A server hosting an internal web app was exposed to the internet for 48 hours. You want to run a UDM search to identify successful exploitations. What event field search should you use?

• A. product_event_type (antimalware/endpoint events)
• B. principal.ip (network traffic where principal is rarely seen)
• C. principal.user.userid (unexpected sign-on users)
• D. metadata.event_type (process launches and rarely seen commands)

Answer: (D)

When a server is exposed and you’re hunting for exploitation, you want to surface signs of what the attacker actually did on the host. In the Unified Data Model, the field metadata.event_type is designed to describe the kind of activity, including process launches and rarely seen commands. Those are exactly the telltale signs of compromise—new processes started by an attacker, shells opened, unusual tools invoked, or other uncommon commands that don’t belong to normal operation. By using a search scoped to metadata.event_type for process creation and rarely seen commands, you can identify sequences of activity that indicate exploitation on the server.

Other fields don’t target this kind of signal as directly. product_event_type focuses on security product events like antimalware detections and endpoint alerts, which may be missing or incomplete on a server running a web app. principal.ip would flag unusual network origins but doesn’t confirm what the attacker did on the host. principal.user.userid looks for sign-ins, which may not occur or may not capture post-exploitation actions. The process-creation and rare-command signals in metadata.event_type provide the most direct window into successful exploitation.