"end_date": "2015-04-19T15:21:57.710Z",
"affected_hosts": [],
"affected_groups": [],
"affected_users": [],
"total_actions": 1,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [],
"last_action": {
"details": "The alert is already being investigated (inv#75).",
"is_remediation": false,
"id": 1990,
"name": "Alert Correlation"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 6
}
]
}

Просмотреть файл

@ -0,0 +1,783 @@
{
"count": 21,
"next": "https://172.2.0.200/api/investigation/all?status=7&perPage=10&page=2",
"previous": null,
"results": [
{
"id": 156,
"name": "McAfee Endpoint Security Tampered",
"start_date": "2015-04-22T08:29:24.666Z",
"end_date": "2015-04-22T08:37:06.417Z",
"affected_hosts": ["XP-X64"],
"affected_groups": [""],
"affected_users": [],
"total_actions": 44,
"remediation_actions": [
{
"details": "Quarantine \"C:\\WINDOWS\\najort5g.exe\" with passphrase:None.",
"id": 3759,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"C:\\WINDOWS\".",
"id": 3756,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3751,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"sus.exe\" pid:340.",
"id": 3750,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:340.",
"id": 3744,
"name": "Release File Handle"
},
{
"details": "Quarantine 1 files in directory \"c:\\\".",
"id": 3745,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3738,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\\a0001090.exe\" with passphrase:None.",
"id": 3739,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 3731,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine 2 files in directory \"c:\\system volume information\\_restore{f4e3a6d0-3705-48cb-b8b6-bf9553179a3f}\\rp23\".",
"id": 3730,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Calculate hash values for 343 files.",
"id": 3749,
"name": "Get Files Hashes"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:340.",
"id": 3744,
"name": "Release File Handle"
},
{
"details": "Calculate hash values for 343 files.",
"id": 3743,
"name": "Get Files Hashes"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3738,
"name": "Quarantine A File"
},
{
"details": "Get browsing history from ()XP-X64@2.0.0.12.",
"id": 3717,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Quarantine \"C:\\WINDOWS\\najort5g.exe\" with passphrase:None.",
"is_remediation": true,
"id": 3759,
"name": "Quarantine A File"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 7
},
{
"id": 131,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-21T13:15:36.687Z",
"end_date": "2015-04-21T13:20:14.179Z",
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 36,
"remediation_actions": [
{
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
"id": 3247,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"file in space.exe\" pid:372.",
"id": 3246,
"name": "Kill Process"
},
{
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:372.",
"id": 3244,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
"id": 3242,
"name": "Quarantine A File"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Analyzing 689 files using AIRS Cloud srvice.",
"id": 3269,
"name": "Analyze Multiple Files"
},
{
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:372.",
"id": 3244,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
"id": 3242,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Analyzing 689 files using AIRS Cloud srvice.",
"is_remediation": false,
"id": 3269,
"name": "Analyze Multiple Files"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 7
},
{
"id": 123,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-21T12:09:30.090Z",
"end_date": "2015-04-21T12:21:29.607Z",
"affected_hosts": ["WIN8-X86"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 33,
"remediation_actions": [
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 2988,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"z5eQA8h9.exe\" pid:3628.",
"id": 2987,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:3628.",
"id": 2985,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 2983,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\\system32\".",
"id": 2979,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:3628.",
"id": 2985,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 2983,
"name": "Quarantine A File"
},
{
"details": "Check 2 addresses whether are known as malicious",
"id": 2970,
"name": "Analyze Multiple IP Addresses"
}
],
"last_action": {
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
"is_remediation": false,
"id": 2997,
"name": "Decide On File Quarantine"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 7
},
{
"id": 121,
"name": "McAfee Port Blocking",
"start_date": "2015-04-21T11:56:49.023Z",
"end_date": "2015-04-21T12:03:13.866Z",
"affected_hosts": ["WIN8-X86"],
"affected_groups": [""],
"affected_users": [
"AUTO\\Administrator",
"WIN8-X86\\DWM-1"
],
"total_actions": 32,
"remediation_actions": [
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 2922,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"sus.exe\" pid:908.",
"id": 2921,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:908.",
"id": 2919,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 2917,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 2913,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:908.",
"id": 2919,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 2917,
"name": "Quarantine A File"
},
{
"details": "Get active connections list.",
"id": 2902,
"name": "Get All Active Connections"
},
{
"details": "Get browsing history from ()WIN8-X86@2.0.0.6.",
"id": 2901,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
"is_remediation": false,
"id": 2931,
"name": "Decide On File Quarantine"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 7
},
{
"id": 116,
"name": "McAfee Endpoint Security Tampered",
"start_date": "2015-04-21T09:25:49.802Z",
"end_date": "2015-04-21T09:31:03.850Z",
"affected_hosts": ["WIN8-X86"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 28,
"remediation_actions": [
{
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
"id": 2833,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:3196.",
"id": 2832,
"name": "Kill Process"
},
{
"details": "Release \"c:\\users\\administrator\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:3196.",
"id": 2830,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
"id": 2828,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\users\\administrator\".",
"id": 2824,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Analyzing 3 files using AIRS Cloud srvice.",
"id": 2837,
"name": "Analyze Multiple Files"
},
{
"details": "Release \"c:\\users\\administrator\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:3196.",
"id": 2830,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
"id": 2828,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Analyzing 3 files using AIRS Cloud srvice.",
"is_remediation": false,
"id": 2837,
"name": "Analyze Multiple Files"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 7
},
{
"id": 104,
"name": "McAfee Port Blocking",
"start_date": "2015-04-21T07:57:19.474Z",
"end_date": "2015-04-21T08:02:58.720Z",
"affected_hosts": ["WIN8-X86"],
