# Deep Security Manager REST API

## Name: antiMalwareEvent

JSON Example:
    {"antiMalwareEvent":
     {
       "antiMalwareConfigID": Number,
       "antiMalwareEventID": Number,
       "containerID": String,
       "containerImageName": String,
       "containerName": String,
       "errorCode": Number,
       "hostID": Number,
       "hostName": String,
       "infectedFilePath": String,
       "infectionSource": String,
       "logTime": Date,
       "majorVirusType": Number,
       "malwareName": String,
       "malwareType": 'GENERAL' | 'SPYWARE' | 'SUSPICIOUS_FILE' | 'SUSPICIOUS_ACTIVITY' | 'UNAUTHORIZED_CHANGE',
       "md5": String,
       "origin": 'UNKNOWN' | 'AGENT' | 'GUESTAGENT' | 'APPLIANCEAGENT' | 'MANAGER',
       "policyId": String,
       "protocol": Number,
       "quarantineRecordID": Number,
       "scanAction1": Number,
       "scanAction2": Number,
       "scanResultAction1": Number,
       "scanResultAction2": Number,
       "scanType": 'REALTIME' | 'MANUAL' | 'SCHEDULED' | 'QUICK',
       "sectionId": String,
       "sha1": String,
       "sha256": String,
       "spywareItems": [antiMalwareSpywareItem],
       "summaryScanResult": String,
       "tags": String,
       "target": String,
       "targetType": Number,
     }
    }

Elements
Name | Type | Required | Default Value | Description
--- | --- | --- | --- | ---
antiMalwareConfigID | Number | No | `` | The primary key of AntiMalwareID.
antiMalwareEventID | Number | Yes | `` | The primary key of the event entry.
containerID | String | No | `` | The ID of the Docker container where the malware was found
containerImageName | String | No | `` | The image name of the Docker container where the malware was found
containerName | String | No | `` | The name of the Docker container where the malware was found
errorCode | Number | Yes | `` | The VSAPI error code indicates the reason of the actions of failure.
hostID | Number | Yes | `` | The id of the host the event was recorded on
hostName | String | Yes | `` | The host name of the event was recorded on
infectedFilePath | String | No | `` | The infected file full path
infectionSource | String | No | `` | The source computer of the infection
logTime | Date | No | `` | The time of the event as recorded by the agent.
majorVirusType | Number | No | `` | The Major Virus Type of malware Possible values are the following integer - 0 maps to Joke - 1 maps to Trojan - 2 maps to Virus - 3 maps to Test - 4 maps to SPYWARE - 5 maps to Packer - 6 maps to Generic - 7 maps to Other - 8 maps to Active Content - 9 maps to Blocked File Type - 10 maps to Heuristic CVE Exploit - 11 maps to Heuristic Detection - 12 maps to Suspicious Object - 13 maps to User Defined Suspicious Object - 14 maps to Suspicious Activity - 15 maps to Unauthorized Change
malwareName | String | No | `` | The name of the malware
malwareType | 'GENERAL' | 'SPYWARE' | 'SUSPICIOUS_FILE' | 'SUSPICIOUS_ACTIVITY' | 'UNAUTHORIZED_CHANGE' | Yes | `` | The Malware Type of Event
md5 | String | No | `` | The md5 value of the file when hash value calculation enabled
origin | 'UNKNOWN' | 'AGENT' | 'GUESTAGENT' | 'APPLIANCEAGENT' | 'MANAGER' | No | `` | the location where the event originated
policyId | String | No | `` | The detection rule, used in behavior monitor
protocol | Number | Yes | `` | The protocols: Local Files(0), Network shared folder(1), etc. However, currently Agent only support local files.
quarantineRecordID | Number | No | `` | The Record ID referring to the record in QuarantineFile Table
scanAction1 | Number | No | `` | The actual first scan action being taken: e.g. Pass, Delete, Quarantined...etc
scanAction2 | Number | No | `` | The actual second scan action being taken: e.g. Pass, Delete, Quarantined...etc
scanResultAction1 | Number | No | `` | The result of the first scan action: represent whether the action is successful (0) or failed (Error Code)
scanResultAction2 | Number | No | `` | The result of the second scan action: represent whether the action is successful (0) or failed (Error Code)
scanType | 'REALTIME' | 'MANUAL' | 'SCHEDULED' | 'QUICK' | Yes | `` | The scan types include Real time, Manual, Scheduled, Quick etc.
sectionId | String | No | `` | The detection method, used in behavior monitor
sha1 | String | No | `` | The sha1 value of the file when hash value calculation enabled
sha256 | String | No | `` | The sha256 value of the file when hash value calculation enabled
spywareItems | zero or N[antiMalwareSpywareItem] | No | `` | Lists of spyware items if this is a spyware event.
summaryScanResult | String | No | `` | Scan result description.
tags | String | No | `` | the event's tags.
target | String | No | `` | The infected target, useful in behavior monitor
targetType | Number | No | `` | The infected target type, useful in behavior monitor Supported the following target type: - 0 maps to Unknown - 1 maps to Process - 2 maps to Registry - 3 maps to File - 4 maps to API - 5 maps to Exploit

Copyright © 2017 Trend Micro Inc. All Rights Reserved.