Skip to content

Trellix ATD

Overview

The Advanced Threat Defense Appliances are purpose-built, scalable, and flexible high-performance servers designed to analyze suspicious files for malware.

  • Vendor: Trellix
  • Supported environment: On Premise
  • Detection based on: Telemetry
  • Supported application or feature: Application logs

Warning

Important note - This format is currently in beta. We highly value your feedback to improve its performance.

High-Level Architecture Diagram

  • Type of integration: Outbound (PUSH to Sekoia.io)
  • Schema trellix_atd_architecture

Specification

Prerequisites

  • Resource:
    • Self-managed syslog forwarder
  • Network:
    • Outbound traffic allowed
  • Permissions:
    • Root access to the Trellix ATD web interface
    • Root access to the Linux server with the syslog forwarder

Transport Protocol/Method

  • Indirect Syslog

Logs details

  • Supported functionalities: See section Overview
  • Supported type(s) of structure: Syslog
  • Supported verbosity level: Informational

Note

Log levels are based on the taxonomy of RFC5424. Adapt according to the terminology used by the vendor.

Step-by-Step Quick Configuration Procedure

  1. Log on to the Advanced Threat Defense web interface.
  2. Click Manage → ATD Configuration → Syslog, then select Enable Logging
  3. In the Statistic to Log section, select the entries that suits your needs.

    Note: When HTTPS Session Log is enabled, Advanced Threat Defense web performance is impacted.

  4. From the drop-down menu, select TCP

    Note, if your security policy requires extra-security (ex: tls) between the application and the syslog forwarder, modify the configuration accordingly

  5. Click Enable Syslog
  6. Type in the IP and port of the forwarder you want the logs sent to.
  7. Click Test Connection and expect a "Test connection successful" message.
  8. Click Submit

Note

If you encounter any issues during the configuration specified in this section "Instructions on the 3rd Party Solution," please do not hesitate to contact your vendor. We also welcome any suggestions for improving our documentation to better serve your needs.

Instruction on Sekoia

Configure Your Intake

This section will guide you through creating the intake object in Sekoia, which provides a unique identifier called the "Intake key." The Intake key is essential for later configuration, as it references the Community, Entity, and Parser (Intake Format) used when receiving raw events on Sekoia.

  1. Go to the Sekoia Intake page.
  2. Click on the + New Intake button at the top right of the page.
  3. Search for your Intake by the product name in the search bar.
  4. Give it a Name and associate it with an Entity (and a Community if using multi-tenant mode).
  5. Click on Create.

Note

For more details on how to use the Intake page and to find the Intake key you just created, refer to this documentation.

Configure a forwarder

To forward events using syslog to Sekoia.io, you need to update the syslog header with the intake key you previously created. Here is an example of your message before the forwarder 

<%pri%>1 %timestamp:::date-rfc3339% %hostname% %app-name% %procid% LOG RAW_MESSAGE
and after 
<%pri%>1 %timestamp:::date-rfc3339% %hostname% %app-name% %procid% LOG [SEKOIA@53288 intake_key=\"YOUR_INTAKE_KEY\"] RAW_MESSAGE

To achieve this you can:

  • Use the Sekoia.io forwarder which is the official supported way to collect data using the syslog protocol in Sekoia.io. In charge of centralizing data coming from many equipments/sources and forwarding them to Sekoia.io with the apporpriated format, it is a prepackaged option. You only have to provide your intake key as parameter.
  • Use your own Syslog service instance. Maybe you already have an intance of one of these components on your side and want to reuse it in order to centralize data before forwarding them to Sekoia.io. When using this mode, you have to configure and maintain your component in order to respect the expected Sekoia.io format.

Warning

Only the Sekoia.io forwarder is officially supported. Other options are documented for reference purposes but do not have official support.

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

{
    "Type": "Audit",
    "MsgId": "L-LG-04-0",
    "Result": "Success",
    "User": "tata",
    "Category": "User",
    "Client": "2.2.2.2",
    "Action": "Session Login",
    "Description": "Successful user login - mwg-w7"
}

{
    "Type": "Audit",
    "MsgId": "L-LG-05-0",
    "Result": "Success",
    "User": "tata",
    "Category": "User",
    "Client": "2.2.2.2",
    "Action": "Session Logout",
    "Description": "Successful user logout: mwg-w7"
}

{
    "Type": "Audit",
    "MsgId": "M-MC-27-1",
    "Result": "Failure",
    "User": "tata",
    "Category": "Admin",
    "Client": "Localhost",
    "Action": "Manage Trusted Certificate",
    "Description": "MATD Web Certificate does not meet Security requirement"
}

{
    "Result": "Success",
    "Action": "Database Pruning",
    "User": "toto",
    "Client": "localhost",
    "Type": "Audit",
    "Category": "Admin",
    "Description": "Record threshold count not met",
    "MsgId": "B-DB-02-1"
}

{
    "Action": "Successful user login",
    "User": "toto",
    "UserID": "65",
    "Timestamp": "2025-07-22 11:38:44",
    "Client": "2.2.2.2"
}