"affected_groups": [""],
"affected_users": [
"AUTO\\Administrator",
"WIN8-X86\\DWM-1"
],
"total_actions": 32,
"remediation_actions": [
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 2429,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"sus.exe\" pid:2680.",
"id": 2428,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2680.",
"id": 2426,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 2424,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 2420,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2680.",
"id": 2426,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 2424,
"name": "Quarantine A File"
},
{
"details": "Get active connections list.",
"id": 2409,
"name": "Get All Active Connections"
},
{
"details": "Get browsing history from ()WIN8-X86@2.0.0.6.",
"id": 2408,
"name": "Get Host Browsing History"
}
],
"last_action": {
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
"is_remediation": false,
"id": 2438,
"name": "Decide On File Quarantine"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 7
},
{
"id": 98,
"name": "McAfee Port Blocking",
"start_date": "2015-04-20T15:57:44.442Z",
"end_date": "2015-04-20T16:03:23.725Z",
"affected_hosts": ["WIN8-X86"],
"affected_groups": [""],
"affected_users": [
"AUTO\\Administrator",
"WIN8-X86\\DWM-1"
],
"total_actions": 47,
"remediation_actions": [
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 2214,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 2213,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
"id": 2212,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"z5eQA8h9.exe\" pid:2632.",
"id": 2211,
"name": "Kill Process"
},
{
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:1080.",
"id": 2210,
"name": "Kill Process"
},
{
"details": "Release \"c:\\users\\administrator\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1080.",
"id": 2207,
"name": "Release File Handle"
},
{
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:2632.",
"id": 2206,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
"id": 2203,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 2202,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\\system32\".",
"id": 2195,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine 1 files in directory \"c:\\users\\administrator\".",
"id": 2194,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Calculate hash values for 754 files.",
"id": 2217,
"name": "Get Files Hashes"
},
{
"details": "Release \"c:\\users\\administrator\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:1080.",
"id": 2207,
"name": "Release File Handle"
},
{
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:2632.",
"id": 2206,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
"id": 2203,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 2202,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
"is_remediation": false,
"id": 2226,
"name": "Decide On File Quarantine"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 7
},
{
"id": 70,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-14T13:50:48.035Z",
"end_date": "2015-04-14T14:24:55.655Z",
"affected_hosts": ["WIN81-X64"],
"affected_groups": [""],
"affected_users": [],
"total_actions": 49,
"remediation_actions": [
{
"details": "Terminate(kill) process name:\"evil.exe\" pid:2032.",
"id": 1850,
"name": "Kill Process"
},
{
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:2032.",
"id": 1848,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\temp\\1.exe\" with passphrase:None.",
"id": 1846,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
"id": 1845,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"1.exe\" pid:3648.",
"id": 1844,
"name": "Kill Process"
},
{
"details": "Release \"c:\\temp\\1.exe\" from process name:\"1.exe\" pid:3648.",
"id": 1839,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\temp\\1.exe\" with passphrase:None.",
"id": 1837,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\temp\".",
"id": 1831,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
"id": 1817,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"file in space.exe\" pid:3100.",
"id": 1816,
"name": "Kill Process"
},
{
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:3100.",
"id": 1814,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
"id": 1812,
"name": "Quarantine A File"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:2032.",
"id": 1848,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
"id": 1845,
"name": "Quarantine A File"
},
{
"details": "Release \"c:\\temp\\1.exe\" from process name:\"1.exe\" pid:3648.",
"id": 1839,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\temp\\1.exe\" with passphrase:None.",
"id": 1837,
"name": "Quarantine A File"
},
{
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:3100.",
"id": 1814,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
"id": 1812,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Terminate(kill) process name:\"evil.exe\" pid:2032.",
"is_remediation": true,
"id": 1850,
"name": "Kill Process"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 9
},
{
"id": 45,
"name": "McAfee Port Blocking",
"start_date": "2015-04-13T07:25:28.355Z",
"end_date": null,
"affected_hosts": ["win8-x86"],
"affected_groups": [""],
"affected_users": [
"AUTO\\Administrator",
"WIN8-X86\\DWM-1"
],
"total_actions": 10,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [
{
"details": "Lists all PEs in \"C:\\Users\\Administrator\\Downloads\".",
"id": 1141,
"name": "Find Files In Directory"
},
{
"details": "List all running processes on ()win8-x86@2.0.0.6.",
"id": 1140,
"name": "Get Process List"
},
{
"details": "Lists all PEs in \"C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\Outlook\".",
"id": 1139,
"name": "Find Files In Directory"
},
{
"details": "Get active connections list.",
"id": 1137,
"name": "Get All Active Connections"
}
],
"last_action": {
"details": "Get all executable files created in last 3600 seconds.",
"is_remediation": false,
"id": 1143,
"name": "Get Recently Created Files"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 9
},
{
"id": 44,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-13T06:58:30.775Z",
"end_date": "2015-04-13T07:06:22.590Z",
"affected_hosts": ["win8-x86"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 38,
"remediation_actions": [
{
"details": "Quarantine 1 files in directory \"c:\\windows\\system32\".",
"id": 1121,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 1120,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"sus.exe\" pid:1180.",
"id": 1119,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:1180.",
"id": 1117,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 1115,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 1111,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Calculate hash values for 762 files.",
"id": 1124,
"name": "Get Files Hashes"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:1180.",
"id": 1117,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 1115,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
"is_remediation": false,
"id": 1133,
"name": "Decide On File Quarantine"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 9
}
]
}

