Discovery details structure

Technical Library | Support

Go to the table of contents

Go to the previous page

Go to the next page

View or print as PDF

Creating Remediation Scripts for TRITON AP-DATA > Discovery details structure

Discovery details structure

Creating Remediation Scripts | Data Protection | Version 8.3.x

The discovery detail structure is an XML file with no DTD. Following is a sample XML file, taken from File System discovery:

<?xml version="1.0" encoding="UTF-8"?>

<ns1:pa-xml-rpc xmlns:ns1="http://www.portauthoritytech.com/schmea/xml-rpc/1.0" xmlns:evt="http://www.portauthoritytech.com/schmea/incident/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<ns1:service-name>insertCrawlerService</ns1:service-name>

<evt:dataAtRest>

<evt:incidentInfo>

<evt:incidentId>5371106770671816417</evt:incidentId>

<evt:serviceId isSecured="false">1800221564</evt:serviceId>

<evt:analyzedBy>NLCTR.nolosscorp.com</evt:analyzedBy>

<evt:subject>\\10.4.228.150\DiscoveryTarget\TestFile.txt</evt:subject>

<evt:localDetectedTime>2011-07-18T14:54:11+10:00</evt:localDetectedTime>

<evt:installVersion>7.6</evt:installVersion>

<evt:resourceType>NETWORK</evt:resourceType>

<evt:totalSize>125</evt:totalSize>

</evt:incidentInfo>

<evt:rule id="170998" type="1" policyID="170893">

<evt:severity>2</evt:severity>

<evt:actionSettings id="172003"/>

<evt:numOfMatches>1</evt:numOfMatches>

<evt:classifierMatches>

<evt:classifierMatch id="171094">

<evt:numberOfMatches>1</evt:numberOfMatches>

<evt:isTruncated>false</evt:isTruncated>

<evt:breachContent>

<evt:contentInfo>

<evt:pathPartInfo order="0">

<evt:path>\\10.4.228.150\DiscoveryTarget\TestFile.txt</evt:path>

<evt:partType>3</evt:partType>

<evt:fileType>2</evt:fileType>

</evt:pathPartInfo>

</evt:contentInfo>

<evt:detectedValues>

<evt:detectedValue>

<evt:unMasked>WebsenseTestKeyword</evt:unMasked>

</evt:detectedValue>

</evt:detectedValues>

<evt:numberOfMatches>1</evt:numberOfMatches>

</evt:breachContent>

</evt:classifierMatch>

</evt:classifierMatches>

<evt:actionTaken type="2097152">

</evt:actionTaken>

<evt:properties>

<evt:name>acl</evt:name>

<evt:value>NLC\Administrator:wr,BUILTIN\Administrators:wr,NLC\websense:r,NT AUTHORITY\SYSTEM:wr</evt:value>

</evt:property>

<evt:name>checksum</evt:name>

<evt:value>7a0627c2efa25daedb56f19b79c22ab7</evt:value>

</evt:property>

<evt:name>fileOwner</evt:name>

<evt:value>BUILTIN\Administrators</evt:value>

</evt:property>

<evt:name>folderOwner</evt:name>

<evt:value>BUILTIN\Administrators</evt:value>

</evt:property>

<evt:name>jobID</evt:name>

<evt:value>172104</evt:value>

</evt:property>

<evt:name>jobName</evt:name>

<evt:value>RemediationTest</evt:value>

</evt:property>

<evt:name>resourceSubType</evt:name>

<evt:value>NETWORK</evt:value>

</evt:property>

</evt:properties>

<evt:filepath>cifs://10.4.228.150/DiscoveryTarget/TestFile.txt</evt:filepath>

<evt:filesize>39</evt:filesize>

<evt:filetype>2</evt:filetype>

<evt:encodeType>N/A</evt:encodeType>

<evt:ip>10.4.228.150</evt:ip>

<evt:dateAccessed>2011-07-18T14:51:54</evt:dateAccessed>

<evt:dateCreated>2011-07-18T14:51:54</evt:dateCreated>

<evt:dateModified>2011-07-18T14:52:16</evt:dateModified>

<evt:incidentUser>

<evt:detail type="5" value="BUILTIN\Administrators" isLookedUp="false"/>

</evt:incidentUser>

<evt:folderOwner>

<evt:incidentUser>

<evt:detail type="5" value="BUILTIN\Administrators" isLookedUp="false"/>

</evt:incidentUser>

</evt:folderOwner>

<evt:jobId>172104</evt:jobId>

<evt:jobName></evt:jobName>

<evt:scanStartTime>2011-07-18T14:54:06</evt:scanStartTime>

<evt:discoveryEndpointInfo>

<evt:endpointType>Unknown</evt:endpointType>

</evt:discoveryEndpointInfo>

</evt:dataAtRest>

</evt:incident>

</ns1:pa-xml-rpc>

Some interesting nodes in this file:


