Enginsight Advanced Persistent Threats

Enginsight APT is a behavioural analytics engine that detects advanced persistent threats across endpoints and network traffic.

Global Fields (4)

FieldType
ngs.id
Unique identifier for the log entry.
string
ngs.createdAt
Timestamp when the event was created locally.
pdate
ngs.indexedAt
Timestamp when the log was indexed into the SIEM.
pdate
ngs.source
Origin or source system of the log.
string

Reference-Specific Fields (12)

FieldType
ngs.apt.location
Absolute file-system path where the suspicious object was found (e.g., "C:\Windows\System32\svchost.exe").
string
ngs.apt.planId
Identifier of the scan plan that scheduled or triggered the detection.
string
ngs.apt.planName
Human-readable name of the plan that defined scope, cadence and hosts for the scan.
text_general
ngs.apt.ruleId
Internal ID of the YARA or signature rule that matched the file.
string
ngs.apt.ruleName
Descriptive title of the detection rule (e.g., "Suspicious Powershell Loader").
text_general
ngs.apt.scanId
Unique identifier of the concrete scan execution in which the finding occurred.
string
ngs.apt.scanName
Label of the scan run (often auto-generated from date or host selection).
text_general
ngs.apt.scanAlias
Optional user-defined alias that makes the scan easier to recognize (e.g., "Weekly Deep Scan").
text_general
ngs.apt.severity
Qualitative risk rating assigned to the detection (low, medium, high, critical).
string
ngs.apt.md5
MD5 checksum of the file's content at detection time.
string
ngs.apt.sha1
SHA-1 hash of the file for integrity and reputation look-ups.
string
ngs.apt.sha256
SHA-256 hash of the file for accurate, collision-resistant identification.
string

Sample Log Event

Below is a representative JSON log entry showing key fields as they're emitted by the system. Depending on the context of the event, some fields may be omitted if they're not applicable.