Просмотреть файл

@ -0,0 +1,632 @@
{
"count": 55,
"next": "https://172.2.0.200/api/investigation/all?status=8&perPage=10&page=2",
"previous": null,
"results": [
{
"id": 139,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-21T14:52:35.459Z",
"end_date": "2015-04-21T14:56:49.977Z",
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 36,
"remediation_actions": [
{
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
"id": 3519,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"file in space.exe\" pid:3212.",
"id": 3518,
"name": "Kill Process"
},
{
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:3212.",
"id": 3516,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
"id": 3514,
"name": "Quarantine A File"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:3212.",
"id": 3516,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
"id": 3514,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Analyzing 691 files using AIRS Cloud srvice.",
"is_remediation": false,
"id": 3541,
"name": "Analyze Multiple Files"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 8
},
{
"id": 138,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-21T14:47:37.565Z",
"end_date": "2015-04-21T14:52:30.475Z",
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 36,
"remediation_actions": [
{
"details": "Quarantine \"C:\\temp\\3.exe\" with passphrase:None.",
"id": 3483,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"3.exe\" pid:3616.",
"id": 3482,
"name": "Kill Process"
},
{
"details": "Release \"C:\\temp\\3.exe\" from process name:\"3.exe\" pid:3616.",
"id": 3480,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\3.exe\" with passphrase:None.",
"id": 3478,
"name": "Quarantine A File"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"C:\\temp\\3.exe\" from process name:\"3.exe\" pid:3616.",
"id": 3480,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\3.exe\" with passphrase:None.",
"id": 3478,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
"is_remediation": false,
"id": 3505,
"name": "Decide On File Quarantine"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 8
},
{
"id": 137,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-21T14:35:05.593Z",
"end_date": "2015-04-21T14:47:30.436Z",
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 49,
"remediation_actions": [
{
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
"id": 3468,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"evil.exe\" pid:3892.",
"id": 3467,
"name": "Kill Process"
},
{
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:3892.",
"id": 3465,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
"id": 3463,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"C:\\temp\\1.exe\" with passphrase:None.",
"id": 3434,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"1.exe\" pid:2168.",
"id": 3433,
"name": "Kill Process"
},
{
"details": "Release \"C:\\temp\\1.exe\" from process name:\"1.exe\" pid:2168.",
"id": 3431,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\1.exe\" with passphrase:None.",
"id": 3429,
"name": "Quarantine A File"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:3892.",
"id": 3465,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
"id": 3463,
"name": "Quarantine A File"
},
{
"details": "Release \"C:\\temp\\1.exe\" from process name:\"1.exe\" pid:2168.",
"id": 3431,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\1.exe\" with passphrase:None.",
"id": 3429,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Wait on a complete report for [u'e783eb65b6bffeb2b276a0fc5731c18d', u'0f0fbd2f2d0bc9f0c86709e1396d9679a284204e'].",
"is_remediation": false,
"id": 3469,
"name": "Wait For Cloud Analysis Report"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 8
},
{
"id": 136,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-21T14:30:36.129Z",
"end_date": "2015-04-21T14:34:58.120Z",
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 36,
"remediation_actions": [
{
"details": "Quarantine \"C:\\temp\\2.exe\" with passphrase:None.",
"id": 3398,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"2.exe\" pid:996.",
"id": 3397,
"name": "Kill Process"
},
{
"details": "Release \"C:\\temp\\2.exe\" from process name:\"2.exe\" pid:996.",
"id": 3395,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\2.exe\" with passphrase:None.",
"id": 3393,
"name": "Quarantine A File"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"C:\\temp\\2.exe\" from process name:\"2.exe\" pid:996.",
"id": 3395,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\2.exe\" with passphrase:None.",
"id": 3393,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Analyzing 691 files using AIRS Cloud srvice.",
"is_remediation": false,
"id": 3420,
"name": "Analyze Multiple Files"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 8
},
{
"id": 134,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-21T14:24:07.281Z",
"end_date": "2015-04-21T14:28:36.134Z",
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 33,
"remediation_actions": [
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3359,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"z5eQA8h9.exe\" pid:3576.",
"id": 3358,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:3576.",
"id": 3356,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3354,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\\system32\".",
"id": 3350,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\windows\\system32\\z5eqa8h9.exe\" from process name:\"z5eQA8h9.exe\" pid:3576.",
"id": 3356,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\system32\\z5eqa8h9.exe\" with passphrase:None.",
"id": 3354,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
"is_remediation": false,
"id": 3368,
"name": "Decide On File Quarantine"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 8
},
{
"id": 133,
"name": "McAfee Endpoint Security Tampered",
"start_date": "2015-04-21T14:19:36.188Z",
"end_date": "2015-04-21T14:24:03.604Z",
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 33,
"remediation_actions": [
{
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
"id": 3326,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"eQ58r9.exe\" pid:3580.",
"id": 3325,
"name": "Kill Process"
},
{
"details": "Release \"c:\\users\\administrator\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:3580.",
"id": 3323,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
"id": 3321,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\users\\administrator\".",
"id": 3317,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\users\\administrator\\eq58r9.exe\" from process name:\"eQ58r9.exe\" pid:3580.",
"id": 3323,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\users\\administrator\\eq58r9.exe\" with passphrase:None.",
"id": 3321,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
"is_remediation": false,
"id": 3335,
"name": "Decide On File Quarantine"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 8
},
{
"id": 132,
"name": "McAfee Port Blocking",
"start_date": "2015-04-21T14:14:57.699Z",
"end_date": "2015-04-21T14:19:31.811Z",
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 33,
"remediation_actions": [
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3293,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"sus.exe\" pid:2920.",
"id": 3292,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2920.",
"id": 3290,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3288,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 3284,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:2920.",
"id": 3290,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 3288,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
"is_remediation": false,
"id": 3302,
"name": "Decide On File Quarantine"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 8
},
{
"id": 130,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-21T13:11:02.515Z",
"end_date": "2015-04-21T13:15:31.154Z",
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 36,
"remediation_actions": [
{
"details": "Quarantine \"C:\\temp\\3.exe\" with passphrase:None.",
"id": 3211,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"3.exe\" pid:1520.",
"id": 3210,
"name": "Kill Process"
},
{
"details": "Release \"C:\\temp\\3.exe\" from process name:\"3.exe\" pid:1520.",
"id": 3208,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\3.exe\" with passphrase:None.",
"id": 3206,
"name": "Quarantine A File"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"C:\\temp\\3.exe\" from process name:\"3.exe\" pid:1520.",
"id": 3208,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\3.exe\" with passphrase:None.",
"id": 3206,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
"is_remediation": false,
"id": 3233,
"name": "Decide On File Quarantine"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 8
},
{
"id": 129,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-21T13:02:50.327Z",
"end_date": "2015-04-21T13:10:55.130Z",
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 49,
"remediation_actions": [
{
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
"id": 3196,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"evil.exe\" pid:3796.",
"id": 3195,
"name": "Kill Process"
},
{
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:3796.",
"id": 3193,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
"id": 3191,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"C:\\temp\\1.exe\" with passphrase:None.",
"id": 3162,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"1.exe\" pid:2140.",
"id": 3161,
"name": "Kill Process"
},
{
"details": "Release \"C:\\temp\\1.exe\" from process name:\"1.exe\" pid:2140.",
"id": 3159,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\1.exe\" with passphrase:None.",
"id": 3157,
"name": "Quarantine A File"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:3796.",
"id": 3193,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
"id": 3191,
"name": "Quarantine A File"
},
{
"details": "Release \"C:\\temp\\1.exe\" from process name:\"1.exe\" pid:2140.",
"id": 3159,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\1.exe\" with passphrase:None.",
"id": 3157,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Wait on a complete report for [u'8b77c7cfcdf6588f65dcccf37891e4fc', u'5b4492aaf05640e1364897d41bb09b54bbcb44c4'].",
"is_remediation": false,
"id": 3197,
"name": "Wait For Cloud Analysis Report"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 8
},
{
"id": 128,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-21T12:58:08.365Z",
"end_date": "2015-04-21T13:02:43.200Z",
"affected_hosts": ["WIN7-ULT-X86.auto.lab"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 36,
"remediation_actions": [
{
"details": "Quarantine \"C:\\temp\\2.exe\" with passphrase:None.",
"id": 3126,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"2.exe\" pid:1984.",
"id": 3125,
"name": "Kill Process"
},
{
"details": "Release \"C:\\temp\\2.exe\" from process name:\"2.exe\" pid:1984.",
"id": 3123,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\2.exe\" with passphrase:None.",
"id": 3121,
"name": "Quarantine A File"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"C:\\temp\\2.exe\" from process name:\"2.exe\" pid:1984.",
"id": 3123,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\2.exe\" with passphrase:None.",
"id": 3121,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Analyzing 694 files using AIRS Cloud srvice.",
"is_remediation": false,
"id": 3148,
"name": "Analyze Multiple Files"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 8
}
]
}

