ahnlab-epp-unknowns
Fetch unknowns from AhnLab EPP
ahnlab-epp-unknowns [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss]
- duration=NUM{mon|w|d|h|m|s}
- Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10s
means data from 10 seconds earlier. - from=yyyyMMddHHmmss
- Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=yyyyMMddHHmmss
- End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
Output Fields
Field | Type | Name | Description |
---|---|---|---|
_time | Date | Time | |
profile | String | Connect profile | |
node_id | String | Node ID | |
node_edr_id | String | Node EDR ID | |
host_ip | IP address | Host IP | |
hostname | String | Hostname | |
user | String | User | |
platform_type | String | Platform type | |
status | String | Workflow status | |
md5 | String | MD5 | |
severity | Integer | Severity | |
ml_score | Double | ML score | |
file_name | String | File name | |
file_path | String | File path | |
watch_obj_id | String | Watch object ID | |
watch_workflow_status | String | Watch workflow status | |
platform_id | String | Platform ID | e.g. WINDOWS_10_ENTERPRISE_X64 |
connection_status | String | Connection status | e.g. CONNECTED |
fileless_type | Bool | Fileless type | |
exploit_type | Bool | Exploit type | |
privilege_type | Bool | Privilege type | |
ransomware_type | Bool | Ransomware type | |
network_type | Bool | Network type | |
injection_type | Bool | Injection type | |
infostealer_type | Bool | Infostealer type | |
system_setting_type | Bool | System setting type | |
etc_type | Bool | Other type |