Hayabusa: Level is the rule’s label, and Details can be cut off

Level belongs to the rule

Each timeline row has a level the rule carried: info, low, medium, high, or the word the profile printed. That label is why the row was included when you set a minimum. It is not a measurement that the event was unwanted, and it is not a substitute for the event id.

RuleTitle is the rule’s name. It can contain words like “suspicious” because the author wrote them. Quote the title as a name. The event id and channel are what you use to find the record in the log.

Details is an extract, and it can end early

The Details column is a short extract of fields the rule selected. It can stop mid-path or mid-name when the cell is long. A cut-off string is not an invitation to complete it. If the finding needs the rest, open the event in the log and quote that field from the event.

A blank Details cell means this export did not fill it. It does not mean the event had no message.

What to file

File Computer, Channel, EventID, Level labeled as the rule’s level, RuleTitle labeled as the rule’s name, and Details exactly as printed if you use it. If you opened the event for a cut-off field, file that field from the event and say so. Do not raise Level into a conclusion.

Worked case: a path that stops at the slash

A high row on lab host ACCT-04, channel System, event 7045, title about a new service, Details “Path: C:\Program Files\LabTools\”. The cell ends there. A draft completes it to a file name the analyst remembers from another host.

The note quotes Level as the rule’s label, the event id, and Details exactly, including the trailing slash and nothing after it. The service path used in the finding comes from the 7045 event, which shows the full path, and the note says that. The remembered name is not added.

Computer: ACCT-04  Channel: System  EventID: 7045
Level: high (rule label)
RuleTitle: <as printed>
Details: Path: C:\Program Files\LabTools\   (ends here)
full path: from the 7045 event, cited separately
not: a filename remembered from elsewhere