[{"data":1,"prerenderedAt":5430},["ShallowReactive",2],{"docs-nav-docs_pl":3,"i-lucide:menu":455,"i-lucide:search":458,"i-lucide:chevron-down":460,"docs-\u002Fpl\u002Fdocs\u002Fsearch\u002Ffield-dictionary":462,"docs-surround-\u002Fpl\u002Fdocs\u002Fsearch\u002Ffield-dictionary":5418,"docs-section-\u002Fpl\u002Fdocs\u002Fsearch":5421,"i-lucide:chevron-right":5422,"i-lucide:arrow-left":5424,"i-lucide:arrow-right":5426,"i-lucide:copy":5428},[4],{"title":5,"path":6,"stem":7,"children":8,"page":454},"Pl","\u002Fpl","pl",[9],{"title":10,"path":11,"stem":12,"children":13,"order":15,"badge":16,"navTitle":17},"Dokumentacja XenXDR","\u002Fpl\u002Fdocs","pl\u002Fdocs\u002Findex",[14,18,54,114,171,202,236,278,308,342,360,402,424],{"title":10,"path":11,"stem":12,"order":15,"badge":16,"navTitle":17},0,null,"Przegląd",{"title":19,"path":20,"stem":21,"children":22,"order":15,"badge":16,"navTitle":19},"Pierwsze kroki","\u002Fpl\u002Fdocs\u002Fgetting-started","pl\u002Fdocs\u002F01.getting-started\u002Findex",[23,24,29,34,39,44,49],{"title":19,"path":20,"stem":21,"order":15,"badge":16,"navTitle":19},{"title":25,"path":26,"stem":27,"order":28,"badge":16,"navTitle":17},"Przegląd platformy","\u002Fpl\u002Fdocs\u002Fgetting-started\u002Foverview","pl\u002Fdocs\u002F01.getting-started\u002F01.overview",1,{"title":30,"path":31,"stem":32,"order":33,"badge":16,"navTitle":16},"Wymagania i dobór zasobów","\u002Fpl\u002Fdocs\u002Fgetting-started\u002Frequirements","pl\u002Fdocs\u002F01.getting-started\u002F02.requirements",2,{"title":35,"path":36,"stem":37,"order":38,"badge":16,"navTitle":16},"Instalacja z Docker Compose","\u002Fpl\u002Fdocs\u002Fgetting-started\u002Finstall","pl\u002Fdocs\u002F01.getting-started\u002F03.install",3,{"title":40,"path":41,"stem":42,"order":43,"badge":16,"navTitle":16},"Logowanie jednokrotne","\u002Fpl\u002Fdocs\u002Fgetting-started\u002Fsingle-sign-on","pl\u002Fdocs\u002F01.getting-started\u002F04.single-sign-on",4,{"title":45,"path":46,"stem":47,"order":48,"badge":16,"navTitle":16},"Lista kontrolna pierwszej godziny","\u002Fpl\u002Fdocs\u002Fgetting-started\u002Ffirst-hour","pl\u002Fdocs\u002F01.getting-started\u002F05.first-hour",5,{"title":50,"path":51,"stem":52,"order":53,"badge":16,"navTitle":16},"Utwardzanie przed startem produkcyjnym","\u002Fpl\u002Fdocs\u002Fgetting-started\u002Fhardening","pl\u002Fdocs\u002F01.getting-started\u002F06.hardening",6,{"title":55,"path":56,"stem":57,"children":58,"order":15,"badge":16,"navTitle":55},"Agent na stacjach","\u002Fpl\u002Fdocs\u002Fagent","pl\u002Fdocs\u002F02.agent\u002Findex",[59,60,64,68,72,76,80,84,89,94,99,104,109],{"title":55,"path":56,"stem":57,"order":15,"badge":16,"navTitle":55},{"title":61,"path":62,"stem":63,"order":28,"badge":16,"navTitle":17},"Agent: przegląd","\u002Fpl\u002Fdocs\u002Fagent\u002Foverview","pl\u002Fdocs\u002F02.agent\u002F01.overview",{"title":65,"path":66,"stem":67,"order":33,"badge":16,"navTitle":16},"Wspierane platformy","\u002Fpl\u002Fdocs\u002Fagent\u002Fsupported-platforms","pl\u002Fdocs\u002F02.agent\u002F02.supported-platforms",{"title":69,"path":70,"stem":71,"order":38,"badge":16,"navTitle":16},"Instalacja na Windows","\u002Fpl\u002Fdocs\u002Fagent\u002Finstall-windows","pl\u002Fdocs\u002F02.agent\u002F03.install-windows",{"title":73,"path":74,"stem":75,"order":43,"badge":16,"navTitle":16},"Instalacja na Linuksie","\u002Fpl\u002Fdocs\u002Fagent\u002Finstall-linux","pl\u002Fdocs\u002F02.agent\u002F04.install-linux",{"title":77,"path":78,"stem":79,"order":48,"badge":16,"navTitle":16},"Pakiety instalacyjne i rejestracja","\u002Fpl\u002Fdocs\u002Fagent\u002Finstaller-bundles","pl\u002Fdocs\u002F02.agent\u002F05.installer-bundles",{"title":81,"path":82,"stem":83,"order":53,"badge":16,"navTitle":16},"Telemetria","\u002Fpl\u002Fdocs\u002Fagent\u002Ftelemetry","pl\u002Fdocs\u002F02.agent\u002F06.telemetry",{"title":85,"path":86,"stem":87,"order":88,"badge":16,"navTitle":16},"Reagowanie na żywo","\u002Fpl\u002Fdocs\u002Fagent\u002Flive-response","pl\u002Fdocs\u002F02.agent\u002F07.live-response",7,{"title":90,"path":91,"stem":92,"order":93,"badge":16,"navTitle":16},"Izolacja sieciowa","\u002Fpl\u002Fdocs\u002Fagent\u002Fnetwork-isolation","pl\u002Fdocs\u002F02.agent\u002F08.network-isolation",8,{"title":95,"path":96,"stem":97,"order":98,"badge":16,"navTitle":16},"Kontrola aplikacji","\u002Fpl\u002Fdocs\u002Fagent\u002Fapplication-control","pl\u002Fdocs\u002F02.agent\u002F09.application-control",9,{"title":100,"path":101,"stem":102,"order":103,"badge":16,"navTitle":16},"Szybki triage","\u002Fpl\u002Fdocs\u002Fagent\u002Fquick-triage","pl\u002Fdocs\u002F02.agent\u002F10.quick-triage",10,{"title":105,"path":106,"stem":107,"order":108,"badge":16,"navTitle":16},"Aktualizacje","\u002Fpl\u002Fdocs\u002Fagent\u002Fupdates","pl\u002Fdocs\u002F02.agent\u002F11.updates",11,{"title":110,"path":111,"stem":112,"order":113,"badge":16,"navTitle":16},"Rozwiązywanie problemów z agentem","\u002Fpl\u002Fdocs\u002Fagent\u002Ftroubleshooting","pl\u002Fdocs\u002F02.agent\u002F12.troubleshooting",12,{"title":115,"path":116,"stem":117,"children":118,"order":15,"badge":16,"navTitle":115},"Źródła danych","\u002Fpl\u002Fdocs\u002Fdata-sources","pl\u002Fdocs\u002F03.data-sources\u002Findex",[119,120,124,128,132,136,140,144,148,167],{"title":115,"path":116,"stem":117,"order":15,"badge":16,"navTitle":115},{"title":121,"path":122,"stem":123,"order":28,"badge":16,"navTitle":17},"Źródła danych: przegląd","\u002Fpl\u002Fdocs\u002Fdata-sources\u002Foverview","pl\u002Fdocs\u002F03.data-sources\u002F01.overview",{"title":125,"path":126,"stem":127,"order":33,"badge":16,"navTitle":16},"Klucze przyjmowania danych","\u002Fpl\u002Fdocs\u002Fdata-sources\u002Fingest-keys","pl\u002Fdocs\u002F03.data-sources\u002F02.ingest-keys",{"title":129,"path":130,"stem":131,"order":38,"badge":16,"navTitle":16},"Beats","\u002Fpl\u002Fdocs\u002Fdata-sources\u002Fbeats","pl\u002Fdocs\u002F03.data-sources\u002F03.beats",{"title":133,"path":134,"stem":135,"order":43,"badge":16,"navTitle":16},"Syslog, CEF i LEEF","\u002Fpl\u002Fdocs\u002Fdata-sources\u002Fsyslog","pl\u002Fdocs\u002F03.data-sources\u002F04.syslog",{"title":137,"path":138,"stem":139,"order":48,"badge":16,"navTitle":16},"HTTP JSON","\u002Fpl\u002Fdocs\u002Fdata-sources\u002Fhttp-json","pl\u002Fdocs\u002F03.data-sources\u002F05.http-json",{"title":141,"path":142,"stem":143,"order":53,"badge":16,"navTitle":16},"Splunk HEC","\u002Fpl\u002Fdocs\u002Fdata-sources\u002Fsplunk-hec","pl\u002Fdocs\u002F03.data-sources\u002F06.splunk-hec",{"title":145,"path":146,"stem":147,"order":88,"badge":16,"navTitle":16},"Katalog źródeł danych","\u002Fpl\u002Fdocs\u002Fdata-sources\u002Fcatalog","pl\u002Fdocs\u002F03.data-sources\u002F07.catalog",{"title":149,"path":150,"stem":151,"children":152,"order":15,"badge":16,"navTitle":149},"Konektory","\u002Fpl\u002Fdocs\u002Fdata-sources\u002Fconnectors","pl\u002Fdocs\u002F03.data-sources\u002F08.connectors\u002Findex",[153,154,158,162],{"title":149,"path":150,"stem":151,"order":15,"badge":16,"navTitle":149},{"title":155,"path":156,"stem":157,"order":28,"badge":16,"navTitle":16},"Okta System Log","\u002Fpl\u002Fdocs\u002Fdata-sources\u002Fconnectors\u002Fokta","pl\u002Fdocs\u002F03.data-sources\u002F08.connectors\u002F01.okta",{"title":159,"path":160,"stem":161,"order":33,"badge":16,"navTitle":16},"Microsoft Entra ID i Microsoft 365","\u002Fpl\u002Fdocs\u002Fdata-sources\u002Fconnectors\u002Fmicrosoft-entra","pl\u002Fdocs\u002F03.data-sources\u002F08.connectors\u002F02.microsoft-entra",{"title":163,"path":164,"stem":165,"order":38,"badge":166,"navTitle":16},"Konektory wkrótce","\u002Fpl\u002Fdocs\u002Fdata-sources\u002Fconnectors\u002Fcoming-soon","pl\u002Fdocs\u002F03.data-sources\u002F08.connectors\u002F03.coming-soon","coming-soon",{"title":168,"path":169,"stem":170,"order":98,"badge":16,"navTitle":16},"Threat intelligence","\u002Fpl\u002Fdocs\u002Fdata-sources\u002Fthreat-intel","pl\u002Fdocs\u002F03.data-sources\u002F09.threat-intel",{"title":172,"path":173,"stem":174,"children":175,"order":15,"badge":16,"navTitle":172},"Wyszukiwanie","\u002Fpl\u002Fdocs\u002Fsearch","pl\u002Fdocs\u002F04.search\u002Findex",[176,177,182,186,190,194,198],{"title":172,"path":173,"stem":174,"order":15,"badge":16,"navTitle":172},{"title":178,"path":179,"stem":180,"order":28,"badge":16,"navTitle":181},"Strona Logs","\u002Fpl\u002Fdocs\u002Fsearch\u002Fdiscover","pl\u002Fdocs\u002F04.search\u002F01.discover","Przegląd strony Logs",{"title":183,"path":184,"stem":185,"order":33,"badge":16,"navTitle":16},"Składnia zapytań","\u002Fpl\u002Fdocs\u002Fsearch\u002Fquery-syntax","pl\u002Fdocs\u002F04.search\u002F02.query-syntax",{"title":187,"path":188,"stem":189,"order":38,"badge":16,"navTitle":16},"Skróty klawiszowe","\u002Fpl\u002Fdocs\u002Fsearch\u002Fkeyboard","pl\u002Fdocs\u002F04.search\u002F03.keyboard",{"title":191,"path":192,"stem":193,"order":43,"badge":16,"navTitle":16},"Zapisane widoki i karty wyszukiwania","\u002Fpl\u002Fdocs\u002Fsearch\u002Fsaved-views","pl\u002Fdocs\u002F04.search\u002F04.saved-views",{"title":195,"path":196,"stem":197,"order":48,"badge":16,"navTitle":16},"AI Hunt","\u002Fpl\u002Fdocs\u002Fsearch\u002Fai-hunt","pl\u002Fdocs\u002F04.search\u002F05.ai-hunt",{"title":199,"path":200,"stem":201,"order":53,"badge":16,"navTitle":16},"Słownik pól","\u002Fpl\u002Fdocs\u002Fsearch\u002Ffield-dictionary","pl\u002Fdocs\u002F04.search\u002F06.field-dictionary",{"title":203,"path":204,"stem":205,"children":206,"order":15,"badge":16,"navTitle":203},"Detekcje","\u002Fpl\u002Fdocs\u002Fdetections","pl\u002Fdocs\u002F05.detections\u002Findex",[207,208,212,216,220,224,228,232],{"title":203,"path":204,"stem":205,"order":15,"badge":16,"navTitle":203},{"title":209,"path":210,"stem":211,"order":28,"badge":16,"navTitle":17},"Detekcje: przegląd","\u002Fpl\u002Fdocs\u002Fdetections\u002Foverview","pl\u002Fdocs\u002F05.detections\u002F01.overview",{"title":213,"path":214,"stem":215,"order":33,"badge":16,"navTitle":16},"Pisanie reguł","\u002Fpl\u002Fdocs\u002Fdetections\u002Fwriting-rules","pl\u002Fdocs\u002F05.detections\u002F02.writing-rules",{"title":217,"path":218,"stem":219,"order":38,"badge":16,"navTitle":16},"Import reguł","\u002Fpl\u002Fdocs\u002Fdetections\u002Fimporting","pl\u002Fdocs\u002F05.detections\u002F03.importing",{"title":221,"path":222,"stem":223,"order":43,"badge":16,"navTitle":16},"Pakiet reguł","\u002Fpl\u002Fdocs\u002Fdetections\u002Fcontent-pack","pl\u002Fdocs\u002F05.detections\u002F04.content-pack",{"title":225,"path":226,"stem":227,"order":48,"badge":16,"navTitle":16},"Wyjątki i wyciszenia","\u002Fpl\u002Fdocs\u002Fdetections\u002Fexceptions-suppressions","pl\u002Fdocs\u002F05.detections\u002F05.exceptions-suppressions",{"title":229,"path":230,"stem":231,"order":53,"badge":16,"navTitle":16},"Pokrycie ATT&CK","\u002Fpl\u002Fdocs\u002Fdetections\u002Fattack-coverage","pl\u002Fdocs\u002F05.detections\u002F06.attack-coverage",{"title":233,"path":234,"stem":235,"order":88,"badge":16,"navTitle":16},"Sygnały bazowe","\u002Fpl\u002Fdocs\u002Fdetections\u002Fbaseline-signals","pl\u002Fdocs\u002F05.detections\u002F07.baseline-signals",{"title":237,"path":238,"stem":239,"children":240,"order":15,"badge":16,"navTitle":237},"Operacje","\u002Fpl\u002Fdocs\u002Foperations","pl\u002Fdocs\u002F06.operations\u002Findex",[241,242,246,250,254,258,262,266,270,274],{"title":237,"path":238,"stem":239,"order":15,"badge":16,"navTitle":237},{"title":243,"path":244,"stem":245,"order":28,"badge":16,"navTitle":16},"Alerty","\u002Fpl\u002Fdocs\u002Foperations\u002Falerts","pl\u002Fdocs\u002F06.operations\u002F01.alerts",{"title":247,"path":248,"stem":249,"order":33,"badge":16,"navTitle":16},"Korelacje","\u002Fpl\u002Fdocs\u002Foperations\u002Fcorrelations","pl\u002Fdocs\u002F06.operations\u002F02.correlations",{"title":251,"path":252,"stem":253,"order":38,"badge":16,"navTitle":16},"Sprawy","\u002Fpl\u002Fdocs\u002Foperations\u002Fcases","pl\u002Fdocs\u002F06.operations\u002F03.cases",{"title":255,"path":256,"stem":257,"order":43,"badge":16,"navTitle":16},"Kategorie