logline_enums.py

event = {
    "1": "IS_ALERT",
    "2": "SCAN_STOP",
    "3": "SCAN_START",
    "4": "PATTERN_UPDATE",
    "5": "INFECTION",
    "6": "FILE_NOT_OPEN",
    "7": "LOAD_PATTERN",
    "8": "GL_STD_MESSAGE_INFO",
    "9": "GL_STD_MESSAGE_ERROR",
    "10": "CHECKSUM",
    "11": "TRAP",
    "12": "CONFIG_CHANGE",
    "13": "SHUTDOWN",
    "14": "STARTUP",
    "15": "PATTERN_DOWNLOAD",
    "16": "TOO_MANY_VIRUSES",
    "17": "FWD_TO_QSERVER",
    "18": "SCANDLVR",
    "19": "BACKUP",
    "20": "SCAN_ABORT",
    "21": "RTS_LOAD_ERROR",
    "22": "RTS_LOAD",
    "23": "RTS_UNLOAD",
    "24": "REMOVE_CLIENT",
    "25": "SCAN_DELAYED",
    "26": "SCAN_RESTART",
    "27": "ADD_SAVROAMCLIENT_TOSERVER",
    "28": "REMOVE_SAVROAMCLIENT_FROMSERVER",
    "29": "LICENSE_WARNING",
    "30": "LICENSE_ERROR",
    "31": "LICENSE_GRACE",
    "32": "UNAUTHORIZED_COMM",
    "33": "LOG_FWD_THRD_ERR",
    "34": "LICENSE_INSTALLED",
    "35": "LICENSE_ALLOCATED",
    "36": "LICENSE_OK",
    "37": "LICENSE_DEALLOCATED",
    "38": "BAD_DEFS_ROLLBACK",
    "39": "BAD_DEFS_UNPROTECTED",
    "40": "SAV_PROVIDER_PARSING_ERROR",
    "41": "RTS_ERROR",
    "42": "COMPLIANCE_FAIL",
    "43": "COMPLIANCE_SUCCESS",
    "44": "SECURITY_SYMPROTECT_POLICYVIOLATION",
    "45": "ANOMALY_START",
    "46": "DETECTION_ACTION_TAKEN",
    "47": "REMEDIATION_ACTION_PENDING",
    "48": "REMEDIATION_ACTION_FAILED",
    "49": "REMEDIATION_ACTION_SUCCESSFUL",
    "50": "ANOMALY_FINISH",
    "51": "COMMS_LOGIN_FAILED",
    "52": "COMMS_LOGIN_SUCCESS",
    "53": "COMMS_UNAUTHORIZED_COMM",
    "54": "CLIENT_INSTALL_AV",
    "55": "CLIENT_INSTALL_FW",
    "56": "CLIENT_UNINSTALL",
    "57": "CLIENT_UNINSTALL_ROLLBACK",
    "58": "COMMS_SERVER_GROUP_ROOT_CERT_ISSUE",
    "59": "COMMS_SERVER_CERT_ISSUE",
    "60": "COMMS_TRUSTED_ROOT_CHANGE",
    "61": "COMMS_SERVER_CERT_STARTUP_FAILED",
    "62": "CLIENT_CHECKIN",
    "63": "CLIENT_NO_CHECKIN",
    "64": "SCAN_SUSPENDED",
    "65": "SCAN_RESUMED",
    "66": "SCAN_DURATION_INSUFFICIENT",
    "67": "CLIENT_MOVE",
    "68": "SCAN_FAILED_ENHANCED",
    "69": "COMPLIANCE_FAILEDAUDIT",
    "70": "HEUR_THREAT_NOW_WHITELISTED",
    "71": "HEUR_THREAT_NOW_WHITELISTED",
    "72": "INTERESTING_PROCESS_DETECTED_START",
    "73": "LOAD_ERROR_BASH",
    "74": "LOAD_ERROR_BASH_DEFINITIONS",
    "75": "INTERESTING_PROCESS_DETECTED_FINISH",
    "76": "BASH_NOT_SUPPORTED_FOR_OS",
    "77": "HEUR_THREAT_NOW_KNOWN",
    "78": "DISABLE_BASH",
    "79": "ENABLE_BASH",
    "80": "DEFS_LOAD_FAILED",
    "81": "LOCALREP_CACHE_SERVER_ERROR",
    "82": "REPUTATION_CHECK_TIMEOUT",
    "83": "SYMEPSECFILTER_DRIVER_ERROR",
    "84": "VSIC_COMMUNICATION_WARNING",
    "85": "VSIC_COMMUNICATION_RESTORED",
    "86": "ELAM_LOAD_FAILED",
    "87": "ELAM_INVALID_OS",
    "88": "ELAM_ENABLE",
    "89": "ELAM_DISABLE",
    "90": "ELAM_BAD",
    "91": "ELAM_BAD_REPORTED_AS_UNKNOWN",
    "92": "DISABLE_SYMPROTECT",
    "93": "ENABLE_SYMPROTECT",
    "94": "NETSEC_EOC_PARSE_FAILED"
}

category = {
    "1": "INFECTION",
    "2": "SUMMARY",
    "3": "PATTERN",
    "4": "SECURITY"
}

