MalOp detection log (syslog CEF, event_id = Malop)

Type	Field	Name	Description
Date	_time	Time
String	event_name	Event name	e.g. Malop Created, Malop Updated, Malop Machine Information, Malop Machine Added, Malop Process Added, Malop User Added, Malop Connection Added
String	risk	Risk	LOW, MEDIUM, HIGH
String	activity_type	Activity type	e.g. RANSOMWARE, MALICIOUS_INFECTION
String	detect_type	Detection type	e.g. RANSOMWARE, EXTENSION_MANIPULATION
String	signature	Key suspicion	e.g. Shadow Copy Deletion
String	suspect	Suspect	e.g. sample.exe
String	affected_user	Affected user	e.g. user01
String	affected_machine_id	Affected machine ID	e.g. PC-0001
String	malop_id	MalOp ID	e.g. 11.-1234567890123456789
String	xref	Reference URL	e.g. https://edr.example.com:443/#/malop/11.-1234567890123456789
String	user	User	e.g. /user01@example.com
String	reason	Reason	e.g. whitelist, indifferent
String	detection_rule	Detection rule	e.g. My Detection Rule
Date	start_time	Start time
Date	suspect_created	Suspect creation time
Date	updated	Updated
Date	ingested_time	Ingested time
String	request_context	Request context	e.g. c:\program files (x86)\sample\sample.exe 2/pbpolicy
String	device_dns_domain	Device DNS domain	e.g. example.com
String	parent_process	Parent process	e.g. explorer.exe
String	children_process	Child processes	e.g. sample.exe
String	os_ver	OS version	e.g. Windows 10
Boolean	is_online	Online
Boolean	is_original_machine	Original machine
Boolean	is_signed	Signed
Integer	affected_machine_cnt	Affected machine count	e.g. 23
String	affected_machines	Affected machines	e.g. PC-0001, PC-0002
IP address	affected_machine_ip_addrs	Affected machine IP	e.g. 10.0.0.10
String	hostname	Affected machine domain	e.g. pc-0001.example.com
String	affected_machine_os_ver	Affected machine OS version	e.g. Windows 10
Integer	affected_user_cnt	Affected user count	e.g. 23
String	affected_user_domain	Affected user domain	e.g. EXAMPLE
String	affected_user_privilege	Affected user privilege	e.g. Administrator
Date	malicious_process_created	Malicious process creation time
Long	malicious_process_pid	Malicious process PID	e.g. 4820
String	malicious_process_name	Malicious process name	e.g. sample.exe
String	malicious_process_cmd	Malicious process command line	e.g. c:\users\user01\downloads\sample.exe -install
String	process_file_name	Process file name	e.g. sample.exe
String	process_file_path	Process file path	e.g. c:\users\user01\downloads\sample.exe
String	process_file_sha1	Process file SHA1	e.g. da39a3ee5e6b4b0d3255bfef95601890afd80709
String	process_file_md5	Process file MD5	e.g. d41d8cd98f00b204e9800998ecf8427e
Date	parent_process_created	Parent process creation time
Long	ppid	Parent process ID	e.g. 3120
String	parent_process_name	Parent process name	e.g. explorer.exe
String	parent_process_cmd	Parent process command line	e.g. c:\windows\explorer.exe