How to know from logs that the detected virus had been cleaned successfully

Hi, team, I am new to Sophos, and now working to load Sophos log data into a SIEM platform.

Currently the logs loaded are sth like:

ThreatInstanceID: "538983" ThreatType: "1" FirstDetectedAt: "2022-09-27 19:11:05.0" ThreatSubType: "0" Priority: "500" ThreatLocalID: "d8683c36833b586447b873fda829bab" ThreatLocalIDSource: "NameFilenameFilepathCIMD5" ThreatName: "Troj/Lnk-I" FullFilePathCheckSum: "66f887417dc16ca11e44c31328eeec9" FullFilePath: "C:\Google\GoogleUpdate.lnk" FileNameOffset: "10" FileVersion: "" CheckSum: "" ActionSubmittedAt: "1900-01-01 00:00:00.0" DealtWithAt: "2022-09-27 19:11:26.0" CleanUpable: "true" IsFragment: "false" IsRebootRequired: "false" Outstanding: "false" Status: "50" InsertedAt: "2022-09-27 18:56:58.15" Name: "171283_CMMWS_1" LastLoggedOnUser: "171283_CMMWS_1\Administrator" IPAddressText: "172.19.204.28" DomainName: "WORKGROUP" OperatingSystem: "33" ServicePack: "Service Pack 1"

The question is how to know whether the detected Troj/Lnk-l showed above had been successfully cleaned or not?

Not sure about the 'cleanupable", "status" field, or there are additional fields missed to load?

Many thanks!

Edited tags
[edited by: Gladys at 7:48 AM (GMT -7) on 3 Oct 2022]

Top Replies

Qoosh over 2 years ago +1

Hi John , Thanks for reaching out to the Sophos Community Forum. Do you know if this response is returned when running the "Get events" or "Get alerts" API query? I'd like to run a similar query…

0 Qoosh over 2 years ago

Hi John,

Thanks for reaching out to the Sophos Community Forum.

Do you know if this response is returned when running the "Get events" or "Get alerts" API query?

I'd like to run a similar query with a detection and cleanup event on my environment to compare the results.

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Cancel
0 John Zack1 over 2 years ago in reply to Qoosh

Thanks Kushal, as far as I know, the log are retrieved by created a database view that queries from dbo.Threats table.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Qoosh over 2 years ago in reply to John Zack1

Thanks for following up with us.

Let me know if the dbo.Threats table is located within your SIEM system or if this is based off of a Sophos Enterprise Console environment, as the SEC database also references the same table name.

To give you some more context, you can see further information on the values that will be returned when sending each HTTP request respectively in the links below.
- /alerts (GET)
- events (GET)

The information from your SIEM system appears to have a few more fields.

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Cancel