The following describes the event_type values for which you can create a BIOC rule.
FILE—Events relating to file create, write, read, and rename according to the file name and path.
INJECTION—Events related to process injections.
LOAD_IMAGE—Events relating to module IDs of processes.
NETWORK—Events relating to incoming and outgoing network, filed IP addresses, port, host name, and protocol.
PROCESS—Events relating to execution and injection of a process name, hash, path, and CMD.
REGISTRY—Events relating to registry write, rename and delete according to registry path.
STORY—Events relating to a combination of firewall and endpoint logs over the network.
EVENT_LOG—Events relating to Windows event logs and Linux system authentication logs.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
LAFJ
8Â months ago