Each row represents a specific detection performed on a file. In other words, each record indicates that the system has found a file that matches a malware detection rule or a known pattern of malicious behavior.

Unlike other collections related to web activity, here it does not record accesses, visits, or HTTP requests, but security events related to potentially compromised files.

This collection is especially useful when you want to answer questions like:

• which files have been detected as malware,
• where those files are located within the hosting,
• what type of threat has been identified,
• when the detection and cleaning occurred

Although it includes technical information, it can also be useful for non-specialized users, since it allows you to easily locate which files require review.

For example, this collection allows you to:

• Detect compromised files: It allows you to identify the files in which the system has found malicious code or behaviors considered dangerous.

• Locate the malware: Each detection indicates the full path of the affected file, making it easy to quickly locate where the problem is within the hosting.

• Identify the type of threat: Each detection is associated with a malware rule or signature that indicates what behavior or threat family has been recognized. This helps to understand if it is, for example, a webshell, hidden code for fraudulent SEO positioning, or another type of malware.

• Analyze when a threat appeared: Thanks to the detection date, it is possible to review when the incidents began to appear and detect if there is a recurrence over time.

• Check if an infection remains active: If the same file or the same rule appears repeatedly over several days, it may indicate that the threat has not been completely removed or that the site remains compromised.

• one row = one malware detection,
• a file = the element where the threat was found,
• a path = the location where that file is located,
• a rule = the type of malware detected,

Not all detections necessarily mean that the file has been executed or that the site has suffered a successful attack. What they indicate is that the system has found content that matches a known malware signature and that it should be reviewed.

Data type: categorical text

Indicates the action recorded during the security analysis. This field allows you to distinguish the type of event recorded. You will be able to see if it was cleaned or detected.

Data type: categorical text

Indicates the name of the file where the malware was detected. It is one of the first fields usually consulted to quickly identify which file is affected.

Example usage:

• locate if the same compromised file always appears,
• check if the threat affects a plugin, a theme, or an application file itself.

Data type: categorical text

Contains the full path of the file where the malware was detected. This field allows you to exactly locate the file within the hosting.

Example usage:

• identify if the threat is inside a WordPress plugin,
• review if it affects a specific folder,
• quickly locate the file to analyze or delete it.

Data type: categorical text

Indicates the process or type of operation that generated the event.

Data type: categorical text

Indicates the security rule or signature that allowed the malware to be identified. Each rule represents a specific type of threat or a known pattern of malicious behavior.

For example, names related to the following may appear:

• webshells,
• backdoors,
• malware oriented to fraudulent SEO positioning,
• remote code loaders,
• or other threat families.

Example usage:

if multiple detections use the same rule, they are probably related to the same infection or the same malware family.

Data type: date and time

Indicates the exact date and time when the detection was recorded. It allows you to know when a threat appeared and analyze its evolution over time.

Example usage:

• detect if infections started after an update,
• check if a threat reappears after having been removed,
• analyze the frequency of detections.

• You can check the rule field, which indicates the signature used to identify the malware.
  
• You can check if the same file or the same rule appears detected repeatedly over several days.
• You can group the information by file_path or file to identify which areas of the hosting concentrate more detections.
• Filter the information by utc_date to identify when the detections started and check if they coincide with recent changes to the website, plugin installations, or updates.