{
"meta": {
"count": 1,
"limit": 1,
"offset": 0,
"next": "https://apps.fireeye.com/helix/id/363/api/v3/alerts?limit=1&offset=1",
"previous": null
},
"results": [
{
"primary_id": 168037,
"alert_type": {
"id": 1084,
"created_at": "2020-11-04T22:10:59.778556Z",
"updated_at": "2026-06-08T13:25:08.044218Z",
"type_id": "135e8-2389e1da49e0",
"category": "Host",
"detail_fields": [
"hostname",
"eventid",
"username"
],
"correlation_fields": [
{
"corr_mql": "class:alerts rawmsg:{}",
"corr_name": "Correlate by hostname",
"corr_fields": [
"hostname",
"srchost"
],
"ignore_vals": [
"system"
],
"relative_time": 240
}
],
"is_default": false,
"is_internal": true,
"name": "Windows Process",
"summary_fields": [
"process",
"username"
],
"source": [
"hostname"
],
"destination": [
"eventid",
"category"
],
"created_by": "abd5feae-84fc-41e9-be61-336ec358c89a",
"updated_by": "abd5feae-84fc-41e9-be61-336ec358c89a"
},
"assigned_to": null,
"context": null,
"created_by": {
"id": "abd5feae-84fc-4a",
"avatar": "https://secure.gravatar.com/avatar/8267ad472c",
"name": "System User",
"username": "system_user",
"primary_email": "no.reply@fireeye.com"
},
"events_count": 1,
"notes_count": 0,
"queues": [
"Default Queue"
],
"source_url": "https://apps.fireeye.com/helix/id/363/alerts/16008037",
"updated_by": {
"id": "abd56ec358c89a",
"avatar": "https://secure.gravatar.com/avatar/8267ad472c",
"name": "System User",
"username": "system_user",
"primary_email": "no.reply@fireeye.com"
},
"organization": "363",
"risk_score": 50,
"life_span": "32d 16h 55m 03s",
"last_event_at": "2026-10-01 17:19:46Z",
"first_event_at": "2026-10-01 17:19:46Z",
"derived_risk": "Low",
"hx_device_versions": [
"10.0.22631"
],
"intel_source": [],
"created_at": "2026-10-01T17:20:26.367329Z",
"updated_at": "2026-10-01T17:20:30.407221Z",
"id": 18037,
"alert_threat": "Unknown",
"alert_type_details": {
"detail": {
"msg": "a new process has been created.",
"pid": 176,
"class": "ms_windows_event",
"source": "microsoft-windows-security-auditing",
"eventid": "88",
"process": "c:\\windows\\system32\\rundll32.exe",
"category": "process creation",
"deviceid": "8b3",
"eventlog": "security",
"hostname": "host.example.com",
"pprocess": "c:\\program files\\...\\outlook.exe",
"severity": "info",
"threadid": "296",
"username": "user1",
"eventtype": "audit_success",
"meta_cbid": 8888,
"metaclass": "windows",
"callingdomain": "example",
"severityvalue": 2
},
"source": "host.example.com",
"summary": {
"process": "c:\\windows\\system32\\rundll32.exe",
"username": "user1"
},
"properties": {
"class": "ms_windows_event",
"deviceid": "8679",
"meta_cbid": 8888,
"customer_id": "363"
},
"destination": "4688"
},
"assigned_at": null,
"classification": 40,
"closed_reason": "",
"closed_state": "Unknown",
"confidence": "Medium",
"description": "This rule looks for a Microsoft Office process launching a suspicious child process.",
"distinguisher_key": "host.example.com",
"distinguishers": {
"hostname": "host.example.com"
},
"emailed_at": 739890,
"events_threshold": 1,
"external_id": "",
"external_ips": [],
"external_ips_count": 0,
"info_links": [
"System Binary Proxy Execution, Technique T1218"
],
"internal_ips": [],
"internal_ips_count": 0,
"is_suppressed": false,
"is_threat": false,
"is_tuned": false,
"kill_chain": [
"5 - Installation"
],
"last_sync_ms": 1790875224056,
"message": "WINDOWS METHODOLOGY [Office Suspicious Child Process]",
"mitre_ids": [
"T1218",
"T1059"
],
"metaclasses": {
"windows": 1
},
"mongo_id": "6abe99b542d34",
"origin_id": "map_rule",
"products": {},
"risk": "Medium",
"risk_order": 2,
"search": "metaclass:windows eventid=4688 process:[rundll32.exe]",
"seconds_threshold": 60,
"severity": "Medium",
"source_revision": 0,
"state": "Open",
"tags": [
"windows",
"methodology",
"office"
],
"threat_changed_at": null,
"threat_type": 5,
"trigger_id": "1.1.2497",
"trigger_revision": 9,
"tuning_search": "",
"type": "fireeye_rule",
"asset_ids": [
25188129,
1343975007
],
"threat_vector": [
"endpoint"
]
}
]
}
