Detailed Aggregation Event Types

The following tables list the activities for each aggregation event type, along with the descriptions.

Network Firewall Attack Type

Event	Description
NetworkFirewallAttackTypeUnexpected	Indicates an unexpected connection detected by the network firewall.

File Integrity Event Type

Event	Description
FileIntegrityEventTypeMetadata	Indicates a change in the metadata of the file or directory.
FileIntegrityEventTypeRead	Indicates that the file or directory was accessed.
FileIntegrityEventTypeWrite	Indicates that the file was written to.
HostActivityTypeServiceRestart	Represents a systemd service restart activity.
HostActivityTypeServiceInstall	Represents a systemd service install activity.
HostActivityTypeServiceModified	Represents a systemd service modified activity.
HostActivityTypeCronModified	Represents a cron file modified activity.
HostActivityTypeSystemUpdate	Represents a system update activity.
HostActivityTypeSystemReboot	Represents a system reboot activity.
HostActivityTypeSourceModified	Represents an external software source modified activity.
HostActivityTypeSourceAdded	Represents an external software source added activity.
HostActivityTypeIptablesChanged	Represents an iptables changed activity.
HostActivityTypeSecretModified	Represents a secret file modified activity.
HostActivityTypeLogin	Represents a user login activity.
HostActivityTypeSudo	Represents sudo activity.
HostActivityTypeAccountsModified	Represents accounts modified activity.
HostActivityTypeSensitiveFilesModified	Represents sensitive files modified activity.
HostActivityTypeDocker	Represents Docker command activity.

Runtime Attack Type

Event	Description
RuntimeAttackTypeNetworkHorizontalPortScanning	Indicates horizontal port scanning detected. This could be an attempt to discover vulnerable services.
RuntimeAttackTypeNetworkVerticalPortScanning	Indicates vertical port scanning detected. This could be an attempt to discover vulnerable hosts.
RuntimeAttackTypeNetworkDeniedIP	Indicates a connection to a denied IP address. This could indicate attempts to communicate with blacklisted or unauthorized hosts.
RuntimeAttackTypeNetworkCustomFeedIP	Indicates a connection to a high-risk IP address based on a custom feed. This could indicate connections to known malicious hosts.
RuntimeAttackTypeNetworkFeedIP	Indicates a connection to a high-risk IP address based on an intelligence feed. This could indicate connections to known malicious hosts.
RuntimeAttackTypeNetworkUnexpectedOutboundPort	Indicates an outbound connection to an unexpected port. This could indicate attempts to exfiltrate data or establish unauthorized communication channels.
RuntimeAttackTypeSuspiciousNetworkActivity	Indicates a process performing suspicious network activity, such as using raw sockets. This could indicate attempts to bypass network security measures.
RuntimeAttackTypeNetworkUnexpectedListeningPort	Indicates a container process is listening on an unexpected port. This could indicate unauthorized services running within containers.
RuntimeAttackTypeNetworkDeniedListeningPort	Indicates a container process is listening on a denied port.This could indicate attempts to run unauthorized services within containers.
RuntimeAttackTypeNetworkDeniedOutboundPort	Indicates a container process opened a denied outbound port. This could indicate attempts to establish unauthorized outbound connections from containers.
RuntimeAttackTypeNetworkListeningPortModifiedProcess	Indicates a container-modified process is listening on an unexpected port. This could indicate attempts to hide malicious activities by modifying listening ports.
RuntimeAttackTypeNetworkOutboundPortModifiedProcess	Indicates a container-modified process opened an outbound port. This could indicate attempts to establish unauthorized outbound connections from modified processes.
RuntimeAttackTypeDNSFeed	Indicates a DNS resolution query of high-risk domain based on the intelligence stream.
RuntimeAttackTypeDNSBlacklist	Indicates a DNS resolution query of the blacklist domain.
RuntimeAttackTypeDNSQuery	Indicates a DNS resolution query of suspicious name.
RuntimeAttackTypeProcUnexpected	Indicates a process that is not part of the runtime model was spawned unexpectedly.
RuntimeAttackTypeProcPortScan	Indicates a process identified as a tool used for port scanning was spawned.
RuntimeAttackTypeProcCustomFeedMalware	Indicates a process identified as malware based on custom feed data was spawned.
RuntimeAttackTypeProcFeedMalware	Indicates a process identified as malware based on intelligence stream data was spawned.
RuntimeAttackTypeProcBlacklist	Indicates a process from a blacklist was spawned.
RuntimeAttackTypeProcModified	Indicates a modified process was spawned.
RuntimeAttackTypeProcCryptoMiner	Indicates a process identified as a crypto miner was spawned.
RuntimeAttackTypeProcLateralMovement	Indicates a process identified as used for lateral movement was spawned.
RuntimeAttackTypeProcTmpfs	Indicates that the process is running from a tmpfs filesystem.
RuntimeAttackTypeProcPolicyHijacked	Indicates that the process policy was hijacked.
RuntimeAttackTypeProcReverseShell	Indicates that the process is a reverse shell.
RuntimeAttackTypeProcSuidBinaries	Indicates that the process is running with elevated privileges.
RuntimeAttackTypeProcUnknownOriginBinary	Indicates that the process was launched from a binary file not recognized by the OS distribution’s package manager.
RuntimeAttackTypeProcWebShell	Indicates that the process was launched by a web shell.
RuntimeAttackTypeFSBackdoorAdministrativeAccount	Indicates that an administrative account file was accessed.
RuntimeAttackTypeFSEncryptedBinary	Indicates that an encrypted binary was written to disk.
RuntimeAttackTypeFSBackdoorSSH	Indicates that an SSH configuration file was accessed.
RuntimeAttackTypeFSBlacklist	Indicates that a file from a blacklist was accessed.
RuntimeAttackTypeFSCustomFeedMalware	Indicates that a file identified as malware based on custom feed data was accessed.
RuntimeAttackTypeFSFeedMalware	Indicates that a file identified as malware based on intelligence stream data was accessed.
RuntimeAttackTypeFSExecutable	Indicates that an executable file (not a shared object) was accessed.
RuntimeAttackTypeFSElf	Indicates that an ELF type file was accessed.
RuntimeAttackTypeFSSecret	Indicates that a secret type file was accessed.
RuntimeAttackTypeFSRegular	Indicates that a regular type file was accessed.
RuntimeAttackTypeFSWildFireMalware	Indicates that malware detected by WildFire was written to the filesystem.
RuntimeAttackTypeFSUnknownOriginBinary	Indicates that a binary file was written by a process not recognized by the OS distribution’s package manager.
RuntimeAttackTypeFSWebShell	Indicates that a file detected as a web shell was written.
RuntimeAttackTypeFileIntegrity	Indicates that file integrity was breached.
RuntimeAttackTypeAlteredBinary	Indicates that a package binary file was replaced during image build.
RuntimeAttackTypeMalwareDownloaded	Indicates that an ELF file was created as part of a malware executable download stage.
RuntimeAttackTypeSuspiciousELFHeader	Indicates that an ELF file with suspicious malware indicators in the header was created.
RuntimeAttackTypeExecutionFlowHijackAttempt	Indicates a possible attempt to hijack program execution flow.
RuntimeAttackTypeCustomRule	Indicates that a custom rule was invoked.