Carbon Black Defense

[
    {
  "EntityResult":
    {
     "assignedToName": null,
     "macAddress": null,
     "adGroupId": 0,
     "avEngine": "",
     "avVdfVersion": null,
     "rootedByAnalyticsTime": null,
     "linuxKernelVersion": null,
     "lastExternalIpAddress": "1.1.1.1",
     "lastDevicePolicyRequestedTime": null,
     "activationCodeExpiryTime": 1513776891190,
     "currentSensorPolicyName": null,
     "organizationName": "cb-internal-alliances.com",
     "deviceGuid": null,
     "loginUserName": null,
     "lastPolicyUpdatedTime": null,
     "registeredTime": 1513172091219,
     "deviceSessionId": null,
     "lastDevicePolicyChangedTime": null,
     "windowsPlatform": null,
     "osVersion": "Windows 10 x64",
     "firstVirusActivityTime": 0,
     "avUpdateServers": null,
     "lastReportedTime": 1520325064134,
     "middleName": null,
     "activationCode": null,
     "deregisteredTime": null,
     "lastResetTime": 0,
     "lastInternalIpAddress": "1.1.1.1",
     "deviceOwnerId": 260377,
     "avMaster": false,
     "lastLocation": "OFFSITE",
     "deviceType": "WINDOWS",
     "targetPriorityType": "MEDIUM",
     "encodedActivationCode": null,
     "lastVirusActivityTime": 0,
     "avStatus": ["AV_BYPASS"],
     "sensorStates": ["ACTIVE","LIVE_RESPONSE_NOT_RUNNING","LIVE_RESPONSE_NOT_KILLED"],
     "email": "ACorona",
     "virtualizationProvider": null,
     "avPackVersion": null,
     "assignedToId": null,
     "scanStatus": null,
     "name": "HP-01",
     "policyName": "default",
     "scanLastActionTime": 0,
     "vdiBaseDevice": null,
     "rootedByAnalytics": false,
     "testId": -1,
     "avProductVersion": null,
     "rootedBySensorTime": null,
     "lastShutdownTime": 1519811818082,
     "quarantined": false,
     "createTime": null,
     "deviceId": 605341,
     "sensorVersion": "1.1.1.1",
     "passiveMode": false,
     "virtualMachine": false,
     "firstName": null,
     "uninstallCode": null,
     "uninstalledTime": null,
     "messages": null,
     "policyOverride": false,
     "organizationId": 1105,
     "sensorOutOfDate": false,
     "avAveVersion": null,
     "status": "REGISTERED",
     "policyId": 6525,
     "deviceMetaDataItemList": null,
     "lastName": null,
     "originEventHash": null,
     "avLastScanTime": 0,
     "rootedBySensor": false,
     "scanLastCompleteTime": 0,
     "lastContact": 1520325053567
 },
 "Entity": "HP-01"
}
]

[
    {
        "EntityResult":
        {
            "0":
            {
                "eventId": "1defe38112e911e7b34047d6447797bd",
                "parentApp":
                {
                    "applicationName": "C: \\\\Windows\\\\System32\\\\svchost.exe",
                    "md5Hash": null,
                    "reputationProperty": null,
                    "effectiveReputation": null,
                    "applicationPath": null,
                    "virusName": null,
                    "effectiveReputationSource": null,
                    "virusCategory": null
                    "sha256Hash": "c7db4ae8175c33a47baa3ddfa089fad17bc8e362f21e835d78ab22c9231fe370",
                    "virusSubCategory": null
                },
                "eventTime": 1490617768036,
                "selectedApp":
                {
                    "applicationName": "taskeng.exe",
                    "md5Hash": "a21ac8d41e63cf1aa24ebc165ae82c9a",
                    "reputationProperty": "TRUSTED_WHITE_LIST",
                    "effectiveReputation": null,
                    "applicationPath": "C: \\\\Windows\\\\System32\\\\taskeng.exe",
                    "virusName": null,
                    "effectiveReputationSource": null,
                    "virusCategory": null,
                    "sha256Hash": "74b9cf472d5008e00735482f084f886eaa201248d6e87ab6b1990e3670bd6693",
                    "virusSubCategory": null
                },
                "attackStage": null,
                "processDetails":
                {
                    "userName": "SYSTEM",
                    "interpreterHash": null,
                    "parentCommandLine": "C: Windows\\\\system32\\\\svchost.exe-knetsvcs",
                    "milisSinceProcessStart": 32,
                    "name": "taskeng.exe",
                    "parentPid": 772,
                    "processId": 2872,
                    "interpreterName": null,
                    "commandLine": "taskeng.exe{5267BC82-9B0D-4F0B-A566-E06CDE5602F1}S-1-5-18: NTAUTHORITY\\\\System: Service: ",
                    "parentName": "svchost.exe",
                    "parentPrivatePid": "772-1489763380982-18",
                    "targetPrivatePid": "2468-1490617768051-975",
                    "targetPid": 2468,
                    "targetCommandLine": "C: \\\\ProgramFiles(x86)\\\\Google\\\\Update\\\\GoogleUpdate.exe",
                    "privatePid": "2872-1490617768004-974",
                    "targetName": "GoogleUpdate.exe",
                    "fullUserName": "NTAUTHORITY\\\\SYSTEM"
                },
                "eventType": "SYSTEM_API_CALL",
                "targetApp":
                {
                    "applicationName": "C: \\\\ProgramFiles(x86)\\\\Google\\\\Update\\\\GoogleUpdate.exe",
                    "md5Hash": null,
                    "reputationProperty": "TRUSTED_WHITE_LIST",
                    "effectiveReputation": null,
                    "applicationPath": null,
                    "virusName": null,
                    "effectiveReputationSource": null,
                    "virusCategory": null,
                    "sha256Hash": "52fc3aa9f704300041e486e57fe863218e4cdf4c8eee05ca6b99a296efee5737",
                    "virusSubCategory": null
                },
                "longDescription": "",
                "threatIndicators": ["SUSPENDED_PROCESS"],
                "securityEventCode": null,
                "registryValue": null,
                "incidentId": null,
                "shortDescription": "",
                "createTime": 1490617872232,
                "alertScore": 0,
                "alertCategory": null
            }
        },
        "Entity": "HP-01"
    }
]

[
    {
        "EntityResult":
        {
            "0":
            {
                "applicationName": "chrome.exe",
                "processId": 3052,
                "numEvents": 252,
                "applicationPath": null,
                "privatePid": "3052-1489181082476-30",
                "sha256Hash": "c8b01dd0153bbe4527630fb002f9ef8b4e04127bdff212831ff67bd6ab0ea265"
            }
        },
        "Entity": "HP-01"
    }
]