Skip to content

Trellix ATD

Overview

The Advanced Threat Defense Appliances are purpose-built, scalable, and flexible high-performance servers designed to analyze suspicious files for malware.

  • Vendor: Trellix
  • Supported environment: On Premise
  • Detection based on: Telemetry
  • Supported application or feature: Application logs

Warning

Important note - This format is currently in beta. We highly value your feedback to improve its performance.

High-Level Architecture Diagram

  • Type of integration: Outbound (PUSH to Sekoia.io)
  • Schema trellix_atd_architecture

Specification

Prerequisites

  • Resource:
    • Self-managed syslog forwarder
  • Network:
    • Outbound traffic allowed
  • Permissions:
    • Root access to the Trellix ATD web interface
    • Root access to the Linux server with the syslog forwarder

Transport Protocol/Method

  • Indirect Syslog

Logs details

  • Supported functionalities: See section Overview
  • Supported type(s) of structure: Syslog
  • Supported verbosity level: Informational

Note

Log levels are based on the taxonomy of RFC5424. Adapt according to the terminology used by the vendor.

Step-by-Step Quick Configuration Procedure

  1. Log on to the Advanced Threat Defense web interface.
  2. Click Manage → ATD Configuration → Syslog, then select Enable Logging
  3. In the Statistic to Log section, select the entries that suits your needs.

    Note: When HTTPS Session Log is enabled, Advanced Threat Defense web performance is impacted.

  4. From the drop-down menu, select TCP

    Note, if your security policy requires extra-security (ex: tls) between the application and the syslog forwarder, modify the configuration accordingly

  5. Click Enable Syslog
  6. Type in the IP and port of the forwarder you want the logs sent to.
  7. Click Test Connection and expect a "Test connection successful" message.
  8. Click Submit

Note

If you encounter any issues during the configuration specified in this section "Instructions on the 3rd Party Solution," please do not hesitate to contact your vendor. We also welcome any suggestions for improving our documentation to better serve your needs.

Instruction on Sekoia

Configure Your Intake

This section will guide you through creating the intake object in Sekoia, which provides a unique identifier called the "Intake key." The Intake key is essential for later configuration, as it references the Community, Entity, and Parser (Intake Format) used when receiving raw events on Sekoia.

  1. Go to the Sekoia Intake page.
  2. Click on the + New Intake button at the top right of the page.
  3. Search for your Intake by the product name in the search bar.
  4. Give it a Name and associate it with an Entity (and a Community if using multi-tenant mode).
  5. Click on Create.

Note

For more details on how to use the Intake page and to find the Intake key you just created, refer to this documentation.

Configure a forwarder

To forward events using syslog to Sekoia.io, you need to update the syslog header with the intake key you previously created. Here is an example of your message before the forwarder 

<%pri%>1 %timestamp:::date-rfc3339% %hostname% %app-name% %procid% LOG RAW_MESSAGE
and after 
<%pri%>1 %timestamp:::date-rfc3339% %hostname% %app-name% %procid% LOG [SEKOIA@53288 intake_key=\"YOUR_INTAKE_KEY\"] RAW_MESSAGE

To achieve this you can:

  • Use the Sekoia.io forwarder which is the official supported way to collect data using the syslog protocol in Sekoia.io. In charge of centralizing data coming from many equipments/sources and forwarding them to Sekoia.io with the apporpriated format, it is a prepackaged option. You only have to provide your intake key as parameter.
  • Use your own Syslog service instance. Maybe you already have an intance of one of these components on your side and want to reuse it in order to centralize data before forwarding them to Sekoia.io. When using this mode, you have to configure and maintain your component in order to respect the expected Sekoia.io format.

Warning

Only the Sekoia.io forwarder is officially supported. Other options are documented for reference purposes but do not have official support.

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

{
    "Type": "Audit",
    "MsgId": "L-LG-04-0",
    "Result": "Success",
    "User": "tata",
    "Category": "User",
    "Client": "2.2.2.2",
    "Action": "Session Login",
    "Description": "Successful user login - mwg-w7"
}

{
    "Type": "Audit",
    "MsgId": "L-LG-05-0",
    "Result": "Success",
    "User": "tata",
    "Category": "User",
    "Client": "2.2.2.2",
    "Action": "Session Logout",
    "Description": "Successful user logout: mwg-w7"
}

{
    "Type": "Audit",
    "MsgId": "M-MC-27-1",
    "Result": "Failure",
    "User": "tata",
    "Category": "Admin",
    "Client": "Localhost",
    "Action": "Manage Trusted Certificate",
    "Description": "MATD Web Certificate does not meet Security requirement"
}

{
    "Result": "Success",
    "Action": "Database Pruning",
    "User": "toto",
    "Client": "localhost",
    "Type": "Audit",
    "Category": "Admin",
    "Description": "Record threshold count not met",
    "MsgId": "B-DB-02-1"
}

{
    "Action": "Successful user login",
    "User": "toto",
    "UserID": "65",
    "Timestamp": "2025-07-22 11:38:44",
    "Client": "2.2.2.2"
}

{
    "Action": "Successful user logout",
    "User": "toto",
    "UserID": "65",
    "Timestamp": "2025-07-22 11:38:45",
    "Client": "2.2.2.2",
    "HTTPAgent": "Skyhigh Secure Web Gateway 12.2.16.52651"
}