spraw","\u002Fpl\u002Fdocs\u002Foperations\u002Fcase-categories","pl\u002Fdocs\u002F06.operations\u002F04.case-categories",{"title":259,"path":260,"stem":261,"order":48,"badge":16,"navTitle":16},"SLA","\u002Fpl\u002Fdocs\u002Foperations\u002Fsla","pl\u002Fdocs\u002F06.operations\u002F05.sla",{"title":263,"path":264,"stem":265,"order":53,"badge":16,"navTitle":16},"Raporty","\u002Fpl\u002Fdocs\u002Foperations\u002Freports","pl\u002Fdocs\u002F06.operations\u002F06.reports",{"title":267,"path":268,"stem":269,"order":88,"badge":16,"navTitle":16},"Zgłoszenia","\u002Fpl\u002Fdocs\u002Foperations\u002Ftickets","pl\u002Fdocs\u002F06.operations\u002F07.tickets",{"title":271,"path":272,"stem":273,"order":93,"badge":16,"navTitle":16},"Powiadomienia","\u002Fpl\u002Fdocs\u002Foperations\u002Fnotifications","pl\u002Fdocs\u002F06.operations\u002F08.notifications",{"title":275,"path":276,"stem":277,"order":98,"badge":16,"navTitle":16},"Dashboardy","\u002Fpl\u002Fdocs\u002Foperations\u002Fdashboards","pl\u002Fdocs\u002F06.operations\u002F09.dashboards",{"title":279,"path":280,"stem":281,"children":282,"order":15,"badge":16,"navTitle":279},"AI","\u002Fpl\u002Fdocs\u002Fai","pl\u002Fdocs\u002F07.ai\u002Findex",[283,284,288,292,296,300,304],{"title":279,"path":280,"stem":281,"order":15,"badge":16,"navTitle":279},{"title":285,"path":286,"stem":287,"order":28,"badge":16,"navTitle":17},"AI: przegląd","\u002Fpl\u002Fdocs\u002Fai\u002Foverview","pl\u002Fdocs\u002F07.ai\u002F01.overview",{"title":289,"path":290,"stem":291,"order":33,"badge":16,"navTitle":16},"Werdykty triage","\u002Fpl\u002Fdocs\u002Fai\u002Ftriage-verdicts","pl\u002Fdocs\u002F07.ai\u002F02.triage-verdicts",{"title":293,"path":294,"stem":295,"order":38,"badge":16,"navTitle":16},"Agent dochodzeniowy","\u002Fpl\u002Fdocs\u002Fai\u002Finvestigation-agent","pl\u002Fdocs\u002F07.ai\u002F03.investigation-agent",{"title":297,"path":298,"stem":299,"order":43,"badge":16,"navTitle":16},"Notatki, przekazania zmiany i szkice raportów","\u002Fpl\u002Fdocs\u002Fai\u002Fnotes-and-reports","pl\u002Fdocs\u002F07.ai\u002F04.notes-and-reports",{"title":301,"path":302,"stem":303,"order":48,"badge":16,"navTitle":16},"Konfiguracja modelu","\u002Fpl\u002Fdocs\u002Fai\u002Fmodel-setup","pl\u002Fdocs\u002F07.ai\u002F05.model-setup",{"title":305,"path":306,"stem":307,"order":53,"badge":16,"navTitle":16},"Informacja zwrotna","\u002Fpl\u002Fdocs\u002Fai\u002Ffeedback","pl\u002Fdocs\u002F07.ai\u002F06.feedback",{"title":309,"path":310,"stem":311,"children":312,"order":15,"badge":16,"navTitle":309},"Automatyzacja","\u002Fpl\u002Fdocs\u002Fautomation","pl\u002Fdocs\u002F08.automation\u002Findex",[313,314,318,322,326,330,334,338],{"title":309,"path":310,"stem":311,"order":15,"badge":16,"navTitle":309},{"title":315,"path":316,"stem":317,"order":28,"badge":16,"navTitle":16},"Playbooki","\u002Fpl\u002Fdocs\u002Fautomation\u002Fplaybooks","pl\u002Fdocs\u002F08.automation\u002F01.playbooks",{"title":319,"path":320,"stem":321,"order":33,"badge":16,"navTitle":16},"Kreator workflow","\u002Fpl\u002Fdocs\u002Fautomation\u002Fbuilder","pl\u002Fdocs\u002F08.automation\u002F02.builder",{"title":323,"path":324,"stem":325,"order":38,"badge":16,"navTitle":16},"Opis bloków","\u002Fpl\u002Fdocs\u002Fautomation\u002Fblocks","pl\u002Fdocs\u002F08.automation\u002F03.blocks",{"title":327,"path":328,"stem":329,"order":43,"badge":16,"navTitle":16},"Tryby i limity","\u002Fpl\u002Fdocs\u002Fautomation\u002Fmodes-and-ceilings","pl\u002Fdocs\u002F08.automation\u002F04.modes-and-ceilings",{"title":331,"path":332,"stem":333,"order":48,"badge":16,"navTitle":16},"Akcje reagowania","\u002Fpl\u002Fdocs\u002Fautomation\u002Fresponse-actions","pl\u002Fdocs\u002F08.automation\u002F05.response-actions",{"title":335,"path":336,"stem":337,"order":53,"badge":16,"navTitle":16},"Powiadomienia i eksport","\u002Fpl\u002Fdocs\u002Fautomation\u002Fegress","pl\u002Fdocs\u002F08.automation\u002F06.egress",{"title":339,"path":340,"stem":341,"order":88,"badge":16,"navTitle":16},"Uruchomienia playbooków","\u002Fpl\u002Fdocs\u002Fautomation\u002Fruns","pl\u002Fdocs\u002F08.automation\u002F07.runs",{"title":343,"path":344,"stem":345,"children":346,"order":15,"badge":16,"navTitle":343},"Flota","\u002Fpl\u002Fdocs\u002Ffleet","pl\u002Fdocs\u002F09.fleet\u002Findex",[347,348,352,356],{"title":343,"path":344,"stem":345,"order":15,"badge":16,"navTitle":343},{"title":349,"path":350,"stem":351,"order":28,"badge":16,"navTitle":16},"Hosty","\u002Fpl\u002Fdocs\u002Ffleet\u002Fhosts","pl\u002Fdocs\u002F09.fleet\u002F01.hosts",{"title":353,"path":354,"stem":355,"order":33,"badge":16,"navTitle":16},"Ocena ryzyka","\u002Fpl\u002Fdocs\u002Ffleet\u002Frisk-score","pl\u002Fdocs\u002F09.fleet\u002F02.risk-score",{"title":357,"path":358,"stem":359,"order":38,"badge":16,"navTitle":16},"Konsola reagowania","\u002Fpl\u002Fdocs\u002Ffleet\u002Fresponse-console","pl\u002Fdocs\u002F09.fleet\u002F03.response-console",{"title":361,"path":362,"stem":363,"children":364,"order":15,"badge":16,"navTitle":361},"Administracja","\u002Fpl\u002Fdocs\u002Fadministration","pl\u002Fdocs\u002F10.administration\u002Findex",[365,366,370,374,378,382,386,390,394,398],{"title":361,"path":362,"stem":363,"order":15,"badge":16,"navTitle":361},{"title":367,"path":368,"stem":369,"order":28,"badge":16,"navTitle":16},"Organizacje","\u002Fpl\u002Fdocs\u002Fadministration\u002Forganizations","pl\u002Fdocs\u002F10.administration\u002F01.organizations",{"title":371,"path":372,"stem":373,"order":33,"badge":16,"navTitle":16},"Użytkownicy i role","\u002Fpl\u002Fdocs\u002Fadministration\u002Fusers-and-roles","pl\u002Fdocs\u002F10.administration\u002F02.users-and-roles",{"title":375,"path":376,"stem":377,"order":38,"badge":16,"navTitle":16},"Dziennik audytu","\u002Fpl\u002Fdocs\u002Fadministration\u002Faudit-log","pl\u002Fdocs\u002F10.administration\u002F03.audit-log",{"title":379,"path":380,"stem":381,"order":43,"badge":16,"navTitle":16},"Retencja","\u002Fpl\u002Fdocs\u002Fadministration\u002Fretention","pl\u002Fdocs\u002F10.administration\u002F04.retention",{"title":383,"path":384,"stem":385,"order":48,"badge":16,"navTitle":16},"Kopie zapasowe i odtwarzanie","\u002Fpl\u002Fdocs\u002Fadministration\u002Fbackups","pl\u002Fdocs\u002F10.administration\u002F05.backups",{"title":387,"path":388,"stem":389,"order":53,"badge":16,"navTitle":16},"Aktualizacje platformy","\u002Fpl\u002Fdocs\u002Fadministration\u002Fupgrades","pl\u002Fdocs\u002F10.administration\u002F06.upgrades",{"title":391,"path":392,"stem":393,"order":88,"badge":16,"navTitle":16},"Monitoring wdrożenia","\u002Fpl\u002Fdocs\u002Fadministration\u002Fmonitoring","pl\u002Fdocs\u002F10.administration\u002F07.monitoring",{"title":395,"path":396,"stem":397,"order":93,"badge":16,"navTitle":16},"Skalowanie","\u002Fpl\u002Fdocs\u002Fadministration\u002Fscaling","pl\u002Fdocs\u002F10.administration\u002F08.scaling",{"title":399,"path":400,"stem":401,"order":98,"badge":16,"navTitle":16},"Opis ustawień","\u002Fpl\u002Fdocs\u002Fadministration\u002Fsettings-reference","pl\u002Fdocs\u002F10.administration\u002F09.settings-reference",{"title":403,"path":404,"stem":405,"children":406,"order":15,"badge":16,"navTitle":403},"Portal klienta","\u002Fpl\u002Fdocs\u002Fcustomer-portal","pl\u002Fdocs\u002F11.customer-portal\u002Findex",[407,408,412,416,420],{"title":403,"path":404,"stem":405,"order":15,"badge":16,"navTitle":403},{"title":409,"path":410,"stem":411,"order":28,"badge":16,"navTitle":17},"Portal klienta: przegląd","\u002Fpl\u002Fdocs\u002Fcustomer-portal\u002Foverview","pl\u002Fdocs\u002F11.customer-portal\u002F01.overview",{"title":413,"path":414,"stem":415,"order":33,"badge":16,"navTitle":16},"Zapraszanie klientów","\u002Fpl\u002Fdocs\u002Fcustomer-portal\u002Finviting-customers","pl\u002Fdocs\u002F11.customer-portal\u002F02.inviting-customers",{"title":417,"path":418,"stem":419,"order":38,"badge":16,"navTitle":16},"Co widzą klienci","\u002Fpl\u002Fdocs\u002Fcustomer-portal\u002Fwhat-customers-see","pl\u002Fdocs\u002F11.customer-portal\u002F03.what-customers-see",{"title":421,"path":422,"stem":423,"order":43,"badge":16,"navTitle":16},"Bezpieczeństwo portalu","\u002Fpl\u002Fdocs\u002Fcustomer-portal\u002Fsecurity","pl\u002Fdocs\u002F11.customer-portal\u002F04.security",{"title":425,"path":426,"stem":427,"children":428,"order":15,"badge":16,"navTitle":425},"Materiały referencyjne","\u002Fpl\u002Fdocs\u002Freference","pl\u002Fdocs\u002F12.reference\u002Findex",[429,430,434,438,442,446,450],{"title":425,"path":426,"stem":427,"order":15,"badge":16,"navTitle":425},{"title":431,"path":432,"stem":433,"order":28,"badge":16,"navTitle":16},"Słownik pojęć","\u002Fpl\u002Fdocs\u002Freference\u002Fglossary","pl\u002Fdocs\u002F12.reference\u002F01.glossary",{"title":435,"path":436,"stem":437,"order":33,"badge":16,"navTitle":16},"Poziomy wsparcia","\u002Fpl\u002Fdocs\u002Freference\u002Fsupport-tiers","pl\u002Fdocs\u002F12.reference\u002F02.support-tiers",{"title":439,"path":440,"stem":441,"order":38,"badge":16,"navTitle":16},"Zgodność","\u002Fpl\u002Fdocs\u002Freference\u002Fcompatibility","pl\u002Fdocs\u002F12.reference\u002F03.compatibility",{"title":443,"path":444,"stem":445,"order":43,"badge":16,"navTitle":16},"Rodzaje powiadomień","\u002Fpl\u002Fdocs\u002Freference\u002Fnotification-kinds","pl\u002Fdocs\u002F12.reference\u002F04.notification-kinds",{"title":447,"path":448,"stem":449,"order":48,"badge":16,"navTitle":16},"Katalog źródeł danych (odnośnik)","\u002Fpl\u002Fdocs\u002Freference\u002Fdata-source-catalog","pl\u002Fdocs\u002F12.reference\u002F05.data-source-catalog",{"title":451,"path":452,"stem":453,"order":53,"badge":16,"navTitle":16},"Informacje o wydaniach","\u002Fpl\u002Fdocs\u002Freference\u002Frelease-notes","pl\u002Fdocs\u002F12.reference\u002F06.release-notes",false,{"left":15,"top":15,"width":456,"height":456,"rotate":15,"vFlip":454,"hFlip":454,"body":457},24,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5h16M4 12h16M4 19h16\"\u002F>",{"left":15,"top":15,"width":456,"height":456,"rotate":15,"vFlip":454,"hFlip":454,"body":459},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m21 21l-4.34-4.34\"\u002F>\u003Ccircle cx=\"11\" cy=\"11\" r=\"8\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":456,"height":456,"rotate":15,"vFlip":454,"hFlip":454,"body":461},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m6 9l6 6l6-6\"\u002F>",{"id":463,"title":199,"audience":16,"badge":16,"body":464,"description":5411,"extension":5412,"meta":5413,"navTitle":16,"navigation":5414,"order":53,"path":200,"seo":5415,"stem":201,"updated":5416,"__hash__":5417},"docs_pl\u002Fpl\u002Fdocs\u002F04.search\u002F06.field-dictionary.md",{"type":465,"value":466,"toc":5405},"minimark",[467,476,481,489,499,506,517,828,960,964,4370,4379,4383,4386,5158,5162,5165,5246,5264],[468,469,470,471,475],"p",{},"Każde pole w XenXDR ma jedną nazwę: z kropkami, zgodną z ECS i taką samą w całej platformie. Tę nazwę wpisujesz w pasku zapytania Logs, na nią zamieniane są pola z importowanych reguł Sigma i do niej odwołują się dashboardy oraz detekcje. Ta sama nazwa obowiązuje dla wszystkich źródeł: ",[472,473,474],"code",{},"file.path"," to plik, którego dotyczy zdarzenie, niezależnie od tego, czy pochodzi ono z Sysmona, Microsoft Defender czy auditd.",[477,478,480],"h2",{"id":479},"wpisywanie-nazwy-pola","Wpisywanie nazwy pola",[468,482,483,484,488],{},"Nazwy z kropkami tworzą drzewo i tak też podpowiada je pasek zapytania: najpierw proponuje ",[485,486,487],"strong",{},"kolejny człon po kropce",", więc nazwę budujesz krok po kroku, bez zapamiętywania całej ścieżki.",[490,491,496],"pre",{"className":492,"code":494,"language":495},[493],"language-text","pro → process.  →  process.par → process.parent.  →  process.parent.exe\n→ process.parent.executable\n","text",[472,497,494],{"__ignoreMap":498},"",[468,500,501,502,505],{},"Podpowiedź zakończona kropką to gałąź: jej wybranie przenosi poziom niżej i pokazuje zawartość gałęzi. Pełne nazwy pól są wyświetlane pod gałęziami, więc widzisz wszystkie dostępne pola. Człony możesz też wpisywać w skrócie: ",[472,503,504],{},"pro.par"," prowadzi do tej samej gałęzi.",[468,507,508,509,512,513,516],{},"Każde pole ma też ",[485,510,511],{},"skrót"," złożony z pierwszych liter członów. Wpisz go bezpośrednio albo poprzedź znakiem ",[472,514,515],{},";",", aby szukać wyłącznie wśród skrótów, gdy te same litery pasują też do początku pełnej nazwy.",[518,519,520,533],"table",{},[521,522,523],"thead",{},[524,525,526,530],"tr",{},[527,528,529],"th",{},"Pole",[527,531,532],{},"Skrót",[534,535,536,553,568,583,598,613,628,643,661,675,690,705,720,735,753,768,783,798,813],"tbody",{},[524,537,538,544],{},[539,540,541],"td",{},[472,542,543],{},"host.name",[539,545,546,549,550],{},[472,547,548],{},";hn",", ",[472,551,552],{},";hname",[524,554,555,560],{},[539,556,557],{},[472,558,559],{},"event.module",[539,561,562,549,565],{},[472,563,564],{},";em",[472,566,567],{},";emodule",[524,569,570,575],{},[539,571,572],{},[472,573,574],{},"event.type",[539,576,577,549,580],{},[472,578,579],{},";et",[472,581,582],{},";etype",[524,584,585,590],{},[539,586,587],{},[472,588,589],{},"event.severity",[539,591,592,549,595],{},[472,593,594],{},";es",[472,596,597],{},";eseverity",[524,599,600,605],{},[539,601,602],{},[472,603,604],{},"user.name",[539,606,607,549,610],{},[472,608,609],{},";un",[472,611,612],{},";uname",[524,614,615,620],{},[539,616,617],{},[472,618,619],{},"process.executable",[539,621,622,549,625],{},[472,623,624],{},";pe",[472,626,627],{},";pexecutable",[524,629,630,635],{},[539,631,632],{},[472,633,634],{},"process.parent.executable",[539,636,637,549,640],{},[472,638,639],{},";ppe",[472,641,642],{},";ppexecutable",[524,644,645,650],{},[539,646,647],{},[472,648,649],{},"process.command_line",[539,651,652,549,655,549,658],{},[472,653,654],{},";pc",[472,656,657],{},";pcl",[472,659,660],{},";pcommand_line",[524,662,663,667],{},[539,664,665],{},[472,666,474],{},[539,668,669,549,672],{},[472,670,671],{},";fp",[472,673,674],{},";fpath",[524,676,677,682],{},[539,678,679],{},[472,680,681],{},"user.target.name",[539,683,684,549,687],{},[472,685,686],{},";utn",[472,688,689],{},";utname",[524,691,692,697],{},[539,693,694],{},[472,695,696],{},"user.audit.id",[539,698,699,549,702],{},[472,700,701],{},";uai",[472,703,704],{},";uaid",[524,706,707,712],{},[539,708,709],{},[472,710,711],{},"event.outcome",[539,713,714,549,717],{},[472,715,716],{},";eo",[472,718,719],{},";eoutcome",[524,721,722,727],{},[539,723,724],{},[472,725,726],{},"threat.name",[539,728,729,549,732],{},[472,730,731],{},";tn",[472,733,734],{},";tname",[524,736,737,742],{},[539,738,739],{},[472,740,741],{},"powershell.script_block_text",[539,743,744,549,747,549,750],{},[472,745,746],{},";ps",[472,748,749],{},";psbt",[472,751,752],{},";pscript_block_text",[524,754,755,760],{},[539,756,757],{},[472,758,759],{},"amsi.content",[539,761,762,549,765],{},[472,763,764],{},";ac",[472,766,767],{},";acontent",[524,769,770,775],{},[539,771,772],{},[472,773,774],{},"threat.indicator.value",[539,776,777,549,780],{},[472,778,779],{},";tiv",[472,781,782],{},";tivalue",[524,784,785,790],{},[539,786,787],{},[472,788,789],{},"rule.onhost.id",[539,791,792,549,795],{},[472,793,794],{},";roi",[472,796,797],{},";roid",[524,799,800,805],{},[539,801,802],{},[472,803,804],{},"auditd.key",[539,806,807,549,810],{},[472,808,809],{},";ak",[472,811,812],{},";akey",[524,814,815,820],{},[539,816,817],{},[472,818,819],{},"auditd.syscall.name",[539,821,822,549,825],{},[472,823,824],{},";asn",[472,826,827],{},";asname",[468,829,830,831,833,834,836,837,840,841,844,845,847,848,844,851,847,853,844,856,847,859,844,862,847,864,844,867,847,869,844,872,847,874,844,877,847,880,844,883,847,886,844,889,847,892,844,895,847,898,844,901,847,904,844,907,847,909,844,912,847,914,844,917,847,919,844,922,847,924,844,927,847,929,844,932,847,935,844,938,847,941,844,944,847,947,844,950,847,953,844,956,959],{},"Gdy skrót pasuje do kilku pól, podpowiadane są wszystkie: ",[472,832,639],{}," to zarówno ",[472,835,634],{},", jak i ",[472,838,839],{},"process.parent.entity_id",", a częściej używane pole pojawia się jako pierwsze. Kilka zapisów, których analitycy często używają, przypisano ręcznie: ",[472,842,843],{},";cmd"," → ",[472,846,649],{}," · ",[472,849,850],{},";cli",[472,852,649],{},[472,854,855],{},";pcmd",[472,857,858],{},"process.parent.command_line",[472,860,861],{},";exe",[472,863,619],{},[472,865,866],{},";img",[472,868,619],{},[472,870,871],{},";pexe",[472,873,634],{},[472,875,876],{},";cwd",[472,878,879],{},"process.working_directory",[472,881,882],{},";sip",[472,884,885],{},"source.ip",[472,887,888],{},";dip",[472,890,891],{},"destination.ip",[472,893,894],{},";sport",[472,896,897],{},"source.port",[472,899,900],{},";dport",[472,902,903],{},"destination.port",[472,905,906],{},";host",[472,908,543],{},[472,910,911],{},";user",[472,913,604],{},[472,915,916],{},";sev",[472,918,589],{},[472,920,921],{},";evt",[472,923,574],{},[472,925,926],{},";mod",[472,928,559],{},[472,930,931],{},";code",[472,933,934],{},"event.code",[472,936,937],{},";msg",[472,939,940],{},"message",[472,942,943],{},";sha256",[472,945,946],{},"file.hash.sha256",[472,948,949],{},";url",[472,951,952],{},"url.original",[472,954,955],{},";chan",[472,957,958],{},"winlog.channel",".",[477,961,963],{"id":962},"pola","Pola",[518,965,966,981],{},[521,967,968],{},[524,969,970,972,975,978],{},[527,971,529],{},[527,973,974],{},"Typ",[527,976,977],{},"Właściwości",[527,979,980],{},"Opis",[534,982,983,1005,1019,1039,1058,1075,1094,1112,1131,1149,1167,1186,1199,1217,1235,1253,1271,1290,1304,1317,1335,1349,1362,1380,1395,1409,1427,1446,1465,1484,1503,1517,1536,1554,1567,1586,1600,1613,1632,1651,1669,1688,1707,1727,1745,1764,1783,1802,1821,1840,1858,1876,1894,1913,1931,1949,1963,1982,1996,2014,2033,2047,2065,2079,2093,2112,2126,2140,2154,2173,2192,2211,2230,2249,2267,2285,2304,2323,2342,2361,2375,2389,2403,2421,2435,2453,2472,2491,2510,2524,2543,2557,2571,2590,2609,2628,2651,2670,2689,2708,2726,2740,2754,2768,2787,2806,2820,2839,2853,2872,2891,2910,2929,2943,2962,2976,2989,3008,3027,3046,3065,3084,3098,3112,3126,3140,3159,3173,3187,3206,3225,3239,3258,3272,3286,3300,3314,3328,3342,3361,3380,3394,3413,3427,3446,3460,3474,3488,3502,3516,3530,3544,3557,3571,3585,3604,3618,3632,3646,3660,3674,3688,3702,3716,3730,3749,3763,3782,3796,3815,3829,3843,3857,3871,3885,3899,3913,3927,3946,3960,3974,3988,4007,4021,4035,4049,4062,4076,4094,4108,4122,4136,4150,4164,4182,4200,4214,4233,4247,4261,4280,4299,4318,4332,4351],{},[524,984,985,989,992,995],{},[539,986,987],{},[472,988,543],{},[539,990,991],{},"string",[539,993,994],{},"bez rozróżniania wielkości liter, grupowalne",[539,996,997,998,1001,1002],{},"Nazwa hosta, z którego pochodzi zdarzenie ",[999,1000],"br",{},"np. ",[472,1003,1004],{},"WKS-0412",[524,1006,1007,1012,1014,1016],{},[539,1008,1009],{},[472,1010,1011],{},"agent.id",[539,1013,991],{},[539,1015,994],{},[539,1017,1018],{},"Identyfikator agenta XenXDR na zgłaszającej stacji",[524,1020,1021,1026,1028,1031],{},[539,1022,1023],{},[472,1024,1025],{},"observer.vendor",[539,1027,991],{},[539,1029,1030],{},"bez rozróżniania wielkości liter",[539,1032,1033,1034,1001,1036],{},"Producent, od którego pochodzi zdarzenie: microsoft, fortinet, okta, … ",[999,1035],{},[472,1037,1038],{},"microsoft",[524,1040,1041,1046,1048,1050],{},[539,1042,1043],{},[472,1044,1045],{},"observer.product",[539,1047,991],{},[539,1049,1030],{},[539,1051,1052,1053,1001,1055],{},"Produkt, który wyemitował zdarzenie: sysmon, defender, fortigate, entra, … ",[999,1054],{},[472,1056,1057],{},"sysmon",[524,1059,1060,1064,1066,1068],{},[539,1061,1062],{},[472,1063,559],{},[539,1065,991],{},[539,1067,1030],{},[539,1069,1070,1071,1001,1073],{},"Strumień telemetrii, po którym filtruje konsola: sysmon, defender, security, powershell, firewall, auditd, syslog, http, hec, … ",[999,1072],{},[472,1074,1057],{},[524,1076,1077,1082,1084,1086],{},[539,1078,1079],{},[472,1080,1081],{},"event.dataset",[539,1083,991],{},[539,1085,1030],{},[539,1087,1088,1089,1001,1091],{},"Strumień w obrębie produktu: sysmon, cef, syslog, sourcetype z HEC ",[999,1090],{},[472,1092,1093],{},"cef",[524,1095,1096,1100,1102,1104],{},[539,1097,1098],{},[472,1099,574],{},[539,1101,991],{},[539,1103,1030],{},[539,1105,1106,1107,1001,1109],{},"Znormalizowany rodzaj zdarzenia, wspólny dla wszystkich źródeł; to według niego działają reguły ",[999,1108],{},[472,1110,1111],{},"process_create",[524,1113,1114,1118,1121,1123],{},[539,1115,1116],{},[472,1117,934],{},[539,1119,1120],{},"number",[539,1122],{},[539,1124,1125,1126,1001,1128],{},"Natywny identyfikator zdarzenia (Windows 4625, Sysmon 1, …) ",[999,1127],{},[472,1129,1130],{},"4625",[524,1132,1133,1137,1139,1141],{},[539,1134,1135],{},[472,1136,589],{},[539,1138,991],{},[539,1140,1030],{},[539,1142,1143,1144,1001,1146],{},"Wskazówka dla triage nadawana podczas przyjmowania danych: info, low, medium, high, critical ",[999,1145],{},[472,1147,1148],{},"high",[524,1150,1151,1155,1157,1159],{},[539,1152,1153],{},[472,1154,604],{},[539,1156,991],{},[539,1158,994],{},[539,1160,1161,1162,1001,1164],{},"Konto wykonujące działanie; konto, którego działanie dotyczy, to user.target.name ",[999,1163],{},[472,1165,1166],{},"j.doe",[524,1168,1169,1173,1175,1178],{},[539,1170,1171],{},[472,1172,885],{},[539,1174,991],{},[539,1176,1177],{},"grupowalne",[539,1179,1180,1181,1001,1183],{},"Znormalizowany adres źródłowy ",[999,1182],{},[472,1184,1185],{},"10.0.0.99",[524,1187,1188,1192,1194,1196],{},[539,1189,1190],{},[472,1191,897],{},[539,1193,1120],{},[539,1195],{},[539,1197,1198],{},"Znormalizowany port źródłowy",[524,1200,1201,1205,1207,1209],{},[539,1202,1203],{},[472,1204,891],{},[539,1206,991],{},[539,1208,1177],{},[539,1210,1211,1212,1001,1214],{},"Znormalizowany adres docelowy ",[999,1213],{},[472,1215,1216],{},"203.0.113.10",[524,1218,1219,1223,1225,1227],{},[539,1220,1221],{},[472,1222,903],{},[539,1224,1120],{},[539,1226],{},[539,1228,1229,1230,1001,1232],{},"Znormalizowany port docelowy ",[999,1231],{},[472,1233,1234],{},"443",[524,1236,1237,1241,1243,1245],{},[539,1238,1239],{},[472,1240,952],{},[539,1242,991],{},[539,1244,994],{},[539,1246,1247,1248,1001,1250],{},"Adres URL \u002F zapytanie DNS \u002F cel żądania ",[999,1249],{},[472,1251,1252],{},"evil.example.com",[524,1254,1255,1259,1261,1263],{},[539,1256,1257],{},[472,1258,619],{},[539,1260,991],{},[539,1262,994],{},[539,1264,1265,1266,1001,1268],{},"Pełna ścieżka uruchomionego obrazu ",[999,1267],{},[472,1269,1270],{},"C:\\Windows\\System32\\powershell.exe",[524,1272,1273,1278,1280,1282],{},[539,1274,1275],{},[472,1276,1277],{},"process.entity_id",[539,1279,991],{},[539,1281,1177],{},[539,1283,1284,1285,1001,1287],{},"Stała tożsamość procesu, według której budowane jest drzewo procesów ",[999,1286],{},[472,1288,1289],{},"a1b2c3d4-0001-6001-ab00-000000001700",[524,1291,1292,1297,1299,1301],{},[539,1293,1294],{},[472,1295,1296],{},"process.pid",[539,1298,1120],{},[539,1300],{},[539,1302,1303],{},"Identyfikator procesu",[524,1305,1306,1310,1312,1314],{},[539,1307,1308],{},[472,1309,839],{},[539,1311,991],{},[539,1313,1177],{},[539,1315,1316],{},"Tożsamość procesu nadrzędnego przy process_create; otwierany proces przy