{
    "Action": "Successful user logout",
    "User": "toto",
    "UserID": "65",
    "Timestamp": "2025-07-22 11:38:45",
    "Client": "2.2.2.2",
    "HTTPAgent": "Skyhigh Secure Web Gateway 12.2.16.52651"
}

{
    "Summary": {
        "Event_Type": "ATD File Report",
        "MISversion": "5.2.0.16",
        "SUMversion": "5.2.0.16",
        "DETversion": "5.2.6.250110",
        "OSversion": "win10p0x64",
        "fileId": "Not Available",
        "Parent MD5": "Not Available",
        "ATD IP": "1.1.1.1",
        "Src IP": "2.2.2.2",
        "Dst IP": "",
        "TaskId": "144115188076224076",
        "JobId": "144115188076216640",
        "JSONversion": "1.003",
        "SubmitterName": "toto",
        "SubmitterType": "MWG",
        "hasDynamicAnalysis": "true",
        "Subject": {
            "Name": "file.xxx",
            "Type": "application/pdf",
            "FileType": "4",
            "md5": "AE299DBD8F796B8A5479E763BB00FB93",
            "sha-1": "A826D22E2FF0971FB932E88CFCB75CCB16D6B9C2",
            "sha-256": "229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A",
            "size": "54620",
            "Timestamp": "2025-07-22 08:25:39",
            "parent_archive": "Not Available"
        },
        "Selectors": [
            {
                "Engine": "Gateway Anti-Malware",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "GTI File Reputation",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "GTI URL Reputation",
                "MalwareName": "Business ",
                "Severity": "1"
            },
            {
                "Engine": "Anti-Malware",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "YARA",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "Sandbox",
                "MalwareName": "---",
                "Severity": "2"
            }
        ],
        "Verdict": {
            "Severity": "2",
            "Description": "Sample is somewhat suspicious: final severity level 2"
        },
        "Processes": [
            {
                "Name": "acrord32.exe",
                "Md5": "",
                "Sha1": "",
                "Sha256": "",
                "Severity": "2"
            },
            {
                "Name": "splwow64.exe",
                "Md5": "",
                "Sha1": "",
                "Sha256": "",
                "Severity": "2"
            },
            {
                "Name": "jst1.js",
                "Md5": "",
                "Sha1": "",
                "Sha256": "",
                "Severity": "2"
            }
        ],
        "Files": [
            {
                "Processes": [
                    {
                        "RelType": "512",
                        "Name": "file.xxx",
                        "Sha256": "229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A"
                    }
                ],
                "Md5": "D633AE9E8E94BC640AF6581B53D250FB",
                "Sha1": "9BC9DBD1F9C23F9B9437F5E71B44FC8988971084",
                "Sha256": "53CBA858F975AB69E9782745369E42DC7674A7B58C24EE10F2C65304C48B9BC8",
                "Name": "file.xxx",
                "FileType": "128"
            },
            {
                "Processes": [
                    {
                        "RelType": "512",
                        "Name": "file.xxx",
                        "Sha256": "229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A"
                    }
                ],
                "Md5": "B451FF15BA0A31EBDFB809D4E8929B3D",
                "Sha1": "B81FA68215FAF82211F226325649BC717DBCAE40",
                "Sha256": "B10D4CFF0E8F500510B412C9543CE8280B616ECA4B7F9FAE184B3095AB43AF53",
                "Name": "file.xxx",
                "FileType": "128"
            }
        ],
        "Urls": [
            {
                "Processes": [
                    {
                        "RelType": "8",
                        "Name": "file.xxx",
                        "Sha256": ""
                    }
                ],
                "Category": "Business ",
                "Functional": "Business/Services ",
                "Risk": "Information ",
                "Port": "80",
                "Reputation": "3",
                "Severity": "1",
                "Url": "HTTPS://ODACE.APPARETE.FR/EDITIONS"
            },
            {
                "Processes": [
                    {
                        "RelType": "8",
                        "Name": "file.xxx",
                        "Sha256": ""
                    }
                ],
                "Category": "Business ",
                "Functional": "Business/Services ",
                "Risk": "Information ",
                "Port": "80",
                "Reputation": "3",
                "Severity": "1",
                "Url": "HTTPS://ODACE.APPARETE.FR/EDITIONS/EDITION_CONSULT.ASPX?DXREP_FAKE=&EDITIONNUMARA=F73A9E66-DB7A-486F-A5E8-D86443F8CAC3&RELOAD=TRUE"
            }
        ],
        "Stats": [
            {
                "ID": "0",
                "Category": "Persistence, Installation Boot Survival ",
                "Severity": "2"
            },
            {
                "ID": "1",
                "Category": "Hiding, Camouflage, Stealthiness, Detection and Removal Protection ",
                "Severity": "2"
            },
            {
                "ID": "2",
                "Category": "Security Solution / Mechanism bypass, termination and removal, Anti Debugging, VM Detection ",
                "Severity": "1"
            },
            {
                "ID": "3",
                "Category": "Spreading ",
                "Severity": "1"
            },
            {
                "ID": "4",
                "Category": "Exploiting, Shellcode ",
                "Severity": "2"
            },
            {
                "ID": "5",
                "Category": "Networking ",
                "Severity": "1"
            },
            {
                "ID": "6",
                "Category": "Data spying, Sniffing, Keylogging, Ebanking Fraud ",
                "Severity": "1"
            }
        ],
        "Behavior": [
            {
                "ID": "2",
                "Analysis": "Identified as --- by Gateway Anti-Malware"
            },
            {
                "ID": "1",
                "Analysis": "Identified as --- by GTI File Reputation"
            },
            {
                "ID": "256",
                "Analysis": "Identified as Business  by GTI URL Reputation"
            },
            {
                "ID": "4",
                "Analysis": "Identified as --- by Anti-Malware"
            },
            {
                "ID": "128",
                "Analysis": "Identified as --- by YARA"
            },
            {
                "ID": "2803",
                "Analysis": "Tracing System location"
            },
            {
                "ID": "2859",
                "Analysis": "Gathered system time information"
            },
            {
                "ID": "25",
                "Analysis": "Detected scripting content embedded in the sample"
            },
            {
                "ID": "2905",
                "Analysis": "Javascipt is executed using wscript or cscript"
            },
            {
                "ID": "2883",
                "Analysis": "Gathering system info via WMIC "
            }
        ],
        "Mitre": [
            {
                "ID": "T1059",
                "Technique Name": "Command and Scripting Interpreter",
                "Tactics": "Execution",
                "Subtechniques": [
                    {
                        "ID": "T1059.005",
                        "Sub-Technique Name": "Visual Basic",
                        "Rules": [
                            {
                                "Description": "Detected scripting content embedded in the sample",
                                "Severity": "2"
                            }
                        ]
                    },
                    {
                        "ID": "T1059.007",
                        "Sub-Technique Name": "JavaScript",
                        "Rules": [
                            {
                                "Description": "Detected scripting content embedded in the sample",
                                "Severity": "2"
                            },
                            {
                                "Description": "Javascipt is executed using wscript or cscript",
                                "Severity": "1"
                            }
                        ]
                    }
                ]
            },
            {
                "ID": "T1082",
                "Technique Name": "System Information Discovery",
                "Tactics": "Discovery",
                "Rules": [
                    {
                        "Description": "Gathering system info via WMIC ",
                        "Severity": "2"
                    }
                ]
            },
            {
                "ID": "T1124",
                "Technique Name": "System Time Discovery",
                "Tactics": "Discovery",
                "Rules": [
                    {
                        "Description": "Gathered system time information",
                        "Severity": "2"
                    }
                ]
            },
            {
                "ID": "T1614",
                "Technique Name": "System Location Discovery",
                "Tactics": "Discovery",
                "Rules": [
                    {
                        "Description": "Tracing System location",
                        "Severity": "2"
                    }
                ]
            }
        ]
    }
}