logger = {
    "0": "Scheduled",
    "1": "Manual",
    "2": "Real_Time",
    "3": "Integrity_Shield",
    "6": "Console",
    "7": "VPDOWN",
    "8": "System",
    "9": "Startup",
    "10": "Idle",
    "11": "DefWatch",
    "12": "Licensing",
    "13": "Manual_Quarantine",
    "14": "SymProtect",
    "15": "Reboot_Processing",
    "16": "Bash",
    "17": "SymElam",
    "18": "PowerEraser",
    "19": "EOCScan",
    "100": "LOCAL_END",
    "101": "Client",
    "102": "Forwarded",
    "256": "Transport_Client"
}

action = {
    "4294967295": "Invalid",
    "1": "Quarantine",
    "2": "Rename",
    "3": "Delete",
    "4": "Leave Alone",
    "5": "Clean",
    "6": "Remove Macros",
    "7": "Save file as...",
    "8": "Sent to backend",
    "9": "Restore from Quarantine",
    "10": "Rename Back (unused)",
    "11": "Undo Action",
    "12": "Error",
    "13": "Backup to quarantine (backup view)",
    "14": "Pending Analysis",
    "15": "Partially Fixed",
    "16": "Terminate Process Required",
    "17": "Exclude from Scanning",
    "18": "Reboot Processing",
    "19": "Clean by Deletion",
    "20": "Access Denied",
    "21": "AC_TERMINATE_PROCESS_ONLY",
    "22": "AC_NO_REPAIR",
    "23": "AC_FAIL",
    "24": "AC_RUN_POWERTOOL",
    "25": "AC_NO_REPAIR_POWERTOOL",
    "110": "AC_INTERESTING_PROCESS_CAL",
    "111": "AC_INTERESTING_PROCESS_DETECTED",
    "1000": "AC_INTERESTING_PROCESS_HASHED_DETECTED",
    "1001": "AC_DNS_HOST_FILE_EXCEPTION"
}

virus_type = {
    "48": "Heuristic",
    "80": "Hack Tools",
    "96": "Spyware",
    "112": "Trackware",
    "128": "Dialers",
    "144": "Remote Access",
    "160": "Adware",
    "176": "Joke Programs",
    "224": "Heuristic Application"
}

erarser_status = {
    "0": "Success",
    "1": "Reboot Required",
    "2": "Nothing To Do",
    "3": "Repaired",
    "4": "Deleted",
    "5": "False",
    "6": "Abort",
    "7": "Continue",
    "8": "Service Not Stopped",
    "9": "Application Heuristic Scan Failure",
    "10": "Cannot Remediate",
    "11": "Whitelist Failure",
    "12": "Driver Failure",
    # yes there are 4x entries for 13, its present in the
    # original macro as well
    "13": "Reserved01",
    # "13": "Commercial Application List Failure",
    # "13": "Application Heuristic Scan Invalid OS",
    # "13": "Content Manager Data Error",
    "999": "Leave Alone",
    "1000": "Generic Failure",
    "1001": "Out Of Memory",
    "1002": "Not Initialized",
    "1003": "Invalid Argument",
    "1004": "Insufficient Buffer",
    "1005": "Decryption Error",
    "1006": "File Not Found",
    "1007": "Out Of Range",
    "1008": "COM Error",
    "1009": "Partial Failure",
    "1010": "Bad Definitions",
    "1011": "Invalid Command",
    "1012": "No Interface",
    "1013": "RSA Error",
    "1014": "Path Not Empty",
    "1015": "Invalid Path",
    "1016": "Path Not Empty",
    "1017": "File Still Present",
    "1018": "Invalid OS",
    "1019": "Not Implemented",
    "1020": "Access Denied",
    "1021": "Directory Still Present",
    "1022": "Inconsistent State",
    "1023": "Timeout",
    "1024": "Action Pending",
    "1025": "Volume Write Protected",
    "1026": "Not Reparse Point",
    "1027": "File Exists",
    "1028": "Target Protected",
    "1029": "Disk Full",
    "1030": "Shutdown In Progress",
    "1031": "Media Error",
    "1032": "Network Defs Error"
}

eraser_category_id = {
    "1": "ECat_HeuristicTrojanWorm",
    "2": "ECat_HeuristicKeyLogger",
    "100": "ECat_CommercialRemoteControl",
    "101": "ECat_CommercialKeyLogger",
    "200": "ECat_Cookie",
    "300": "ECat_Shields",
}

dynamic_categoryset_id = {
    "1": "SCANW_CATEGORY_SET_MALWARE",
    "2": "SCANW_CATEGORY_SET_SECURITY_RISK",
    "3": "SCANW_CATEGORY_SET_POTENTIALLY_UNWANTED_APPLICATIONS",
    "4": "SCANW_CATEGORY_SET_EXPERIMENTAL_HEURISTIC",
    "5": "SCANW_CATEGORY_SET_LEGACY_VIRAL",
    "6": "SCANW_CATEGORY_SET_LEGACY_NON_VIRAL",
    "7": "SCANW_CATEGORY_CRIMEWARE",
    "8": "SCANW_CATEGORY_SET_ADVANCED_HEURISTICS",
    "9": "SCANW_CATEGORY_SET_REPUTATION_BACKED_ADVANCED_HEURISTICS",
    "10": "SCANW_CATEGORY_PREVALENCE_BACKED_ADVANCED_HEURISTICS"
}

display_name = {
    "0": "Application Name",
    "1": "VID Virus Name"
}

reputation_disposition = {
    "0": "Good",
    "1": "Bad",
    "127": "Unknown"
}

detection_type = {
    "0": "Traditional",
    "1": "Heuristic"
}

visc_state = {
    "0": "Off",
    "1": "On",
    "2": "Failed"
}

targetapp_type = {
    "0": "Normal",
    "1": "Modern (Metro)"
}