process_access",[524,1318,1319,1323,1325,1327],{},[539,1320,1321],{},[472,1322,634],{},[539,1324,991],{},[539,1326,1030],{},[539,1328,1329,1330,1001,1332],{},"Ścieżka obrazu procesu nadrzędnego ",[999,1331],{},[472,1333,1334],{},"C:\\Windows\\explorer.exe",[524,1336,1337,1342,1344,1346],{},[539,1338,1339],{},[472,1340,1341],{},"process.parent.pid",[539,1343,1120],{},[539,1345],{},[539,1347,1348],{},"Identyfikator procesu nadrzędnego w chwili utworzenia",[524,1350,1351,1355,1357,1359],{},[539,1352,1353],{},[472,1354,946],{},[539,1356,991],{},[539,1358,1177],{},[539,1360,1361],{},"SHA256, jeśli źródło go dostarcza",[524,1363,1364,1368,1370,1372],{},[539,1365,1366],{},[472,1367,940],{},[539,1369,991],{},[539,1371,1030],{},[539,1373,1374,1375,1001,1377],{},"Czytelny komunikat zdarzenia ",[999,1376],{},[472,1378,1379],{},"An account failed to log on.",[524,1381,1382,1387,1390,1392],{},[539,1383,1384],{},[472,1385,1386],{},"fields",[539,1388,1389],{},"map",[539,1391],{},[539,1393,1394],{},"Każde pole wyemitowane przez źródło, które nie ma nazwy kanonicznej, pod własnym kluczem źródła",[524,1396,1397,1402,1404,1406],{},[539,1398,1399],{},[472,1400,1401],{},"raw",[539,1403,991],{},[539,1405],{},[539,1407,1408],{},"Oryginalny dokument zdarzenia, zachowany dosłownie na potrzeby analizy śledczej",[524,1410,1411,1415,1417,1419],{},[539,1412,1413],{},[472,1414,958],{},[539,1416,991],{},[539,1418,1030],{},[539,1420,1421,1422,1001,1424],{},"Kanał dziennika zdarzeń Windows ",[999,1423],{},[472,1425,1426],{},"Microsoft-Windows-Sysmon\u002FOperational",[524,1428,1429,1434,1436,1438],{},[539,1430,1431],{},[472,1432,1433],{},"winlog.provider",[539,1435,991],{},[539,1437,1030],{},[539,1439,1440,1441,1001,1443],{},"Nazwa dostawcy zdarzeń ",[999,1442],{},[472,1444,1445],{},"Microsoft-Windows-Security-Auditing",[524,1447,1448,1453,1455,1457],{},[539,1449,1450],{},[472,1451,1452],{},"log.file.path",[539,1454,991],{},[539,1456,1030],{},[539,1458,1459,1460,1001,1462],{},"Ścieżka pliku, z którego odczytano wiersz logu ",[999,1461],{},[472,1463,1464],{},"\u002Fvar\u002Flog\u002Fauth.log",[524,1466,1467,1472,1474,1476],{},[539,1468,1469],{},[472,1470,1471],{},"log.syslog.facility",[539,1473,991],{},[539,1475,1030],{},[539,1477,1478,1479,1001,1481],{},"Kategoria syslog (facility), pod którą urządzenie zapisało wpis ",[999,1480],{},[472,1482,1483],{},"auth",[524,1485,1486,1491,1493,1495],{},[539,1487,1488],{},[472,1489,1490],{},"log.syslog.appname",[539,1492,991],{},[539,1494,1030],{},[539,1496,1497,1498,1001,1500],{},"APP-NAME syslog (RFC 5424) lub tag przed dwukropkiem ",[999,1499],{},[472,1501,1502],{},"sshd",[524,1504,1505,1510,1512,1514],{},[539,1506,1507],{},[472,1508,1509],{},"log.syslog.procid",[539,1511,991],{},[539,1513],{},[539,1515,1516],{},"PROCID syslog; pid nadawcy jako tekst, dokładnie w takiej postaci, w jakiej go zapisał",[524,1518,1519,1524,1526,1528],{},[539,1520,1521],{},[472,1522,1523],{},"splunk.sourcetype",[539,1525,991],{},[539,1527,1030],{},[539,1529,1530,1531,1001,1533],{},"Sourcetype Splunk z koperty HEC ",[999,1532],{},[472,1534,1535],{},"cisco:asa",[524,1537,1538,1542,1544,1546],{},[539,1539,1540],{},[472,1541,649],{},[539,1543,991],{},[539,1545,1030],{},[539,1547,1548,1549,1001,1551],{},"Pełny wiersz poleceń procesu; Sysmon 1, Security 4688 lub odtworzony z rekordu EXECVE auditd ",[999,1550],{},[472,1552,1553],{},"powershell -enc SQBFAFgA…",[524,1555,1556,1560,1562,1564],{},[539,1557,1558],{},[472,1559,858],{},[539,1561,991],{},[539,1563,1030],{},[539,1565,1566],{},"Wiersz poleceń procesu nadrzędnego",[524,1568,1569,1574,1576,1578],{},[539,1570,1571],{},[472,1572,1573],{},"process.name",[539,1575,991],{},[539,1577,1030],{},[539,1579,1580,1581,1001,1583],{},"Krótka nazwa polecenia widziana przez jądro (auditd comm=); nazwa bazowa, podczas gdy process.executable to pełna ścieżka ",[999,1582],{},[472,1584,1585],{},"sh",[524,1587,1588,1593,1595,1597],{},[539,1589,1590],{},[472,1591,1592],{},"process.title",[539,1594,991],{},[539,1596,1030],{},[539,1598,1599],{},"Obcięte przez jądro argv; wartość zastępcza, gdy brak rekordu EXECVE",[524,1601,1602,1606,1608,1610],{},[539,1603,1604],{},[472,1605,879],{},[539,1607,991],{},[539,1609,1030],{},[539,1611,1612],{},"Katalog roboczy w chwili startu procesu (Sysmon) lub wywołania systemowego (auditd)",[524,1614,1615,1620,1622,1624],{},[539,1616,1617],{},[472,1618,1619],{},"process.integrity_level",[539,1621,991],{},[539,1623,1030],{},[539,1625,1626,1627,1001,1629],{},"Poziom integralności procesu ",[999,1628],{},[472,1630,1631],{},"High",[524,1633,1634,1639,1641,1643],{},[539,1635,1636],{},[472,1637,1638],{},"process.args_count",[539,1640,1120],{},[539,1642],{},[539,1644,1645,1646,1001,1648],{},"Liczba argumentów execve (auditd EXECVE argc=) ",[999,1647],{},[472,1649,1650],{},"3",[524,1652,1653,1658,1660,1662],{},[539,1654,1655],{},[472,1656,1657],{},"process.creator.entity_id",[539,1659,991],{},[539,1661],{},[539,1663,1664,1665,1001,1667],{},"Proces, który według jądra faktycznie utworzył ten proces; różni się od procesu nadrzędnego dokładnie wtedy, gdy PPID został podrobiony ",[999,1666],{},[472,1668,1289],{},[524,1670,1671,1676,1678,1680],{},[539,1672,1673],{},[472,1674,1675],{},"process.creator.pid",[539,1677,1120],{},[539,1679],{},[539,1681,1682,1683,1001,1685],{},"Pid procesu tworzącego, gdy zgłoszony rodzic może być fałszywy ",[999,1684],{},[472,1686,1687],{},"4",[524,1689,1690,1695,1697,1699],{},[539,1691,1692],{},[472,1693,1694],{},"process.creator.executable",[539,1696,991],{},[539,1698,1030],{},[539,1700,1701,1702,1001,1704],{},"Obraz procesu, który faktycznie utworzył ten proces; zapisywany tylko, gdy różni się od procesu nadrzędnego, a brak oznacza, że to ten sam proces ",[999,1703],{},[472,1705,1706],{},"C:\\Windows\\System32\\svchost.exe",[524,1708,1709,1714,1717,1719],{},[539,1710,1711],{},[472,1712,1713],{},"process.creator.mismatch",[539,1715,1716],{},"boolean",[539,1718],{},[539,1720,1721,1722,1001,1724],{},"True, gdy proces tworzący nie jest zgłoszonym procesem nadrzędnym; podrobienie PPID tego nie ukryje, ale sama niezgodność nie przesądza o zagrożeniu ",[999,1723],{},[472,1725,1726],{},"true",[524,1728,1729,1734,1736,1738],{},[539,1730,1731],{},[472,1732,1733],{},"process.creator.broker",[539,1735,1716],{},[539,1737],{},[539,1739,1740,1741,1001,1743],{},"True, gdy niezgodność wynika ze znanej, legalnej zmiany procesu nadrzędnego, a nie z podrobienia ",[999,1742],{},[472,1744,1726],{},[524,1746,1747,1752,1754,1756],{},[539,1748,1749],{},[472,1750,1751],{},"process.creator.resolved",[539,1753,1716],{},[539,1755],{},[539,1757,1758,1759,1001,1761],{},"False, gdy proces tworzący udało się zidentyfikować tylko po pid ",[999,1760],{},[472,1762,1763],{},"false",[524,1765,1766,1771,1773,1775],{},[539,1767,1768],{},[472,1769,1770],{},"process.start_key",[539,1772,991],{},[539,1774],{},[539,1776,1777,1778,1001,1780],{},"Klucz startu procesu, w odróżnieniu od pid unikalny przez cały czas od uruchomienia systemu ",[999,1779],{},[472,1781,1782],{},"91000",[524,1784,1785,1790,1792,1794],{},[539,1786,1787],{},[472,1788,1789],{},"process.parent.start_key",[539,1791,991],{},[539,1793],{},[539,1795,1796,1797,1001,1799],{},"Klucz startu zgłoszonego procesu nadrzędnego, pozwalający wykryć ponowne użycie pid ",[999,1798],{},[472,1800,1801],{},"70000",[524,1803,1804,1809,1811,1813],{},[539,1805,1806],{},[472,1807,1808],{},"process.exit_code",[539,1810,991],{},[539,1812],{},[539,1814,1815,1816,1001,1818],{},"Kod wyjścia, z jakim proces się zakończył, według jądra ",[999,1817],{},[472,1819,1820],{},"0",[524,1822,1823,1828,1830,1832],{},[539,1824,1825],{},[472,1826,1827],{},"process.exit_signal",[539,1829,991],{},[539,1831],{},[539,1833,1834,1835,1001,1837],{},"Sygnał, który zakończył proces, jeśli taki był ",[999,1836],{},[472,1838,1839],{},"SIGKILL",[524,1841,1842,1847,1849,1851],{},[539,1843,1844],{},[472,1845,1846],{},"process.parent.attested",[539,1848,1716],{},[539,1850],{},[539,1852,1853,1854,1001,1856],{},"True, gdy system operacyjny potwierdził proces nadrzędny w chwili startu procesu ",[999,1855],{},[472,1857,1726],{},[524,1859,1860,1865,1867,1869],{},[539,1861,1862],{},[472,1863,1864],{},"process.args_truncated",[539,1866,1716],{},[539,1868],{},[539,1870,1871,1872,1001,1874],{},"True, gdy wiersz poleceń był zbyt długi, by zapisać go w całości ",[999,1873],{},[472,1875,1726],{},[524,1877,1878,1883,1885,1887],{},[539,1879,1880],{},[472,1881,1882],{},"process.executable_partial",[539,1884,1716],{},[539,1886],{},[539,1888,1889,1890,1001,1892],{},"True, gdy nie udało się ustalić pełnej ścieżki pliku wykonywalnego ",[999,1891],{},[472,1893,1726],{},[524,1895,1896,1901,1903,1905],{},[539,1897,1898],{},[472,1899,1900],{},"winlog.process.granted_access",[539,1902,991],{},[539,1904,1030],{},[539,1906,1907,1908,1001,1910],{},"Maska dostępu, której zażądał proces otwierający, w postaci zapisanej przez Sysmon 10; tekst szesnastkowy, więc testy bitów wymagają winlog.process.create_access ",[999,1909],{},[472,1911,1912],{},"0x1010",[524,1914,1915,1920,1922,1924],{},[539,1916,1917],{},[472,1918,1919],{},"winlog.process.create_access",[539,1921,1716],{},[539,1923,1030],{},[539,1925,1926,1927,1001,1929],{},"True, gdy maska dostępu Sysmon 10 zawiera PROCESS_CREATE_PROCESS (0x0080); wyliczane podczas przyjmowania danych, bo reguła nie może testować bitów w ciągu szesnastkowym ",[999,1928],{},[472,1930,1726],{},[524,1932,1933,1937,1939,1941],{},[539,1934,1935],{},[472,1936,474],{},[539,1938,991],{},[539,1940,1030],{},[539,1942,1943,1944,1001,1946],{},"Plik, na którym wykonano działanie; TargetFilename z Sysmon 11, Path z Defendera lub rekord PATH z auditd ",[999,1945],{},[472,1947,1948],{},"\u002Fetc\u002Fshadow",[524,1950,1951,1956,1958,1960],{},[539,1952,1953],{},[472,1954,1955],{},"file.paths",[539,1957,991],{},[539,1959,1030],{},[539,1961,1962],{},"Każda ścieżka rozwiązana przez wywołanie systemowe, w kolejności",[524,1964,1965,1970,1972,1974],{},[539,1966,1967],{},[472,1968,1969],{},"file.mode",[539,1971,991],{},[539,1973],{},[539,1975,1976,1977,1001,1979],{},"Bity uprawnień dotkniętego pliku ",[999,1978],{},[472,1980,1981],{},"0100755",[524,1983,1984,1989,1991,1993],{},[539,1985,1986],{},[472,1987,1988],{},"file.inode",[539,1990,991],{},[539,1992],{},[539,1994,1995],{},"I-węzeł dotkniętego pliku; pozwala odróżnić nadpisanie od podmiany",[524,1997,1998,2003,2005,2007],{},[539,1999,2000],{},[472,2001,2002],{},"file.owner.id",[539,2004,991],{},[539,2006],{},[539,2008,2009,2010,1001,2012],{},"Uid właściciela dotkniętego pliku (auditd PATH ouid=) ",[999,2011],{},[472,2013,1820],{},[524,2015,2016,2021,2023,2025],{},[539,2017,2018],{},[472,2019,2020],{},"file.share.name",[539,2022,991],{},[539,2024,1030],{},[539,2026,2027,2028,1001,2030],{},"Udział SMB, którego dotyczyło zdarzenie (5140\u002F5145) ",[999,2029],{},[472,2031,2032],{},"\\\\*\\ADMIN$",[524,2034,2035,2040,2042,2044],{},[539,2036,2037],{},[472,2038,2039],{},"dll.path",[539,2041,991],{},[539,2043,1030],{},[539,2045,2046],{},"Załadowana biblioteka DLL lub obraz (Sysmon 7)",[524,2048,2049,2054,2056,2058],{},[539,2050,2051],{},[472,2052,2053],{},"dll.code_signature.signed",[539,2055,1716],{},[539,2057,1030],{},[539,2059,2060,2061,1001,2063],{},"Stan podpisu obrazu (Sysmon 7) ",[999,2062],{},[472,2064,1726],{},[524,2066,2067,2072,2074,2076],{},[539,2068,2069],{},[472,2070,2071],{},"registry.path",[539,2073,991],{},[539,2075,1030],{},[539,2077,2078],{},"Zapisany klucz lub wartość rejestru (Sysmon 13)",[524,2080,2081,2086,2088,2090],{},[539,2082,2083],{},[472,2084,2085],{},"destination.domain",[539,2087,991],{},[539,2089,1030],{},[539,2091,2092],{},"Rozwiązana nazwa hosta docelowego",[524,2094,2095,2100,2102,2104],{},[539,2096,2097],{},[472,2098,2099],{},"network.transport",[539,2101,991],{},[539,2103,1030],{},[539,2105,2106,2107,1001,2109],{},"Protokół