Просмотреть файл

@ -0,0 +1,351 @@
{
"count": 6,
"next": null,
"previous": null,
"results": [
{
"id": 70,
"name": "Symantec Virus Found syslog",
"start_date": "2015-04-14T13:50:48.035Z",
"end_date": "2015-04-14T14:24:55.655Z",
"affected_hosts": ["WIN81-X64"],
"affected_groups": [""],
"user": "Yossi",
"affected_users": [],
"total_actions": 49,
"remediation_actions": [
{
"details": "Terminate(kill) process name:\"evil.exe\" pid:2032.",
"id": 1850,
"name": "Kill Process"
},
{
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:2032.",
"id": 1848,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\temp\\1.exe\" with passphrase:None.",
"id": 1846,
"name": "Quarantine A File"
},
{
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
"id": 1845,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"1.exe\" pid:3648.",
"id": 1844,
"name": "Kill Process"
},
{
"details": "Release \"c:\\temp\\1.exe\" from process name:\"1.exe\" pid:3648.",
"id": 1839,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\temp\\1.exe\" with passphrase:None.",
"id": 1837,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\temp\".",
"id": 1831,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
"id": 1817,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"file in space.exe\" pid:3100.",
"id": 1816,
"name": "Kill Process"
},
{
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:3100.",
"id": 1814,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
"id": 1812,
"name": "Quarantine A File"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Release \"c:\\temp\\evil.exe\" from process name:\"evil.exe\" pid:2032.",
"id": 1848,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\temp\\evil.exe\" with passphrase:None.",
"id": 1845,
"name": "Quarantine A File"
},
{
"details": "Release \"c:\\temp\\1.exe\" from process name:\"1.exe\" pid:3648.",
"id": 1839,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\temp\\1.exe\" with passphrase:None.",
"id": 1837,
"name": "Quarantine A File"
},
{
"details": "Release \"C:\\temp\\file in space.exe\" from process name:\"file in space.exe\" pid:3100.",
"id": 1814,
"name": "Release File Handle"
},
{
"details": "Quarantine \"C:\\temp\\file in space.exe\" with passphrase:None.",
"id": 1812,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Terminate(kill) process name:\"evil.exe\" pid:2032.",
"is_remediation": true,
"id": 1850,
"name": "Kill Process"
},
"important": false,
"detection_system": "e2e",
"error_description": "Canceled by YOSSIK",
"status": 9
},
{
"id": 45,
"name": "McAfee Port Blocking",
"start_date": "2015-04-13T07:25:28.355Z",
"end_date": null,
"affected_hosts": ["win8-x86"],
"affected_groups": [""],
"affected_users": [
"AUTO\\Administrator",
"WIN8-X86\\DWM-1"
],
"total_actions": 10,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [
{
"details": "Lists all PEs in \"C:\\Users\\Administrator\\Downloads\".",
"id": 1141,
"name": "Find Files In Directory"
},
{
"details": "List all running processes on ()win8-x86@2.0.0.6.",
"id": 1140,
"name": "Get Process List"
},
{
"details": "Lists all PEs in \"C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\Outlook\".",
"id": 1139,
"name": "Find Files In Directory"
},
{
"details": "Get active connections list.",
"id": 1137,
"name": "Get All Active Connections"
}
],
"last_action": {
"details": "Get all executable files created in last 3600 seconds.",
"is_remediation": false,
"id": 1143,
"name": "Get Recently Created Files"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 9
},
{
"id": 44,
"name": "McAfee Abnormal Host Behavior",
"start_date": "2015-04-13T06:58:30.775Z",
"end_date": "2015-04-13T07:06:22.590Z",
"affected_hosts": ["win8-x86"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 38,
"remediation_actions": [
{
"details": "Quarantine 1 files in directory \"c:\\windows\\system32\".",
"id": 1121,
"name": "Quarantine Files In Directory"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 1120,
"name": "Quarantine A File"
},
{
"details": "Terminate(kill) process name:\"sus.exe\" pid:1180.",
"id": 1119,
"name": "Kill Process"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:1180.",
"id": 1117,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 1115,
"name": "Quarantine A File"
},
{
"details": "Quarantine 1 files in directory \"c:\\windows\".",
"id": 1111,
"name": "Quarantine Files In Directory"
}
],
"pending_actions": [],
"failed_actions": [
{
"details": "Calculate hash values for 762 files.",
"id": 1124,
"name": "Get Files Hashes"
},
{
"details": "Release \"c:\\windows\\sus.exe\" from process name:\"sus.exe\" pid:1180.",
"id": 1117,
"name": "Release File Handle"
},
{
"details": "Quarantine \"c:\\windows\\sus.exe\" with passphrase:None.",
"id": 1115,
"name": "Quarantine A File"
}
],
"last_action": {
"details": "Checks that file C:\\Windows\\System32\\drivers\\etc\\hosts status \"not_found\" requires quarantine.",
"is_remediation": false,
"id": 1133,
"name": "Decide On File Quarantine"
},
"important": false,
"detection_system": "e2e",
"error_description": "",
"status": 9
},
{
"id": 38,
"name": "Symantec Virus Found",
"start_date": "2015-04-12T14:44:59.525Z",
"end_date": null,
"affected_hosts": ["xp-x86-sp3"],
"affected_groups": [""],
"affected_users": ["AUTO\\Administrator"],
"total_actions": 13,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [
{
"details": "Lists all PEs in \"C:\\Users\\Administrator\\Downloads\".",
"id": 1010,
"name": "Find Files In Directory"
},
{
"details": "List all services installed on ()xp-x86-sp3@2.0.0.10.",
"id": 1009,
"name": "Get Service List"
},
{
"details": "Lists all PEs in \"C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\Outlook\".",
"id": 1008,
"name": "Find Files In Directory"
},
{
"details": "List all running processes on ()xp-x86-sp3@2.0.0.10.",
"id": 1006,
"name": "Get Process List"
},
{
"details": "Check for known persistency method on host ()xp-x86-sp3@2.0.0.10, filter=[None].",
"id": 1005,
"name": "Persistency Check"
},
{
"details": "Get active connections list.",
"id": 1004,
"name": "Get All Active Connections"
},
{
"details": "Check \"C:\\testfile.txt\" exists on ()xp-x86-sp3@2.0.0.10.",
"id": 1003,
"name": "File Exists"
}
],
"last_action": {
"details": "Get all executable files created in last 3600 seconds.",
"is_remediation": false,
"id": 1011,
"name": "Get Recently Created Files"
},
"important": false,
"detection_system": "sanity",
"error_description": "",
"status": 9
},
{
"id": 35,
"name": "Symantec Virus Found",
"start_date": "2015-04-12T13:37:09.216Z",
"end_date": null,
"affected_hosts": ["xp-x86-sp3"],
"affected_groups": [""],
"affected_users": [],
"total_actions": 3,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [],
"last_action": {
"details": "Get hostname from host",
"is_remediation": false,
"id": 960,
"name": "Get Hostname From Host"
},
"important": false,
"detection_system": "sanity",
"error_description": "",
"status": 9
},
{
"id": 34,
"name": "Symantec Virus Found",
"start_date": "2015-04-12T13:15:29.034Z",
"end_date": "2015-04-12T13:44:55.290Z",
"affected_hosts": ["xp-x64"],
"affected_groups": [""],
"affected_users": [],
"total_actions": 6,
"remediation_actions": [],
"pending_actions": [],
"failed_actions": [
{
"details": "Get hostname from host",
"id": 954,
"name": "Get Hostname From Host"
}
],
"last_action": {
"details": "Get hostname from host",
"is_remediation": false,
"id": 957,
"name": "Get Hostname From Host"
},
"important": false,
"detection_system": "sanity",
"error_description": "",
"status": 9
}
]
}

Просмотреть файл

@ -0,0 +1,14 @@
{
"0":31,
"1":81,
"2":22,
"3":41,
"4":2,
"5":5,
"6":3855,
"7":12,
"8":12,
"9":8,
"10":3,
"11": 1
}

Просмотреть файл

@ -0,0 +1,5 @@
{
"id": "YOSSI-PC",
"name": "yossi-pc",
"domain": "hexadite"
}

Просмотреть файл

@ -0,0 +1,98 @@
const express = require('express');
const fs = require("fs");
const bodyParser = require('body-parser');
const https = require("https");
var routeModules = [
//require("./modules/investigations.routes"),
//require("./modules/alerts.routes"),
//require("./modules/machines.routes")
];
var common = require("./mock_common");
var app = express();
var jsonParser = bodyParser.json();
var busboy = require('connect-busboy');
function customHeaders(req, res, next) {
// Switch off the default 'X-Powered-By: Express' header
app.disable('connection');
res.removeHeader("connection");
next();
}
routeModules.forEach(function (routeModule) {
routeModule.init(app, jsonParser);
});
app.use(customHeaders);
app.use(jsonParser);
app.use(busboy());
/**
* All other API calls return the corresponding file inside the api_mock_data folder
*/
app.use(function (req, res) {
// All delete requests are OK
if (req.method === "DELETE") {
setTimeout(function () {
res.status(200).end();
}, 1000);
}
else if (req.method === "PATCH" || req.method === "PUT") {
setTimeout(function () {
var obj = req.body;
res.status(200).json(obj);
}, 600);
}
else {
var mockDataFileUrl = req.originalUrl.replace(/^\/api\//, common.MOCK_DATA_FOLDER).replace(/\.json/, "").replace(/\?.+/, "");
var apiMatch = req.originalUrl.match(/^\/api\/([\w-_\d\/]+)\/([\w\d-_]+)?$/);
if (apiMatch){
var entity = apiMatch[1],
entityId = apiMatch[2];
// If the URL ends with '/', we expect all the data in the folder, which is mocked by the 'all.json' file inside it:
mockDataFileUrl = common.MOCK_DATA_FOLDER + entity + "/" + entity.replace(/\//g, "_") + (entityId ? "_item" : "_all") + ".mock";
}
if (req.method === "POST") {
common.getFileData(mockDataFileUrl, function (error, data) {
if (error) {
setTimeout(function () {
var obj = req.body;
obj.id = Math.round(Math.random() * Math.pow(10, 10));
res.status(200).json(obj);
}, 1000);
}
else {
common.getResponseCallback(res)(null, data);
}
});
}
else {
common.getFileData(mockDataFileUrl, common.getResponseCallback(res));
}
}
});
//https.createServer(options, app).listen(port);
// http2
// .createServer(options, app)
// .listen(port, function(err){
// if (err)
// throw new Error(err);
//
// /* eslint-disable no-console */
// console.log('Listening on port: ' + port + '.');
// /* eslint-enable no-console */
// });
module.exports = app;

