Cybereason MalOp (API)

MalOp records collected from the MalOp management API (POST /rest/mmng/v2/malops)

#	Field	Type	Display name	Description
1	_time	DATE	시각
2	risk	STRING	위험도	HIGH, MEDIUM, LOW
3	signatures	STRING	공격명목록	e.g. RANSOMWARE
4	signature	STRING	공격명	e.g. Shadow Copy Deletion
5	activity_type	STRING	활동유형	e.g. RANSOMWARE
6	decision_statuses	STRING	결정상태
7	investigation_status	STRING	조사상태	Pending, Reopened, UnderInvestigation, OnHold, Closed
8	status	STRING	상태	Active, Inactive, Resolved, Excluded
9	detection_engines	STRING	탐지엔진	e.g. EDR, NGAV
10	mitre_tactics	STRING	MITRE전술	e.g. TA0040
11	mitre_techniques	STRING	MITRE기법	e.g. T1486
12	file_name	STRING	파일이름	e.g. sample.exe
13	created	DATE	생성시각
14	updated	DATE	수정시각
15	meta_updated	DATE	메타수정시각
16	root_cause_hash	STRING	루트원인해시	e.g. da39a3ee5e6b4b0d3255bfef95601890afd80709
17	root_cause_type	STRING	루트원인유형	e.g. Process, File
18	malop_type	STRING	Malop유형
19	close_admin	STRING	종결관리자	e.g. /user01@example.com
20	is_escalated	BOOL	에스컬레이션여부
21	is_edr	BOOL	EDR여부
22	group_id	STRING	그룹ID	e.g. 00000000-0000-0000-0000-000000000000
23	affected_machines	STRING	영향장비	e.g. PC-0001
24	affected_users	STRING	영향계정목록	e.g. EXAMPLE\user01
25	malware_guid	STRING	악성코드GUID	e.g. 11.-1234567890123456789
26	icon_base64	STRING	아이콘Base64