{
    "Summary": {
        "Event_Type": "ATD File Report",
        "MISversion": "5.2.0.16",
        "SUMversion": "5.2.0.16",
        "DETversion": "5.2.6.250110",
        "OSversion": "win10p0x64",
        "fileId": "Not Available",
        "Parent MD5": "Not Available",
        "ATD IP": "1.1.1.1",
        "Src IP": "2.2.2.2",
        "Dst IP": "",
        "TaskId": "144115188076224076",
        "JobId": "144115188076216640",
        "JSONversion": "1.003",
        "SubmitterName": "toto",
        "SubmitterType": "MWG",
        "hasDynamicAnalysis": "true",
        "Subject": {
            "Name": "file.xxx",
            "Type": "application/pdf",
            "FileType": "4",
            "md5": "AE299DBD8F796B8A5479E763BB00FB93",
            "sha-1": "A826D22E2FF0971FB932E88CFCB75CCB16D6B9C2",
            "sha-256": "229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A",
            "size": "54620",
            "Timestamp": "2025-07-22 08:25:39",
            "parent_archive": "Not Available"
        },
        "Selectors": [
            {
                "Engine": "Gateway Anti-Malware",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "GTI File Reputation",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "GTI URL Reputation",
                "MalwareName": "Business ",
                "Severity": "1"
            },
            {
                "Engine": "Anti-Malware",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "YARA",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "Sandbox",
                "MalwareName": "---",
                "Severity": "2"
            }
        ],
        "Verdict": {
            "Severity": "2",
            "Description": "Sample is somewhat suspicious: final severity level 2"
        },
        "Processes": [
            {
                "Name": "acrord32.exe",
                "Md5": "",
                "Sha1": "",
                "Sha256": "",
                "Severity": "2"
            },
            {
                "Name": "splwow64.exe",
                "Md5": "",
                "Sha1": "",
                "Sha256": "",
                "Severity": "2"
            },
            {
                "Name": "jst1.js",
                "Md5": "",
                "Sha1": "",
                "Sha256": "",
                "Severity": "2"
            }
        ],
        "Files": [
            {
                "Processes": [
                    {
                        "RelType": "512",
                        "Name": "file.xxx",
                        "Sha256": "229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A"
                    }
                ],
                "Md5": "D633AE9E8E94BC640AF6581B53D250FB",
                "Sha1": "9BC9DBD1F9C23F9B9437F5E71B44FC8988971084",
                "Sha256": "53CBA858F975AB69E9782745369E42DC7674A7B58C24EE10F2C65304C48B9BC8",
                "Name": "file.xxx",
                "FileType": "128"
            },
            {
                "Processes": [
                    {
                        "RelType": "512",
                        "Name": "file.xxx",
                        "Sha256": "229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A"
                    }
                ],
                "Md5": "B451FF15BA0A31EBDFB809D4E8929B3D",
                "Sha1": "B81FA68215FAF82211F226325649BC717DBCAE40",
                "Sha256": "B10D4CFF0E8F500510B412C9543CE8280B616ECA4B7F9FAE184B3095AB43AF53",
                "Name": "file.xxx",
                "FileType": "128"
            }
        ],
        "Urls": [
            {
                "Processes": [
                    {
                        "RelType": "8",
                        "Name": "file.xxx",
                        "Sha256": ""
                    }
                ],
                "Category": "Business ",
                "Functional": "Business/Services ",
                "Risk": "Information ",
                "Port": "80",
                "Reputation": "3",
                "Severity": "1",
                "Url": "HTTPS://ODACE.APPARETE.FR/EDITIONS"
            },
            {
                "Processes": [
                    {
                        "RelType": "8",
                        "Name": "file.xxx",
                        "Sha256": ""
                    }
                ],
                "Category": "Business ",
                "Functional": "Business/Services ",
                "Risk": "Information ",
                "Port": "80",
                "Reputation": "3",
                "Severity": "1",
                "Url": "HTTPS://ODACE.APPARETE.FR/EDITIONS/EDITION_CONSULT.ASPX?DXREP_FAKE=&EDITIONNUMARA=F73A9E66-DB7A-486F-A5E8-D86443F8CAC3&RELOAD=TRUE"
            }
        ],
        "Stats": [
            {
                "ID": "0",
                "Category": "Persistence, Installation Boot Survival ",
                "Severity": "2"
            },
            {
                "ID": "1",
                "Category": "Hiding, Camouflage, Stealthiness, Detection and Removal Protection ",
                "Severity": "2"
            },
            {
                "ID": "2",
                "Category": "Security Solution / Mechanism bypass, termination and removal, Anti Debugging, VM Detection ",
                "Severity": "1"
            },
            {
                "ID": "3",
                "Category": "Spreading ",
                "Severity": "1"
            },
            {
                "ID": "4",
                "Category": "Exploiting, Shellcode ",
                "Severity": "2"
            },
            {
                "ID": "5",
                "Category": "Networking ",
                "Severity": "1"
            },
            {
                "ID": "6",
                "Category": "Data spying, Sniffing, Keylogging, Ebanking Fraud ",
                "Severity": "1"
            }
        ],
        "Behavior": [
            {
                "ID": "2",
                "Analysis": "Identified as --- by Gateway Anti-Malware"
            },
            {
                "ID": "1",
                "Analysis": "Identified as --- by GTI File Reputation"
            },
            {
                "ID": "256",
                "Analysis": "Identified as Business  by GTI URL Reputation"
            },
            {
                "ID": "4",
                "Analysis": "Identified as --- by Anti-Malware"
            },
            {
                "ID": "128",
                "Analysis": "Identified as --- by YARA"
            },
            {
                "ID": "2803",
                "Analysis": "Tracing System location"
            },
            {
                "ID": "2859",
                "Analysis": "Gathered system time information"
            },
            {
                "ID": "25",
                "Analysis": "Detected scripting content embedded in the sample"
            },
            {
                "ID": "2905",
                "Analysis": "Javascipt is executed using wscript or cscript"
            },
            {
                "ID": "2883",
                "Analysis": "Gathering system info via WMIC "
            }
        ],
        "Mitre": [
            {
                "ID": "T1059",
                "Technique Name": "Command and Scripting Interpreter",
                "Tactics": "Execution",
                "Subtechniques": [
                    {
                        "ID": "T1059.005",
                        "Sub-Technique Name": "Visual Basic",
                        "Rules": [
                            {
                                "Description": "Detected scripting content embedded in the sample",
                                "Severity": "2"
                            }
                        ]
                    },
                    {
                        "ID": "T1059.007",
                        "Sub-Technique Name": "JavaScript",
                        "Rules": [
                            {
                                "Description": "Detected scripting content embedded in the sample",
                                "Severity": "2"
                            },
                            {
                                "Description": "Javascipt is executed using wscript or cscript",
                                "Severity": "1"
                            }
                        ]
                    }
                ]
            },
            {
                "ID": "T1082",
                "Technique Name": "System Information Discovery",
                "Tactics": "Discovery",
                "Rules": [
                    {
                        "Description": "Gathering system info via WMIC ",
                        "Severity": "2"
                    }
                ]
            },
            {
                "ID": "T1124",
                "Technique Name": "System Time Discovery",
                "Tactics": "Discovery",
                "Rules": [
                    {
                        "Description": "Gathered system time information",
                        "Severity": "2"
                    }
                ]
            },
            {
                "ID": "T1614",
                "Technique Name": "System Location Discovery",
                "Tactics": "Discovery",
                "Rules": [
                    {
                        "Description": "Tracing System location",
                        "Severity": "2"
                    }
                ]
            }
        ]
    }
}

