# Linux Malware Alert

- OS: Linux
- Data Stream: `logs-endpoint.alerts-*`
- KQL: `event.code : "malicious_file" and event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "linux"`

This alert is generated when a Malware alert occurs.


| Field |
|---|
| @timestamp |
| Endpoint.policy.applied.artifacts.global.identifiers.name |
| Endpoint.policy.applied.artifacts.global.identifiers.sha256 |
| Endpoint.policy.applied.artifacts.global.version |
| Endpoint.policy.applied.artifacts.user.identifiers.name |
| Endpoint.policy.applied.artifacts.user.identifiers.sha256 |
| Endpoint.policy.applied.artifacts.user.version |
| agent.build.original |
| agent.id |
| agent.type |
| agent.version |
| data_stream.dataset |
| data_stream.namespace |
| data_stream.type |
| ecs.version |
| elastic.agent.id |
| event.action |
| event.category |
| event.code |
| event.created |
| event.dataset |
| event.id |
| event.kind |
| event.module |
| event.outcome |
| event.risk_score |
| event.sequence |
| event.severity |
| event.type |
| file.Ext.malware_classification.identifier |
| file.Ext.malware_classification.score |
| file.Ext.malware_classification.threshold |
| file.Ext.malware_classification.version |
| file.Ext.malware_signature.all_names |
| file.Ext.malware_signature.identifier |
| file.Ext.malware_signature.primary.matches |
| file.Ext.malware_signature.primary.signature.hash.sha256 |
| file.Ext.malware_signature.primary.signature.id |
| file.Ext.malware_signature.primary.signature.name |
| file.Ext.malware_signature.version |
| file.Ext.quarantine_message |
| file.Ext.quarantine_path |
| file.Ext.quarantine_result |
| file.Ext.temp_file_path |
| file.accessed |
| file.created |
| file.directory |
| file.extension |
| file.hash.md5 |
| file.hash.sha1 |
| file.hash.sha256 |
| file.inode |
| file.mtime |
| file.name |
| file.owner |
| file.path |
| file.size |
| host.architecture |
| host.hostname |
| host.id |
| host.ip |
| host.mac |
| host.name |
| host.os.Ext.variant |
| host.os.family |
| host.os.full |
| host.os.kernel |
| host.os.name |
| host.os.platform |
| host.os.type |
| host.os.version |
| message |
| process.Ext.ancestry |
| process.Ext.user |
| process.args |
| process.args_count |
| process.command_line |
| process.entity_id |
| process.entry_leader.args |
| process.entry_leader.args_count |
| process.entry_leader.entity_id |
| process.entry_leader.entry_meta.source.ip |
| process.entry_leader.entry_meta.type |
| process.entry_leader.executable |
| process.entry_leader.group.id |
| process.entry_leader.group.name |
| process.entry_leader.interactive |
| process.entry_leader.name |
| process.entry_leader.parent.entity_id |
| process.entry_leader.parent.pid |
| process.entry_leader.parent.start |
| process.entry_leader.pid |
| process.entry_leader.real_group.id |
| process.entry_leader.real_group.name |
| process.entry_leader.real_user.id |
| process.entry_leader.real_user.name |
| process.entry_leader.same_as_process |
| process.entry_leader.start |
| process.entry_leader.supplemental_groups.id |
| process.entry_leader.supplemental_groups.name |
| process.entry_leader.tty.char_device.major |
| process.entry_leader.tty.char_device.minor |
| process.entry_leader.user.id |
| process.entry_leader.user.name |
| process.entry_leader.working_directory |
| process.executable |
| process.group.id |
| process.group.name |
| process.group_leader.args |
| process.group_leader.args_count |
| process.group_leader.entity_id |
| process.group_leader.executable |
| process.group_leader.group.id |
| process.group_leader.group.name |
| process.group_leader.interactive |
| process.group_leader.name |
| process.group_leader.pid |
| process.group_leader.real_group.id |
| process.group_leader.real_group.name |
| process.group_leader.real_user.id |
| process.group_leader.real_user.name |
| process.group_leader.same_as_process |
| process.group_leader.start |
| process.group_leader.supplemental_groups.id |
| process.group_leader.supplemental_groups.name |
| process.group_leader.tty.char_device.major |
| process.group_leader.tty.char_device.minor |
| process.group_leader.user.id |
| process.group_leader.user.name |
| process.group_leader.working_directory |
| process.hash.md5 |
| process.hash.sha1 |
| process.hash.sha256 |
| process.interactive |
| process.name |
| process.parent.Ext.user |
| process.parent.args |
| process.parent.args_count |
| process.parent.command_line |
| process.parent.entity_id |
| process.parent.executable |
| process.parent.group.id |
| process.parent.group.name |
| process.parent.hash.md5 |
| process.parent.hash.sha1 |
| process.parent.hash.sha256 |
| process.parent.interactive |
| process.parent.name |
| process.parent.pgid |
| process.parent.pid |
| process.parent.ppid |
| process.parent.real_group.id |
| process.parent.real_group.name |
| process.parent.real_user.id |
| process.parent.real_user.name |
| process.parent.start |
| process.parent.supplemental_groups.id |
| process.parent.supplemental_groups.name |
| process.parent.tty.char_device.major |
| process.parent.tty.char_device.minor |
| process.parent.uptime |
| process.parent.user.id |
| process.parent.user.name |
| process.parent.working_directory |
| process.pgid |
| process.pid |
| process.real_group.id |
| process.real_group.name |
| process.real_user.id |
| process.real_user.name |
| process.session_leader.args |
| process.session_leader.args_count |
| process.session_leader.entity_id |
| process.session_leader.executable |
| process.session_leader.group.id |
| process.session_leader.group.name |
| process.session_leader.interactive |
| process.session_leader.name |
| process.session_leader.pid |
| process.session_leader.real_group.id |
| process.session_leader.real_group.name |
| process.session_leader.real_user.id |
| process.session_leader.real_user.name |
| process.session_leader.same_as_process |
| process.session_leader.start |
| process.session_leader.supplemental_groups.id |
| process.session_leader.supplemental_groups.name |
| process.session_leader.tty.char_device.major |
| process.session_leader.tty.char_device.minor |
| process.session_leader.user.id |
| process.session_leader.user.name |
| process.session_leader.working_directory |
| process.start |
| process.supplemental_groups.id |
| process.supplemental_groups.name |
| process.tty.char_device.major |
| process.tty.char_device.minor |
| process.uptime |
| process.user.id |
| process.user.name |
| process.working_directory |
| rule.id |
| rule.name |
| rule.ruleset |
| user.name |

