Malware Scan Info
malware_scan_info
The malware scan information object describes characteristics, metadata of a malware scanning job.
Attributes
| Caption | Name | Type | Description |
|---|---|---|---|
| End Time | end_time | Timestamp | The timestamp indicating when the scan job completed execution. |
| Name | name | String | The administrator-supplied or application-generated name of the scan. For example: "Home office weekly user database scan", "Scan folders for viruses", "Full system virus scan" |
| Scanned Files | num_files | Integer | The total number of files analyzed during the scan. |
| Number of Infected Entities | num_infected | Integer | The total number of files identified as infected with malware during the scan. |
| Number of Volumes | num_volumes | Integer | The total number of storage volumes examined during the malware scan. |
| Raw Data | raw_data | JSON | Group: |
| Record ID | record_id | String | Group: |
| Size | size | Long | The total size in bytes of all files that were scanned. |
| Start Time | start_time | Timestamp | The timestamp indicating when the scan job began execution. |
| Type | type | String | The type of scan. |
| Type ID | type_id | Integer | The type id of the scan.
|
| Scan UID | uid | String | The application-defined unique identifier assigned to an instance of a scan. |
| Unique Malware Count | unique_malware_count | Integer | The number of unique malware detected across all infected files. |
| Unmapped | unmapped | Unmapped[] | Data from the source that was not mapped into the schema. |
Relationships
Inbound Relationships
These objects and events reference Malware Scan Info in their attributes:
- FTP Activity
- Web Resource Access Activity
- Scan Activity
- Email File Activity
- File System Activity
- Device Config State Change
- User Inventory Info
- Module Query
- Kernel Activity
- IAM Analysis Finding
- Base Event
- SSH Activity
- Group Management
- Registry Value Query
- Data Security Finding
- Email Activity
- File Remediation Activity
- Module Activity
- Windows Service Activity
- Device Inventory Info
- File Hosting Activity
- Authorize Session
- Registry Value Activity
- Application Lifecycle
- DNS Activity
- Account Change
- Airborne Broadcast Activity
- Operating System Patch State
- Incident Finding
- Drone Flights Activity
- DHCP Activity
- Remediation Activity
- Kernel Extension Activity
- User Session Query
- Cloud Resources Inventory Info
- Web Resources Activity
- Script Activity
- File Query
- Detection Finding
- Process Query
- OSINT Inventory Info
- Compliance Finding
- Network Activity
- Entity Management
- Vulnerability Finding
- Admin Group Query
- RDP Activity
- Peripheral Device Query
- Network Connection Query
- Windows Resource Activity
- Application Security Posture Finding
- Live Evidence Info
- Registry Key Activity
- Authentication
- Application Error
- Folder Query
- Datastore Activity
- Tunnel Activity
- Process Remediation Activity
- NTP Activity
- Event Log Activity
- Scheduled Job Activity
- Prefetch Query
- Process Activity
- Memory Activity
- Startup Item Query
- Network File Activity
- Security Finding
- Registry Key Query
- Kernel Object Query
- User Access Management
- Service Query
- Job Query
- API Activity
- HTTP Activity
- Device Config State
- Email URL Activity
- Network Remediation Activity
- Networks Query
- Software Inventory Info
- User Query
- SMB Activity
Outbound Relationships
Malware Scan Info references the following objects and events in its attributes:
This page describes qdm-1.5.1+ocsf-1.6.0
Updated 22 days ago