{
    "Summary": {
        "Event_Type": "ATD File Report",
        "MISversion": "5.2.0.16",
        "SUMversion": "5.2.0.16",
        "DETversion": "5.2.6.250110",
        "OSversion": "win7sp1x64_Win7SP1x64-IANNG",
        "fileId": "Not Available",
        "Parent MD5": "Not Available",
        "ATD IP": "1.1.1.1",
        "Src IP": "2.2.2.2",
        "Dst IP": "",
        "TaskId": "144115188076224043",
        "JobId": "144115188076216607",
        "JSONversion": "1.003",
        "SubmitterName": "toto",
        "SubmitterType": "MWG",
        "hasDynamicAnalysis": "true",
        "Subject": {
            "Name": "file.xxx",
            "Type": "PE32+ executable (GUI) x86-64",
            "FileType": "0",
            "md5": "D0E38E34A8A648CB663FB75DBCC849D2",
            "sha-1": "8B86FAFB36D4A680121209C0EEABB606E6169B36",
            "sha-256": "6AB95CCECF9FF63EDC1FA183B4E85D52A24A078471D9E4AD8BC7D7739CA78957",
            "size": "1210009",
            "Timestamp": "2025-07-20 20:28:11",
            "parent_archive": "Not Available"
        },
        "Selectors": [
            {
                "Engine": "Gateway Anti-Malware",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "GTI File Reputation",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "GTI URL Reputation",
                "MalwareName": "---",
                "Severity": "-1"
            },
            {
                "Engine": "Anti-Malware",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "YARA",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "Sandbox",
                "MalwareName": "---",
                "Severity": "0"
            }
        ],
        "Verdict": {
            "Severity": "0",
            "Description": "Sample termination reason: Sample could not run successfully in the Windows system."
        },
        "Urls": [
            {
                "Processes": [
                    {
                        "RelType": "8",
                        "Name": "file.xxx",
                        "Sha256": ""
                    }
                ],
                "Category": "Business ",
                "Functional": "Business/Services ",
                "Risk": "Information ",
                "Port": "80",
                "Reputation": "-2",
                "Severity": "0",
                "Url": "HTTP://MSEDGE.B.TLU.DL.DELIVERY.MP.MICROSOFT.COM/FILESTREAMINGSERVICE/FILES"
            },
            {
                "Processes": [
                    {
                        "RelType": "8",
                        "Name": "file.xxx",
                        "Sha256": ""
                    }
                ],
                "Category": "Business ",
                "Functional": "Business/Services ",
                "Risk": "Information ",
                "Port": "80",
                "Reputation": "-2",
                "Severity": "0",
                "Url": "HTTP://MSEDGE.B.TLU.DL.DELIVERY.MP.MICROSOFT.COM/FILESTREAMINGSERVICE/FILES/5F16D794-76D1-4AAC-94C6-CCD95709A3EB?P1=1753647178&P2=404&P3=2&P4=LNT3D5CCNVBKF8PY170SO36YRX%2B%2BKLCTFWQOF80NDJW9WOEXHDFAKX"
            }
        ],
        "Behavior": [
            {
                "ID": "2",
                "Analysis": "Identified as --- by Gateway Anti-Malware"
            },
            {
                "ID": "1",
                "Analysis": "Identified as --- by GTI File Reputation"
            },
            {
                "ID": "256",
                "Analysis": "Identified as --- by GTI URL Reputation"
            },
            {
                "ID": "4",
                "Analysis": "Identified as --- by Anti-Malware"
            },
            {
                "ID": "128",
                "Analysis": "Identified as --- by YARA"
            }
        ]
    }
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

