exosp-ransomware-access-logs

Fetch ransomware file access logs for specified date range from Exosphere service.

exosp-ransomware-access-logs [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] [order=ORDER]

profile=PROFILE: Connect profile code of Exosphere
duration=NUM{mon|w|d|h|m|s}: Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss: Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
to=yyyyMMddHHmmss: End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
order=ORDER: asc or desc.

Output Fields

Field	Type	Name	Description
_time	String	Event time
profile	String	Connect profile	Exosphere connect profile code
emp_name	String	Employee name	e.g. Scott
dept_name	String	Department name	e.g. HR
hostname	String	Hostname	e.g. Scott's MacBook Pro
os_name	String	OS name	e.g. macos
user	String	User	e.g. scott
image	String	Process name	e.g. TextExtract
access_file_name	String	Access file name	e.g. document.zip
access_file_path	String	Access file path	e.g. /path/to/document.zip
company_name	String	Company name
product_name	String	Product name
signer	String	Digital signer
sha256	String	SHA256
image_path	String	Process path
dept_path	String	Department path	e.g. Logpresso > HR