{
    "Summary": {
        "Event_Type": "ATD File Report",
        "MISversion": "5.2.0.16",
        "SUMversion": "5.2.0.16",
        "DETversion": "5.2.6.250110",
        "OSversion": "win7sp1x64_Win7SP1x64-IANNG",
        "fileId": "Not Available",
        "Parent MD5": "Not Available",
        "ATD IP": "1.1.1.1",
        "Src IP": "2.2.2.2",
        "Dst IP": "",
        "TaskId": "144115188076224043",
        "JobId": "144115188076216607",
        "JSONversion": "1.003",
        "SubmitterName": "toto",
        "SubmitterType": "MWG",
        "hasDynamicAnalysis": "true",
        "Subject": {
            "Name": "file.xxx",
            "Type": "PE32+ executable (GUI) x86-64",
            "FileType": "0",
            "md5": "D0E38E34A8A648CB663FB75DBCC849D2",
            "sha-1": "8B86FAFB36D4A680121209C0EEABB606E6169B36",
            "sha-256": "6AB95CCECF9FF63EDC1FA183B4E85D52A24A078471D9E4AD8BC7D7739CA78957",
            "size": "1210009",
            "Timestamp": "2025-07-20 20:28:11",
            "parent_archive": "Not Available"
        },
        "Selectors": [
            {
                "Engine": "Gateway Anti-Malware",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "GTI File Reputation",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "GTI URL Reputation",
                "MalwareName": "---",
                "Severity": "-1"
            },
            {
                "Engine": "Anti-Malware",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "YARA",
                "MalwareName": "---",
                "Severity": "0"
            },
            {
                "Engine": "Sandbox",
                "MalwareName": "---",
                "Severity": "0"
            }
        ],
        "Verdict": {
            "Severity": "0",
            "Description": "Sample termination reason: Sample could not run successfully in the Windows system."
        },
        "Urls": [
            {
                "Processes": [
                    {
                        "RelType": "8",
                        "Name": "file.xxx",
                        "Sha256": ""
                    }
                ],
                "Category": "Business ",
                "Functional": "Business/Services ",
                "Risk": "Information ",
                "Port": "80",
                "Reputation": "-2",
                "Severity": "0",
                "Url": "HTTP://MSEDGE.B.TLU.DL.DELIVERY.MP.MICROSOFT.COM/FILESTREAMINGSERVICE/FILES"
            },
            {
                "Processes": [
                    {
                        "RelType": "8",
                        "Name": "file.xxx",
                        "Sha256": ""
                    }
                ],
                "Category": "Business ",
                "Functional": "Business/Services ",
                "Risk": "Information ",
                "Port": "80",
                "Reputation": "-2",
                "Severity": "0",
                "Url": "HTTP://MSEDGE.B.TLU.DL.DELIVERY.MP.MICROSOFT.COM/FILESTREAMINGSERVICE/FILES/5F16D794-76D1-4AAC-94C6-CCD95709A3EB?P1=1753647178&P2=404&P3=2&P4=LNT3D5CCNVBKF8PY170SO36YRX%2B%2BKLCTFWQOF80NDJW9WOEXHDFAKX"
            }
        ],
        "Behavior": [
            {
                "ID": "2",
                "Analysis": "Identified as --- by Gateway Anti-Malware"
            },
            {
                "ID": "1",
                "Analysis": "Identified as --- by GTI File Reputation"
            },
            {
                "ID": "256",
                "Analysis": "Identified as --- by GTI URL Reputation"
            },
            {
                "ID": "4",
                "Analysis": "Identified as --- by Anti-Malware"
            },
            {
                "ID": "128",
                "Analysis": "Identified as --- by YARA"
            }
        ]
    }
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Anti-virus None
File monitoring None