The following Sekoia.io built-in rules match the intake Trellix Advanced Threat Defense [Beta]. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x Trellix Advanced Threat Defense [Beta] on ATT&CK Navigator

Account Added To A Security Enabled Group

Detection in order to investigate who has added a specific Domain User in Domain Admins or Group Policy Creator Owners (Security event 4728)

  • Effort: master
Account Removed From A Security Enabled Group

Detection in order to investigate who has removed a specific Domain User in Domain Admins or Group Policy Creator Owners (Security event 4729)

  • Effort: master
Advanced IP Scanner

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

  • Effort: master
Certify Or Certipy

Detects the use of certify and certipy which are two different tools used to enumerate and abuse Active Directory Certificate Services.

  • Effort: advanced
Cobalt Strike Default Beacons Names

Detects the default names of Cobalt Strike beacons / payloads.

  • Effort: intermediate
Computer Account Deleted

Detects computer account deletion.

  • Effort: master
Credential Dump Tools Related Files

Detects processes or file names related to credential dumping tools and the dropped files they generate by default.

  • Effort: advanced
Cryptomining

Detection of domain names potentially related to cryptomining activities.

  • Effort: master
Domain Trust Created Or Removed

A trust was created or removed to a domain. An attacker could perform that in order to do lateral movement easily between domains or shutdown the ability of two domains to communicate.

  • Effort: advanced
Dynamic DNS Contacted

Detect communication with dynamic dns domain. This kind of domain is often used by attackers. This rule can trigger false positive in non-controlled environment because dynamic dns is not always malicious.

  • Effort: master
Exfiltration Domain

Detects traffic toward a domain flagged as a possible exfiltration vector.

  • Effort: master
HackTools Suspicious Names

Quick-win rule to detect the default process names or file names of several HackTools.

  • Effort: advanced
Password Change On Directory Service Restore Mode (DSRM) Account

The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password to gain persistence.

  • Effort: intermediate
PasswordDump SecurityXploded Tool

Detects the execution of the PasswordDump SecurityXploded Tool

  • Effort: elementary
Possible Replay Attack

This event can be a sign of Kerberos replay attack or, among other things, network device configuration or routing problems.

  • Effort: master
RTLO Character

Detects RTLO (Right-To-Left character) in file and process names.

  • Effort: elementary
Remote Access Tool Domain

Detects traffic toward a domain flagged as a Remote Administration Tool (RAT).

  • Effort: master
SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

  • Effort: elementary
Sekoia.io EICAR Detection

Detects observables in Sekoia.io CTI tagged as EICAR, which are fake samples meant to test detection.

  • Effort: master
Suspicious File Name

Detects suspicious file name possibly linked to malicious tool.

  • Effort: advanced
Suspicious PROCEXP152.sys File Created In Tmp

Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU. Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it.

  • Effort: advanced
TOR Usage Generic Rule

Detects TOR usage globally, whether the IP is a destination or source. TOR is short for The Onion Router, and it gets its name from how it works. TOR intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.

  • Effort: master
User Account Created

Detects user creation on windows servers, which shouldn't happen in an Active Directory environment. Apply this on your windows server logs and not on your DC logs. One default account defaultuser0 is excluded as only used during Windows set-up. This detection use Security Event ID 4720.

  • Effort: master
User Account Deleted

Detects local user deletion

  • Effort: master
WCE wceaux.dll Creation

Detects wceaux.dll creation while Windows Credentials Editor (WCE) is executed.

  • Effort: intermediate

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Anti-virus None
File monitoring None

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind event
Category ``
Type ['info']

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

{
    "message": "{\"Type\":\"Audit\",\"MsgId\":\"L-LG-04-0\",\"Result\":\"Success\",\"User\":\"tata\",\"Category\":\"User\",\"Client\":\"2.2.2.2\",\"Action\":\"Session Login\",\"Description\":\"Successful user login - mwg-w7\"}",
    "event": {
        "action": "Session Login",
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "client": {
        "address": "2.2.2.2",
        "ip": "2.2.2.2",
        "user": {
            "name": "tata"
        }
    },
    "log": {
        "description": "Successful user login - mwg-w7"
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "ip": [
            "2.2.2.2"
        ],
        "user": [
            "tata"
        ]
    }
}

{
    "message": "{\"Type\":\"Audit\",\"MsgId\":\"L-LG-05-0\",\"Result\":\"Success\",\"User\":\"tata\",\"Category\":\"User\",\"Client\":\"2.2.2.2\",\"Action\":\"Session Logout\",\"Description\":\"Successful user logout: mwg-w7\"}",
    "event": {
        "action": "Session Logout",
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "client": {
        "address": "2.2.2.2",
        "ip": "2.2.2.2",
        "user": {
            "name": "tata"
        }
    },
    "log": {
        "description": "Successful user logout: mwg-w7"
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "ip": [
            "2.2.2.2"
        ],
        "user": [
            "tata"
        ]
    }
}

