uberAgent

Generic Properties

July 31, 2024

Contributed by:

Sometimes, when a Threat Detection rule matches an event, one would like to have more information than what the fields of the source type uberAgentESA:ActivityMonitoring:ProcessTagging provide. In such a case, one can define up to 10 generic properties per rule that can access the event information the query has access to. Any event property listed under Common Event Properties, Network Event Properties, Image Load Event Properties, or Registry Event Properties can be used as a generic property. Note that certain properties are only defined for specific event types. For instance, Net.Target.Port and Reg.Key.Path are only available for network and registry event types, respectively. Please refer to Event Types for a list of available event types, as well as the individual event properties documentation pages mentioned above.

Generic properties can be defined using one of the two syntaxes, long form:

GenericProperty1Name = ProcHash
GenericProperty1Data = Process.Hash.MD5
<!--NeedCopy-->

or short form:

GenericProperty1 = Process.Hash.MD5
<!--NeedCopy-->

in which case, the fields GenericProperty1Name and GenericProperty1Data, containing Process.Hash.MD5 and the process’s MD5 hash respectively, will be sent to uberAgentESA:ActivityMonitoring:ProcessTagging.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Generic Properties

July 31, 2024

Contributed by:

July 31, 2024

Contributed by:

Generic Properties

In this article