{% extends "base.html" %} {% block title %}Event Details - {{ log.id }}{% endblock %} {% block content %}
Back to Flagged Events
Live Analysis
Security Event Monitor

Event Analysis

Comprehensive security event investigation

Event ID: {{ log.id }} {{ log_type|capitalize }} Log
Risk Assessment
{{ risk_score if risk_score is not none else 75 }}%
{{ risk_level|upper if risk_level else 'HIGH' }}
{% if matching_rules %}

Matched Sigma Rules

{{ matching_rules|length }} Active Detections
{% for rule in matching_rules %}

{{ rule.title }}

{{ rule.level|upper }}
Detection ID {{ rule.id }}
{% if rule.description %}
Description

{{ rule.description[:180] }}{% if rule.description|length > 180 %}...{% endif %}

{% endif %}
{% if rule.author %}
Author {{ rule.author }}
{% endif %} {% if rule.date %}
Date {{ rule.date }}
{% endif %}
{% if rule.tags %}
{% for tag in rule.tags[:4] %} {{ tag }} {% endfor %} {% if rule.tags|length > 4 %} {{ rule.tags|length - 4 }} more {% endif %}
{% endif %} {% if rule.status %}
Status {{ rule.status }}
{% endif %}
{% endfor %}
{% else %}

No Sigma Rules Matched

This event did not trigger any Sigma detection rules

The event appears to be routine activity
{% endif %}

Event Information

Event Type
{{ log_type|capitalize }}
Event ID
#{{ log.event_id if log.event_id else 'N/A' }}
Timestamp
{{ log.time_created.strftime('%Y-%m-%d %H:%M:%S') if log.time_created else 'N/A' }}
Computer System {{ log.computer }}
User Account {% if log_type == 'security' %} {{ log.subject_user_name if log.subject_user_name else log.target_user_name if log.target_user_name else 'N/A' }} {% else %} {{ log.user if log.user else 'N/A' }} {% endif %}
{% if log_type == 'sysmon' %}

Sysmon Process Details

{% if log.image %}
Process Image

{{ log.image }}

{% endif %} {% if log.process_id %}
Process ID

{{ log.process_id }}

{% endif %} {% if log.command_line %}
Command Line

{{ log.command_line }}

{% endif %}
{% elif log_type == 'security' %}

Security Event Details

{% if log.target_user_name %}
Target User

{{ log.target_user_name }}

{% endif %} {% if log.subject_domain_name %}
Domain

{{ log.subject_domain_name }}

{% endif %}
{% endif %}

Risk Analysis

{{ risk_score }}%
Overall Risk
{{ risk_factors|length if risk_factors else 0 }}
Risk Factors
{{ matching_rules|length if matching_rules else 0 }}
Rules Matched
{% if log_type == 'sysmon' %}{{ log.event_id or 'N/A' }}{% else %}1{% endif %}
Event Type
{% if risk_factors %}

Identified Risk Factors:

{% for factor in risk_factors %}
{{ factor.type if factor.type else factor }}
{% if factor.description %}
{{ factor.description }}
{% endif %}
{% endfor %}
{% endif %}

Quick Actions

View All Events {% if log_type == 'sysmon' and log.computer %}
Events from System {{ log.computer }}
{% endif %}

Raw Log Data

{% endblock %}