{
    "message": "{\"Type\":\"Audit\",\"MsgId\":\"M-MC-27-1\",\"Result\":\"Failure\",\"User\":\"tata\",\"Category\":\"Admin\",\"Client\":\"Localhost\",\"Action\":\"Manage Trusted Certificate\",\"Description\":\"MATD Web Certificate does not meet Security requirement\"}",
    "event": {
        "action": "Manage Trusted Certificate",
        "category": [
            "admin"
        ],
        "kind": "event",
        "outcome": "failure",
        "type": [
            "info"
        ]
    },
    "client": {
        "address": "localhost",
        "domain": "localhost",
        "user": {
            "name": "tata"
        }
    },
    "log": {
        "description": "MATD Web Certificate does not meet Security requirement"
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "hosts": [
            "localhost"
        ],
        "user": [
            "tata"
        ]
    }
}

{
    "message": "{\"Result\": \"Success\", \"Action\": \"Database Pruning\", \"User\": \"toto\", \"Client\": \"localhost\", \"Type\": \"Audit\", \"Category\": \"Admin\", \"Description\": \"Record threshold count not met\", \"MsgId\": \"B-DB-02-1\"}",
    "event": {
        "action": "Database Pruning",
        "category": [
            "admin"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "client": {
        "address": "localhost",
        "domain": "localhost",
        "user": {
            "name": "toto"
        }
    },
    "log": {
        "description": "Record threshold count not met"
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "hosts": [
            "localhost"
        ],
        "user": [
            "toto"
        ]
    }
}

{
    "message": "{\"Action\": \"Successful user login\", \"User\": \"toto\", \"UserID\": \"65\", \"Timestamp\": \"2025-07-22 11:38:44\", \"Client\": \"2.2.2.2\"}",
    "event": {
        "action": "Successful user login",
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "@timestamp": "2025-07-22T11:38:44Z",
    "client": {
        "address": "2.2.2.2",
        "ip": "2.2.2.2",
        "user": {
            "id": "65",
            "name": "toto"
        }
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "ip": [
            "2.2.2.2"
        ],
        "user": [
            "toto"
        ]
    }
}

{
    "message": "{\"Action\": \"Successful user logout\", \"User\": \"toto\", \"UserID\": \"65\", \"Timestamp\": \"2025-07-22 11:38:45\", \"Client\": \"2.2.2.2\", \"HTTPAgent\": \"Skyhigh Secure Web Gateway 12.2.16.52651\"}",
    "event": {
        "action": "Successful user logout",
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "@timestamp": "2025-07-22T11:38:45Z",
    "client": {
        "address": "2.2.2.2",
        "ip": "2.2.2.2",
        "user": {
            "id": "65",
            "name": "toto"
        }
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "ip": [
            "2.2.2.2"
        ],
        "user": [
            "toto"
        ]
    }
}

