M4. Other

Automatic update of a license key

Called when a license key is expiring.

Database

Parameters

Returned value

available

•event — event type:

▫expire — license key is expiring, automatic update is not available

▫diff — new license key has been downloaded, but the compound of licensed components differs in the current and the new keys. The license key must be replaced manually

▫renew — license key has been automatically updated

•old_key — old license key content

•new_key — new license key content. Available if the event type is diff or renew

ignored

Procedure text:

--[[

Called:

when license key expire or have been renewed

Database:

available

Parameters:

event event type: "expire" - license key expires or have done it

"diff" - received new key, but components differs from current one

"renew" - current key have been renewed, old one was deleted

old_key content of old license key

new_key content of renew license key, available at event type "diff" or "renew"

Returned value:

ignored

]]

local args = ... -- args.event, args.old_key, args.new_key

Epidemic detected

Called when virus epidemic is detected in the network.

Database

Parameters

Returned value

available

•virus — most common threat

•total — total number of detected threats

ignored

Procedure text:

--[[

Called:

when virus epidemic has been detected by the server

Database:

available

Parameters:

total total count of viruses

virus most frequently detected virus name

Returned value:

ignored

]]

local args = ... -- args.total, args.virus

Report of Application Control

Called when the Application Control report received from a station.

Database

Parameters

Returned value

available

•id — station ID

•address — station network address

•station — station name

•time — time of event occurrence (station time)

•sid — station SID

•user — user who initiated a process with suspicious activity

•type — event type

•action — applied action

•policy_type — matched policy type

•policy_mask — matched policy mask

•test_mode — event occurred in the test mode

•profile_id — profile UUID used for activity blocking

•profile_name — profile name used for activity blocking

•rule_id — rule UUID used for activity blocking (if exists)

•rule_name — rule name used for activity blocking (if exists)

•process_path — path to the blocked process

•process_file_sha256 — process file SHA-256

•process_file_version — process file version

•process_file_description — process file description

•process_file_origname — process file original name

•process_file_prodname — process file product name

•process_file_prodver — process file product version

•process_file_company — process file company name

•process_cert_thumbprint — process file signing certificate thumbprint (SHA-1) (if exists)

•process_cert_serial — process file signing certificate serial number (if exists)

•process_cert_issuer — process file signing certificate issuer (if exists)

•process_cert_subject — process file signing certificate subject (if exists)

•process_cert_timestamp — process file signing certificate issuance timestamp (if exists)

•process_cert_not_before — process file signing certificate start timestamp (if exists)

•process_cert_not_after — process file signing certificate expiration timestamp (if exists)

•process_hashdb — bulletin containing the hash of process file

•object_path — path to the blocked script or empty

•object_file_sha256 — script file SHA-256 (if exists)

•object_file_version — script file version (if exists)

•object_file_description — script file description (if exists)

•object_file_origname — script file original name (if exists)

•object_file_prodname — script file product name (if exists)

•object_file_prodver — script file product version (if exists)

•object_file_company — script file company name (if exists)

•object_cert_thumbprint — script file signing certificate thumbprint (SHA-1) (if exists)

•object_cert_serial — script file signing certificate serial number (if exists)

•object_cert_issuer — script file signing certificate issuer (if exists)

•object_cert_subject — script file signing certificate subject (if exists)

•object_cert_timestamp — script file signing certificate issuance timestamp (if exists)

•object_cert_not_before — script file signing certificate start timestamp (if exists)

•object_cert_not_after — script file signing certificate expiration timestamp (if exists)

•object_hashdb — bulletin containing the hash of script file

ignored

Procedure text:

--[[

Called:

when application control event received from Agent

Database:

available

Parameters:

id station ID

address station address

station station name

time station time

sid SID of user initiated activity

user name of user initiated activity

type event type

action applied action

policy_type matched policy type

policy_mask matched policy mask

test_mode event occured in test mode

profile_id profile UUID used for activity blocking

profile_name profile name used for activity blocking

rule_id rule UUID used for activity blocking (if exist)

rule_name rule name used for activity blocking (if exist)

process_path path to affected process file

process_file_sha256 process file SHA-256

process_file_version process file version

process_file_description process file description

process_file_origname process file original name

process_file_prodname process file product name

process_file_prodver process file product version

process_file_company process file company name

process_cert_thumbprint process file signing certificate thumbprint (SHA-1) (if exist)

process_cert_serial process file signing certificate serial number (if exist)

process_cert_issuer process file signing certificate issuer (if exist)

process_cert_subject process file signing certificate subject (if exist)

process_cert_timestamp process file signing certificate sign issuance timestamp (if exist)

process_cert_not_before process file signing certificate NotBefore timestamp (if exist)

process_cert_not_after process file signing certificate NotAfter timestamp (if exist)

process_hashdb hash database containing process file

object_path path to affected object file (script, etc) or empty

object_file_sha256 object file SHA-256 (if exist)

object_file_version object file version (if exist)

object_file_description object file description (if exist)

object_file_origname object file original name (if exist)

object_file_prodname object file product name (if exist)

object_file_prodver object file product version (if exist)

object_file_company object file company name (if exist)

object_cert_thumbprint object file signing certificate thumbprint (SHA-1) (if exist)

object_cert_serial object file signing certificate serial number (if exist)

object_cert_issuer object file signing certificate issuer (if exist)

object_cert_subject object file signing certificate subject (if exist)

object_cert_timestamp object file signing certificate sign issuance timestamp (if exist)

object_cert_not_before object file signing certificate NotBefore timestamp (if exist)

object_cert_not_after object file signing certificate NotAfter timestamp (if exist)

object_hashdb hash database containing object file

Returned value:

ignored

]]

local args = ...

Report of Application Control from the neighbor Dr.Web Server

Called when the Application Control report received for a station from neighbor Dr.Web Server.

Database

Parameters

Returned value

available

•neighborid — ID of neighbor Dr.Web Server from which the event is received

•neighborname — neighbor Dr.Web Server name

•originatorid — ID of Dr.Web Server that originated the event

•originatorname — name of Dr.Web Server that originated the event

•stationid — station ID

•stationname — station name

•eventid — event ID

•event_time — time of event occurrence on a station