transportowy ",[999,2108],{},[472,2110,2111],{},"tcp",[524,2113,2114,2119,2121,2123],{},[539,2115,2116],{},[472,2117,2118],{},"network.type",[539,2120,991],{},[539,2122,1030],{},[539,2124,2125],{},"Rodzina gniazd, do której kierowane było połączenie: ipv4, ipv6, unix",[524,2127,2128,2133,2135,2137],{},[539,2129,2130],{},[472,2131,2132],{},"network.socket.path",[539,2134,991],{},[539,2136,1030],{},[539,2138,2139],{},"Ścieżka gniazda uniksowego dla zdarzeń ipc_connect",[524,2141,2142,2147,2149,2151],{},[539,2143,2144],{},[472,2145,2146],{},"dns.answers",[539,2148,991],{},[539,2150,1030],{},[539,2152,2153],{},"Odpowiedzi DNS (Sysmon 22)",[524,2155,2156,2161,2163,2165],{},[539,2157,2158],{},[472,2159,2160],{},"network.direction",[539,2162,991],{},[539,2164,1030],{},[539,2166,2167,2168,1001,2170],{},"Kierunek przepływu: inbound, outbound lub internal ",[999,2169],{},[472,2171,2172],{},"outbound",[524,2174,2175,2180,2182,2184],{},[539,2176,2177],{},[472,2178,2179],{},"network.bytes_sent",[539,2181,1120],{},[539,2183],{},[539,2185,2186,2187,1001,2189],{},"Bajty wysłane przez stację w tym przepływie; pozwalają odróżnić beaconing od wycieku danych i przypisać ruch do procesu, czego nie da log firewalla ",[999,2188],{},[472,2190,2191],{},"4096",[524,2193,2194,2199,2201,2203],{},[539,2195,2196],{},[472,2197,2198],{},"network.bytes_received",[539,2200,1120],{},[539,2202],{},[539,2204,2205,2206,1001,2208],{},"Bajty odebrane przez stację w tym przepływie ",[999,2207],{},[472,2209,2210],{},"182000",[524,2212,2213,2218,2220,2222],{},[539,2214,2215],{},[472,2216,2217],{},"network.packets",[539,2219,1120],{},[539,2221],{},[539,2223,2224,2225,1001,2227],{},"Liczba pakietów w przepływie ",[999,2226],{},[472,2228,2229],{},"210",[524,2231,2232,2237,2239,2241],{},[539,2233,2234],{},[472,2235,2236],{},"event.duration_ms",[539,2238,1120],{},[539,2240],{},[539,2242,2243,2244,1001,2246],{},"Czas trwania obserwowanej operacji lub przepływu w milisekundach ",[999,2245],{},[472,2247,2248],{},"61000",[524,2250,2251,2255,2257,2259],{},[539,2252,2253],{},[472,2254,681],{},[539,2256,991],{},[539,2258,1030],{},[539,2260,2261,2262,1001,2264],{},"Konto, na którym wykonano działanie: cel logowania, acct= z auditd, tożsamość, którą sudo miało przyjąć ",[999,2263],{},[472,2265,2266],{},"Administrator",[524,2268,2269,2274,2276,2278],{},[539,2270,2271],{},[472,2272,2273],{},"user.effective.name",[539,2275,991],{},[539,2277,1030],{},[539,2279,2280,2281,1001,2283],{},"Konto, które otworzyło sesję w imieniu celu (PAM „by \u003Cuser>”) ",[999,2282],{},[472,2284,1166],{},[524,2286,2287,2292,2294,2296],{},[539,2288,2289],{},[472,2290,2291],{},"user.full_name",[539,2293,991],{},[539,2295,1030],{},[539,2297,2298,2299,1001,2301],{},"Nazwa wyświetlana konta wykonującego działanie (Okta\u002FEntra) ",[999,2300],{},[472,2302,2303],{},"Jane Doe",[524,2305,2306,2311,2313,2315],{},[539,2307,2308],{},[472,2309,2310],{},"user.type",[539,2312,991],{},[539,2314,1030],{},[539,2316,2317,2318,1001,2320],{},"Rodzaj podmiotu wykonującego działanie: User, SystemPrincipal, Application ",[999,2319],{},[472,2321,2322],{},"User",[524,2324,2325,2330,2332,2334],{},[539,2326,2327],{},[472,2328,2329],{},"user_agent.original",[539,2331,991],{},[539,2333,1030],{},[539,2335,2336,2337,1001,2339],{},"Ciąg user-agent wysłany przez klienta ",[999,2338],{},[472,2340,2341],{},"Mozilla\u002F5.0 …",[524,2343,2344,2349,2351,2353],{},[539,2345,2346],{},[472,2347,2348],{},"source.geo.name",[539,2350,991],{},[539,2352,1030],{},[539,2354,2355,2356,1001,2358],{},"Lokalizacja adresu źródłowego według dostawcy ",[999,2357],{},[472,2359,2360],{},"Warsaw, PL",[524,2362,2363,2368,2370,2372],{},[539,2364,2365],{},[472,2366,2367],{},"user.domain",[539,2369,991],{},[539,2371,1030],{},[539,2373,2374],{},"Domena konta docelowego",[524,2376,2377,2382,2384,2386],{},[539,2378,2379],{},[472,2380,2381],{},"user.id",[539,2383,991],{},[539,2385],{},[539,2387,2388],{},"Identyfikator użytkownika obowiązujący przy wywołaniu systemowym (liczbowy, chyba że auditd działa w trybie ENRICHED)",[524,2390,2391,2396,2398,2400],{},[539,2392,2393],{},[472,2394,2395],{},"user.group.id",[539,2397,991],{},[539,2399],{},[539,2401,2402],{},"Identyfikator grupy przy wywołaniu systemowym",[524,2404,2405,2410,2412,2414],{},[539,2406,2407],{},[472,2408,2409],{},"user.effective.id",[539,2411,991],{},[539,2413],{},[539,2415,2416,2417,1001,2419],{},"Efektywny uid; różni się od user.id dokładnie wtedy, gdy uruchomiono coś z setuid ",[999,2418],{},[472,2420,1820],{},[524,2422,2423,2428,2430,2432],{},[539,2424,2425],{},[472,2426,2427],{},"user.effective.group.id",[539,2429,991],{},[539,2431],{},[539,2433,2434],{},"Efektywny identyfikator grupy przy wywołaniu systemowym",[524,2436,2437,2441,2443,2445],{},[539,2438,2439],{},[472,2440,696],{},[539,2442,991],{},[539,2444],{},[539,2446,2447,2448,1001,2450],{},"Uid logowania; przetrwa su\u002Fsudo, więc wskazuje, kto naprawdę działa ",[999,2449],{},[472,2451,2452],{},"1000",[524,2454,2455,2460,2462,2464],{},[539,2456,2457],{},[472,2458,2459],{},"winlog.session_id",[539,2461,991],{},[539,2463],{},[539,2465,2466,2467,1001,2469],{},"Sesja Windows, w której działa proces; 0 to usługi, 1 użytkownik konsoli; proces z sesji usług uruchamiający proces interaktywny jest wart sprawdzenia ",[999,2468],{},[472,2470,2471],{},"1",[524,2473,2474,2479,2481,2483],{},[539,2475,2476],{},[472,2477,2478],{},"winlog.logon.type",[539,2480,1120],{},[539,2482],{},[539,2484,2485,2486,1001,2488],{},"Typ logowania Windows: 2 interaktywne, 3 sieciowe, 10 RDP… ",[999,2487],{},[472,2489,2490],{},"10",[524,2492,2493,2498,2500,2502],{},[539,2494,2495],{},[472,2496,2497],{},"winlog.logon.id",[539,2499,991],{},[539,2501,1030],{},[539,2503,2504,2505,1001,2507],{},"Identyfikator logowania utworzonej sesji; łączy logowanie ze wszystkim, co zrobiono w jego ramach ",[999,2506],{},[472,2508,2509],{},"0x3e7",[524,2511,2512,2517,2519,2521],{},[539,2513,2514],{},[472,2515,2516],{},"winlog.logon.subject_id",[539,2518,991],{},[539,2520,1030],{},[539,2522,2523],{},"Identyfikator logowania sesji, która zażądała operacji",[524,2525,2526,2531,2533,2535],{},[539,2527,2528],{},[472,2529,2530],{},"winlog.logon.process",[539,2532,991],{},[539,2534,1030],{},[539,2536,2537,2538,1001,2540],{},"Proces logowania, który obsłużył uwierzytelnienie ",[999,2539],{},[472,2541,2542],{},"Advapi",[524,2544,2545,2550,2552,2554],{},[539,2546,2547],{},[472,2548,2549],{},"winlog.logon.authentication_package",[539,2551,991],{},[539,2553,1030],{},[539,2555,2556],{},"Pakiet uwierzytelniania (NTLM, Kerberos…)",[524,2558,2559,2564,2566,2568],{},[539,2560,2561],{},[472,2562,2563],{},"winlog.logon.workstation",[539,2565,991],{},[539,2567,1030],{},[539,2569,2570],{},"Stacja robocza, z której nastąpiło logowanie",[524,2572,2573,2578,2580,2582],{},[539,2574,2575],{},[472,2576,2577],{},"winlog.kerberos.ticket_encryption",[539,2579,991],{},[539,2581,1030],{},[539,2583,2584,2585,1001,2587],{},"Typ szyfrowania biletu Kerberos (4769); 0x17 to RC4, do którego obniża szyfrowanie Kerberoasting ",[999,2586],{},[472,2588,2589],{},"0x17",[524,2591,2592,2597,2599,2601],{},[539,2593,2594],{},[472,2595,2596],{},"winlog.privileges",[539,2598,991],{},[539,2600,1030],{},[539,2602,2603,2604,1001,2606],{},"Przypisane lub użyte uprawnienia (4672\u002F4673) ",[999,2605],{},[472,2607,2608],{},"SeDebugPrivilege",[524,2610,2611,2616,2618,2620],{},[539,2612,2613],{},[472,2614,2615],{},"winlog.status",[539,2617,991],{},[539,2619,1030],{},[539,2621,2622,2623,1001,2625],{},"Kod stanu NT operacji ",[999,2624],{},[472,2626,2627],{},"0xc000006d",[524,2629,2630,2634,2636,2638],{},[539,2631,2632],{},[472,2633,711],{},[539,2635,991],{},[539,2637,1030],{},[539,2639,2640,2641,2645,2646,1001,2648],{},"Czy operacja się powiodła; success= z auditd przy wywołaniu systemowym, res= w rekordzie USER_",[2642,2643,2644],"em",{},"\u002FCRED_",", wynik z Okta\u002FEntra ",[999,2647],{},[472,2649,2650],{},"yes",[524,2652,2653,2658,2660,2662],{},[539,2654,2655],{},[472,2656,2657],{},"event.reason",[539,2659,991],{},[539,2661,1030],{},[539,2663,2664,2665,1001,2667],{},"Dlaczego operacja zakończyła się w ten sposób, słowami dostawcy ",[999,2666],{},[472,2668,2669],{},"Invalid username or password",[524,2671,2672,2677,2679,2681],{},[539,2673,2674],{},[472,2675,2676],{},"event.id",[539,2678,991],{},[539,2680],{},[539,2682,2683,2684,1001,2686],{},"Własny unikalny identyfikator zdarzenia nadany przez dostawcę; różny od event.code, który jest liczbowym rodzajem zdarzenia ",[999,2685],{},[472,2687,2688],{},"9f1c…",[524,2690,2691,2696,2698,2700],{},[539,2692,2693],{},[472,2694,2695],{},"event.action",[539,2697,991],{},[539,2699,1030],{},[539,2701,2702,2703,1001,2705],{},"Działanie naprawcze wykonane przez produkt (Defender) ",[999,2704],{},[472,2706,2707],{},"Quarantine",[524,2709,2710,2714,2716,2718],{},[539,2711,2712],{},[472,2713,726],{},[539,2715,991],{},[539,2717,1030],{},[539,2719,2720,2721,1001,2723],{},"Nazwa detekcji Defendera ",[999,2722],{},[472,2724,2725],{},"Trojan:Win32\u002FWacatac.B!ml",[524,2727,2728,2733,2735,2737],{},[539,2729,2730],{},[472,2731,2732],{},"threat.category",[539,2734,991],{},[539,2736,1030],{},[539,2738,2739],{},"Kategoria zagrożenia według Defendera",[524,2741,2742,2747,2749,2751],{},[539,2743,2744],{},[472,2745,2746],{},"service.name",[539,2748,991],{},[539,2750,1030],{},[539,2752,2753],{},"Zainstalowana lub zmieniona usługa (7045\u002F4697)",[524,2755,2756,2761,2763,2765],{},[539,2757,2758],{},[472,2759,2760],{},"service.executable",[539,2762,991],{},[539,2764,1030],{},[539,2766,2767],{},"Ścieżka pliku wykonywalnego usługi (7045)",[524,2769,2770,2775,2777,2779],{},[539,2771,2772],{},[472,2773,2774],{},"service.unit",[539,2776,991],{},[539,2778,1030],{},[539,2780,2781,2782,1001,2784],{},"Jednostka systemd wskazana w rekordzie audytu ",[999,2783],{},[472,2785,2786],{},"sshd.service",[524,2788,2789,2794,2796,2798],{},[539,2790,2791],{},[472,2792,2793],{},"device.instance_id",[539,2795,991],{},[539,2797,1030],{},[539,2799,2800,2801,1001,2803],{},"Identyfikator instancji podłączanego urządzenia (Kernel-PnP) ",[999,2802],{},[472,2804,2805],{},"USBSTOR\\Disk&Ven_Kingston&Prod_DataTraveler\\0019E06B1234&0",[524,2807,2808,2813,2815,2817],{},[539,2809,2810],{},[472,2811,2812],{},"device.driver",[539,2814,991],{},[539,2816],{},[539,2818,2819],{},"Sterownik lub usługa, która przejęła podłączane urządzenie",[524,2821,2822,2827,2829,2831],{},[539,2823,2824],{},[472,2825,2826],{},"device.class",[539,2828,991],{},[539,2830],{},[539,2832,2833,2834,1001,2836],{},"Klasa instalacji podłączanego urządzenia ",[999,2835],{},[472,2837,2838],{},"DiskDrive",[524,2840,2841,2846,2848,2850],{},[539,2842,2843],{},[472,2844,2845],{},"device.storage",[539,2847,1716],{},[539,2849],{},[539,2851,2852],{},"true, gdy podłączane urządzenie jest pamięcią masową; odpowiada na częste pytanie o nośniki wymienne",[524,2854,2855,2860,2862,2864],{},[539,2856,2857],{},[472,2858,2859],{},"device.port",[539,2861,991],{},[539,2863],{},[539,2865,2866,2867,1001,2869],{},"Port magistrali USB, na którym wykryto urządzenie (wiersz jądra Linuksa) ",[999,2868],{},[472,2870,2871],{},"1-1.4",[524,2873,2874,2879,2881,2883],{},[539,2875,2876],{},[472,2877,2878],{},"device.vendor",[539,2880,991],{},[539,2882],{},[539,2884,2885,2886,1001,2888],{},"idVendor USB podłączanego urządzenia, w postaci wypisanej przez jądro ",[999,2887],{},[472,2889,2890],{},"0951",[524,2892,2893,2898,2900,2902],{},[539,2894,2895],{},[472,2896,2897],{},"device.product",[539,2899,991],{},[539,2901],{},[539,2903,2904,2905,1001,2907],{},"idProduct USB podłączanego urządzenia, w postaci wypisanej przez jądro ",[999,2906],{},[472,2908,2909],{},"1666",[524,2911,2912,2917,2919,2921],{},[539,2913,2914],{},[472,2915,2916],{},"service.start_type",[539,2918,991],{},[539,2920],{},[539,2922,2923,2924,1001,2926],{},"Obecny