Cybereason Suspicions
Process suspicions collected from the investigation API (POST /rest/visualsearch/query/simple)
| Type | Field | Name | Description |
|---|---|---|---|
| Date | _time | Time | |
| Date | end_time | End time | |
| String | process_name | Process name | e.g. sample.exe |
| String | process_info | Process info | e.g. c:\users\user01\downloads\sample.exe |
| String | suspicions | Suspicions | e.g. blackListedFileHashSuspicion |
| String | guid | Process GUID | e.g. -1234567890123456789 |
| Boolean | is_malicious | Malicious | |
| Boolean | is_suspect | Suspect | |
| Boolean | is_malicious_verdict | Malicious verdict |