> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/runtime-defense/event-aggregation-event-types-table.md). # Detailed Aggregation Event Types The following tables list the activities for each aggregation event type, along with the descriptions. ## Network Firewall Attack Type | Event | Description | | ----------------------------------- | -------------------------------------------------------------------- | | NetworkFirewallAttackTypeUnexpected | Indicates an unexpected connection detected by the network firewall. | ## File Integrity Event Type | Event | Description | | -------------------------------------- | ------------------------------------------------------------ | | FileIntegrityEventTypeMetadata | Indicates a change in the metadata of the file or directory. | | FileIntegrityEventTypeRead | Indicates that the file or directory was accessed. | | FileIntegrityEventTypeWrite | Indicates that the file was written to. | | HostActivityTypeServiceRestart | Represents a systemd service restart activity. | | HostActivityTypeServiceInstall | Represents a systemd service install activity. | | HostActivityTypeServiceModified | Represents a systemd service modified activity. | | HostActivityTypeCronModified | Represents a cron file modified activity. | | HostActivityTypeSystemUpdate | Represents a system update activity. | | HostActivityTypeSystemReboot | Represents a system reboot activity. | | HostActivityTypeSourceModified | Represents an external software source modified activity. | | HostActivityTypeSourceAdded | Represents an external software source added activity. | | HostActivityTypeIptablesChanged | Represents an iptables changed activity. | | HostActivityTypeSecretModified | Represents a secret file modified activity. | | HostActivityTypeLogin | Represents a user login activity. | | HostActivityTypeSudo | Represents sudo activity. | | HostActivityTypeAccountsModified | Represents accounts modified activity. | | HostActivityTypeSensitiveFilesModified | Represents sensitive files modified activity. | | HostActivityTypeDocker | Represents Docker command activity. | ## Runtime Attack Type | Event | Description | | ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | RuntimeAttackTypeNetworkHorizontalPortScanning | Indicates horizontal port scanning detected. This could be an attempt to discover vulnerable services. | | RuntimeAttackTypeNetworkVerticalPortScanning | Indicates vertical port scanning detected. This could be an attempt to discover vulnerable hosts. | | RuntimeAttackTypeNetworkDeniedIP | Indicates a connection to a denied IP address. This could indicate attempts to communicate with blacklisted or unauthorized hosts. | | RuntimeAttackTypeNetworkCustomFeedIP | Indicates a connection to a high-risk IP address based on a custom feed. This could indicate connections to known malicious hosts. | | RuntimeAttackTypeNetworkFeedIP | Indicates a connection to a high-risk IP address based on an intelligence feed. This could indicate connections to known malicious hosts. | | RuntimeAttackTypeNetworkUnexpectedOutboundPort | Indicates an outbound connection to an unexpected port. This could indicate attempts to exfiltrate data or establish unauthorized communication channels. | | RuntimeAttackTypeSuspiciousNetworkActivity | Indicates a process performing suspicious network activity, such as using raw sockets. This could indicate attempts to bypass network security measures. | | RuntimeAttackTypeNetworkUnexpectedListeningPort | Indicates a container process is listening on an unexpected port. This could indicate unauthorized services running within containers. | | RuntimeAttackTypeNetworkDeniedListeningPort | Indicates a container process is listening on a denied port.This could indicate attempts to run unauthorized services within containers. | | RuntimeAttackTypeNetworkDeniedOutboundPort | Indicates a container process opened a denied outbound port. This could indicate attempts to establish unauthorized outbound connections from containers. | | RuntimeAttackTypeNetworkListeningPortModifiedProcess | Indicates a container-modified process is listening on an unexpected port. This could indicate attempts to hide malicious activities