genian-edr-threat-indicators
Reads the alerts of the threat's process chain grouped like the analysis indicator tab, then its behavior tags.
genian-edr-threat-indicators [profile=VALUE] threat-id=VALUE
- profile=VALUE
- Optional. Genian EDR connect profile name. Every Genian EDR profile is queried when omitted.
- threat-id=VALUE
- Required. Threat to read, the threat_id of genian-edr-threats
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| type | String | Row type | e.g. indicator. indicator or tag. |
| category | String | Category | e.g. XBA. Detect type of the group. |
| category_label | String | Category label | e.g. XBA. Console label of the category. |
| desc | String | Description | e.g. <b>powershell.exe</b> 에 의한 <b>의심스러운 파워쉘 실행</b> 이상행위가 진단됨 (<b>80%</b>). Indicator sentence of the console. |
| count | Integer | Count | e.g. 30. Alerts in the group. |
| detect_time | Date | Detect time | e.g. 2026-11-07 00:14:20. Latest alert of the group. |
| query | String | Query | e.g. RuleID:SuspiciousPowershellCommand AND ProcGuid:9C3E1A7F5B2D48E6A0F4C8B1D7E3925A6F0B12 AND DetectType:XBA. genian-edr-search dsl that finds the alerts of the group. |
| name | String | Tag | e.g. DirCreate. Behavior tag (TTP) of a tag row. |
| weight | Integer | Weight | e.g. 138. Events with the tag. |
| _time | Date | Time | e.g. 2026-11-07 00:14:20. Representative time of the row. |