Reference documentation and code samples for the Chronicle V1 API module Google::Backstory::SecurityResult::SecurityCategory.
SecurityCategory is used to standardize security categories across products so one event is not categorized as "malware" and another as a "virus".
Constants
UNKNOWN_CATEGORY
value: 0
The default category.
SOFTWARE_MALICIOUS
value: 10_000
Malware, spyware, rootkit.
SOFTWARE_SUSPICIOUS
value: 10_100
Below the conviction threshold; probably bad.
SOFTWARE_PUA
value: 10_200
Potentially Unwanted App (such as adware).
NETWORK_MALICIOUS
value: 20_000
Includes C&C or network exploit.
NETWORK_SUSPICIOUS
value: 20_100
Suspicious activity, such as potential reverse tunnel.
NETWORK_CATEGORIZED_CONTENT
value: 20_200
Non-security related: URL has category like gambling or porn.
NETWORK_DENIAL_OF_SERVICE
value: 20_300
DoS, DDoS.
NETWORK_RECON
value: 20_400
Port scan detected by an IDS, probing of web app.
NETWORK_COMMAND_AND_CONTROL
value: 20_500
If we know this is a C&C channel.
ACL_VIOLATION
value: 30_000
Unauthorized access attempted, including attempted access to files,
web services, processes, web objects, etc.
AUTH_VIOLATION
value: 40_000
Authentication failed (e.g. bad password or bad 2-factor authentication).
EXPLOIT
value: 50_000
Exploit: For all manner of exploits including attempted overflows, bad
protocol encodings, ROP, SQL injection, etc. For both network and host-
based exploits.
DATA_EXFILTRATION
value: 60_000
DLP: Sensitive data transmission, copy to thumb drive.
DATA_AT_REST
value: 60_100
DLP: Sensitive data found at rest in a scan.
DATA_DESTRUCTION
value: 60_200
Attempt to destroy/delete data.
TOR_EXIT_NODE
value: 60_300
TOR Exit Nodes.
MAIL_SPAM
value: 70_000
Spam email, message, etc.
MAIL_PHISHING
value: 70_100
Phishing email, chat messages, etc.
MAIL_SPOOFING
value: 70_200
Spoofed source email address, etc.
POLICY_VIOLATION
value: 80_000
Security-related policy violation (e.g. firewall/proxy/HIPS rule
violated, NAC block action).
SOCIAL_ENGINEERING
value: 90_001
Threats which manipulate to break normal security procedures.
PHISHING
value: 90_002
Phishing pages, pops, https phishing etc.