{
    "message": "{\"Summary\": { \"Event_Type\": \"ATD File Report\",\"MISversion\": \"5.2.0.16\",\"SUMversion\": \"5.2.0.16\",\"DETversion\": \"5.2.6.250110\",\"OSversion\": \"win10p0x64\",\"fileId\": \"Not Available\",\"Parent MD5\": \"Not Available\",\"ATD IP\": \"1.1.1.1\",\"Src IP\": \"2.2.2.2\",\"Dst IP\": \"\",\"TaskId\": \"144115188076224076\",\"JobId\": \"144115188076216640\",\"JSONversion\": \"1.003\",\"SubmitterName\": \"toto\",\"SubmitterType\": \"MWG\",\"hasDynamicAnalysis\": \"true\",\"Subject\": {\"Name\": \"file.xxx\",\"Type\": \"application/pdf\",\"FileType\": \"4\",\"md5\": \"AE299DBD8F796B8A5479E763BB00FB93\",\"sha-1\": \"A826D22E2FF0971FB932E88CFCB75CCB16D6B9C2\",\"sha-256\": \"229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A\",\"size\": \"54620\",\"Timestamp\": \"2025-07-22 08:25:39\",\"parent_archive\": \"Not Available\"},\"Selectors\": [{\"Engine\": \"Gateway Anti-Malware\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"GTI File Reputation\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"GTI URL Reputation\",\"MalwareName\": \"Business \",\"Severity\": \"1\"},{\"Engine\": \"Anti-Malware\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"YARA\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"Sandbox\",\"MalwareName\": \"---\",\"Severity\": \"2\"}],\"Verdict\": {\"Severity\": \"2\",\"Description\": \"Sample is somewhat suspicious: final severity level 2\"},\"Processes\" : [{\"Name\" : \"acrord32.exe\",\"Md5\" : \"\",\"Sha1\" : \"\",\"Sha256\" : \"\",\"Severity\" : \"2\"},{\"Name\" : \"splwow64.exe\",\"Md5\" : \"\",\"Sha1\" : \"\",\"Sha256\" : \"\",\"Severity\" : \"2\"},{\"Name\" : \"jst1.js\",\"Md5\" : \"\",\"Sha1\" : \"\",\"Sha256\" : \"\",\"Severity\" : \"2\"}],\"Files\" : [{\"Processes\" : [{\"RelType\" : \"512\",\"Name\" : \"file.xxx\",\"Sha256\" : \"229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A\"}],\"Md5\" : \"D633AE9E8E94BC640AF6581B53D250FB\",\"Sha1\" : \"9BC9DBD1F9C23F9B9437F5E71B44FC8988971084\",\"Sha256\" : \"53CBA858F975AB69E9782745369E42DC7674A7B58C24EE10F2C65304C48B9BC8\",\"Name\" : \"file.xxx\",\"FileType\" : \"128\"},{\"Processes\" : [{\"RelType\" : \"512\",\"Name\" : \"file.xxx\",\"Sha256\" : \"229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A\"}],\"Md5\" : \"B451FF15BA0A31EBDFB809D4E8929B3D\",\"Sha1\" : \"B81FA68215FAF82211F226325649BC717DBCAE40\",\"Sha256\" : \"B10D4CFF0E8F500510B412C9543CE8280B616ECA4B7F9FAE184B3095AB43AF53\",\"Name\" : \"file.xxx\",\"FileType\" : \"128\"}],\"Urls\" : [{\"Processes\" : [{\"RelType\" : \"8\",\"Name\" : \"file.xxx\",\"Sha256\" : \"\"}],\"Category\" : \"Business \",\"Functional\" : \"Business/Services \",\"Risk\" : \"Information \",\"Port\" : \"80\",\"Reputation\" : \"3\",\"Severity\" : \"1\",\"Url\" : \"HTTPS:\\/\\/ODACE.APPARETE.FR\\/EDITIONS\"},{\"Processes\" : [{\"RelType\" : \"8\",\"Name\" : \"file.xxx\",\"Sha256\" : \"\"}],\"Category\" : \"Business \",\"Functional\" : \"Business/Services \",\"Risk\" : \"Information \",\"Port\" : \"80\",\"Reputation\" : \"3\",\"Severity\" : \"1\",\"Url\" : \"HTTPS:\\/\\/ODACE.APPARETE.FR\\/EDITIONS\\/EDITION_CONSULT.ASPX?DXREP_FAKE=&EDITIONNUMARA=F73A9E66-DB7A-486F-A5E8-D86443F8CAC3&RELOAD=TRUE\"}],\"Stats\": [{\"ID\": \"0\",\"Category\": \"Persistence, Installation Boot Survival \",\"Severity\": \"2\"},{\"ID\": \"1\",\"Category\": \"Hiding, Camouflage, Stealthiness, Detection and Removal Protection \",\"Severity\": \"2\"},{\"ID\": \"2\",\"Category\": \"Security Solution / Mechanism bypass, termination and removal, Anti Debugging, VM Detection \",\"Severity\": \"1\"},{\"ID\": \"3\",\"Category\": \"Spreading \",\"Severity\": \"1\"},{\"ID\": \"4\",\"Category\": \"Exploiting, Shellcode \",\"Severity\": \"2\"},{\"ID\": \"5\",\"Category\": \"Networking \",\"Severity\": \"1\"},{\"ID\": \"6\",\"Category\": \"Data spying, Sniffing, Keylogging, Ebanking Fraud \",\"Severity\": \"1\"}],\"Behavior\": [{\"ID\": \"2\",\"Analysis\": \"Identified as --- by Gateway Anti-Malware\"},{\"ID\": \"1\",\"Analysis\": \"Identified as --- by GTI File Reputation\"},{\"ID\": \"256\",\"Analysis\": \"Identified as Business  by GTI URL Reputation\"},{\"ID\": \"4\",\"Analysis\": \"Identified as --- by Anti-Malware\"},{\"ID\": \"128\",\"Analysis\": \"Identified as --- by YARA\"},{\"ID\": \"2803\",\"Analysis\": \"Tracing