typ uruchamiania usługi (SCM 7045\u002F7040) ",[999,2925],{},[472,2927,2928],{},"auto start",[524,2930,2931,2936,2938,2940],{},[539,2932,2933],{},[472,2934,2935],{},"service.start_type_old",[539,2937,991],{},[539,2939],{},[539,2941,2942],{},"Typ uruchamiania usługi przed zmianą 7040",[524,2944,2945,2950,2952,2954],{},[539,2946,2947],{},[472,2948,2949],{},"service.account",[539,2951,991],{},[539,2953,1030],{},[539,2955,2956,2957,1001,2959],{},"Konto, na którym działa nowo zainstalowana usługa ",[999,2958],{},[472,2960,2961],{},"LocalSystem",[524,2963,2964,2969,2971,2973],{},[539,2965,2966],{},[472,2967,2968],{},"winlog.task_name",[539,2970,991],{},[539,2972,1030],{},[539,2974,2975],{},"Zarejestrowane lub zaktualizowane zaplanowane zadanie (106\u002F140)",[524,2977,2978,2982,2984,2986],{},[539,2979,2980],{},[472,2981,741],{},[539,2983,991],{},[539,2985,1030],{},[539,2987,2988],{},"Zalogowany blok skryptu PowerShell (4104)",[524,2990,2991,2996,2998,3000],{},[539,2992,2993],{},[472,2994,2995],{},"entra.application",[539,2997,991],{},[539,2999,1030],{},[539,3001,3002,3003,1001,3005],{},"Aplikacja, do której nastąpiło logowanie ",[999,3004],{},[472,3006,3007],{},"Office 365 Exchange Online",[524,3009,3010,3015,3017,3019],{},[539,3011,3012],{},[472,3013,3014],{},"entra.client_app",[539,3016,991],{},[539,3018,1030],{},[539,3020,3021,3022,1001,3024],{},"Typ aplikacji klienckiej użytej przy logowaniu; tu widać starsze protokoły ",[999,3023],{},[472,3025,3026],{},"Browser",[524,3028,3029,3034,3036,3038],{},[539,3030,3031],{},[472,3032,3033],{},"entra.category",[539,3035,991],{},[539,3037,1030],{},[539,3039,3040,3041,1001,3043],{},"Kategoria audytu katalogu według nazewnictwa Entra ",[999,3042],{},[472,3044,3045],{},"UserManagement",[524,3047,3048,3053,3055,3057],{},[539,3049,3050],{},[472,3051,3052],{},"dns.question.type",[539,3054,991],{},[539,3056,1030],{},[539,3058,3059,3060,1001,3062],{},"Typ rekordu, o który pytano: A, AAAA, CNAME, TXT… ",[999,3061],{},[472,3063,3064],{},"AAAA",[524,3066,3067,3072,3074,3076],{},[539,3068,3069],{},[472,3070,3071],{},"dns.response_code",[539,3073,991],{},[539,3075,1030],{},[539,3077,3078,3079,1001,3081],{},"Stan odpowiedzi: NOERROR, NXDOMAIN, SERVFAIL, REFUSED, TIMEOUT ",[999,3080],{},[472,3082,3083],{},"NXDOMAIN",[524,3085,3086,3091,3093,3095],{},[539,3087,3088],{},[472,3089,3090],{},"dns.answers.cname",[539,3092,991],{},[539,3094,1030],{},[539,3096,3097],{},"Aliasy CNAME w odpowiedzi, oddzielone od adresów, aby reguła na dns.answers dopasowywała tylko adresy",[524,3099,3100,3105,3107,3109],{},[539,3101,3102],{},[472,3103,3104],{},"dns.server",[539,3106,991],{},[539,3108],{},[539,3110,3111],{},"Serwer DNS, do którego trafiło zapytanie (ServerList z DNS-Client w Windows)",[524,3113,3114,3119,3121,3123],{},[539,3115,3116],{},[472,3117,3118],{},"dns.id",[539,3120,991],{},[539,3122],{},[539,3124,3125],{},"Identyfikator transakcji komunikatu DNS, łączący zapytanie z odpowiedzią",[524,3127,3128,3133,3135,3137],{},[539,3129,3130],{},[472,3131,3132],{},"dns.partial",[539,3134,1716],{},[539,3136],{},[539,3138,3139],{},"True, gdy odpowiedź DNS zapisano częściowo",[524,3141,3142,3147,3149,3151],{},[539,3143,3144],{},[472,3145,3146],{},"network.flow.state",[539,3148,991],{},[539,3150,1030],{},[539,3152,3153,3154,1001,3156],{},"open dla rekordu minutowego wciąż trwającego połączenia, closed dla ostatniego ",[999,3155],{},[472,3157,3158],{},"closed",[524,3160,3161,3166,3168,3170],{},[539,3162,3163],{},[472,3164,3165],{},"network.flow.continued",[539,3167,1716],{},[539,3169],{},[539,3171,3172],{},"True w każdym rekordzie przepływu po pierwszym dla tego samego połączenia; liczniki są przyrostowe, więc ich suma daje wartość całkowitą",[524,3174,3175,3180,3182,3184],{},[539,3176,3177],{},[472,3178,3179],{},"network.flow.bytes_total",[539,3181,1716],{},[539,3183],{},[539,3185,3186],{},"True, gdy liczniki bajtów są sumami z całego czasu trwania połączenia",[524,3188,3189,3194,3196,3198],{},[539,3190,3191],{},[472,3192,3193],{},"file.target_path",[539,3195,991],{},[539,3197,1030],{},[539,3199,3200,3201,1001,3203],{},"Nowa ścieżka po zmianie nazwy lub utworzeniu łącza ",[999,3202],{},[472,3204,3205],{},"C:\\Users\\j.doe\\Downloads\\payload.exe",[524,3207,3208,3213,3215,3217],{},[539,3209,3210],{},[472,3211,3212],{},"file.extension",[539,3214,991],{},[539,3216,1030],{},[539,3218,3219,3220,1001,3222],{},"Rozszerzenie pliku, na którym wykonano działanie, bez kropki ",[999,3221],{},[472,3223,3224],{},"vbs",[524,3226,3227,3232,3234,3236],{},[539,3228,3229],{},[472,3230,3231],{},"file.extension_changed",[539,3233,1716],{},[539,3235],{},[539,3237,3238],{},"True, gdy zmiana nazwy zmieniła rozszerzenie; typowy krok przygotowania ataku (payload.txt → payload.exe)",[524,3240,3241,3246,3248,3250],{},[539,3242,3243],{},[472,3244,3245],{},"file.name",[539,3247,991],{},[539,3249,1030],{},[539,3251,3252,3253,1001,3255],{},"Nazwa bazowa pliku, na którym wykonano działanie ",[999,3254],{},[472,3256,3257],{},"update.vbs",[524,3259,3260,3265,3267,3269],{},[539,3261,3262],{},[472,3263,3264],{},"file.directory",[539,3266,991],{},[539,3268,1030],{},[539,3270,3271],{},"Katalog pliku, na którym wykonano działanie",[524,3273,3274,3279,3281,3283],{},[539,3275,3276],{},[472,3277,3278],{},"file.alternate_stream",[539,3280,1716],{},[539,3282],{},[539,3284,3285],{},"True, gdy ścieżka wskazuje alternatywny strumień danych NTFS; takiego zapisu nie widać w zwykłej liście plików katalogu",[524,3287,3288,3293,3295,3297],{},[539,3289,3290],{},[472,3291,3292],{},"file.write_bytes",[539,3294,1120],{},[539,3296],{},[539,3298,3299],{},"Bajty pierwszego zapisu przez uchwyt w minucie objętej rekordem",[524,3301,3302,3307,3309,3311],{},[539,3303,3304],{},[472,3305,3306],{},"file.truncated",[539,3308,1716],{},[539,3310],{},[539,3312,3313],{},"True, gdy otwarcie obcięło plik (O_TRUNC)",[524,3315,3316,3321,3323,3325],{},[539,3317,3318],{},[472,3319,3320],{},"file.path_partial",[539,3322,1716],{},[539,3324],{},[539,3326,3327],{},"True, gdy ścieżka jest względna wobec systemu plików, a nie bezwzględna",[524,3329,3330,3335,3337,3339],{},[539,3331,3332],{},[472,3333,3334],{},"file.path_truncated",[539,3336,1716],{},[539,3338],{},[539,3340,3341],{},"True, gdy ścieżka była zbyt długa, by zapisać ją w całości",[524,3343,3344,3349,3351,3353],{},[539,3345,3346],{},[472,3347,3348],{},"registry.key",[539,3350,991],{},[539,3352,1030],{},[539,3354,3355,3356,1001,3358],{},"Klucz zapisu w rejestrze, bez nazwy wartości ",[999,3357],{},[472,3359,3360],{},"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",[524,3362,3363,3368,3370,3372],{},[539,3364,3365],{},[472,3366,3367],{},"registry.value",[539,3369,991],{},[539,3371,1030],{},[539,3373,3374,3375,1001,3377],{},"Nazwa wartości zapisu w rejestrze ",[999,3376],{},[472,3378,3379],{},"Updater",[524,3381,3382,3387,3389,3391],{},[539,3383,3384],{},[472,3385,3386],{},"registry.data",[539,3388,991],{},[539,3390,1030],{},[539,3392,3393],{},"Zapisane dane w postaci przedstawionej przez dostawcę, z limitem 512 bajtów",[524,3395,3396,3401,3403,3405],{},[539,3397,3398],{},[472,3399,3400],{},"registry.data_type",[539,3402,991],{},[539,3404,1030],{},[539,3406,3407,3408,1001,3410],{},"Typ REG_* zapisanej wartości ",[999,3409],{},[472,3411,3412],{},"REG_SZ",[524,3414,3415,3420,3422,3424],{},[539,3416,3417],{},[472,3418,3419],{},"registry.data_truncated",[539,3421,1716],{},[539,3423],{},[539,3425,3426],{},"True, gdy registry.data obcięto na limicie",[524,3428,3429,3434,3436,3438],{},[539,3430,3431],{},[472,3432,3433],{},"registry.hive",[539,3435,991],{},[539,3437,1030],{},[539,3439,3440,3441,1001,3443],{},"HKLM lub HKU ",[999,3442],{},[472,3444,3445],{},"HKLM",[524,3447,3448,3453,3455,3457],{},[539,3449,3450],{},[472,3451,3452],{},"registry.path_partial",[539,3454,1716],{},[539,3456],{},[539,3458,3459],{},"True, gdy klucz dało się nazwać tylko względem obiektu nadrzędnego",[524,3461,3462,3467,3469,3471],{},[539,3463,3464],{},[472,3465,3466],{},"dll.base",[539,3468,991],{},[539,3470],{},[539,3472,3473],{},"Adres załadowania obrazu",[524,3475,3476,3481,3483,3485],{},[539,3477,3478],{},[472,3479,3480],{},"dll.size",[539,3482,991],{},[539,3484],{},[539,3486,3487],{},"Rozmiar zmapowanego obrazu",[524,3489,3490,3495,3497,3499],{},[539,3491,3492],{},[472,3493,3494],{},"dll.checksum",[539,3496,991],{},[539,3498],{},[539,3500,3501],{},"Suma kontrolna PE obrazu, według programu ładującego",[524,3503,3504,3509,3511,3513],{},[539,3505,3506],{},[472,3507,3508],{},"dll.timestamp",[539,3510,991],{},[539,3512],{},[539,3514,3515],{},"Znacznik czasu linkowania PE obrazu",[524,3517,3518,3523,3525,3527],{},[539,3519,3520],{},[472,3521,3522],{},"dll.unusual_path",[539,3524,1716],{},[539,3526],{},[539,3528,3529],{},"True, gdy obraz załadowano spoza katalogów systemowych i katalogów programów",[524,3531,3532,3537,3539,3541],{},[539,3533,3534],{},[472,3535,3536],{},"amsi.app",[539,3538,991],{},[539,3540,1030],{},[539,3542,3543],{},"Aplikacja, która przekazała treść do AMSI (host PowerShell, WSH, VBA…)",[524,3545,3546,3550,3552,3554],{},[539,3547,3548],{},[472,3549,759],{},[539,3551,991],{},[539,3553,1030],{},[539,3555,3556],{},"Treść skryptu w postaci przeskanowanej przez dostawcę AMSI; po usunięciu zaciemnienia, z limitem 8 KB",[524,3558,3559,3564,3566,3568],{},[539,3560,3561],{},[472,3562,3563],{},"amsi.content_name",[539,3565,991],{},[539,3567,1030],{},[539,3569,3570],{},"Nazwa lub ścieżka przekazana do AMSI dla treści",[524,3572,3573,3578,3580,3582],{},[539,3574,3575],{},[472,3576,3577],{},"amsi.content_size",[539,3579,1120],{},[539,3581],{},[539,3583,3584],{},"Liczba bajtów przekazanych do skanera",[524,3586,3587,3592,3594,3596],{},[539,3588,3589],{},[472,3590,3591],{},"amsi.result",[539,3593,991],{},[539,3595,1030],{},[539,3597,3598,3599,1001,3601],{},"Werdykt skanera: clean, not_detected, blocked_by_admin, detected ",[999,3600],{},[472,3602,3603],{},"detected",[524,3605,3606,3611,3613,3615],{},[539,3607,3608],{},[472,3609,3610],{},"amsi.hash",[539,3612,991],{},[539,3614],{},[539,3616,3617],{},"Skrót treści zgłoszony przez AMSI",[524,3619,3620,3625,3627,3629],{},[539,3621,3622],{},[472,3623,3624],{},"amsi.content_truncated",[539,3626,1716],{},[539,3628],{},[539,3630,3631],{},"True, gdy amsi.content jest niepełne",[524,3633,3634,3639,3641,3643],{},[539,3635,3636],{},[472,3637,3638],{},"powershell.script_block_id",[539,3640,991],{},[539,3642],{},[539,3644,3645],{},"Identyfikator łączący fragmenty jednego bloku skryptu",[524,3647,3648,3653,3655,3657],{},[539,3649,3650],{},[472,3651,3652],{},"powershell.message_number",[539,3654,1120],{},[539,3656],{},[539,3658,3659],{},"Numer fragmentu bloku skryptu",[524,3661,3662,3667,3669,3671],{},[539,3663,3664],{},[472,3665,3666],{},"powershell.message_total",[539,3668,1120],{},[539,3670],{},[539,3672,3673],{},"Liczba fragmentów bloku skryptu",[524,3675,3676,3681,3683,3685],{},[539,3677,3678],{},[472,3679,3680],{},"powershell.suspicious",[539,3682,1716],{},[539,3684],{},[539,3686,3687],{},"True, gdy blok pasuje do własnej listy podejrzanych treści PowerShell (logowany na poziomie Warning niezależnie od tego, czy włączono Script Block Logging)",[524,3689,3690,3695,3697,3699],{},[539,3691,3692],{},[472,3693,3694],{},"powershell.script_block_truncated",[539,3696,1716],{},[539,3698],{},[539,3700,3701],{},"True, gdy tekst bloku jest niepełny",[524,3703,3704,3709,3711,3713],{},[539,3705,3706],{},[472,3707,3708],{},"powershell.command",[539,3710,991],{},[539,3712,1030],{},[539,3714,3715],{},"Szczegóły wykonania potoku PowerShell (4103)",[524,3717,3718,3723,3725,3727],{},[539,3719,3720],{},[472,3721,3722],{},"powershell.command_truncated",[539,3724,1716],{},[539,3726],{},[539,3728,3729],{},"True, gdy powershell.command obcięto",[524,3731,3732,3737,3739,3741],{},[539,3733,3734],{},[472,3735,3736],{},"wmi.namespace",[539,3738,991],{},[539,3740,1030],{},[539,3742,3743,3744,1001,3746],{},"Przestrzeń nazw WMI operacji lub subskrypcji ",[999,3745],{},[472,3747,3748],{},"\u002F\u002F.