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind event
Category ``
Type ['info']

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

{
    "message": "{\"Type\":\"Audit\",\"MsgId\":\"L-LG-04-0\",\"Result\":\"Success\",\"User\":\"tata\",\"Category\":\"User\",\"Client\":\"2.2.2.2\",\"Action\":\"Session Login\",\"Description\":\"Successful user login - mwg-w7\"}",
    "event": {
        "action": "Session Login",
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "client": {
        "address": "2.2.2.2",
        "ip": "2.2.2.2",
        "user": {
            "name": "tata"
        }
    },
    "log": {
        "description": "Successful user login - mwg-w7"
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "ip": [
            "2.2.2.2"
        ],
        "user": [
            "tata"
        ]
    }
}

{
    "message": "{\"Type\":\"Audit\",\"MsgId\":\"L-LG-05-0\",\"Result\":\"Success\",\"User\":\"tata\",\"Category\":\"User\",\"Client\":\"2.2.2.2\",\"Action\":\"Session Logout\",\"Description\":\"Successful user logout: mwg-w7\"}",
    "event": {
        "action": "Session Logout",
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "client": {
        "address": "2.2.2.2",
        "ip": "2.2.2.2",
        "user": {
            "name": "tata"
        }
    },
    "log": {
        "description": "Successful user logout: mwg-w7"
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "ip": [
            "2.2.2.2"
        ],
        "user": [
            "tata"
        ]
    }
}

{
    "message": "{\"Type\":\"Audit\",\"MsgId\":\"M-MC-27-1\",\"Result\":\"Failure\",\"User\":\"tata\",\"Category\":\"Admin\",\"Client\":\"Localhost\",\"Action\":\"Manage Trusted Certificate\",\"Description\":\"MATD Web Certificate does not meet Security requirement\"}",
    "event": {
        "action": "Manage Trusted Certificate",
        "category": [
            "admin"
        ],
        "kind": "event",
        "outcome": "failure",
        "type": [
            "info"
        ]
    },
    "client": {
        "address": "localhost",
        "domain": "localhost",
        "user": {
            "name": "tata"
        }
    },
    "log": {
        "description": "MATD Web Certificate does not meet Security requirement"
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "hosts": [
            "localhost"
        ],
        "user": [
            "tata"
        ]
    }
}

{
    "message": "{\"Result\": \"Success\", \"Action\": \"Database Pruning\", \"User\": \"toto\", \"Client\": \"localhost\", \"Type\": \"Audit\", \"Category\": \"Admin\", \"Description\": \"Record threshold count not met\", \"MsgId\": \"B-DB-02-1\"}",
    "event": {
        "action": "Database Pruning",
        "category": [
            "admin"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "client": {
        "address": "localhost",
        "domain": "localhost",
        "user": {
            "name": "toto"
        }
    },
    "log": {
        "description": "Record threshold count not met"
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "hosts": [
            "localhost"
        ],
        "user": [
            "toto"
        ]
    }
}

{
    "message": "{\"Action\": \"Successful user login\", \"User\": \"toto\", \"UserID\": \"65\", \"Timestamp\": \"2025-07-22 11:38:44\", \"Client\": \"2.2.2.2\"}",
    "event": {
        "action": "Successful user login",
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "@timestamp": "2025-07-22T11:38:44Z",
    "client": {
        "address": "2.2.2.2",
        "ip": "2.2.2.2",
        "user": {
            "id": "65",
            "name": "toto"
        }
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "ip": [
            "2.2.2.2"
        ],
        "user": [
            "toto"
        ]
    }
}