Просмотреть файл

@ -0,0 +1,72 @@
fs = require("fs");
var MOCK_DATA_FOLDER = "./data/";
var exports = module.exports = {
getFileData: getFileData,
getIdentifiableItem: getIdentifiableItem,
getResponseCallback: getResponseCallback,
MOCK_DATA_FOLDER: MOCK_DATA_FOLDER,
sendError: sendError
};
function sendError(status, errorText){
if (!status)
status = 500;
if (!errorText)
errorText = "SERVER ERROR";
return function(req, res){
res.status(status).send(errorText);
};
}
function getResponseCallback(res){
return function(err, data){
if (err)
res.status(404).end();
else
res.status(200).json(data);
}
}
/**
* Returns a function to handler requests with an ID, which all map to the same mock data file.
* @param path {String} The path of the single JSON file to return for any ID
* @param idProperty The ID property to add to the result JSON data (the value is the 'id' param in the URL)
* @returns {Function}
*/
function getIdentifiableItem(path, idProperty){
var itemMockDataFolder = MOCK_DATA_FOLDER + path;
return function(req, res){
getFileData(itemMockDataFolder, function(err, itemData){
if (err) {
res.status(404).end()
}
else {
var id = parseInt(req.params.id, 10);
itemData[idProperty || "id"] = !isNaN(id) ? id : req.params.id;
res.json(itemData);
}
});
};
}
function getFileData(filePath, callback){
fs.readFile(filePath + ".json", "utf8", function(err, data){
if (err) {
console.error("ERROR reading file: ", filePath);
callback(err);
}
else {
try {
var fileData = JSON.parse(data);
callback(null, fileData);
}
catch(e){
console.error("ERROR parsing json: " + filePath + data + ": " + e.message);
callback("ERROR parsing json: " + filePath);
}
}
});
}

Просмотреть файл

@ -0,0 +1,25 @@
common = require("../../mock_common");
var adminRouteModules = [
require("./admin_keys.routes"),
require("./admin_settings.routes")
];
module.exports.init = function(app){
adminRouteModules.forEach(function(routeModule){
routeModule.init(app);
});
app.post("/api/admin/license/activate", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "admin/license/all", common.getResponseCallback(res));
});
app.post("/api/admin/quarantine_password/unveil", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "admin/quarantine_password/unveil", common.getResponseCallback(res));
});
app.get("/api/admin/systeminfo/all", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "admin/systeminfo/all", common.getResponseCallback(res));
});
};

Просмотреть файл

@ -0,0 +1,28 @@
common = require("../../mock_common");
fs = require("fs");
module.exports.init = function(app){
app.get("/api/admin/keys/csr/request", function(req, res){
var responseCbk = common.getResponseCallback(res);
fs.readFile(common.MOCK_DATA_FOLDER + "admin/keys/csr/request.txt", "utf8", function(err, data){
if (err)
responseCbk(err);
else {
responseCbk(null, data);
}
});
});
app.post("/api/admin/keys/csr/request", function(req, res){
setTimeout(function() {
common.getFileData(common.MOCK_DATA_FOLDER + "admin/keys/csr/request", common.getResponseCallback(res));
}, 3000);
});
app.post("/api/admin/keys/csr/response", function(req, res){
setTimeout(function() {
common.getFileData(common.MOCK_DATA_FOLDER + "admin/keys/csr/response", common.getResponseCallback(res));
}, 2000);
});
};

Просмотреть файл

@ -0,0 +1,54 @@
common = require("../../mock_common");
module.exports.init = function(app){
app.put("/api/admin/settings/organization/all", function(req, res){
res.status(200).json({ detail: "BAD BAD NOT GOOD"});
});
app.post("/api/admin/settings/domains/validate_groups", function(req, res){
res.status(200).json({"valid":false,"errors":["Group with name AirsAdminssdfsdss does not exist"]});
});
app.post("/api/admin/domains", function(req, res){
setTimeout(function(){
var obj = req.body;
obj.id = Math.round(Math.random() * Math.pow(10, 10));
res.status(200).json(obj);
}, 1000);
});
app.get("/api/admin/domains/", function(req, res){
setTimeout(function(){
common.getFileData(common.MOCK_DATA_FOLDER + "admin/domains", common.getResponseCallback(res));
}, 1000);
});
app.get("/api/admin/settings/domains/dns", function(req, res){
setTimeout(function(){
common.getFileData(common.MOCK_DATA_FOLDER + "admin/dns", common.getResponseCallback(res));
}, 1000);
});
app.post("/api/admin/settings/:settingsGroup/validate_:settingId", function(req, res){
setTimeout(function(){
common.getFileData(common.MOCK_DATA_FOLDER + "admin/settings/validate_setting", common.getResponseCallback(res));
}, 2000);
});
app.post("/api/admin/settings/verify_user", function(req, res){
setTimeout(function(){
common.getFileData(common.MOCK_DATA_FOLDER + "admin/settings/verify_user", common.getResponseCallback(res));
}, 1000);
});
app.get("/api/admin/settings/:settingsGroup/:settingId", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "admin/settings/values/settings." + req.params.settingsGroup, function(err, data){
if (err)
res.status(404).end();
else{
setTimeout(function(){
res.status(200).json(req.params.settingId === "all" ? { "data": data } : data[req.params.settingId]);
}, 400);
}
});
});
};

Просмотреть файл

@ -0,0 +1,20 @@
common = require("../mock_common");
var url = require('url');
module.exports.init = function(app){
app.get("/api/alerts", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "alerts/alerts_mock", common.getResponseCallback(res));
});
app.get("/api/alerts/filters", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "alerts/alerts_filters", common.getResponseCallback(res));
});
app.get("/api/alerts/count_by_type", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "alerts/count_by_type", common.getResponseCallback(res));
});
app.get("/api/alerts/:id", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "alerts/alert_mock", common.getResponseCallback(res));
});
};

Просмотреть файл

@ -0,0 +1,72 @@
common = require("../mock_common");
var investigationStatuses = {
"3": "fully_remediated",
"9": "terminated_by_airs",
"14": "benign",
"15": "terminated_by_user",
"16": "pending_user",
"17": "running",
"18": "pending_resource"
};
module.exports.init = function(app){
app.get("/api/investigations/:id(\\d+)", function(req, res){
var investigationStatus = investigationStatuses[String(req.params.id)],
investigationMockUrl = investigationStatus ? "investigations_by_status/investigation." + investigationStatus + ".mock" : "investigation_mock";
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/" + investigationMockUrl, common.getResponseCallback(res));
});
app.get("/api/investigations/filters", function(req, res){
setTimeout(function(){
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/investigation_filters_mock", common.getResponseCallback(res));
}, 500)
});
app.get("/api/investigations/:investigationId/export", function(req, res){
setTimeout(function(){
res.status(500).send("Couldn't export investigation.");
}, 3000);
});
app.get("/api/investigations/all", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/all", sendResponse);
function setToPageSize(data){
if (data && req.query.page_size)
data.results = data.results.slice(0, req.query.page_size);
}
function sendResponse(error, data){
setToPageSize(data);
if (error)
res.status(200).json({ count: 0, results: [] });
else
res.status(200).json(data);
}
});
app.get("/api/investigations/:id/hosts/filters/search", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/hosts/investigation_hosts_filter_search", common.getResponseCallback(res));
});
app.get("/api/investigations/:id/actions", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/actions/investigation_actions_mock", common.getResponseCallback(res));
});
app.get("/api/investigations/:id/actions/filters", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/actions/investigation_actions_filters", common.getResponseCallback(res));
});
app.get("/api/investigations/:id/actions/filters/search", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/actions/investigation_actions_filter_search", common.getResponseCallback(res));
});
app.patch("/api/investigations/:id", function(req, res){
// Adding timeout to simulate server time:
res.setTimeout(1000, function(){
common.getFileData(common.MOCK_DATA_FOLDER + "investigations/patch_investigation", common.getResponseCallback(res));
});
});
};

Просмотреть файл

@ -0,0 +1,19 @@
common = require("../mock_common");
module.exports.init = function(app){
app.get("/api/machines/all", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "machines/machines_mock", common.getResponseCallback(res));
});
app.get("/api/machines/filters", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "machines/machines_filters", common.getResponseCallback(res));
});
app.get("/api/machines/count_by_type", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "machines/count_by_type", common.getResponseCallback(res));
});
app.get("/api/machines/:id", function(req, res){
common.getFileData(common.MOCK_DATA_FOLDER + "machines/machine_mock", common.getResponseCallback(res));
});
};