\u002Froot\u002Fsubscription",[524,3750,3751,3756,3758,3760],{},[539,3752,3753],{},[472,3754,3755],{},"wmi.filter",[539,3757,991],{},[539,3759,1030],{},[539,3761,3762],{},"Filtr zdarzeń (ESS) trwałej subskrypcji",[524,3764,3765,3770,3772,3774],{},[539,3766,3767],{},[472,3768,3769],{},"wmi.consumer",[539,3771,991],{},[539,3773,1030],{},[539,3775,3776,3777,1001,3779],{},"Konsument trwałej subskrypcji; to, co uruchamia się, gdy filtr zadziała ",[999,3778],{},[472,3780,3781],{},"CommandLineEventConsumer.Name=\"Updater\"",[524,3783,3784,3789,3791,3793],{},[539,3785,3786],{},[472,3787,3788],{},"wmi.possible_cause",[539,3790,991],{},[539,3792,1030],{},[539,3794,3795],{},"Własna uwaga WMI-Activity do zdarzenia subskrypcji",[524,3797,3798,3803,3805,3807],{},[539,3799,3800],{},[472,3801,3802],{},"wmi.operation",[539,3804,991],{},[539,3806,1030],{},[539,3808,3809,3810,1001,3812],{},"Operacja WMI w zapisie kanału Trace ",[999,3811],{},[472,3813,3814],{},"Start IWbemServices::ExecMethod - root\\cimv2 : Win32_Process::Create",[524,3816,3817,3822,3824,3826],{},[539,3818,3819],{},[472,3820,3821],{},"wmi.client_machine",[539,3823,991],{},[539,3825,1030],{},[539,3827,3828],{},"Maszyna, z której połączył się klient WMI; jeśli to inny host, może to oznaczać ruch boczny",[524,3830,3831,3836,3838,3840],{},[539,3832,3833],{},[472,3834,3835],{},"winlog.task_action",[539,3837,991],{},[539,3839,1030],{},[539,3841,3842],{},"Plik wykonywalny uruchomiony przez zaplanowane zadanie (129)",[524,3844,3845,3850,3852,3854],{},[539,3846,3847],{},[472,3848,3849],{},"process.working_directory_partial",[539,3851,1716],{},[539,3853],{},[539,3855,3856],{},"True, gdy nie udało się ustalić pełnego katalogu roboczego",[524,3858,3859,3864,3866,3868],{},[539,3860,3861],{},[472,3862,3863],{},"process.target.pid",[539,3865,1120],{},[539,3867],{},[539,3869,3870],{},"Pid, do którego podłączył się ptrace",[524,3872,3873,3878,3880,3882],{},[539,3874,3875],{},[472,3876,3877],{},"process.target.entity_id",[539,3879,991],{},[539,3881],{},[539,3883,3884],{},"Tożsamość procesu, do którego podłączył się ptrace",[524,3886,3887,3892,3894,3896],{},[539,3888,3889],{},[472,3890,3891],{},"process.target.executable",[539,3893,991],{},[539,3895,1030],{},[539,3897,3898],{},"Obraz procesu, do którego podłączył się ptrace",[524,3900,3901,3906,3908,3910],{},[539,3902,3903],{},[472,3904,3905],{},"process.target.name",[539,3907,991],{},[539,3909,1030],{},[539,3911,3912],{},"Nazwa polecenia celu ptrace, którego nie udało się nazwać po obrazie",[524,3914,3915,3920,3922,3924],{},[539,3916,3917],{},[472,3918,3919],{},"process.ptrace.mode",[539,3921,991],{},[539,3923],{},[539,3925,3926],{},"Bity PTRACE_MODE_* sprawdzenia dostępu",[524,3928,3929,3934,3936,3938],{},[539,3930,3931],{},[472,3932,3933],{},"module.name",[539,3935,991],{},[539,3937,1030],{},[539,3939,3940,3941,1001,3943],{},"Żądany lub załadowany moduł jądra ",[999,3942],{},[472,3944,3945],{},"rootkit",[524,3947,3948,3953,3955,3957],{},[539,3949,3950],{},[472,3951,3952],{},"bpf.cmd",[539,3954,991],{},[539,3956],{},[539,3958,3959],{},"Numer polecenia bpf(2) (5 = BPF_PROG_LOAD)",[524,3961,3962,3967,3969,3971],{},[539,3963,3964],{},[472,3965,3966],{},"kexec.syscall",[539,3968,991],{},[539,3970],{},[539,3972,3973],{},"kexec_load lub kexec_file_load",[524,3975,3976,3981,3983,3985],{},[539,3977,3978],{},[472,3979,3980],{},"kexec.flags",[539,3982,991],{},[539,3984],{},[539,3986,3987],{},"Flagi przekazane do kexec",[524,3989,3990,3995,3997,3999],{},[539,3991,3992],{},[472,3993,3994],{},"container.id",[539,3996,991],{},[539,3998],{},[539,4000,4001,4002,1001,4004],{},"Kontener, do którego należy proces, według jego cgroup ",[999,4003],{},[472,4005,4006],{},"3f1c2b5a9d8e",[524,4008,4009,4014,4016,4018],{},[539,4010,4011],{},[472,4012,4013],{},"container.runtime",[539,4015,991],{},[539,4017,1030],{},[539,4019,4020],{},"Środowisko uruchomieniowe, do którego należy kontener: docker, containerd, cri-o, podman, kubernetes",[524,4022,4023,4028,4030,4032],{},[539,4024,4025],{},[472,4026,4027],{},"process.hash.sha256",[539,4029,991],{},[539,4031],{},[539,4033,4034],{},"SHA256 obrazu procesu, używany do dopasowywania wskaźników",[524,4036,4037,4042,4044,4046],{},[539,4038,4039],{},[472,4040,4041],{},"threat.indicator.type",[539,4043,991],{},[539,4045,1030],{},[539,4047,4048],{},"Co dopasowało wskaźnik: hash, ip lub domain",[524,4050,4051,4055,4057,4059],{},[539,4052,4053],{},[472,4054,774],{},[539,4056,991],{},[539,4058,1030],{},[539,4060,4061],{},"Wskaźnik, który został dopasowany",[524,4063,4064,4069,4071,4073],{},[539,4065,4066],{},[472,4067,4068],{},"threat.indicator.rev",[539,4070,991],{},[539,4072],{},[539,4074,4075],{},"Wersja zestawu wskaźników, względem której nastąpiło dopasowanie",[524,4077,4078,4082,4084,4086],{},[539,4079,4080],{},[472,4081,789],{},[539,4083,991],{},[539,4085,1030],{},[539,4087,4088,4089,1001,4091],{},"Reguła na hoście, która zadziałała ",[999,4090],{},[472,4092,4093],{},"shadow-copy-delete",[524,4095,4096,4101,4103,4105],{},[539,4097,4098],{},[472,4099,4100],{},"rule.onhost.response",[539,4102,991],{},[539,4104,1030],{},[539,4106,4107],{},"Reakcja reguły: alert lub alert+kill",[524,4109,4110,4115,4117,4119],{},[539,4111,4112],{},[472,4113,4114],{},"rule.onhost.version",[539,4116,991],{},[539,4118],{},[539,4120,4121],{},"Wersja stałej listy reguł, którą ma agent",[524,4123,4124,4129,4131,4133],{},[539,4125,4126],{},[472,4127,4128],{},"rule.onhost.killed",[539,4130,1716],{},[539,4132],{},[539,4134,4135],{},"True, gdy zabicie procesu przez regułę się powiodło",[524,4137,4138,4143,4145,4147],{},[539,4139,4140],{},[472,4141,4142],{},"rule.onhost.kill_error",[539,4144,991],{},[539,4146],{},[539,4148,4149],{},"Przyczyna niepowodzenia zabicia procesu: pid nie wykonywał już wskazanego obrazu albo system odmówił",[524,4151,4152,4157,4159,4161],{},[539,4153,4154],{},[472,4155,4156],{},"rule.onhost.kill_disabled",[539,4158,1716],{},[539,4160],{},[539,4162,4163],{},"True, gdy reguła chciała zabić proces, ale grupa nie ma włączonego zabijania",[524,4165,4166,4170,4172,4174],{},[539,4167,4168],{},[472,4169,804],{},[539,4171,991],{},[539,4173,1030],{},[539,4175,4176,4177,1001,4179],{},"Tag reguły audytu, która wygenerowała rekord ",[999,4178],{},[472,4180,4181],{},"xen-persistence",[524,4183,4184,4188,4190,4192],{},[539,4185,4186],{},[472,4187,819],{},[539,4189,991],{},[539,4191,1030],{},[539,4193,4194,4195,1001,4197],{},"Rozwiązana nazwa wywołania systemowego dla architektury, która je wykonała ",[999,4196],{},[472,4198,4199],{},"execve",[524,4201,4202,4207,4209,4211],{},[539,4203,4204],{},[472,4205,4206],{},"auditd.syscall.number",[539,4208,1120],{},[539,4210],{},[539,4212,4213],{},"Surowy numer wywołania systemowego (zależny od ABI; lepiej używać auditd.syscall.name)",[524,4215,4216,4221,4223,4225],{},[539,4217,4218],{},[472,4219,4220],{},"auditd.arch",[539,4222,991],{},[539,4224,1030],{},[539,4226,4227,4228,1001,4230],{},"ABI audytu procesu wywołującego ",[999,4229],{},[472,4231,4232],{},"c000003e",[524,4234,4235,4240,4242,4244],{},[539,4236,4237],{},[472,4238,4239],{},"auditd.nametype",[539,4241,991],{},[539,4243,1030],{},[539,4245,4246],{},"Sposób użycia ścieżki: NORMAL, CREATE, DELETE, PARENT",[524,4248,4249,4254,4256,4258],{},[539,4250,4251],{},[472,4252,4253],{},"auditd.session",[539,4255,991],{},[539,4257],{},[539,4259,4260],{},"Identyfikator sesji audytu; grupuje wszystko, co zrobiono w ramach jednego logowania",[524,4262,4263,4268,4270,4272],{},[539,4264,4265],{},[472,4266,4267],{},"auditd.tty",[539,4269,991],{},[539,4271,1030],{},[539,4273,4274,4275,1001,4277],{},"Terminal sterujący ",[999,4276],{},[472,4278,4279],{},"pts0",[524,4281,4282,4287,4289,4291],{},[539,4283,4284],{},[472,4285,4286],{},"auditd.record_types",[539,4288,991],{},[539,4290,1030],{},[539,4292,4293,4294,1001,4296],{},"Rekordy audytu scalone w to zdarzenie ",[999,4295],{},[472,4297,4298],{},"SYSCALL,EXECVE,CWD,PATH,PROCTITLE",[524,4300,4301,4306,4308,4310],{},[539,4302,4303],{},[472,4304,4305],{},"auditd.record_type",[539,4307,991],{},[539,4309,1030],{},[539,4311,4312,4313,1001,4315],{},"Rekord audytu, z którego zbudowano to zdarzenie, gdy brak rekordu wywołania systemowego ",[999,4314],{},[472,4316,4317],{},"USER_AUTH",[524,4319,4320,4325,4327,4329],{},[539,4321,4322],{},[472,4323,4324],{},"auditd.id",[539,4326,991],{},[539,4328],{},[539,4330,4331],{},"Numer seryjny audytu łączący powiązane rekordy",[524,4333,4334,4339,4341,4343],{},[539,4335,4336],{},[472,4337,4338],{},"auditd.exit",[539,4340,1120],{},[539,4342],{},[539,4344,4345,4346,1001,4348],{},"Wartość zwrócona przez wywołanie systemowe; wartość ujemna to errno, więc odmowa otwarcia jest tu widoczna nawet przy success=yes ",[999,4347],{},[472,4349,4350],{},"-13",[524,4352,4353,4358,4360,4362],{},[539,4354,4355],{},[472,4356,4357],{},"auditd.op",[539,4359,991],{},[539,4361,1030],{},[539,4363,4364,4365,1001,4367],{},"Operacja wskazana w rekordzie (op=), dla rekordów bez wywołania systemowego ",[999,4366],{},[472,4368,4369],{},"PAM:authentication",[468,4371,4372,4373,4375,4376,4378],{},"Pola ",[2642,4374,1030],{}," pasują niezależnie od wielkości liter. Pola ",[2642,4377,1177],{}," mogą być encją reguły detekcji, czyli wartością, według której grupowane są alerty.",[477,4380,4382],{"id":4381},"akceptowane-aliasy","Akceptowane aliasy",[468,4384,4385],{},"Reguły tworzone przez społeczność często używają własnych nazw pól. Gdy importowana reguła Sigma, KQL lub EQL używa jednego z poniższych zapisów, XenXDR zamienia go na nazwę ze słownika, więc reguła działa bez zmian. Aliasy dotyczą wyłącznie importowanych reguł. Zapisane zapytania, wyniki i pasek zapytania używają nazw widocznych w panelu pól.",[518,4387,4388,4397],{},[521,4389,4390],{},[524,4391,4392,4394],{},[527,4393,529],{},[527,4395,4396],{},"Akceptowane także",[534,4398,4399,4416,4427,4438,4449,4460,4474,4503,4529,4555,4572,4592,4615,4658,4675,4692,4709,4735,4749,4769,4780,4791,4802,4813,4827,4838,4849,4863,4874,4885,4896,4907,4918,4929,4940,4957,4968,4979,4990,5001,5012,5023,5034,5045,5056,5067,5078,5092,5103,5114,5125,5136,5147],{},[524,4400,4401,4405],{},[539,4402,4403],{},[472,4404,543],{},[539,4406,4407,549,4410,549,4413],{},[472,4408,4409],{},"hostname",[472,4411,4412],{},"computername",[472,4414,4415],{},"computer",[524,4417,4418,4422],{},[539,4419,4420],{},[472,4421,1011],{},[539,4423,4424],{},[472,4425,4426],{},"agentid",[524,4428,4429,4433],{},[539,4430,4431],{},[472,4432,559],{},[539,4434,4435],{},[472,4436,4437],{},"module",[524,4439,4440,4444],{},[539,4441,4442],{},[472,4443,574],{},[539,4445,4446],{},[472,4447,4448],{},"eventtype",[524,4450,4451,4455],{},[539,4452,4453],{},[472,4454,934],{},[539,4456,4457],{},[472,4458,4459],{},"eventid",[524,4461,4462,4466],{},[539,4463,4464],{},[472,4465,589],{},[539,4467,4468,549,4471],{},[472,4469,4470],{},"log.level",[472,4472,4473],{},"severity name",[524,4475,4476,4480],{},[539,4477,4478],{},[472,4479,604],{},[539,4481,4482,549,4485,549,4488,549,4491,549,4494,549,4497,549,4500],{},[472,4483,4484],{},"username",[472,4486,4487],{},"subjectusername",[472,4489,4490],{},"account",[472,4492,4493],{},"detection