//
// Policy common definitions
//
{
	"version": 2,
	"name": "common",

	"constants": {
		"eventBaseType": {
			"MLE_FILE_COPY": 1000001,
			"MLE_PROCESS_ELEVATION": 1000002,
			"MLE_THREAD_ELEVATION": 1000003,
			"MLE_INTEGRITY_LEVEL_ELEVATION": 1000004,
			"MLE_DANGEROUS_FILE_DOWNLOAD": 1000005,
			"MLE_NETWORK_REQUEST_DATA_FROM_SHELL": 1000006,
			"MLE_NETWORK_REQUEST_DATA_UNUSUAL_PORT": 1000007
		},
		"eventTypes": [
			"LLE_PROCESS_CREATE",
			"LLE_PROCESS_DELETE",
			"LLE_FILE_CREATE",
			"LLE_FILE_DELETE",
			"LLE_FILE_CLOSE",
			"LLE_FILE_DATA_CHANGE",
			"LLE_FILE_DATA_READ_FULL",
			"LLE_FILE_DATA_WRITE_FULL",
			"LLE_REGISTRY_KEY_CREATE",
			"LLE_REGISTRY_KEY_NAME_CHANGE",
			"LLE_REGISTRY_KEY_DELETE",
			"LLE_REGISTRY_VALUE_SET",
			"LLE_REGISTRY_VALUE_DELETE",
			"LLE_PROCESS_OPEN",
			"LLE_PROCESS_MEMORY_READ",
			"LLE_PROCESS_MEMORY_WRITE",
			"LLE_WINDOW_PROC_GLOBAL_HOOK",
			"LLE_KEYBOARD_GLOBAL_READ",
			"LLE_DISK_RAW_WRITE_ACCESS",
			"LLE_VOLUME_RAW_WRITE_ACCESS",
			"LLE_DISK_LINK_CREATE",
			"LLE_VOLUME_LINK_CREATE",
			"LLE_DEVICE_LINK_CREATE",
			"LLE_INJECTION_ACTIVITY",
			"LLE_KEYBOARD_BLOCK",
			"LLE_CLIPBOARD_READ",
			"MLE_FILE_COPY_TO_USB",
			"MLE_FILE_COPY_TO_SHARE",
			"MLE_FILE_COPY_FROM_USB",
			"MLE_FILE_COPY_FROM_SHARE",
			"LLE_KEYBOARD_GLOBAL_WRITE",
			"LLE_MICROPHONE_ENUM",
			"LLE_MICROPHONE_READ",
			"LLE_MOUSE_GLOBAL_WRITE",
			"LLE_WINDOW_DATA_READ",
			"LLE_DESKTOP_WALLPAPER_SET",
			"LLE_MOUSE_BLOCK",
			"LLE_NETWORK_CONNECT_IN",
			"LLE_NETWORK_CONNECT_OUT",
			"LLE_NETWORK_LISTEN",
			"MLE_FILE_COPY",
			"LLE_USER_LOGON",
			"LLE_USER_IMPERSONATION",
			"LLE_NETWORK_REQUEST_DNS",
			"LLE_NETWORK_REQUEST_DATA",
			"MLE_PROCESS_ELEVATION",
			"MLE_THREAD_ELEVATION",
			"MLE_INTEGRITY_LEVEL_ELEVATION",
			"MLE_DANGEROUS_FILE_DOWNLOAD",
			"MLE_NETWORK_REQUEST_DATA_FROM_SHELL",
			"MLE_NETWORK_REQUEST_DATA_UNUSUAL_PORT"
		],	
		"verdict": {
			"ABSENT": 0,
			"SAFE": 1,
			"MALWARE": 2,
			"UNKNOWN": 3
		},	
		"tokenClass": {
			"UNKNOWN": 0,
			"GUEST": 1,
			"USER": 2,
			"LOCALADMIN": 3,
			"DOMAINADMIN": 4,
			"SERVICE": 5,
			"SYSTEM": 6
		},	
		"impersonationType": {
			"LOCAL": 0,
			"IPC": 1
		}
	}
}