{
    "message": "{\"Action\": \"Successful user logout\", \"User\": \"toto\", \"UserID\": \"65\", \"Timestamp\": \"2025-07-22 11:38:45\", \"Client\": \"2.2.2.2\", \"HTTPAgent\": \"Skyhigh Secure Web Gateway 12.2.16.52651\"}",
    "event": {
        "action": "Successful user logout",
        "category": [
            "authentication"
        ],
        "kind": "event",
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "@timestamp": "2025-07-22T11:38:45Z",
    "client": {
        "address": "2.2.2.2",
        "ip": "2.2.2.2",
        "user": {
            "id": "65",
            "name": "toto"
        }
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "ip": [
            "2.2.2.2"
        ],
        "user": [
            "toto"
        ]
    }
}

{
    "message": "{\"Summary\": { \"Event_Type\": \"ATD File Report\",\"MISversion\": \"5.2.0.16\",\"SUMversion\": \"5.2.0.16\",\"DETversion\": \"5.2.6.250110\",\"OSversion\": \"win10p0x64\",\"fileId\": \"Not Available\",\"Parent MD5\": \"Not Available\",\"ATD IP\": \"1.1.1.1\",\"Src IP\": \"2.2.2.2\",\"Dst IP\": \"\",\"TaskId\": \"144115188076224076\",\"JobId\": \"144115188076216640\",\"JSONversion\": \"1.003\",\"SubmitterName\": \"toto\",\"SubmitterType\": \"MWG\",\"hasDynamicAnalysis\": \"true\",\"Subject\": {\"Name\": \"file.xxx\",\"Type\": \"application/pdf\",\"FileType\": \"4\",\"md5\": \"AE299DBD8F796B8A5479E763BB00FB93\",\"sha-1\": \"A826D22E2FF0971FB932E88CFCB75CCB16D6B9C2\",\"sha-256\": \"229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A\",\"size\": \"54620\",\"Timestamp\": \"2025-07-22 08:25:39\",\"parent_archive\": \"Not Available\"},\"Selectors\": [{\"Engine\": \"Gateway Anti-Malware\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"GTI File Reputation\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"GTI URL Reputation\",\"MalwareName\": \"Business \",\"Severity\": \"1\"},{\"Engine\": \"Anti-Malware\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"YARA\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"Sandbox\",\"MalwareName\": \"---\",\"Severity\": \"2\"}],\"Verdict\": {\"Severity\": \"2\",\"Description\": \"Sample is somewhat suspicious: final severity level 2\"},\"Processes\" : [{\"Name\" : \"acrord32.exe\",\"Md5\" : \"\",\"Sha1\" : \"\",\"Sha256\" : \"\",\"Severity\" : \"2\"},{\"Name\" : \"splwow64.exe\",\"Md5\" : \"\",\"Sha1\" : \"\",\"Sha256\" : \"\",\"Severity\" : \"2\"},{\"Name\" : \"jst1.js\",\"Md5\" : \"\",\"Sha1\" : \"\",\"Sha256\" : \"\",\"Severity\" : \"2\"}],\"Files\" : [{\"Processes\" : [{\"RelType\" : \"512\",\"Name\" : \"file.xxx\",\"Sha256\" : \"229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A\"}],\"Md5\" : \"D633AE9E8E94BC640AF6581B53D250FB\",\"Sha1\" : \"9BC9DBD1F9C23F9B9437F5E71B44FC8988971084\",\"Sha256\" : \"53CBA858F975AB69E9782745369E42DC7674A7B58C24EE10F2C65304C48B9BC8\",\"Name\" : \"file.xxx\",\"FileType\" : \"128\"},{\"Processes\" : [{\"RelType\" : \"512\",\"Name\" : \"file.xxx\",\"Sha256\" : \"229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A\"}],\"Md5\" : \"B451FF15BA0A31EBDFB809D4E8929B3D\",\"Sha1\" : \"B81FA68215FAF82211F226325649BC717DBCAE40\",\"Sha256\" : \"B10D4CFF0E8F500510B412C9543CE8280B616ECA4B7F9FAE184B3095AB43AF53\",\"Name\" : \"file.xxx\",\"FileType\" : \"128\"}],\"Urls\" : [{\"Processes\" : [{\"RelType\" : \"8\",\"Name\" : \"file.xxx\",\"Sha256\" : \"\"}],\"Category\" : \"Business \",\"Functional\" : \"Business/Services \",\"Risk\" : \"Information \",\"Port\" : \"80\",\"Reputation\" : \"3\",\"Severity\" : \"1\",\"Url\" : \"HTTPS:\\/\\/ODACE.APPARETE.FR\\/EDITIONS\"},{\"Processes\" : [{\"RelType\" : \"8\",\"Name\" : \"file.xxx\",\"Sha256\" : \"\"}],\"Category\" : \"Business \",\"Functional\" : \"Business/Services \",\"Risk\" : \"Information \",\"Port\" : \"80\",\"Reputation\" : \"3\",\"Severity\" : \"1\",\"Url\" : \"HTTPS:\\/\\/ODACE.APPARETE.FR\\/EDITIONS\\/EDITION_CONSULT.ASPX?DXREP_FAKE=&EDITIONNUMARA=F73A9E66-DB7A-486F-A5E8-D86443F8CAC3&RELOAD=TRUE\"}],\"Stats\": [{\"ID\": \"0\",\"Category\": \"Persistence, Installation Boot Survival \",\"Severity\": \"2\"},{\"ID\": \"1\",\"Category\": \"Hiding, Camouflage, Stealthiness, Detection and Removal Protection \",\"Severity\": \"2\"},{\"ID\": \"2\",\"Category\": \"Security Solution / Mechanism bypass, termination and removal, Anti Debugging, VM Detection \",\"Severity\": \"1\"},{\"ID\": \"3\",\"Category\": \"Spreading \",\"Severity\": \"1\"},{\"ID\": \"4\",\"Category\": \"Exploiting, Shellcode \",\"Severity\": \"2\"},{\"ID\": \"5\",\"Category\": \"Networking \",\"Severity\": \"1\"},{\"ID\": \"6\",\"Category\": \"Data spying, Sniffing, Keylogging, Ebanking Fraud \",\"Severity\": \"1\"}],\"Behavior\": [{\"ID\": \"2\",\"Analysis\": \"Identified