11
mock_server/package.json Normal file
Просмотреть файл

@ -0,0 +1,11 @@
{
"name": "mockAPI",
"version": "0.0.0",
"dependencies": {
"body-parser": "^1.14.1",
"connect-busboy": "0.0.2",
"express": "5.0.0-alpha.5",
"express-ws": "^3.0.0",
"http2": "latest"
}
}

14
mock_server/server.js Normal file
Просмотреть файл

@ -0,0 +1,14 @@
const port = 5001;
var httpApp = require('./http-server');
var server = require('./ws-server');
server.on('request', httpApp);
server.listen(port, function (err) {
if (err)
throw new Error(err);
console.log('Listening on port: ' + port + '.');
});

53
mock_server/ws-server.js Normal file
Просмотреть файл

@ -0,0 +1,53 @@
'use strict';
var WsServer = require('ws').Server;
var server = require('http').createServer();
// Create web socket server on top of a regular http server
var wss = new WsServer({
server: server,
path: '/ws'
});
var modules = [
];
var availableStreams = new Map(modules.map(function(module){
var s = module.stream;
return [s.streamName, s]
}));
wss.on('connection', function connection(ws) {
var registeredStreams = [];
ws.on('message', function incoming(message) {
var parsedMessage = JSON.parse(message);
console.log('got message: ' + message);
var streamName = parsedMessage.stream;
var stream = streamName ? availableStreams.get(streamName) : null;
if (parsedMessage.action === 'register'){
if (stream){
stream.startStream(ws);
registeredStreams.push(stream);
}
}
if (parsedMessage.action === 'unregister'){
if (stream){
stream.stopStream();
}
}
});
ws.on('error', function error(err){
registeredStreams.forEach(function(stream){
console.log('stopping stream ' + stream);
stream.stopStream();
})
});
});
module.exports = server;

161
package.json Normal file
Просмотреть файл

@ -0,0 +1,161 @@
{
"name": "Paris",
"version": "1.0.0",
"description": "Library for the implementation of Domain Driven Design in Angular/TypeScript apps",
"repository": {
"url": "https://github.com/microsoft/paris.ts"
},
"scripts": {
"build.dev": "gulp build.dev --color --env-config dev",
"build.dev.watch": "gulp build.dev.watch --color",
"build.e2e": "gulp build.e2e --color",
"build.prod": "gulp build.prod --color --env-config prod --build-type prod",
"build.prod.exp": "gulp build.prod.aot --color --env-config prod --build-type prod",
"build.prod.rollup.aot": "gulp build.prod.rollup.aot --color --env-config prod --build-type prod",
"build.prod.aot": "gulp build.prod.aot --color --env-config prod --build-type prod",
"build.test": "gulp build.test --color",
"test.watch": "gulp test.watch --color",
"generate.manifest": "gulp generate.manifest --color",
"e2e": "protractor",
"e2e.live": "protractor --elementExplorer",
"gulp": "gulp",
"i18n": "gulp i18n.build --build-type prod && ng-xi18n -p dist/tmp/tsconfig.json --i18nFormat xlf && gulp i18n.merge",
"lint": "gulp tslint",
"karma": "karma",
"karma.start": "karma start",
"postinstall": "gulp check.versions && gulp build.bundle.rxjs && gulp webdriver && gulp print.banner",
"reinstall": "npm cache clean && npm install",
"serve.coverage": "gulp serve.coverage --color",
"serve.dev": "gulp serve.dev --color --env-config dev",
"serve.e2e": "gulp serve.e2e --color",
"serve.prod": "gulp serve.prod --color --env-config prod --build-type prod",
"serve.prod.aot": "gulp serve.prod.aot --color --env-config prod --build-type prod",
"serve.prod.exp": "gulp serve.prod.aot --color --env-config prod --build-type prod",
"serve.prod.rollup.aot": "gulp serve.prod.rollup.aot --color --env-config prod --build-type prod",
"sme.prod": "gulp sme.prod --color --env-config prod --build-type prod --preserve-source-maps",
"sme.prod.aot": "gulp sme.prod.aot --color --env-config prod --build-type prod --preserve-source-maps",
"sme.prod.rollup.aot": "gulp sme.prod.rollup.aot --color --env-config prod --build-type prod --preserve-source-maps",
"start": "gulp serve.dev --color",
"start.deving": "gulp start.deving --color",
"tasks.list": "gulp --tasks-simple --color",
"test": "gulp test --color",
"e2e.ci": "gulp build.prod.rollup.aot --color && gulp build.e2e --color && gulp e2e --color",
"tests.all": "npm test && npm run e2e.ci",
"webdriver-start": "node ./node_modules/protractor/bin/webdriver-manager start",
"webdriver-update": "node ./node_modules/protractor/bin/webdriver-manager update",
"compodoc": "./node_modules/.bin/compodoc -p src/client/tsconfig.json",
"serve.compodoc": "./node_modules/.bin/compodoc -s"
},
"author": "Yossi Kolesnicov",
"license": "MIT",
"devDependencies": {
"@angular/compiler-cli": "^5.0.0-beta.6",
"@angular/platform-server": "^5.0.0-beta.6",
"@compodoc/compodoc": "^1.0.0-beta.7",
"@types/async": "^2.0.32",
"@types/browser-sync": "^0.0.36",
"@types/express": "^4.0.33",
"@types/gulp": "^4.0.0",
"@types/gulp-filter": "^3.0.29",
"@types/gulp-htmlmin": "^1.3.30",
"@types/gulp-load-plugins": "^0.0.30",
"@types/gulp-protractor": "^1.0.30",
"@types/gulp-sass": "^0.0.30",
"@types/gulp-util": "^3.0.29",
"@types/jasmine": "^2.5.52",
"@types/node": "^8.0.25",
"@types/rimraf": "2.0.2",
"@types/run-sequence": "^0.0.29",
"@types/selenium-webdriver": "^3.0.3",
"@types/systemjs": "^0.20.2",
"@types/yargs": "^8.0.2",
"async": "^2.1.1",
"autoprefixer": "^7.0.1",
"browser-sync": "^2.17.3",
"codelyzer": "^3.1.2",
"connect-history-api-fallback": "^1.3.0",
"cssnano": "^3.7.7",
"deep-extend": "^0.5.0",
"event-stream": "^3.3.4",
"express": "~4.15.2",
"express-history-api-fallback": "^2.0.0",
"gulp": "^3.9.1",
"gulp-cached": "^1.1.0",
"gulp-cheerio": "^0.6.2",
"gulp-concat": "^2.6.0",
"gulp-concat-css": "^2.3.0",
"gulp-filter": "^5.0.0",
"gulp-htmlmin": "^3.0.0",
"gulp-inject": "^4.1.0",
"gulp-inline-ng2-template": "^4.0.0",
"gulp-load-plugins": "^1.3.0",
"gulp-plumber": "~1.1.0",
"gulp-postcss": "^7.0.0",
"gulp-progeny": "^0.4.0",
"gulp-protractor": "^3.0.0",
"gulp-rename": "^1.2.2",
"gulp-replace": "^0.6.1",
"gulp-sass": "^3.0.0",
"gulp-sourcemaps": "2.6.0",
"gulp-template": "^4.0.0",
"gulp-tslint": "^8.0.0",
"gulp-typescript": "~3.2.2",
"gulp-uglify": "^3.0.0",
"gulp-util": "^3.0.7",
"gulp-watch": "^4.3.10",
"http-proxy-middleware": "^0.17.4",
"is-ci": "^1.0.9",
"isstream": "^0.1.2",
"jasmine-core": "~2.6.1",
"jasmine-spec-reporter": "^4.1.0",
"karma": "~1.7.1",
"karma-chrome-launcher": "~2.2.0",
"karma-coverage": "^1.1.1",
"karma-jasmine": "~1.1.0",
"karma-mocha-reporter": "^2.2.0",
"karma-remap-istanbul": "^0.6.0",
"merge-stream": "^1.0.0",
"minimatch": "^3.0.3",
"open": "0.0.5",
"protractor": "^4.0.14",
"remap-istanbul": "^0.9.5",
"rimraf": "^2.5.4",
"rollup": "^0.43.0",
"rollup-plugin-commonjs": "^8.0.2",
"rollup-plugin-includepaths": "0.2.2",
"rollup-plugin-node-resolve": "^3.0.0",
"run-sequence": "^1.2.2",
"semver": "^5.3.0",
"serve-static": "^1.11.1",
"slash": "~1.0.0",
"source-map-explorer": "^1.4.0",
"supports-color": "^3.1.2",
"systemjs-builder": "0.16.9",
"temp": "^0.8.3",
"tildify": "^1.2.0",
"traceur": "^0.0.111",
"ts-node": "^3.0.4",
"tslint": "^5.0.0",
"tslib": "latest",
"typescript": "2.4.2",
"walk": "^2.3.9",
"yargs": "^8.0.1"
},
"dependencies": {
"@angular/animations": "^5.0.0-beta.6",
"@angular/common": "^5.0.0-beta.6",
"@angular/compiler": "^5.0.0-beta.6",
"@angular/core": "^5.0.0-beta.6",
"@angular/forms": "^5.0.0-beta.6",
"@angular/http": "^5.0.0-beta.6",
"@angular/platform-browser": "^5.0.0-beta.6",
"@angular/platform-browser-dynamic": "^5.0.0-beta.6",
"@angular/router": "^5.0.0-beta.6",
"@angular/service-worker": "^1.0.0-beta.16",
"core-js": "^2.4.1",
"intl": "^1.2.5",
"rxjs": "^5.4.2",
"systemjs": "0.20.14",
"zone.js": "0.8.12"
}
}

