Allgemeine Suchdatenquellen

Ansichten:

Wichtig

Diese Datenquellenabfragemethode ist nach dem 2. Februar 2026 nicht mehr verfügbar. Für weitere Informationen zu den derzeit verfügbaren Datenquellen für Abfragen im XDR Data Explorer gehen Sie zu https://trendmicro.github.io/tm-v1-schema/pages/index.

Allgemeines Feld	Entsprechende Felder			Beispiel
Allgemeines Feld	Endpunkt-Aktivitätsdaten	Network Activity Data	Erkennungsdaten	Beispiel
AccountDomain	-	userDomain	userDomain	-
CLICommand	objectCmd parentCmd processCmd	-	processCmd objectCmd parentCmd botCmd	"C:\Programmdateien (x86)\Google\Chrome\Application\chrome.exe" --type=utility --lang=en-US --no-sandbox
DomainName	hostName objectHostName	requestBase userDomain hostName sslZertifikatAllgemeinerName shost dhost	hostName interessierterHost userDomain shost dhost denyListHost domainName peerHost requestBase sslZertifikatAllgemeinerName netBiosDomainName	self.events.data.microsoft.com
EmailNachrichtenID	-	msgId	msgId	<rRzmIhBrXbgjvr4uhIwCcbtE6BnmgNTtAU51qWmqY@example.online>
E-Mail-Empfänger	-	duser	duser	john_doe@example.com
EmailSender	-	suser	suser	john_doe@example.com
EmailSubject	-	mailMsgSubject	mailMsgSubject	Betreff: Vom Schreibtisch des nigerianischen Prinzen
EndpunktID	endpointGuid	endpointGUID	endpointGUID	e3c49595-09b9-47a3-a43f-6c21aa52e54f
EndpointName	endpointHostName	endpointHostName	endpointHostName userDomain	hr-johndoe1
FileFullPath	objectFilePath parentFilePath processFilePath srcFilePath	FileName	filePath filePathName objectFilePath processFilePath fullPath parentFilePath malSrc ZielFreigabe srcFilePath	C:\Programme (x86)\temp\Application\test.exe
FileMD5	objectFileHashMd5 parentFileHashMd5 processFileHashMd5 srcFileHashMd5	-	attachmentFileHashMd5 objectFileHashMd5 parentFileHashMd5 processFileHashMd5 srcFileHashMd5 fileHashMd5	46CFB4E38C6299983048DE39012FD08F
FileName	objectFilePath parentFilePath processFilePath srcFilePath	FileName	FileName objectFileName compressedFileName attachmentFileName processFilePath	example.exe
FileSHA1	objectFileHashSha1 parentFileHashSha1 processFileHashSha1 srcFileHashSha1	fileHash respFileHash	fileHash attachmentFileHash attachmentFileHashSha1 compressedFileHash denyListFileHash objectFileHashSha1 oldFileHash parentFileHashSha1 processFileHashSha1 appPublicKeySha1 hervorgehobeneDatei-Hashes objectPayloadFileHashSha1 srcFileHashSha1	98A9A1C8F69373B211E5F1E303BA8762F44BC898
FileSHA2	objectFileHashSha256 parentFileHashSha256 processFileHashSha256 srcFileHashSha256	fileHashSha256 respFileHashSha256	fileHashSha256 attachmentFileHashSha256 compressedFileHashSha256 objectFileHashSha256 parentFileHashSha256 processFileHashSha256 appDexSha256 srcFileHashSha256	16e4e8b57e82159a16f5d7d898da9e2a4fbe90c17cd95c02074e75226337c90a
HostDomain	hostName	hostName requestBase sslZertifikatAllgemeinerName	hostName requestBase sslZertifikatAllgemeinerName	-
IPv4	endpunktIp objectIp objectIps dst src publicSrc	dst src clientIp serverIp httpXForwardedForIp resolvedUrlIp ObjectIps pktSrcAddr pktDstAddr	src dst interessierteIp endpunktIp peerIp denyListIp objectIp rawSrcIp rawDstIp	192.0.2.0
IPv6	endpunktIp objectIp objectIps dst src publicSrc	dst src clientIp serverIp httpXForwardedForIp resolvedUrlIp ObjectIps pktSrcAddr pktDstAddr	src dst interessierteIp endpunktIp peerIp denyListIp objectIp rawSrcIp rawDstIp	2001:0db8:85a3:0000:0000:8a2e:0370:7334
Port	objectPort spt dpt ÖffentlichSpt	spt dpt clientPort serverPort resolvedUrlPort	dpt spt rawSrcPort rawDstPort	8080
ProcessFullPath	processFilePath	-	processFilePath	C:\Programme (x86)\temp\Application\test.exe
Prozessname	processFilePath processName	-	processName	-
RegistryKey	objectRegistryKeyHandle	-	objectRegistryKeyHandle	hklm\software\wow6432node\microsoft\windows\currentversion\run
RegistryValue	objectRegistryValue	-	objectRegistryValue	its_ie_settings
RegistryValueData	objectRegistryData	-	objectRegistryData	wscript "C:\Programmdateien (x86)\JNJ\ITS_IE_PREF\IE_Preferences.vbs"
Taktik	-	-	tacticId Tags	TA0008
Technik	Tags	Tags	techniqueId Tags	T1210
URL	Anforderung	Anforderung httpReferer httpLocation Anfragen	Anforderung botUrl cccaZiel httpReferer	https://www.example.com
UserAccount	Benutzer anmelden objectUser processUser	principalName suid sUser1 dUser1	suid dUser1 processUser sUser1 objectUser	john_doe