as --- by Gateway Anti-Malware\"},{\"ID\": \"1\",\"Analysis\": \"Identified as --- by GTI File Reputation\"},{\"ID\": \"256\",\"Analysis\": \"Identified as Business  by GTI URL Reputation\"},{\"ID\": \"4\",\"Analysis\": \"Identified as --- by Anti-Malware\"},{\"ID\": \"128\",\"Analysis\": \"Identified as --- by YARA\"},{\"ID\": \"2803\",\"Analysis\": \"Tracing System location\"},{\"ID\": \"2859\",\"Analysis\": \"Gathered system time information\"},{\"ID\": \"25\",\"Analysis\": \"Detected scripting content embedded in the sample\"},{\"ID\": \"2905\",\"Analysis\": \"Javascipt is executed using wscript or cscript\"},{\"ID\": \"2883\",\"Analysis\": \"Gathering system info via WMIC \"}],\"Mitre\" : [{ \"ID\" : \"T1059\",\"Technique Name\" : \"Command and Scripting Interpreter\",\"Tactics\" : \"Execution\",\"Subtechniques\" :     [{ \"ID\" : \"T1059.005\",\"Sub-Technique Name\" : \"Visual Basic\",\"Rules\" :     [{ \"Description\" : \"Detected scripting content embedded in the sample\",\"Severity\" : \"2\"}]},{ \"ID\" : \"T1059.007\",\"Sub-Technique Name\" : \"JavaScript\",\"Rules\" :     [{ \"Description\" : \"Detected scripting content embedded in the sample\",\"Severity\" : \"2\"},{ \"Description\" : \"Javascipt is executed using wscript or cscript\",\"Severity\" : \"1\"}]}]},{ \"ID\" : \"T1082\",\"Technique Name\" : \"System Information Discovery\",\"Tactics\" : \"Discovery\",\"Rules\" :     [{ \"Description\" : \"Gathering system info via WMIC \",\"Severity\" : \"2\"}]},{ \"ID\" : \"T1124\",\"Technique Name\" : \"System Time Discovery\",\"Tactics\" : \"Discovery\",\"Rules\" :     [{ \"Description\" : \"Gathered system time information\",\"Severity\" : \"2\"}]},{ \"ID\" : \"T1614\",\"Technique Name\" : \"System Location Discovery\",\"Tactics\" : \"Discovery\",\"Rules\" :     [{ \"Description\" : \"Tracing System location\",\"Severity\" : \"2\"}]}]}}",
    "event": {
        "action": "ATD File Report",
        "category": [
            "file"
        ],
        "kind": "event",
        "outcome": "unknown",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2025-07-22T08:25:39Z",
    "file": {
        "hash": {
            "md5": "AE299DBD8F796B8A5479E763BB00FB93",
            "sha1": "A826D22E2FF0971FB932E88CFCB75CCB16D6B9C2",
            "sha256": "229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A"
        },
        "name": "file.xxx",
        "size": 54620,
        "type": "application/pdf"
    },
    "host": {
        "os": {
            "version": "win10p0x64"
        }
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "hash": [
            "229F83A69C6D7B8E10819762CBDE8AC45CC03B4BD0DD5EA54EC608AB6A85B89A",
            "A826D22E2FF0971FB932E88CFCB75CCB16D6B9C2",
            "AE299DBD8F796B8A5479E763BB00FB93"
        ],
        "ip": [
            "2.2.2.2"
        ]
    },
    "source": {
        "address": "2.2.2.2",
        "ip": "2.2.2.2"
    },
    "trellix": {
        "atd": {
            "engine": {
                "AM": {
                    "malware": {
                        "severity": "unverified"
                    }
                },
                "GTIFR": {
                    "malware": {
                        "severity": "unverified"
                    }
                },
                "GTIUR": {
                    "malware": {
                        "name": "Business ",
                        "severity": "informational"
                    }
                },
                "GWAM": {
                    "malware": {
                        "severity": "unverified"
                    }
                },
                "sandbox": {
                    "malware": {
                        "severity": "low"
                    }
                },
                "yara": {
                    "malware": {
                        "severity": "unverified"
                    }
                }
            },
            "ip": "1.1.1.1",
            "parent": {
                "archive": "Not Available"
            },
            "processes": [
                "acrord32.exe",
                "jst1.js",
                "splwow64.exe"
            ],
            "submitter": {
                "name": "toto",
                "type": "MWG"
            },
            "url": [
                "https://odace.apparete.fr/editions",
                "https://odace.apparete.fr/editions/edition_consult.aspx?dxrep_fake=&editionnumara=f73a9e66-db7a-486f-a5e8-d86443f8cac3&reload=true"
            ],
            "verdict": "low",
            "verdict_reason": "Sample is somewhat suspicious: final severity level 2"
        }
    }
}