49
protractor.conf.js Normal file
Просмотреть файл

@ -0,0 +1,49 @@
const config = {
baseUrl: 'http://localhost:5555/',
specs: [
'./dist/e2e/**/*.e2e-spec.js'
],
exclude: [],
// 'jasmine' by default will use the latest jasmine framework
framework: 'jasmine',
// allScriptsTimeout: 110000,
jasmineNodeOpts: {
// showTiming: true,
showColors: true,
isVerbose: false,
includeStackTrace: false,
// defaultTimeoutInterval: 400000
},
directConnect: true,
capabilities: {
browserName: 'chrome'
},
onPrepare: function() {
browser.ignoreSynchronization = false;
},
/**
* Angular 2 configuration
*
* useAllAngular2AppRoots: tells Protractor to wait for any angular2 apps on the page instead of just the one matching
* `rootEl`
*/
useAllAngular2AppRoots: true
};
if (process.env.TRAVIS) {
config.capabilities = {
browserName: 'firefox'
};
}
exports.config = config;

Просмотреть файл

@ -0,0 +1,16 @@
import {Entity} from "../paris/entity/entity.decorator";
import {Identifiable} from "./base/identifiable.model";
import {EntityField} from "../paris/entity/entity-field.decorator";
@Entity({
singularName: "Alert Status",
pluralName: "Alert Statuses",
endpoint: "alerts/status",
loadAll: true
})
export class AlertStatusModel extends Identifiable<number> {
@EntityField({
name: "Category"
})
category:string;
}

Просмотреть файл

@ -0,0 +1,33 @@
import {Entity} from "../paris/entity/entity.decorator";
import {Identifiable} from "./base/identifiable.model";
import {EntityField} from "../paris/entity/entity-field.decorator";
import {MachineModel} from "./machine.model";
import {AlertStatusModel} from "./alert-status.model";
@Entity({
singularName: "Alert",
pluralName: "Alerts",
endpoint: "alerts"
})
export class AlertModel extends Identifiable<string> {
@EntityField({
name: "Name",
data: "title"
})
name?: string;
@EntityField({
name: "Status"
})
status:AlertStatusModel;
@EntityField({
name: "Machine"
})
machine?:MachineModel;
@EntityField({
name: "Host"
})
host?:MachineModel;
}

Просмотреть файл

@ -0,0 +1,23 @@
import {EntityField} from "../../paris/entity/entity-field.decorator";
import {IIdentifiable} from "../../paris/models/identifiable.model";
export abstract class Identifiable<T extends string | number> implements IIdentifiable{
@EntityField({
name: "ID"
})
id:T;
@EntityField({
name: "Name"
})
name?:string;
constructor(data:IdentifiableData<T>){
Object.assign(this, data);
}
}
export interface IdentifiableData<T extends string | number>{
id:T,
name?:string
}

Просмотреть файл

@ -0,0 +1,15 @@
import {Identifiable} from "./base/identifiable.model";
import {Entity} from "../paris/entity/entity.decorator";
import {EntityField} from "../paris/entity/entity-field.decorator";
@Entity({
singularName: "Machine",
pluralName: "Machines",
endpoint: "machines"
})
export class MachineModel extends Identifiable<string> {
@EntityField({
name: "Domain"
})
domain:string;
}

Просмотреть файл

@ -0,0 +1,15 @@
import { NgModule } from '@angular/core';
import { RouterModule } from '@angular/router';
@NgModule({
imports: [
RouterModule.forRoot([
/* define app module routes here, e.g., to lazily load a module
(do not place feature module routes here, use an own -routing.module.ts in the feature instead)
*/
])
],
exports: [RouterModule]
})
export class AppRoutingModule { }

Просмотреть файл

@ -0,0 +1,26 @@
:host {
flex: 1 1 100%;
display: flex;
flex-flow: column;
padding: 1rem;
}
table{
border: solid 1px #ddd;
}
table td, table th{
text-align: left;
padding: 6px 10px;
}
thead tr{
background: #106cc8;
color: White;
}
tr + tr{
border-top: solid 1px #eaeaea;
}

Просмотреть файл

@ -0,0 +1,39 @@
<div *ngIf="alert">
<h2>Alert</h2>
<table>
<tr>
<th>Title</th>
<td>{{alert.name}}</td>
</tr>
<tr>
<th>Status</th>
<td>{{alert.status.name}}</td>
</tr>
<tr>
<th>Machine</th>
<td>{{alert.machine.domain}}\{{alert.machine.name}}</td>
</tr>
</table>
</div>
<hr />
<div *ngIf="alerts">
<h2>Alerts DataSet</h2>
<table>
<thead>
<tr>
<th>ID</th>
<th>Name</th>
<th>Status</th>
<th>Machine</th>
</tr>
</thead>
<tbody>
<tr *ngFor="let alert of alerts">
<td>{{alert.id}}</td>
<td>{{alert.name}}</td>
<td>{{alert.status.name}}</td>
<td>{{alert.machine.name}} ({{alert.machine.domain || 'No Domain'}})</td>
</tr>
</tbody>
</table>
</div>

Просмотреть файл

@ -0,0 +1,41 @@
import {Component} from '@angular/core';
import './operators';
import {RepositoryManagerService} from "./paris/repository/repository-manager.service";
import {AlertModel} from "./@model/alert.model";
import {MachineModel} from "./@model/machine.model";
import {Repository} from "./paris/repository/repository";
import {DataSet} from "./paris/data/dataset";
/**
* This class represents the main application component.
*/
@Component({
moduleId: module.id,
selector: 'sd-app',
templateUrl: 'app.component.html',
styleUrls: ['app.component.css'],
})
export class AppComponent {
alert:AlertModel;
machine:MachineModel;
alerts:Array<AlertModel>;
constructor(repositoriesManagerService: RepositoryManagerService) {
let alertsRepo:Repository<AlertModel> = repositoriesManagerService.getRepository(AlertModel);
alertsRepo.getItemById("123")
.subscribe((alert:AlertModel) => {
console.log("alert: ", alert);
this.alert = alert;
}, error => console.error("ERROR", error));
alertsRepo.getItemsDataSet().subscribe((alerts:DataSet<AlertModel>) => {
console.log("Alerts: ", alerts);
this.alerts = alerts.results;
});
let machinesRepo:Repository<MachineModel> = repositoriesManagerService.getRepository(MachineModel);
machinesRepo.getItemById("yossi-pc")
.subscribe((machine:MachineModel) => console.log("Machine: ", machine));
}
}