by modifying listening ports. | | RuntimeAttackTypeNetworkOutboundPortModifiedProcess | Indicates a container-modified process opened an outbound port. This could indicate attempts to establish unauthorized outbound connections from modified processes. | | RuntimeAttackTypeDNSFeed | Indicates a DNS resolution query of high-risk domain based on the intelligence stream. | | RuntimeAttackTypeDNSBlacklist | Indicates a DNS resolution query of the blacklist domain. | | RuntimeAttackTypeDNSQuery | Indicates a DNS resolution query of suspicious name. | | RuntimeAttackTypeProcUnexpected | Indicates a process that is not part of the runtime model was spawned unexpectedly. | | RuntimeAttackTypeProcPortScan | Indicates a process identified as a tool used for port scanning was spawned. | | RuntimeAttackTypeProcCustomFeedMalware | Indicates a process identified as malware based on custom feed data was spawned. | | RuntimeAttackTypeProcFeedMalware | Indicates a process identified as malware based on intelligence stream data was spawned. | | RuntimeAttackTypeProcBlacklist | Indicates a process from a blacklist was spawned. | | RuntimeAttackTypeProcModified | Indicates a modified process was spawned. | | RuntimeAttackTypeProcCryptoMiner | Indicates a process identified as a crypto miner was spawned. | | RuntimeAttackTypeProcLateralMovement | Indicates a process identified as used for lateral movement was spawned. | | RuntimeAttackTypeProcTmpfs | Indicates that the process is running from a tmpfs filesystem. | | RuntimeAttackTypeProcPolicyHijacked | Indicates that the process policy was hijacked. | | RuntimeAttackTypeProcReverseShell | Indicates that the process is a reverse shell. | | RuntimeAttackTypeProcSuidBinaries | Indicates that the process is running with elevated privileges. | | RuntimeAttackTypeProcUnknownOriginBinary | Indicates that the process was launched from a binary file not recognized by the OS distribution’s package manager. | | RuntimeAttackTypeProcWebShell | Indicates that the process was launched by a web shell. | | RuntimeAttackTypeFSBackdoorAdministrativeAccount | Indicates that an administrative account file was accessed. | | RuntimeAttackTypeFSEncryptedBinary | Indicates that an encrypted binary was written to disk. | | RuntimeAttackTypeFSBackdoorSSH | Indicates that an SSH configuration file was accessed. | | RuntimeAttackTypeFSBlacklist | Indicates that a file from a blacklist was accessed. | | RuntimeAttackTypeFSCustomFeedMalware | Indicates that a file identified as malware based on custom feed data was accessed. | | RuntimeAttackTypeFSFeedMalware | Indicates that a file identified as malware based on intelligence stream data was accessed. | | RuntimeAttackTypeFSExecutable | Indicates that an executable file (not a shared object) was accessed. | | RuntimeAttackTypeFSElf | Indicates that an ELF type file was accessed. | | RuntimeAttackTypeFSSecret | Indicates that a secret type file was accessed. | | RuntimeAttackTypeFSRegular | Indicates that a regular type file was accessed. | | RuntimeAttackTypeFSWildFireMalware | Indicates that malware detected by WildFire was written to the filesystem. | | RuntimeAttackTypeFSUnknownOriginBinary | Indicates that a binary file was written by a process not recognized by the OS distribution’s package manager. | | RuntimeAttackTypeFSWebShell | Indicates that a file detected as a web shell was written. | | RuntimeAttackTypeFileIntegrity | Indicates that file integrity was breached. | | RuntimeAttackTypeAlteredBinary | Indicates that a package binary file was replaced during image build. | | RuntimeAttackTypeMalwareDownloaded | Indicates that an ELF file was created as part of a malware executable download stage. | | RuntimeAttackTypeSuspiciousELFHeader | Indicates that an ELF file with suspicious malware indicators in the header was created. | | RuntimeAttackTypeExecutionFlowHijackAttempt | Indicates a possible attempt to hijack program execution flow. | | RuntimeAttackTypeCustomRule | Indicates that a custom rule was invoked. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/admin-guide/runtime-defense/event-aggregation-event-types-table.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.