System location\"},{\"ID\": \"2859\",\"Analysis\": \"Gathered system time information\"},{\"ID\": \"25\",\"Analysis\": \"Detected scripting content embedded in the sample\"},{\"ID\": \"2905\",\"Analysis\": \"Javascipt is executed using wscript or cscript\"},{\"ID\": \"2883\",\"Analysis\": \"Gathering system info via WMIC \"}],\"Mitre\" : [{ \"ID\" : \"T1059\",\"Technique Name\" : \"Command and Scripting Interpreter\",\"Tactics\" : \"Execution\",\"Subtechniques\" :     [{ \"ID\" : \"T1059.005\",\"Sub-Technique Name\" : \"Visual Basic\",\"Rules\" :     [{ \"Description\" : \"Detected scripting content embedded in the sample\",\"Severity\" : \"2\"}]},{ \"ID\" : \"T1059.007\",\"Sub-Technique Name\" : \"JavaScript\",\"Rules\" :     [{ \"Description\" : \"Detected scripting content embedded in the sample\",\"Severity\" : \"2\"},{ \"Description\" : \"Javascipt is executed using wscript or cscript\",\"Severity\" : \"1\"}]}]},{ \"ID\" : \"T1082\",\"Technique Name\" : \"System Information Discovery\",\"Tactics\" : \"Discovery\",\"Rules\" :     [{ \"Description\" : \"Gathering system info via WMIC \",\"Severity\" : \"2\"}]},{ \"ID\" : \"T1124\",\"Technique Name\" : \"System Time Discovery\",\"Tactics\" : \"Discovery\",\"Rules\" :     [{ \"Description\" : \"Gathered system time information\",\"Severity\" : \"2\"}]},{ \"ID\" : \"T1614\",\"Technique Name\" : \"System Location Discovery\",\"Tactics\" : \"Discovery\",\"Rules\" :     [{ \"Description\" : \"Tracing System location\",\"Severity\" : \"2\"}]}]}}",
    "event": {
        "action": "ATD File Report",
        "category": [
            "file"
        ],
        "kind": "event",
        "outcome": "unknown",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2025-07-22T08:25:39Z",
    "file": {
        "hash": {
            "md5": "AE299DBD8F796B8A5479E763BB00FB93",
            "sha1": "A826D22E2FF0971FB932E88CFCB75CCB16D6B9C2",
            "sha256": "229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A"
        },
        "name": "file.xxx",
        "size": 54620,
        "type": "application/pdf"
    },
    "host": {
        "os": {
            "version": "win10p0x64"
        }
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "hash": [
            "229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A",
            "A826D22E2FF0971FB932E88CFCB75CCB16D6B9C2",
            "AE299DBD8F796B8A5479E763BB00FB93"
        ],
        "ip": [
            "2.2.2.2"
        ]
    },
    "source": {
        "address": "2.2.2.2",
        "ip": "2.2.2.2"
    },
    "trellix": {
        "atd": {
            "engine": {
                "AM": {
                    "malware": {
                        "severity": "unverified"
                    }
                },
                "GTIFR": {
                    "malware": {
                        "severity": "unverified"
                    }
                },
                "GTIUR": {
                    "malware": {
                        "name": "Business ",
                        "severity": "informational"
                    }
                },
                "GWAM": {
                    "malware": {
                        "severity": "unverified"
                    }
                },
                "sandbox": {
                    "malware": {
                        "severity": "low"
                    }
                },
                "yara": {
                    "malware": {
                        "severity": "unverified"
                    }
                }
            },
            "ip": "1.1.1.1",
            "parent": {
                "archive": "Not Available"
            },
            "processes": [
                "acrord32.exe",
                "jst1.js",
                "splwow64.exe"
            ],
            "submitter": {
                "name": "toto",
                "type": "MWG"
            },
            "url": [
                "https://odace.apparete.fr/editions",
                "https://odace.apparete.fr/editions/edition_consult.aspx?dxrep_fake=&editionnumara=f73a9e66-db7a-486f-a5e8-d86443f8cac3&reload=true"
            ],
            "verdict": "low",
            "verdict_reason": "Sample is somewhat suspicious: final severity level 2"
        }
    }
}

