# Plaso anti-virus related event formatters.
---
type: 'conditional'
data_type: 'av:defender:detection_history'
message:
- 'File Name: {filename}'
- 'Hash: {sha256}'
- 'User: {host_and_user}'
- '{threat_name}'
- 'Process: {process}'
- '{container_filenames}'
- '{web_filenames}'
- '{additional_filenames}'
short_message:
- '{filename}'
- '{threat_name}'
short_source: 'LOG'
source: 'Windows Defender Detection History Log'
---
type: 'conditional'
data_type: 'av:mcafee:accessprotectionlog'
message:
- 'File Name: {filename}'
- 'User: {username}'
- '{trigger_location}'
- '{status}'
- '{rule}'
- '{action}'
short_message:
- '{filename}'
- '{action}'
short_source: 'LOG'
source: 'McAfee Access Protection Log'
---
type: 'conditional'
data_type: 'av:symantec:scanlog'
enumeration_helpers:
- input_attribute: 'event_code'
  output_attribute: 'event_code_map'
  default_value: 'Unknown'
  values:
    '1': 'GL_EVENT_IS_ALERT'
    '2': 'GL_EVENT_SCAN_STOP'
    '3': 'GL_EVENT_SCAN_START'
    '4': 'GL_EVENT_PATTERN_UPDATE'
    '5': 'GL_EVENT_INFECTION'
    '6': 'GL_EVENT_FILE_NOT_OPEN'
    '7': 'GL_EVENT_LOAD_PATTERN'
    '8': 'GL_STD_MESSAGE_INFO'
    '9': 'GL_STD_MESSAGE_ERROR'
    '10': 'GL_EVENT_CHECKSUM'
    '11': 'GL_EVENT_TRAP'
    '12': 'GL_EVENT_CONFIG_CHANGE'
    '13': 'GL_EVENT_SHUTDOWN'
    '14': 'GL_EVENT_STARTUP'
    '16': 'GL_EVENT_PATTERN_DOWNLOAD'
    '17': 'GL_EVENT_TOO_MANY_VIRUSES'
    '18': 'GL_EVENT_FWD_TO_QSERVER'
    '19': 'GL_EVENT_SCANDLVR'
    '20': 'GL_EVENT_BACKUP'
    '21': 'GL_EVENT_SCAN_ABORT'
    '22': 'GL_EVENT_RTS_LOAD_ERROR'
    '23': 'GL_EVENT_RTS_LOAD'
    '24': 'GL_EVENT_RTS_UNLOAD'
    '25': 'GL_EVENT_REMOVE_CLIENT'
    '26': 'GL_EVENT_SCAN_DELAYED'
    '27': 'GL_EVENT_SCAN_RESTART'
    '28': 'GL_EVENT_ADD_SAVROAMCLIENT_TOSERVER'
    '29': 'GL_EVENT_REMOVE_SAVROAMCLIENT_FROMSERVER'
    '30': 'GL_EVENT_LICENSE_WARNING'
    '31': 'GL_EVENT_LICENSE_ERROR'
    '32': 'GL_EVENT_LICENSE_GRACE'
    '33': 'GL_EVENT_UNAUTHORIZED_COMM'
    '34': 'GL_EVENT_LOG_FWD_THRD_ERR'
    '35': 'GL_EVENT_LICENSE_INSTALLED'
    '36': 'GL_EVENT_LICENSE_ALLOCATED'
    '37': 'GL_EVENT_LICENSE_OK'
    '38': 'GL_EVENT_LICENSE_DEALLOCATED'
    '39': 'GL_EVENT_BAD_DEFS_ROLLBACK'
    '40': 'GL_EVENT_BAD_DEFS_UNPROTECTED'
    '41': 'GL_EVENT_SAV_PROVIDER_PARSING_ERROR'
    '42': 'GL_EVENT_RTS_ERROR'
    '43': 'GL_EVENT_COMPLIANCE_FAIL'
    '44': 'GL_EVENT_COMPLIANCE_SUCCESS'
    '45': 'GL_EVENT_SECURITY_SYMPROTECT_POLICYVIOLATION'
    '46': 'GL_EVENT_ANOMALY_START'
    '47': 'GL_EVENT_DETECTION_ACTION_TAKEN'
    '48': 'GL_EVENT_REMEDIATION_ACTION_PENDING'
    '49': 'GL_EVENT_REMEDIATION_ACTION_FAILED'
    '50': 'GL_EVENT_REMEDIATION_ACTION_SUCCESSFUL'
    '51': 'GL_EVENT_ANOMALY_FINISH'
    '52': 'GL_EVENT_COMMS_LOGIN_FAILED'
    '53': 'GL_EVENT_COMMS_LOGIN_SUCCESS'
    '54': 'GL_EVENT_COMMS_UNAUTHORIZED_COMM'
    '55': 'GL_EVENT_CLIENT_INSTALL_AV'
    '56': 'GL_EVENT_CLIENT_INSTALL_FW'
    '57': 'GL_EVENT_CLIENT_UNINSTALL'
    '58': 'GL_EVENT_CLIENT_UNINSTALL_ROLLBACK'
    '59': 'GL_EVENT_COMMS_SERVER_GROUP_ROOT_CERT_ISSUE'
    '60': 'GL_EVENT_COMMS_SERVER_CERT_ISSUE'
    '61': 'GL_EVENT_COMMS_TRUSTED_ROOT_CHANGE'
    '62': 'GL_EVENT_COMMS_SERVER_CERT_STARTUP_FAILED'
    '63': 'GL_EVENT_CLIENT_CHECKIN'
    '64': 'GL_EVENT_CLIENT_NO_CHECKIN'
    '65': 'GL_EVENT_SCAN_SUSPENDED'
    '66': 'GL_EVENT_SCAN_RESUMED'
    '67': 'GL_EVENT_SCAN_DURATION_INSUFFICIENT'
    '68': 'GL_EVENT_CLIENT_MOVE'
    '69': 'GL_EVENT_SCAN_FAILED_ENHANCED'
    '70': 'GL_EVENT_COMPLIANCE_FAILED_AUDIT'
    '71': 'GL_EVENT_HEUR_THREAT_NOW_WHITELISTED'
    '72': 'GL_EVENT_INTERESTING_PROCESS_DETECTED_START'
    '73': 'GL_EVENT_LOAD_ERROR_COH'
    '74': 'GL_EVENT_LOAD_ERROR_SYKNAPPS'
    '75': 'GL_EVENT_INTERESTING_PROCESS_DETECTED_FINISH'
    '76': 'GL_EVENT_HPP_SCAN_NOT_SUPPORTED_FOR_OS'
    '77': 'GL_EVENT_HEUR_THREAT_NOW_KNOWN'
- input_attribute: 'category'
  output_attribute: 'category_map'
  default_value: 'Unknown'
  values:
    '1': 'GL_CAT_INFECTION'
    '2': 'GL_CAT_SUMMARY'
    '3': 'GL_CAT_PATTERN'
    '4': 'GL_CAT_SECURITY'
- input_attribute: 'action0'
  output_attribute: 'action0_map'
  default_value: 'Unknown'
  values:
    '1': 'Quarantined'
    '2': 'Renamed'
    '3': 'Deleted'
    '4': 'Left alone'
    '5': 'Cleaned'
    '6': 'Cleaned or macros deleted (no longer used as of Symantec AntiVirus 9.x)'
    '7': 'Saved file as...'
