@@ -35,6 +35,7 @@ Shieldによって生成される可能性があるアラートは以下のと
35352 . 不審なセッション
36363 . 異常なダウンロード
37374 . 悪意のあるコンテンツ
38+ 5 . Ransomware activity (part of Shield Pro)
3839
3940Shieldの脅威検出アラートイベントはすべて、[ Enterprise Event] [ events ] Stream内で生成されます。これらのイベントは標準のイベントオブジェクトスキーマに従い、` event_type ` 値は` SHIELD_ALERT ` に設定されます。
4041
@@ -336,6 +337,77 @@ Sessions`値によって識別できます。
336337
337338```
338339
340+ ### Ransomware activity alert
341+
342+ <!-- alex ignore-->
343+
344+ A ransomware activity alert is produced when Box Shield identifies suspicious file extensions that may be indicative of a ransomware attack. It can be identified by the Ransomware Activity value within ` additional_details.shield_alert.rule_category ` .
345+
346+ ` additional_details ` ペイロードは以下の詳細を示します。
347+
348+ <!-- alex enable-->
349+
350+ ``` json
351+ {
352+ "source" : null ,
353+ "created_by" : {
354+ "type" : " user" ,
355+ "id" : " 2" ,
356+ "name" : " Unknown User" ,
357+ "login" : " "
358+ },
359+ "action_by" : null ,
360+ "created_at" : " 2025-08-19T10:44:26-07:00" ,
361+ "event_id" : " 5b508973-0e48-4bc1-80b2-a05b5382eb37" ,
362+ "event_type" : " SHIELD_ALERT" ,
363+ "ip_address" : " 1.2.3.4" ,
364+ "type" : " event" ,
365+ "session_id" : null ,
366+ "additional_details" : {
367+ "shield_alert" : {
368+ "rule_category" : " Ransomware Activity" ,
369+ "rule_id" : " 1234" ,
370+ "rule_name" : " Ransomware Detection" ,
371+ "rule_response_action" : null ,
372+ "risk_score" : 100 ,
373+ "alert_summary" : {
374+ "total_files_affected" : 42 ,
375+ "ip_details" : [
376+ {
377+ "ip" : " 1.2.3.4" ,
378+ "registrant" : " Microsoft Corporation" ,
379+ "latitude" : " 37.5555" ,
380+ "longitude" : " -120.6789" ,
381+ "city_name" : " San Jose" ,
382+ "region_name" : " California" ,
383+ "country_code" : " US"
384+ }
385+ ],
386+ "suspicious_file_extensions" : [
387+ " lockbit"
388+ ],
389+ "anomaly_period" : {
390+ "date_range" : {
391+ "start_date" : " 2009-02-13T23:31:30Z" ,
392+ "end_date" : " 2009-02-13T23:31:30Z"
393+ }
394+ }
395+ },
396+ "alert_id" : 1234 ,
397+ "priority" : " medium" ,
398+ "user" : {
399+ "id" : 8167630149 ,
400+ "name" : " Some user" ,
401+ 402+ },
403+ "link" : " https://app.box.com/master/shield/alerts/1234" ,
404+ "created_at" : " 2025-08-19T10:44:26-07:00"
405+ }
406+ }
407+ }
408+
409+ ```
410+
339411<!-- i18n-enable localize-links -->
340412
341413[ box-shield ] : https://www.box.com/ja-jp/shield
0 commit comments