/ns1:pa-xml-rpc/ns1:request/ns1:params/evt:incident/ evt:dataAtRest/evt:incidentInfo/evt:resourceType	Contains NETWORK or ENDPOINT – depending on the type of discovery incident. Can enable the creation of scripts that work on both types.
/ns1:pa-xml-rpc/ns1:request/ns1:params/evt:incident/ evt:dataAtRest/evt:rules/	A list of the violated rules.
â€¦evt:rules/evt:rule/evt:classifierMatches /ns1:pa-xml-rpc/ns1:request/ns1:params/evt:incident/	A list of the matched classifier in a specific rule.
evt:dataAtRest/evt:properties/ /ns1:pa-xml-rpc/ns1:request/ns1:params/evt:incident/	A list of properties such as file owner, file ACL, discovery task name.
evt:dataAtRest/evt:file/evt:filepath /ns1:pa-xml-rpc/ns1:request/ns1:params/evt:incident/	The path to the file, in a URI format. Converting it back to a UNC format means that the slashes needs to be turned around into backslashes.
evt:dataAtRest/evt:file/evt:dateModifies /ns1:pa-xml-rpc/ns1:request/ns1:params/evt:incident/	The date the file was last modified in YYYY-MM-DDTHH:MM:SS.
evt:dataAtRest/evt:file/evt:owner/evt: incidentUser/ evt:detail	In the network it contains an evt:detail node with a value attribute of DOMAIN\Username (type 5). On the endpoint it contains a value attribute of the user's SID (type 8).

Here is a sample of Exchange discovery:

<?xml version="1.0" encoding="UTF-8"?>

<ns1:pa-xml-rpc xmlns:ns1="http://www.portauthoritytech.com/schmea/xml-rpc/1.0" xmlns:evt="http://www.portauthoritytech.com/schmea/incident/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<ns1:service-name>insertCrawlerService</ns1:service-name>