    '8': 'Sent to Intel (AMS)'
    '9': 'Moved to backup location'
    '10': 'Renamed backup file'
    '11': 'Undo action in Quarantine View'
    '12': 'Write protected or lack of permissions - Unable to act on file'
    '13': 'Backed up file'
- input_attribute: 'action1'
  output_attribute: 'action1_map'
  default_value: 'Unknown'
  values:
    '1': 'Quarantine infected file'
    '2': 'Rename infected file'
    '3': 'Delete infected file'
    '4': 'Leave alone (log only)'
    '5': 'Clean virus from file'
    '6': 'Clean or delete macros'
- input_attribute: 'action2'
  output_attribute: 'action2_map'
  default_value: 'Unknown'
  values:
    '1': 'Quarantine infected file'
    '2': 'Rename infected file'
    '3': 'Delete infected file'
    '4': 'Leave alone (log only)'
    '5': 'Clean virus from file'
    '6': 'Clean or delete macros'
message:
- 'Event: {event_code_map}'
- 'Category Name: {category_map}'
- 'Malware Name: {virus}'
- 'Malware Path: {file_path}'
- 'Action0: {action0_map}'
- 'Action1: {action1_map}'
- 'Action2: {action2_map}'
- 'Description: {description}'
- 'Scan ID: {scan_identifier}'
- 'Event Data: {event_data}'
- 'Remote Machine: {remote_machine}'
- 'Remote IP: {remote_machine_ip}'
separator: '; '
short_message:
- '{file_path}'
- '{virus}'
- '{action0_map}'
- '{action1_map}'
- '{action2_map}'
short_source: 'LOG'
source: 'Symantec AV Log'
---
type: 'conditional'
data_type: 'av:trendmicro:scan'
enumeration_helpers:
- input_attribute: 'action'
  output_attribute: 'action'
  default_value: 'UNKNOWN'
  values:
    0: 'Success (clean)'
    1: 'Success (move)'
    2: 'Success (delete)'
    3: 'Success (rename)'
    4: 'Pass > Deny access'
    5: 'Failure (clean)'
    6: 'Failure (move)'
    7: 'Failure (delete)'
    8: 'Failure (rename)'
    10: 'Failure (clean), moved'
    11: 'Failure (clean), deleted'
    12: 'Failure (clean), renamed'
    13: 'Pass > Deny access'
    14: 'Failure (clean), move also failed'
    15: 'Failure (clean), delete also failed'
    16: 'Failure (clean), rename also failed'
    25: 'Passed a potential security risk'
- input_attribute: 'scan_type'
  output_attribute: 'scan_type'
  default_value: 'UNKNOWN'
  values:
    0: 'Manual scan'
    1: 'Real-time scan'
    2: 'Scheduled scan'
    3: 'Scan Now scan'
    4: 'DCS scan'
message:
- 'Path: {path}'
- 'File name: {filename}'
- '{threat}'
- ': {action}'
- '({scan_type})'
short_message:
- '{path}'
- '{filename}'
- '{action}'
short_source: 'LOG'
source: 'Trend Micro Office Scan Virus Detection Log'
---
type: 'conditional'
data_type: 'av:trendmicro:webrep'
enumeration_helpers:
- input_attribute: 'block_mode'
  output_attribute: 'block_mode'
  default_value: 'UNKNOWN'
  values:
    0: 'Internal filter'
    1: 'Whitelist only'
message:
- '{url}'
- '{ip}'
- 'Group: {group_name}'
- '{group_code}'
- 'Mode: {block_mode}'
- 'Policy ID: {policy_identifier}'
- 'Credibility rating: {credibility_rating}'
- 'Credibility score: {credibility_score}'
- 'Threshold value: {threshold}'
- 'Accessed by: {application_name}'
short_message:
- '{url}'
- '{group_name}'
short_source: 'LOG'
source: 'Trend Micro Office Scan Virus Detection Log'
---
type: 'conditional'
data_type: 'sophos:av:log'
message:
- '{text}'
short_message:
- '{text}'
short_source: 'LOG'
source: 'Sophos Anti-Virus log'