Просмотреть файл

@ -0,0 +1,35 @@
import {NgModule} from '@angular/core';
import {BrowserModule} from '@angular/platform-browser';
import {APP_BASE_HREF} from '@angular/common';
import {AppComponent} from './app.component';
import {AppRoutingModule} from './app-routing.module';
import {ParisModule} from "./paris/paris.module";
import {HttpClient, HttpClientModule} from "@angular/common/http";
import {DataStoreService} from "./paris/services/data-store/data-store.service";
import {dataStoreServiceFactory} from "./paris/services/data-store/data-store.service.provider";
import {ParisConfigService} from "./paris.config.service";
import {ParisConfig} from "./paris/config/paris-config";
const parisConfig:ParisConfig = {
apiRoot: "api"
};
@NgModule({
imports: [
BrowserModule,
HttpClientModule,
AppRoutingModule,
ParisModule.forRoot(parisConfig)
],
declarations: [AppComponent],
providers: [
{
provide: APP_BASE_HREF,
useValue: '<%= APP_BASE %>'
}
],
bootstrap: [AppComponent]
})
export class AppModule {
}

Просмотреть файл

@ -0,0 +1,31 @@
// import { TRANSLATIONS, TRANSLATIONS_FORMAT, LOCALE_ID } from '@angular/core';
//
// export class TranslationProviders {
//
// public getTranslationFile = (): Promise<any> => {
// let noProviders: Object[] = [];
//
// // Define a way to retrieve the local information
// let locale: string = 'en-US';
//
// // Set the directory to the translation files
// let file: string = `../assets/locale/messages.${locale}.xlf`;
//
// if(!locale || locale === 'en-US') return Promise.resolve(noProviders);
//
// return new Promise(function (resolve, reject) {
// let xhr = new XMLHttpRequest;
// xhr.open('GET', file);
// xhr.onload = (data: any) => resolve(
// [
// { provide: TRANSLATIONS, useValue: data.target.response },
// { provide: TRANSLATIONS_FORMAT, useValue: 'xlf' },
// { provide: LOCALE_ID, useValue: locale }
// ]
// );
// xhr.onerror = () => reject(noProviders);
// xhr.send();
// });
// }
// };
//

Просмотреть файл

@ -0,0 +1,23 @@
/**
* Bootstraps the application and makes the ROUTER_PROVIDERS and the APP_BASE_HREF available to it.
* @see https://angular.io/docs/ts/latest/api/platform-browser-dynamic/index/bootstrap-function.html
*/
import { enableProdMode } from '@angular/core';
import { platformBrowser } from '@angular/platform-browser';
import { AppModuleNgFactory } from './app.module.ngfactory';
enableProdMode();
platformBrowser().bootstrapModuleFactory(AppModuleNgFactory);
// In order to start the Service Worker located at "/worker-basic.min.js"
// uncomment this line. More about Service Workers here
// https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API/Using_Service_Workers
//
// if ('serviceWorker' in navigator) {
// (<any>navigator).serviceWorker.register('/worker-basic.min.js').then((registration: any) =>
// console.log('ServiceWorker registration successful with scope: ', registration.scope))
// .catch((err: any) =>
// console.log('ServiceWorker registration failed: ', err));
// }

35
src/client/app/main.ts Normal file
Просмотреть файл

@ -0,0 +1,35 @@
/**
* Bootstraps the application and makes the ROUTER_PROVIDERS and the APP_BASE_HREF available to it.
* @see https://angular.io/docs/ts/latest/api/platform-browser-dynamic/index/bootstrap-function.html
*/
import { enableProdMode } from '@angular/core';
// The browser platform with a compiler
import { platformBrowserDynamic } from '@angular/platform-browser-dynamic';
// Load i18n providers
// import { TranslationProviders } from './i18n.providers';
// The app module
import { AppModule } from './app.module';
if (String('<%= BUILD_TYPE %>') === 'prod') { enableProdMode(); }
// Compile and launch the module with i18n providers
// let TP = new TranslationProviders();
// TP.getTranslationFile().then((providers: any) => {
// const options: any = { providers };
platformBrowserDynamic().bootstrapModule(AppModule/*, options*/);
// });
// In order to start the Service Worker located at "/worker-basic.[min.]js"
// uncomment this line. More about Service Workers here
// https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API/Using_Service_Workers
//
// if ('serviceWorker' in navigator) {
// let workerScript = '/worker-basic';
// if (String('<%= BUILD_TYPE %>') === 'prod') { workerScript = workerScript + '.min'; }
// workerScript = workerScript + '.js';
// (<any>navigator).serviceWorker.register(workerScript).then((registration: any) =>
// console.log('ServiceWorker registration successful with scope: ', registration.scope))
// .catch((err: any) =>
// console.log('ServiceWorker registration failed: ', err));
// }

Просмотреть файл

@ -0,0 +1,15 @@
// rxjs
import 'rxjs/add/observable/throw';
import 'rxjs/add/operator/map';
import 'rxjs/add/operator/catch';
import 'rxjs/add/observable/of';
import 'rxjs/add/observable/combineLatest';
import 'rxjs/add/operator/do';
import 'rxjs/add/operator/mergeMap';
import 'rxjs/add/operator/share';
import 'rxjs/add/operator/finally';
import "reflect-metadata";
// ngrx
//import '@ngrx/core/add/operator/select';

Просмотреть файл

@ -0,0 +1,7 @@
import {Injectable} from "@angular/core";
import {ParisConfig} from "./paris/config/paris-config";
@Injectable()
export class ParisConfigService implements ParisConfig{
apiRoot:string = "/api222"
}

Просмотреть файл

@ -0,0 +1,4 @@
export interface ParisConfig{
apiRoot?:string,
allItemsProperty?:string
}

Просмотреть файл

@ -0,0 +1,4 @@
export interface DataSet<T>{
count:number,
results:Array<T>
}

Просмотреть файл

@ -0,0 +1,9 @@
import {IIdentifiable} from "../models/identifiable.model";
export interface DataEntityConstructor<T> extends DataEntityType{
new(data:IIdentifiable): T
}
export interface DataEntityType{
new(data:IIdentifiable):any
}

Просмотреть файл

@ -0,0 +1,5 @@
export class EntityAction{
name:string;
endpoint:string;
multiple?:boolean = true;
}

Просмотреть файл

@ -0,0 +1,16 @@
import {DataEntityType} from "./data-entity.base";
import {Field} from "./entity-field";
import {entityFieldsService} from "../services/entity-fields.service";
export function EntityField(fieldConfig:Field):PropertyDecorator {
return function (entityPrototype: DataEntityType, propertyKey: string | symbol) {
let propertyConstructor:DataEntityType = Reflect.getMetadata("design:type", entityPrototype, propertyKey);
let fieldConfigCopy:Field = Object.assign({}, fieldConfig);
if (!fieldConfigCopy.id)
fieldConfigCopy.id = String(propertyKey);
fieldConfigCopy.type = propertyConstructor;
entityFieldsService.addEntityField(entityPrototype, fieldConfigCopy);
}
}

Просмотреть файл

@ -0,0 +1,10 @@
import {DataEntityType} from "./data-entity.base";
export interface Field{
id?:string,
name:string,
data?:string,
entity?:DataEntityType,
type?:DataEntityType,
defaultValue?:any
}

Некоторые файлы не были показаны из-за слишком большого количества измененных файлов Показать больше