genian-edr-threat

Reads one threat with its detection evidence and rule.

genian-edr-threat [profile=VALUE] threat-id=VALUE

profile=VALUE: Optional. Genian EDR connect profile name. Every Genian EDR profile is queried when omitted.
threat-id=VALUE: Required. Threat to read, the threat_id of genian-edr-threats

Output Fields

Field	Type	Name	Description
threat_id	String	Threat ID	e.g. 5f1c9e3a7d2b48c6a0e4f81b3d9c2a76. ID of the threat, what the threat-id option takes.
detect_time	Date	Detect time	e.g. 2026-11-07 00:14:20. When the threat was detected.
detect_type	String	Detect type	e.g. XBA. Malware, XBA (abnormal behavior) and so on.
detect_sub_type	String	Detect sub type	e.g. Exploit. Sub type of the detection, e.g. Exploit, MaliciousIP.
state	String	State	e.g. new. new, inprogress or resolved.
alert_decision	String	Verdict	e.g. true. true (malicious), false (safe), unknown (on hold); absent when not decided.
level	Integer	Level	e.g. 9. 3 critical, 2, 1, 9 information; 100 more for a resolved threat.
score	Integer	Score	e.g. 80. Confidence of the detection (%).
host_name	String	Host name	e.g. DESKTOP-A1B2C3D. Host the threat was detected on.
device_id	String	Device ID	e.g. 0f8c2a4e-1b7d-4e5a-9c3f-2d6b8e1a7c45. Agent device ID.
ip	IP	IP	e.g. 10.10.20.31. IP address of the device.
auth_name	String	User name	e.g. 홍길동. Authenticated user of the device.
file_name	String	File name	e.g. powershell.exe. File the detection is about.
file_path	String	File path	e.g. C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe. Path of the file.
md5	String	MD5	e.g. 7b2e9c41d0a5f83e6c1b4d92a8f0e357. MD5 of the file.
sha256	String	SHA256	e.g. 3f8a1c6e9b2d4f70a5c8e1b3d6f9a2c4e7b0d3f6a9c2e5b8d1f4a7c0e3b6d9f2. SHA256 of the file.
proc_name	String	Process name	e.g. C:\Program Files\Vendor\Agent\agent.exe. Process that raised the detection.
proc_guid	String	Process GUID	e.g. 9C3E1A7F5B2D48E6A0F4C8B1D7E3925A6F0B12. GUID of the process; the ProcGuid of genian-edr-search.
cmd_line	String	Command line	e.g. "C:\Program Files\Vendor\Agent\agent.exe". Command line of the process.
rule_id	String	Rule ID	e.g. SuspiciousPowershellCommand. ID of the detection rule.
rule_name	String	Rule name	e.g. 의심스러운 파워쉘 실행. Name of the detection rule.
remote_ip	IP	Remote IP	e.g. 203.0.113.24. Remote address of a network detection.
remote_port	Integer	Remote port	e.g. 443. Remote port of a network detection; 0 otherwise.
dns_name	String	DNS name	e.g. update.example.com. Domain of the remote address.
verdict	String	Classification	Malware classification of the console
assignee	String	Assignee	e.g. admin01. Console account handling the threat.
memo	String	Memo	Memo left on the threat
tactic	List	Tactics	e.g. [Execution]. MITRE ATT&CK tactics.
title	String	Title	e.g. powershell.exe. What the threat list names the threat by: the file, process or remote address.
_time	Date	Time	e.g. 2026-11-07 00:14:20. Representative time of the row.
rule_description	String	Rule description	e.g. 파워쉘은 윈도우에서 기본적으로 제공되고 기능이 강력하기 때문에 악성코드에 의해 이용되는 경우가 많다. …. What the detection rule looks for.
reason	String	Reason	e.g. 파워쉘 커맨드라인 인자가 다음의 키워드를 포함한 경우 - 인터넷 상의 스크립트를 실행하는 옵션 …. Why the rule considers it a threat.
false_positives	String	False positives	e.g. 3rd Party 소프트웨어가 파워쉘을 Hidden으로 실행시키는 경우 간혹 오진 발생. Known false positive cases of the rule.
indicators	List	Indicators	e.g. [<b>powershell.exe</b> 에 의한 <b>의심스러운 파워쉘 실행</b> 이상행위가 진단됨 (<b>80%</b>)]. Descriptions of the detection indicators.
terminate_processes	List	Process chain	e.g. [{proc_name=agent.exe, description=커맨드/스크립트를 실행한 프로세스의 부모 프로세스, …}, {proc_name=powershell.exe, description=의심 행위를 수행한 프로세스, …}]. Process chain from the parent to the suspicious process.
suspicious_info_list	List	Suspicious files	e.g. []. Files the detection found suspicious.
mitre_attack	List	MITRE ATT&CK	e.g. [{key=T1086, name=PowerShell, link=https://attack.mitre.org/techniques/T1086}]. Techniques and links of the detection.