{
    "message": "{\"Summary\": { \"Event_Type\": \"ATD File Report\",\"MISversion\": \"5.2.0.16\",\"SUMversion\": \"5.2.0.16\",\"DETversion\": \"5.2.6.250110\",\"OSversion\": \"win7sp1x64_Win7SP1x64-IANNG\",\"fileId\": \"Not Available\",\"Parent MD5\": \"Not Available\",\"ATD IP\": \"1.1.1.1\",\"Src IP\": \"2.2.2.2\",\"Dst IP\": \"\",\"TaskId\": \"144115188076224043\",\"JobId\": \"144115188076216607\",\"JSONversion\": \"1.003\",\"SubmitterName\": \"toto\",\"SubmitterType\": \"MWG\",\"hasDynamicAnalysis\": \"true\",\"Subject\": {\"Name\": \"file.xxx\",\"Type\": \"PE32+ executable (GUI) x86-64\",\"FileType\": \"0\",\"md5\": \"D0E38E34A8A648CB663FB75DBCC849D2\",\"sha-1\": \"8B86FAFB36D4A680121209C0EEABB606E6169B36\",\"sha-256\": \"6AB95CCECF9FF63EDC1FA183B4E85D52A24A078471D9E4AD8BC7D7739CA78957\",\"size\": \"1210009\",\"Timestamp\": \"2025-07-20 20:28:11\",\"parent_archive\": \"Not Available\"},\"Selectors\": [{\"Engine\": \"Gateway Anti-Malware\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"GTI File Reputation\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"GTI URL Reputation\",\"MalwareName\": \"---\",\"Severity\": \"-1\"},{\"Engine\": \"Anti-Malware\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"YARA\",\"MalwareName\": \"---\",\"Severity\": \"0\"},{\"Engine\": \"Sandbox\",\"MalwareName\": \"---\",\"Severity\": \"0\"}],\"Verdict\": {\"Severity\": \"0\",\"Description\": \"Sample termination reason: Sample could not run successfully in the Windows system.\"},\"Urls\" : [{\"Processes\" : [{\"RelType\" : \"8\",\"Name\" : \"file.xxx\",\"Sha256\" : \"\"}],\"Category\" : \"Business \",\"Functional\" : \"Business/Services \",\"Risk\" : \"Information \",\"Port\" : \"80\",\"Reputation\" : \"-2\",\"Severity\" : \"0\",\"Url\" : \"HTTP:\\/\\/MSEDGE.B.TLU.DL.DELIVERY.MP.MICROSOFT.COM\\/FILESTREAMINGSERVICE\\/FILES\"},{\"Processes\" : [{\"RelType\" : \"8\",\"Name\" : \"file.xxx\",\"Sha256\" : \"\"}],\"Category\" : \"Business \",\"Functional\" : \"Business/Services \",\"Risk\" : \"Information \",\"Port\" : \"80\",\"Reputation\" : \"-2\",\"Severity\" : \"0\",\"Url\" : \"HTTP:\\/\\/MSEDGE.B.TLU.DL.DELIVERY.MP.MICROSOFT.COM\\/FILESTREAMINGSERVICE\\/FILES\\/5F16D794-76D1-4AAC-94C6-CCD95709A3EB?P1=1753647178&P2=404&P3=2&P4=LNT3D5CCNVBKF8PY170SO36YRX%2B%2BKLCTFWQOF80NDJW9WOEXHDFAKX\"}],\"Behavior\": [{\"ID\": \"2\",\"Analysis\": \"Identified as --- by Gateway Anti-Malware\"},{\"ID\": \"1\",\"Analysis\": \"Identified as --- by GTI File Reputation\"},{\"ID\": \"256\",\"Analysis\": \"Identified as --- by GTI URL Reputation\"},{\"ID\": \"4\",\"Analysis\": \"Identified as --- by Anti-Malware\"},{\"ID\": \"128\",\"Analysis\": \"Identified as --- by YARA\"}]}}",
    "event": {
        "action": "ATD File Report",
        "category": [
            "file"
        ],
        "kind": "event",
        "outcome": "unknown",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2025-07-20T20:28:11Z",
    "file": {
        "hash": {
            "md5": "D0E38E34A8A648CB663FB75DBCC849D2",
            "sha1": "8B86FAFB36D4A680121209C0EEABB606E6169B36",
            "sha256": "6AB95CCECF9FF63EDC1FA183B4E85D52A24A078471D9E4AD8BC7D7739CA78957"
        },
        "name": "file.xxx",
        "size": 1210009,
        "type": "PE32+ executable (GUI) x86-64"
    },
    "host": {
        "os": {
            "version": "win7sp1x64_Win7SP1x64-IANNG"
        }
    },
    "observer": {
        "product": "ATD",
        "vendor": "Trellix"
    },
    "related": {
        "hash": [
            "6AB95CCECF9FF63EDC1FA183B4E85D52A24A078471D9E4AD8BC7D7739CA78957",
            "8B86FAFB36D4A680121209C0EEABB606E6169B36",
            "D0E38E34A8A648CB663FB75DBCC849D2"
        ],
        "ip": [
            "2.2.2.2"
        ]
    },
    "source": {
        "address": "2.2.2.2",
        "ip": "2.2.2.2"
    },
    "trellix": {
        "atd": {
            "engine": {
                "AM": {
                    "malware": {
                        "severity": "unverified"
                    }
                },
                "GTIFR": {
                    "malware": {
                        "severity": "unverified"
                    }
                },
                "GTIUR": {
                    "malware": {
                        "severity": "clean"
                    }
                },
                "GWAM": {
