1 2024-10-26T12:49:19.470171 eyeglass-vm Superna-Zero-Trust 172.31.1.102 - - - device_product=Eyeglass Zero Trust,device_vendor=Superna,device_version=V1,device_event_class_id=security,version=1.0,event_type=threat_detection,protocol=SMB2,client_ip=172.31.1.45,comment=Lockout access result:<br>demo93dr: successfully locked share nfsdata:nfssmb for user DEMO\demo1.<br>demo93dr: successfully locked share System:igls-dfs-dfs for user DEMO\demo1.<br>onefs93: successfully locked share System:docmgmt for user DEMO\demo1.<br>onefs93: successfully locked share nfsdata:nfssmb for user DEMO\demo1.<br>onefs93: successfully locked share System:QFSQuarantine for user DEMO\demo1.<br>onefs93: successfully locked share System:dfs for user DEMO\demo1. | Detected ransomware extension(s): [*.locky] | Signal received; New event is raised | Signal received; Event state going to LOCKED_OUT | Severity changing from MAJOR to CRITICAL | Saved locked out shares | Signal received; Event state going to LOCKED_OUT | Signal received; Event state going to LOCKED_OUT | Signal received; Event state going to LOCKED_OUT | Creating Snapshots for User DEMO\demo1<br>Successfully created snapshot onefs93 - igls-DEMO-demo1-System-docmgmt-17_10074-1696865466421.<br>Successfully created snapshot onefs93 - igls-critical-path-ifs-data-demo2-17_10074-1696865465908.<br>Successfully created snapshot demo93dr - igls-DEMO-demo1-nfsdata-nfssmb-17_10074-1696865466862.<br>Successfully created snapshot onefs93 - igls-DEMO-demo1-System-QFSQuarantine-17_10074-1696865466415.<br>Successfully created snapshot onefs93 - igls-DEMO-demo1-nfsdata-nfssmb-17_10074-1696865466425.<br>Successfully created snapshot onefs93 - igls-DEMO-demo1-System-dfs-17_10074-1696865466422.<br>Successfully created snapshot demo93dr - igls-DEMO-demo1-System-igls-dfs-dfs-17_10074-1696865466859. | Severity changing from WARNING to MAJOR | Creating Snapshots for User DEMO\demo1<br>Successfully created snapshot onefs93 - igls-DEMO-demo1-System-docmgmt-17_10074-1696865466421.<br>Successfully created snapshot onefs93 - igls-critical-path-ifs-data-demo2-17_10074-1696865465908.<br>Successfully created snapshot demo93dr - igls-DEMO-demo1-nfsdata-nfssmb-17_10074-1696865466862.<br>Successfully created snapshot onefs93 - igls-DEMO-demo1-System-QFSQuarantine-17_10074-1696865466415.<br>Successfully created snapshot onefs93 - igls-DEMO-demo1-nfsdata-nfssmb-17_10074-1696865466425.<br>Successfully created snapshot onefs93 - igls-DEMO-demo1-System-dfs-17_10074-1696865466422.<br>Successfully created snapshot demo93dr - igls-DEMO-demo1-System-igls-dfs-dfs-17_10074-1696865466859. | Signal received; Event state going to LOCKED_OUT,time=2024-10-26T12:49:19.470Z,user=DEMO\demo1,action=Lockout,severity=CRITICAL,state=LOCKED_OUT