<evt:dataAtRest>

<evt:incidentInfo>

<evt:incidentId>4679778800686204169</evt:incidentId>

<evt:serviceId isSecured="false">1800221564</evt:serviceId>

<evt:analyzedBy>NLCTR.nolosscorp.com</evt:analyzedBy>

<evt:subject>ismith/Deleted Items/DSS Incident [ID:12564].EML</evt:subject>

<evt:localDetectedTime>2011-07-26T14:17:57+10:00</evt:localDetectedTime>

<evt:installVersion>7.6</evt:installVersion>

<evt:resourceType>EXCHANGE</evt:resourceType>

<evt:totalSize>36827</evt:totalSize>

</evt:incidentInfo>

<evt:rule id="170998" type="1" policyID="170893">

<evt:severity>2</evt:severity>

<evt:actionSettings id="172003"/>

<evt:numOfMatches>1</evt:numOfMatches>

<evt:classifierMatches>

<evt:classifierMatch id="171094">

<evt:numberOfMatches>1</evt:numberOfMatches>

<evt:isTruncated>false</evt:isTruncated>

<evt:breachContent>

<evt:contentInfo>

<evt:pathPartInfo order="0">

<evt:path>ismith/Deleted Items/DSS Incident [ID:12564].EML</evt:path>

<evt:partType>1</evt:partType>

<evt:fileType>233</evt:fileType>

</evt:pathPartInfo>

<evt:pathPartInfo order="1">

<evt:path>Transaction Body.txt</evt:path>

<evt:partType>1</evt:partType>

<evt:fileType>236</evt:fileType>

</evt:pathPartInfo>

</evt:contentInfo>

<evt:detectedValues>

<evt:detectedValue>

<evt:unMasked>WebsenseTestKeyword</evt:unMasked>

</evt:detectedValue>

</evt:detectedValues>

<evt:numberOfMatches>1</evt:numberOfMatches>

</evt:breachContent>

<evt:breachContent>

<evt:contentInfo>

<evt:pathPartInfo order="0">

<evt:path>ismith/Deleted Items/DSS Incident [ID:12564].EML</evt:path>

<evt:partType>1</evt:partType>

<evt:fileType>233</evt:fileType>

</evt:pathPartInfo>

<evt:pathPartInfo order="1">

<evt:path>Original_Message_Incident_12564</evt:path>

<evt:partType>2</evt:partType>

<evt:fileType>233</evt:fileType>

</evt:pathPartInfo>

<evt:pathPartInfo order="2">

<evt:path>Transaction Body.txt</evt:path>

<evt:partType>2</evt:partType>

<evt:fileType>2</evt:fileType>

</evt:pathPartInfo>

</evt:contentInfo>

<evt:detectedValues>

<evt:detectedValue>

<evt:unMasked>WebsenseTestKeyword</evt:unMasked>

</evt:detectedValue>

</evt:detectedValues>

<evt:numberOfMatches>1</evt:numberOfMatches>

</evt:breachContent>

</evt:classifierMatch>

</evt:classifierMatches>

<evt:actionTaken type="2097152">

</evt:actionTaken>

<evt:properties>

<evt:name>checksum</evt:name>

<evt:value>60104d41558c2d6aba1ad287813155ea</evt:value>

</evt:property>

<evt:name>exchange-from</evt:name>

<evt:value>"DSS@nolosscorp.com" <DSS@nolosscorp.com></evt:value>

</evt:property>

<evt:name>exchange-subject</evt:name>

<evt:value>DSS Incident [ID:12564]</evt:value>

</evt:property>

<evt:name>exchange-to</evt:name>

<evt:value>"ismith@nolosscorp.com" <ismith@nolosscorp.com></evt:value>

</evt:property>

<evt:name>fileOwner</evt:name>

<evt:value>ismith</evt:value>

</evt:property>

<evt:name>folderOwner</evt:name>

<evt:value>N/A</evt:value>

</evt:property>

<evt:name>jobID</evt:name>

<evt:value>172106</evt:value>

</evt:property>

<evt:name>jobName</evt:name>

<evt:value>Test discovery</evt:value>

</evt:property>

<evt:name>resourceSubType</evt:name>

<evt:value>PRIVATE FOLDER</evt:value>

</evt:property>

</evt:properties>

<evt:filepath>cifs://ismith/Deleted Items/DSS Incident [ID:12564].EML</evt:filepath>

<evt:filesize>19672</evt:filesize>

<evt:filetype>233</evt:filetype>

<evt:encodeType>N/A</evt:encodeType>

<evt:hostname>ismith@nolosscorp.com</evt:hostname>

<evt:dateAccessed>2010-10-21T03:10:51.505</evt:dateAccessed>

<evt:dateCreated>2010-10-21T03:10:51.505</evt:dateCreated>

<evt:dateModified>2010-10-21T03:10:51.505</evt:dateModified>

<evt:incidentUser>

<evt:detail type="5" value="ismith" isLookedUp="false"/>

</evt:incidentUser>

<evt:folderOwner>

<evt:incidentUser>

<evt:detail type="5" value="N/A" isLookedUp="false"/>

</evt:incidentUser>

</evt:folderOwner>

<evt:jobId>172106</evt:jobId>

<evt:jobName></evt:jobName>

<evt:scanStartTime>2011-07-26T14:16:49</evt:scanStartTime>

<evt:discoveryEndpointInfo>

<evt:endpointType>Unknown</evt:endpointType>

</evt:discoveryEndpointInfo>

</evt:dataAtRest>

</evt:incident>

</ns1:pa-xml-rpc>

Please note the main differences:

The evt:parameters sections contain more Exchange centric information (such as email fields).

The pathname in the evt:file section is invalid as a path name, but is valid as a URL suffix in OWA instead.

The evt:resourceType is "EXCHANGE", which differentiates this incident.

You will have to write your own parsing code to get the information in this incident. The provided module will not be able to extract any meaningful information from it.

Go to the table of contents

Go to the previous page

Go to the next page

View or print as PDF

Creating Remediation Scripts for TRITON AP-DATA > Discovery details structure

Copyright 2016 Forcepoint LLC. All rights reserved.