I have logs from a security appliance from Damballa which has cryptic names for threats observed in a network which I am trying to make sense of. Some examples of these threats are "RedTreeBruisers" , "WeirdSideTroop" , "WhiteBikeScorpions" ,etc. which I do not know how to interpret . I have over a 100 of these unique threat names with 3 words concatenated together. Unfortunately I don't have access to documentation / otherwise for this appliance. Any ideas what these threats mean & Is this a standard of some sort? What would be the best way to decode them?
The appliance is obviously using arbitrary names to name/describe those threats.
Vendors often use such home-made naming/description conventions. For example:
And you can also find naming/description standards from the academic world or standard organizations, for example:
Sometimes on those appliances you can find additional information in the detailed view that gives you the "official" name and variant of the detected threat.