Skip Navigation
  1. BlackBerry Docs
  2. Cylance products
  3. BlackBerry Syslog Guide
  4. BlackBerry Optics detection events
  5. BlackBerry Optics memory-based detection events

BlackBerry Optics
 memory-based detection events

These events occur when a Detection Event that includes a macOS Memory Event (such as changing an area of memory marked as read/write to execute.)
Field
Value
Description
Description
[varies]
Name of the Detection Rule that was triggered
Device Id
[varies]
Unique ID for the device
Device Name
[varies]
Name of the device on which the Detection Event occurred
Event Id
[varies]
Unique ID for the Detection Event
Event Name
OpticsCaeMemoryEvent
Detection Event involved a memory event
Event Type
OpticsCaeMemoryEvent
Detection Event involved a memory event
Instigating Process ImageFileSha256
[varies]
SHA256 hash of the process that instigated the action
Instigating Process Name
[varies]
Name of the process that instigated the action
Instigating Process Owner
[varies]
User who owns the process that instigated the action
Severity
[varies]
Severity of the event:
  • High: A malicious event that requires immediate attention.
  • Medium: A suspicious event that should be reviewed.
  • Low: An important event, but may not be malicious.
  • Info: An observed event.
Zone Names
[varies]
Zones that the device belongs to
Example message for memory-based detection events
Event Type: OpticsCaeMemoryEvent, Event Name: OpticsCaeMemoryEvent, Device Name: OPTICS-DEMO-2, Zone Names: (Zone1, Zone2), Event Id: 26874384-989c-4962-bc5f-bca0da4b8bb1, Severity: Low, Description: Read/Write Memory Changed to Executable, Instigating Process Name: memory-mapper.app, Instigating Process Owner: CYLANCE/mmorin, Instigating Process ImageFileSha256: 4E66B857B7010DB8D4E4E28D73EB81A99BD6915350BB9A63CD86671051B22F0E, Device Id: e378dacb-9324-453a-b8c6-5a8406952195