Cyber Security: Malware

Description

The Malware section monitors events related to malware detection and blocking.

Displayed Data

• number of infected hosts and detected and blocked infections
• malware statistics by type
• trends in detected and blocked infections
• most frequently detected and blocked malware types
• hosts with the most malware detections and blocks
• infection event statistics broken down by host
• infection event statistics broken down by malware

List of Dashboards

The section includes three dashboards.

Malware: Overview

Malware: Infected Host Profile

Malware: Malware Type Profile

---

Data Model

The section uses the data source fields described below. Alias used: sm_cs_malware_indexes.

Categorization Fields

Field Name	Value
event.kind	alert
event.category	malware
event.action	From the source event.

General Purpose Fields

Malware Detection Location host

Field Name	Value
host.ip	IP address of the host where malware was detected.
host.name	Name of the host where malware was detected.

User user

Field Name	Value
user.name	Username.
user.domain	User domain.

Infection Source file

Field Name	Value
file.name	Name of the file with malware.
file.path	Full path to the file with malware.
file.hash	Hash of the file with malware.

Other Fields

Field Name	Value
event.original	Original event text.

Optional Fields

Field Name	Value
message	Event description.
malware_description	Threat description.

---

Dictionaries

Below is a table of dictionaries used by the section.

Name	Fields	Description
sm_cs_malware_type	malware_description malware_type	Dictionary of threat types.
sm_cs_malware_action	event.action malware_action - (detected | blocked)	Dictionary of actions with threats.

---

Example Sources

• Cisco Secure Endpoint
• Symantec Endpoint Agent