                    "malware": {
                        "severity": "unverified"
                    }
                },
                "sandbox": {
                    "malware": {
                        "severity": "unverified"
                    }
                },
                "yara": {
                    "malware": {
                        "severity": "unverified"
                    }
                }
            },
            "ip": "1.1.1.1",
            "parent": {
                "archive": "Not Available"
            },
            "submitter": {
                "name": "toto",
                "type": "MWG"
            },
            "url": [
                "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files",
                "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/5f16d794-76d1-4aac-94c6-ccd95709a3eb?p1=1753647178&p2=404&p3=2&p4=lnt3d5ccnvbkf8py170so36yrx%2b%2bklctfwqof80ndjw9woexhdfakx"
            ],
            "verdict": "unverified",
            "verdict_reason": "Sample termination reason: Sample could not run successfully in the Windows system."
        }
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
client.domain keyword The domain name of the client.
client.ip ip IP address of the client.
client.user.id keyword Unique identifier of the user.
client.user.name keyword Short name or login of the user.
destination.ip ip IP address of the destination.
event.action keyword The action captured by the event.
event.category keyword Event category. The second categorization field in the hierarchy.
event.code keyword Identification code for this event.
event.kind keyword The kind of the event. The highest categorization field in the hierarchy.
event.outcome keyword The outcome of the event. The lowest level categorization field in the hierarchy.
event.reason keyword Reason why this event happened, according to the source
event.severity long Numeric severity of the event.
event.type keyword Event type. The third categorization field in the hierarchy.
file.hash.md5 keyword MD5 hash.
file.hash.sha1 keyword SHA1 hash.
file.hash.sha256 keyword SHA256 hash.
file.name keyword Name of the file including the extension, without the directory.
file.size long File size in bytes.
file.type keyword File type (file, dir, or symlink).
host.os.version keyword Operating system version as a raw string.
observer.product keyword The product name of the observer.
observer.vendor keyword Vendor name of the observer.
source.ip ip IP address of the source.
trellix.atd.engine.AM.malware.name keyword Malware name identified by the Anti Malware engine
trellix.atd.engine.AM.malware.severity keyword Malware severity identified by the Anti Malware engine
trellix.atd.engine.GTIFR.malware.name keyword Malware name identified by the GTI File Reputation engine
trellix.atd.engine.GTIFR.malware.severity keyword Malware severity identified by the GTI File Reputation engine
trellix.atd.engine.GTIUR.malware.name keyword Malware name identified by the GTI Url Reputation engine
trellix.atd.engine.GTIUR.malware.severity keyword Malware severity identified by the GTI Url Reputation engine
trellix.atd.engine.GWAM.malware.name keyword Malware name detected by the Gateway Anti-Malware engine
trellix.atd.engine.GWAM.malware.severity keyword Malware severity detected by the Gateway Anti-Malware engine
trellix.atd.engine.sandbox.malware.name keyword Malware name identified by the Sandbox engine
trellix.atd.engine.sandbox.malware.severity keyword Malware severity identified by the Sandbox engine
trellix.atd.engine.yara.malware.name keyword Malware name identified by the yara engine
trellix.atd.engine.yara.malware.severity keyword Malware severity identified by the yara engine
trellix.atd.ip ip IP address of the Trellix ATD appliance
trellix.atd.parent.archive keyword Name of the file's parent archive
trellix.atd.processes array Processes for which Trellix Advanced Threat Defense system acts.
trellix.atd.submitter.name keyword Name of the ATD request submitter
trellix.atd.submitter.type keyword Type of the ATD request submitter
trellix.atd.url array Url(s) concerned by the trellix atd action
trellix.atd.verdict keyword Verdict found by Trellix ATD engines
trellix.atd.verdict_reason keyword Details about Trellix ATD engines verdict

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.