Size: a a a
RS
RS
К
RS
К
К
К
RS
К
SS
RS
К
SS
К
query AV_Action($scope_id, $host, $path, $name, $time) from Malware_history_lst {
scopeid == $scope_id and hostname == $host and path == $path
and (family == $name or family == null)
and eventtimestamp > $time
and action != "found"
}
event KAV_found:
key: event_src.host
filter {
find_substr(category.generic, "AV/Detect") != null
and not exec_query("AV_Action", [scope_id, lower(event_src.hostname), lower(object.path), lower(object.name), datetime_to_epoch(datetime(time))-1320])
}
event KAV_action:
key: event_src.host
filter {
find_substr(category.generic, "AV/Action/blocked") != null
or find_substr(category.generic, "AV/Action/cured") != null
or find_substr(category.generic, "AV/Action/quarantined") != null
or find_substr(category.generic, "AV/Action/deleted") != null
}
rule Malware_not_cured: KAV_found -> KAV_action* timer 22mК
SS
R
e
К
e