{
    "message": "{\"Summary\": { \"Event_Type\": \"ATD File Report\",\"MISversion\": \"5.2.0.16\",\"SUMversion\": \"5.2.0.16\",\"DETversion\": \"5.2.6.250110\",\"OSversion\": \"win7sp1x64_Win7SP1x64-IANNG\",\"fileId\": \"Not Available\",\"Parent MD5\": \"Not Available\",\"ATD IP\": \"1.1.1.1\",\"Src IP\": \"2.2.2.2\",\"Dst IP\": \"\",\"TaskId\": \"144115188076224043\",\"JobId\": \"144115188076216607\",\"JSONversion\": \"1.003\",\"SubmitterName\": \"toto\",\"SubmitterType\": \"MWG\",\"hasDynamicAnalysis\": \"true\",\"Subject\": {\"Name\": \"file.xxx\",\"Type\": \"PE32+ executable (GUI) x86-64\",\"FileType\": \"0\",\"md5\": \"D0E38E34A8A648CB663FB75DBCC849D2\",\"sha-1\": \"8B86FAFB36D4A680121209C0EEABB606E6169B36\",\"sha-256\": \"6AB95CCECF9FF63EDC1FA183B4E85D52A24A078471D9E4AD8BC7D7739CA78957\",\"size\": \"1210009\",\"Timestamp\": \"2025-07-20 20:28:11\",\"parent_archive\": \"Not Available\"},\"Selectors\": [{\"Engine\": \"Gateway Anti-Malware\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"GTI File Reputation\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"GTI URL Reputation\",\"MalwareName\": \"---\",\"Severity\": \"-1\"},{\"Engine\": \"Anti-Malware\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"YARA\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"Sandbox\",\"MalwareName\": \"---\",\"Severity\": \"0\"}],\"Verdict\": {\"Severity\": \"0\",\"Description\": \"Sample termination reason: Sample could not run successfully in the Windows system.\"},\"Urls\" : [{\"Processes\" : [{\"RelType\" : \"8\",\"Name\" : \"file.xxx\",\"Sha256\" : \"\"}],\"Category\" : \"Business \",\"Functional\" : \"Business/Services \",\"Risk\" : \"Information \",\"Port\" : \"80\",\"Reputation\" : \"-2\",\"Severity\" : \"0\",\"Url\" : \"HTTP:\\/\\/MSEDGE.B.TLU.DL.DELIVERY.MP.MICROSOFT.COM\\/FILESTREAMINGSERVICE\\/FILES\"},{\"Processes\" : [{\"RelType\" : \"8\",\"Name\" : \"file.xxx\",\"Sha256\" : \"\"}],\"Category\" : \"Business \",\"Functional\" : \"Business/Services \",\"Risk\" : \"Information \",\"Port\" : \"80\",\"Reputation\" : \"-2\",\"Severity\" : \"0\",\"Url\" : \"HTTP:\\/\\/MSEDGE.B.TLU.DL.DELIVERY.MP.MICROSOFT.COM\\/FILESTREAMINGSERVICE\\/FILES\\/5F16D794-76D1-4AAC-94C6-CCD95709A3EB?P1=1753647178&P2=404&P3=2&P4=LNT3D5CCNVBKF8PY170SO36YRX%2B%2BKLCTFWQOF80NDJW9WOEXHDFAKX\"}],\"Behavior\": [{\"ID\": \"2\",\"Analysis\": \"Identified as --- by Gateway Anti-Malware\"},{\"ID\": \"1\",\"Analysis\": \"Identified as --- by GTI File Reputation\"},{\"ID\": \"256\",\"Analysis\": \"Identified as --- by GTI URL Reputation\"},{\"ID\": \"4\",\"Analysis\": \"Identified as --- by Anti-Malware\"},{\"ID\": \"128\",\"Analysis\": \"Identified as --- by YARA\"}]}}",
    "event": {
        "action": "ATD File Report",
        "category": [
            "file"
        ],
        "kind": "event",
        "outcome": "unknown",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2025-07-20T20:28:11Z",
    "file": {
        "hash": {
            "md5": "D0E38E34A8A648CB663FB75DBCC849D2",
            "sha1": "8B86FAFB36D4A680121209C0EEABB606E6169B36",
            "sha256": "6AB95CCECF9FF63EDC1FA183B4E85D52A24A078471D9E4AD8BC7D7739CA78957"
        },
        "name": "file.xxx",
        "size": 1210009,
        "type": "PE32+ executable (GUI) x86-64"
    },
    "host": {
        "os": {
            "version": "win7sp1x64_Win7SP1x64-IANNG"
        }
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "hash": [
            "6AB95CCECF9FF63EDC1FA183B4E85D52A24A078471D9E4AD8BC7D7739CA78957",
            "8B86FAFB36D4A680121209C0EEABB606E6169B36",
            "D0E38E34A8A648CB663FB75DBCC849D2"
        ],
        "ip": [
            "2.2.2.2"
        ]
    },
    "source": {
        "address": "2.2.2.2",
        "ip": "2.2.2.2"
    },
    "trellix": {
        "atd": {
            "engine": {
                "AM": {
                    "malware": {
                        "severity": "unverified"
                    }
                },
                "GTIFR": {
                    "malware": {
                        "severity": "unverified"
                    }
                },
                "GTIUR": {
                    "malware": {
                        "severity": "clean"
                    }
                },
                "GWAM": {
                    "malware": {
                        "severity": "unverified"
                    }
                },
                "sandbox": {
                    "malware": {
                        "severity": "unverified"
                    }
                },
                "yara": {
                    "malware": {
                        "severity": "unverified"
                    }
                }
            },
            "ip": "1.1.1.1",
            "parent": {
                "archive": "Not Available"
            },
            "submitter": {
                "name": "toto",
                "type": "MWG"
            },
            "url": [
                "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files",
                "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5f16d794-76d1-4aac-94c6-ccd95709a3eb?p1=1753647178&p2=404&p3=2&p4=lnt3d5ccnvbkf8py170so36yrx%2b%2bklctfwqof80ndjw9woexhdfakx"
            ],
            "verdict": "unverified",
            "verdict_reason": "Sample termination reason: Sample could not run successfully in the Windows system."
        }
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
client.domain keyword The domain name of the client.
client.ip ip IP address of the client.
client.user.id keyword Unique identifier of the user.
client.user.name keyword Short name or login of the user.
destination.ip ip IP address of the destination.
event.action keyword The action captured by the event.
event.category keyword Event category. The second categorization field in the hierarchy.
event.code keyword Identification code for this event.
event.kind keyword The kind of the event. The highest categorization field in the hierarchy.
event.outcome keyword The outcome of the event. The lowest level categorization field in the hierarchy.
event.reason keyword Reason why this event happened, according to the source
event.severity long Numeric severity of the event.
event.type keyword Event type. The third categorization field in the hierarchy.
file.hash.md5 keyword MD5 hash.
file.hash.sha1 keyword SHA1 hash.
file.hash.sha256 keyword SHA256 hash.
file.name keyword Name of the file including the extension, without the directory.
file.size long File size in bytes.
file.type keyword File type (file, dir, or symlink).
host.os.version keyword Operating system version as a raw string.
observer.product keyword The product name of the observer.
observer.vendor keyword Vendor name of the observer.
source.ip ip IP address of the source.
trellix.atd.engine.AM.malware.name keyword Malware name identified by the Anti Malware engine
trellix.atd.engine.AM.malware.severity keyword Malware severity identified by the Anti Malware engine
trellix.atd.engine.GTIFR.malware.name keyword Malware name identified by the GTI File Reputation engine
trellix.atd.engine.GTIFR.malware.severity keyword Malware severity identified by the GTI File Reputation engine
trellix.atd.engine.GTIUR.malware.name keyword Malware name identified by the GTI Url Reputation engine
trellix.atd.engine.GTIUR.malware.severity keyword Malware severity identified by the GTI Url Reputation engine
trellix.atd.engine.GWAM.malware.name keyword Malware name detected by the Gateway Anti-Malware engine
trellix.atd.engine.GWAM.malware.severity keyword Malware severity detected by the Gateway Anti-Malware engine
trellix.atd.engine.sandbox.malware.name keyword Malware name identified by the Sandbox engine
trellix.atd.engine.sandbox.malware.severity keyword Malware severity identified by the Sandbox engine
trellix.atd.engine.yara.malware.name keyword Malware name identified by the yara engine
trellix.atd.engine.yara.malware.severity keyword Malware severity identified by the yara engine
trellix.atd.ip ip IP address of the Trellix ATD appliance
trellix.atd.parent.archive keyword Name of the file's parent archive
trellix.atd.processes array Processes for which Trellix Advanced Threat Defense system acts.
trellix.atd.submitter.name keyword Name of the ATD request submitter
trellix.atd.submitter.type keyword Type of the ATD request submitter
trellix.atd.url array Url(s) concerned by the trellix atd action
trellix.atd.verdict keyword Verdict found by Trellix ATD engines
trellix.atd.verdict_reason keyword Details about Trellix ATD engines verdict

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.