Virus Detected Action

Common Event Grammar › Host Security Category › Antivirus Activity Class › Virus Detected Action

Virus Detected Action

The Virus Detected action occurs when detecting a known virus on a given host.

Information	Level
Source - User Information	Tertiary
Source - Host Information	Secondary
Source - Object Information	Secondary
Source - Process Information	Tertiary
Source - Group Information	Tertiary
Dest - User Information	Secondary
Dest - Host Information	Primary
Dest - Object Information	Primary
Dest - Process Information	Primary
Dest - Group Information	Tertiary
Agent - Information	Primary
Agent - Host Information	Primary
Event Source - Host Information	Primary
Event Source - Information	Tertiary
Event - Information	Primary
Result - Information	Primary

The important information for this action is which process or file was the virus detected in on which host. The event information was expressed on which host and recorded by which agent on which host.

The virus name should be stored in the result_signature field of CEG.

Result	event_result	event_severity
Success	S	6