user",[472,4495,4496],{},"suser",[472,4498,4499],{},"duser",[472,4501,4502],{},"usrName",[524,4504,4505,4509],{},[539,4506,4507],{},[472,4508,885],{},[539,4510,4511,549,4514,549,4517,549,4520,549,4523,549,4526],{},[472,4512,4513],{},"sourceip",[472,4515,4516],{},"ipaddress",[472,4518,4519],{},"clientip",[472,4521,4522],{},"SourceIp",[472,4524,4525],{},"IpAddress",[472,4527,4528],{},"src",[524,4530,4531,4535],{},[539,4532,4533],{},[472,4534,897],{},[539,4536,4537,549,4540,549,4543,549,4546,549,4549,549,4552],{},[472,4538,4539],{},"sourceport",[472,4541,4542],{},"ipport",[472,4544,4545],{},"SourcePort",[472,4547,4548],{},"IpPort",[472,4550,4551],{},"spt",[472,4553,4554],{},"srcPort",[524,4556,4557,4561],{},[539,4558,4559],{},[472,4560,891],{},[539,4562,4563,549,4566,549,4569],{},[472,4564,4565],{},"destinationip",[472,4567,4568],{},"DestinationIp",[472,4570,4571],{},"dst",[524,4573,4574,4578],{},[539,4575,4576],{},[472,4577,903],{},[539,4579,4580,549,4583,549,4586,549,4589],{},[472,4581,4582],{},"destinationport",[472,4584,4585],{},"DestinationPort",[472,4587,4588],{},"dpt",[472,4590,4591],{},"dstPort",[524,4593,4594,4598],{},[539,4595,4596],{},[472,4597,952],{},[539,4599,4600,549,4603,549,4606,549,4609,549,4612],{},[472,4601,4602],{},"url.full",[472,4604,4605],{},"queryname",[472,4607,4608],{},"dns.question.name",[472,4610,4611],{},"QueryName",[472,4613,4614],{},"request",[524,4616,4617,4621],{},[539,4618,4619],{},[472,4620,619],{},[539,4622,4623,549,4626,549,4629,549,4632,549,4635,549,4638,549,4641,549,4644,549,4647,549,4650,549,4652,549,4655],{},[472,4624,4625],{},"processname",[472,4627,4628],{},"image",[472,4630,4631],{},"newprocessname",[472,4633,4634],{},"exe",[472,4636,4637],{},"Image",[472,4639,4640],{},"SourceImage",[472,4642,4643],{},"NewProcessName",[472,4645,4646],{},"ProcessName",[472,4648,4649],{},"Process Name",[472,4651,4634],{},[472,4653,4654],{},"dproc",[472,4656,4657],{},"sproc",[524,4659,4660,4664],{},[539,4661,4662],{},[472,4663,1277],{},[539,4665,4666,549,4669,549,4672],{},[472,4667,4668],{},"processguid",[472,4670,4671],{},"ProcessGuid",[472,4673,4674],{},"SourceProcessGUID",[524,4676,4677,4681],{},[539,4678,4679],{},[472,4680,1296],{},[539,4682,4683,549,4686,549,4689],{},[472,4684,4685],{},"processid",[472,4687,4688],{},"ProcessId",[472,4690,4691],{},"NewProcessId",[524,4693,4694,4698],{},[539,4695,4696],{},[472,4697,839],{},[539,4699,4700,549,4703,549,4706],{},[472,4701,4702],{},"parentprocessguid",[472,4704,4705],{},"ParentProcessGuid",[472,4707,4708],{},"TargetProcessGUID",[524,4710,4711,4715],{},[539,4712,4713],{},[472,4714,634],{},[539,4716,4717,549,4720,549,4723,549,4726,549,4729,549,4732],{},[472,4718,4719],{},"parentimage",[472,4721,4722],{},"parentprocessname",[472,4724,4725],{},"process.parent.name",[472,4727,4728],{},"ParentImage",[472,4730,4731],{},"TargetImage",[472,4733,4734],{},"ParentProcessName",[524,4736,4737,4741],{},[539,4738,4739],{},[472,4740,1341],{},[539,4742,4743,549,4746],{},[472,4744,4745],{},"parentprocessid",[472,4747,4748],{},"ParentProcessId",[524,4750,4751,4755],{},[539,4752,4753],{},[472,4754,946],{},[539,4756,4757,549,4760,549,4763,549,4766],{},[472,4758,4759],{},"hashes",[472,4761,4762],{},"sha256",[472,4764,4765],{},"Hashes",[472,4767,4768],{},"fileHash",[524,4770,4771,4775],{},[539,4772,4773],{},[472,4774,649],{},[539,4776,4777],{},[472,4778,4779],{},"commandline",[524,4781,4782,4786],{},[539,4783,4784],{},[472,4785,858],{},[539,4787,4788],{},[472,4789,4790],{},"parentcommandline",[524,4792,4793,4797],{},[539,4794,4795],{},[472,4796,1573],{},[539,4798,4799],{},[472,4800,4801],{},"comm",[524,4803,4804,4808],{},[539,4805,4806],{},[472,4807,1592],{},[539,4809,4810],{},[472,4811,4812],{},"proctitle",[524,4814,4815,4819],{},[539,4816,4817],{},[472,4818,879],{},[539,4820,4821,549,4824],{},[472,4822,4823],{},"currentdirectory",[472,4825,4826],{},"cwd",[524,4828,4829,4833],{},[539,4830,4831],{},[472,4832,1619],{},[539,4834,4835],{},[472,4836,4837],{},"integritylevel",[524,4839,4840,4844],{},[539,4841,4842],{},[472,4843,1900],{},[539,4845,4846],{},[472,4847,4848],{},"grantedaccess",[524,4850,4851,4855],{},[539,4852,4853],{},[472,4854,474],{},[539,4856,4857,549,4860],{},[472,4858,4859],{},"targetfilename",[472,4861,4862],{},"file_path",[524,4864,4865,4869],{},[539,4866,4867],{},[472,4868,2020],{},[539,4870,4871],{},[472,4872,4873],{},"sharename",[524,4875,4876,4880],{},[539,4877,4878],{},[472,4879,2039],{},[539,4881,4882],{},[472,4883,4884],{},"imageloaded",[524,4886,4887,4891],{},[539,4888,4889],{},[472,4890,2053],{},[539,4892,4893],{},[472,4894,4895],{},"signed",[524,4897,4898,4902],{},[539,4899,4900],{},[472,4901,2071],{},[539,4903,4904],{},[472,4905,4906],{},"targetobject",[524,4908,4909,4913],{},[539,4910,4911],{},[472,4912,2085],{},[539,4914,4915],{},[472,4916,4917],{},"destinationhostname",[524,4919,4920,4924],{},[539,4921,4922],{},[472,4923,2099],{},[539,4925,4926],{},[472,4927,4928],{},"protocol",[524,4930,4931,4935],{},[539,4932,4933],{},[472,4934,2146],{},[539,4936,4937],{},[472,4938,4939],{},"queryresults",[524,4941,4942,4946],{},[539,4943,4944],{},[472,4945,681],{},[539,4947,4948,549,4951,549,4954],{},[472,4949,4950],{},"targetusername",[472,4952,4953],{},"acct",[472,4955,4956],{},"target_user",[524,4958,4959,4963],{},[539,4960,4961],{},[472,4962,2367],{},[539,4964,4965],{},[472,4966,4967],{},"targetdomainname",[524,4969,4970,4974],{},[539,4971,4972],{},[472,4973,696],{},[539,4975,4976],{},[472,4977,4978],{},"auid",[524,4980,4981,4985],{},[539,4982,4983],{},[472,4984,2478],{},[539,4986,4987],{},[472,4988,4989],{},"logontype",[524,4991,4992,4996],{},[539,4993,4994],{},[472,4995,2497],{},[539,4997,4998],{},[472,4999,5000],{},"targetlogonid",[524,5002,5003,5007],{},[539,5004,5005],{},[472,5006,2516],{},[539,5008,5009],{},[472,5010,5011],{},"subjectlogonid",[524,5013,5014,5018],{},[539,5015,5016],{},[472,5017,2530],{},[539,5019,5020],{},[472,5021,5022],{},"logonprocessname",[524,5024,5025,5029],{},[539,5026,5027],{},[472,5028,2549],{},[539,5030,5031],{},[472,5032,5033],{},"authenticationpackagename",[524,5035,5036,5040],{},[539,5037,5038],{},[472,5039,2563],{},[539,5041,5042],{},[472,5043,5044],{},"workstationname",[524,5046,5047,5051],{},[539,5048,5049],{},[472,5050,2577],{},[539,5052,5053],{},[472,5054,5055],{},"ticketencryptiontype",[524,5057,5058,5062],{},[539,5059,5060],{},[472,5061,2596],{},[539,5063,5064],{},[472,5065,5066],{},"privilegelist",[524,5068,5069,5073],{},[539,5070,5071],{},[472,5072,2615],{},[539,5074,5075],{},[472,5076,5077],{},"status",[524,5079,5080,5084],{},[539,5081,5082],{},[472,5083,711],{},[539,5085,5086,549,5089],{},[472,5087,5088],{},"success",[472,5090,5091],{},"res",[524,5093,5094,5098],{},[539,5095,5096],{},[472,5097,2746],{},[539,5099,5100],{},[472,5101,5102],{},"servicename",[524,5104,5105,5109],{},[539,5106,5107],{},[472,5108,2760],{},[539,5110,5111],{},[472,5112,5113],{},"imagepath",[524,5115,5116,5120],{},[539,5117,5118],{},[472,5119,2968],{},[539,5121,5122],{},[472,5123,5124],{},"taskname",[524,5126,5127,5131],{},[539,5128,5129],{},[472,5130,741],{},[539,5132,5133],{},[472,5134,5135],{},"scriptblocktext",[524,5137,5138,5142],{},[539,5139,5140],{},[472,5141,804],{},[539,5143,5144],{},[472,5145,5146],{},"audit_key",[524,5148,5149,5153],{},[539,5150,5151],{},[472,5152,819],{},[539,5154,5155],{},[472,5156,5157],{},"syscall_name",[477,5159,5161],{"id":5160},"dozwolone-wartości","Dozwolone wartości",[468,5163,5164],{},"Wartości nadawane przez XenXDR podczas normalizacji. Autouzupełnianie je podpowiada.",[468,5166,5167,5169,5170,549,5172,549,5175,549,5178,549,5181,549,5184,549,5187,549,5190,549,5193,549,5196,549,5199,549,5202,549,5205,549,5208,549,5211,549,5214,549,5217,549,5220,549,5222,549,5225,549,5228,549,5231,549,5234,549,5237,549,5240,549,5243],{},[485,5168,559],{},": ",[472,5171,1057],{},[472,5173,5174],{},"defender",[472,5176,5177],{},"security",[472,5179,5180],{},"system",[472,5182,5183],{},"powershell",[472,5185,5186],{},"firewall",[472,5188,5189],{},"scheduled-tasks",[472,5191,5192],{},"application",[472,5194,5195],{},"wmi",[472,5197,5198],{},"rdp",[472,5200,5201],{},"winrm",[472,5203,5204],{},"smb",[472,5206,5207],{},"code-integrity",[472,5209,5210],{},"applocker",[472,5212,5213],{},"bits",[472,5215,5216],{},"winlog",[472,5218,5219],{},"auditd",[472,5221,1483],{},[472,5223,5224],{},"journald",[472,5226,5227],{},"linux",[472,5229,5230],{},"container",[472,5232,5233],{},"syslog",[472,5235,5236],{},"http",[472,5238,5239],{},"hec",[472,5241,5242],{},"xenxdr",[472,5244,5245],{},"file",[468,5247,5248,5169,5250,549,5253,549,5256,549,5259,549,5261],{},[485,5249,589],{},[472,5251,5252],{},"info",[472,5254,5255],{},"low",[472,5257,5258],{},"medium",[472,5260,1148],{},[472,5262,5263],{},"critical",[468,5265,5266,5169,5268,549,5270,549,5273,549,5276,549,5279,549,5282,549,5285,549,5288,549,5291,549,5294,549,5297,549,5300,549,5303,549,5306,549,5309,549,5312,549,5315,549,5318,549,5321,549,5324,549,5327,549,5330,549,5333,549,5336,549,5339,549,5342,549,5345,549,5348,549,5351,549,5354,549,5357,549,5360,549,5363,549,5366,549,5369,549,5372,549,5375,549,5378,549,5381,549,5384,549,5387,549,5390,549,5393,549,5396,549,5399,549,5402],{},[485,5267,574],{},[472,5269,1111],{},[472,5271,5272],{},"process_exit",[472,5274,5275],{},"process_access",[472,5277,5278],{},"network_connect",[472,5280,5281],{},"dns_query",[472,5283,5284],{},"file_create",[472,5286,5287],{},"registry_set",[472,5289,5290],{},"image_load",[472,5292,5293],{},"create_remote_thread",[472,5295,5296],{},"logon_success",[472,5298,5299],{},"logon_failed",[472,5301,5302],{},"logoff",[472,5304,5305],{},"malware_detected",[472,5307,5308],{},"scriptblock_logged",[472,5310,5311],{},"service_installed",[472,5313,5314],{},"user_created",[472,5316,5317],{},"audit_log_cleared",[472,5319,5320],{},"sensor_state",[472,5322,5323],{},"ipc_connect",[472,5325,5326],{},"network_listen",[472,5328,5329],{},"module_load",[472,5331,5332],{},"module_unload",[472,5334,5335],{},"privilege_change",[472,5337,5338],{},"file_modified",[472,5340,5341],{},"file_delete",[472,5343,5344],{},"file_rename",[472,5346,5347],{},"file_permissions_changed",[472,5349,5350],{},"file_owner_changed",[472,5352,5353],{},"sudo_command",[472,5355,5356],{},"session_start",[472,5358,5359],{},"session_end",[472,5361,5362],{},"audit_config_changed",[472,5364,5365],{},"audit_started",[472,5367,5368],{},"audit_stopped",[472,5370,5371],{},"avc_denied",[472,5373,5374],{},"seccomp_violation",[472,5376,5377],{},"promiscuous_mode",[472,5379,5380],{},"user_deleted",[472,5382,5383],{},"credential_changed",[472,5385,5386],{},"bpf_load",[472,5388,5389],{},"memfd_create",[472,5391,5392],{},"namespace_change",[472,5394,5395],{},"kernel_load",[472,5397,5398],{},"signin",[472,5400,5401],{},"signin_failed",[472,5403,5404],{},"directory_audit",{"title":498,"searchDepth":38,"depth":38,"links":5406},[5407,5408,5409,5410],{"id":479,"depth":33,"text":480},{"id":962,"depth":33,"text":963},{"id":4381,"depth":33,"text":4382},{"id":5160,"depth":33,"text":5161},"Wszystkie nazwy pól wraz z typem i znaczeniem.","md",{},true,{"title":199,"description":5411},"2026-09-16","wOz77zAFOa804syJrHL6LXxg0sc8UL8Ov2QMPRgwOR8",[5419,5420],{"title":195,"path":196,"stem":197,"children":-1},{"title":203,"path":204,"stem":205,"children":-1},{"title":172,"navTitle":172},{"left":15,"top":15,"width":456,"height":456,"rotate":15,"vFlip":454,"hFlip":454,"body":5423},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m9 18l6-6l-6-6\"\u002F>",{"left":15,"top":15,"width":456,"height":456,"rotate":15,"vFlip":454,"hFlip":454,"body":5425},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 19l-7-7l7-7m7 7H5\"\u002F>",{"left":15,"top":15,"width":456,"height":456,"rotate":15,"vFlip":454,"hFlip":454,"body":5427},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14m-7-7l7 7l-7 7\"\u002F>",{"left":15,"top":15,"width":456,"height":456,"rotate":15,"vFlip":454,"hFlip":454,"body":5429},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Crect width=\"14\" height=\"14\" x=\"8\" y=\"8\" rx=\"2\" ry=\"2\"\u002F>\u003Cpath d=\"M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2\"\u002F>\u003C\u002Fg>",1789936663452]