...
Field | Data type | Description |
|---|
alertHost | str
| this field indicates an internal Devo component related to alert dispatching. |
domain | str
| Devo domain to which the alert belongs. |
priority | float
| Priority level assigned to the alert, represented as a numerical value: 0 → Very low 3 → Low 5 → Normal 7 → High 10 → Very high
| Note |
|---|
Devo alert priorities VS SecOps alert priorities Please keep in mind that these priority levels do not correspond to the ones used in the Security Operations application. |
|
context | str
| Contextualization of the alert resulting from a combination of its category, domain and name. | Info |
|---|
Special characters in the alert name Alert names are normalized upon creation, replacing all special characters (not alphanumeric) by underscores (_). |
|
category | str
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
alertId | str
| Unique ID assigned to the alert when triggered. |
status | int
| Condition of the triggered alert regarding their life cycle, represented as a numerical value: Unread → 0 Updated → 1 Watched → 100 False positive → 2 Closed → 300 Suppressed → 800
|
srcIp | ip4
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
srcPort | int
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
srcHost | str
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
dstIp | ip4
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
dstPort | int
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
dstHost | str
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
protocol | str
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
username | str
| User who created the alert definition. |
application | str
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
engine | str
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
extraData | str
| Information extracted from different fields to indicate the conditions that triggered the alert (more info here). |
AlertContextSubscription | int
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
Alertcreationdate | timestamp
| Exact date on which the specified alert conditions were met and the alert triggered, which may reveal a slight delay with the eventdate (date on which the event was registered in the Devo table). |
...
Field | Data type | Description |
|---|
alertHost | str
| this field indicates an internal Devo component related to alert dispatching. |
errorCode | str
| Explanation about the reason for the alert not being triggered. The most common are: |
domain | str
| Domain to which the alert belongs. |
priority | float
| Priority level assigned to the alert, represented as a numerical value: 0 → Very low 3 → Low 5 → Normal 7 → High 10 → Very high
|
context | str
| Contextualization of the alert resulting from a combination of its category, domain and name. | Info |
|---|
Special characters in the alert name Alert names are normalized upon creation, replacing all special characters (not alphanumeric) by underscores (_). |
|
category | str
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
status | int
| Condition of the triggered alert regarding their life cycle, represented as a numerical value: Unread → 0 Updated → 1 Watched → 100 False positive → 2 Closed → 300 Suppressed → 800
|
alertId | str
| Unique ID assigned to the alert when triggered. |
srcIp | ip4
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
srcPort | int
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
srcHost | str
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
dstIp | ip4
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
dstPort | int
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
dstHost | str
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
protocol | str
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
username | str
| User who created the alert definition. |
application | str
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
engine | str
| this field indicates an internal Devo component related to alert dispatching. |
extraData | str
| Information extracted from different fields to indicate the conditions that triggered the alert (more info here). |
AlertContextSubscription | int
| | Status |
|---|
| colour | Red |
|---|
| title | Deprecated field: |
|---|
|
information is not provided in this field anymore. |
Alertcreationdate | timestamp
| Exact date on which the specified alert conditions were met but did not trigger an alert due to an error, which may indicate a slight delay with the event date (date on which the error event was registered in the Devo table). |
...
In this table, you can find detailed information about all alerts defined in the current domain and the changes they undergo. You can see below the fields included in this table along with a brief explanation.
...
Field | Data type | Description |
|---|
hostname | str
| Domain where the alert was triggered. |
actiondate | timestamp
| Date of the action performed. |
Id | str
| Unique ID automatically assigned to the alert when defined. |
name | str
| Name assigned to the alert when defined. |
action | str
| The action carried out (, which can be one of the following: , EDIT PRIORITY, DELETE…).EDIT PRIORITY DELETE CREATE COMMENT REPLY COMMENT UPDATE COMMENT DELETE COMMENT
|
username | str
| User who performed the action. | Info |
|---|
admin.alerts@devo.com This user represents an internal entity responsible for automatically registering alerts in the audit system when they are triggered. As a consequence, it only appears when the action is CREATE. |
|
info | json
| Whenever a modification is made to a triggered alert, the information related to the change is collected and displayed here to indicate the new values assigned to status and priority, or to signify its deletion.See siem.logtrust.alert.info for the meaning of numerical values in fields such as priority or status. Depending on the action (indicated in the action field), the displayed values vary: Create: the status and priority names, as well as the status and priority codes.
E.g. → {"statusName":"Unread","priorityName":"Low","statusCode":"0","priorityCode":"3.0"}. Edit status: the new status code and the corresponding status name.
E.g. → {"statusCode":"100","statusName":"Watched"}. Edit priority: the new priority and the corresponding priority name.
E.g. → {"priorityCode":"1.0","priorityName":"Very Low"}. Deletion: empty. Comments: type of comment (ALERT-new comment vs REPLY), content of the message, ID assigned to the comment, and other IDs interrelating them with alerts and other comments.
|
