[Global]

#PIDProduct             = -1
#PIDSystem              = 4
#AppIdProduct           = 2
#AppIdSystem            = 1

$IsRepItem              = bindok("TaskID")
$RepEventIcon           = s_VerdictIcon(Verdict)
$RepEventBg             = s_VerdictIconBacknd(s_VerdictIcon(Verdict))
$ActionText             = s_Action(Action)
$VerdictDescrText       = s_Verdict(Verdict)
$VerdictText            = $VerdictDescrText + if(DetectName, ": " + ($DetectNameText)) + s_DetectNameService(DetectType)
$ObjectTypeText         = s_ObjectType(ObjectType)
$ObjectTypeTextLoCase   = capitalize($ObjectTypeText,0)
$ReasonText             = s_DecisionReason(DecisionReason)
$DetectTypeText         = if(DetectDanger, s_RepDetectType(DetectType))
$DetectDangerText       = s_DetectDanger(DetectDanger)
$ExactText              = TaskID == #eTASK_AS && ObjectType == #eMailMessage ? s_SpamProbability(dExtraInfo) : s_Exact(IsExact)
$ObjectIdText           = f_ObjectIdText(c_object(ObjectID, object(ObjectID)))
$ObjectSerText          = s_EventObjSerByType(ObjectType, c_repser(ObjectID, objectdata(ObjectID)))
$ObjectRealText         = (ObjectID ? ($IsEventObjSer ? $ObjectSerText : $ObjectIdText) : ($IsTaskStateEvent ? $TaskObjectText : s_ObjectTextByTask(TaskID)))
$ObjectText             = f_displayObject(PID, $ObjectRealText)
$ObjectPathText         = f_displayObject(PID, if(ObjectID && s_HasPath(ObjectType), objdir($ObjectIdText)))
$ObjectNameText         = ObjectID ? ($IsEventObjSer ? $ObjectSerText : if(ObjectType != #eMailMessage, objfile($ObjectIdText))) : ($IsTaskStateEvent ? $TaskObjectText : s_ObjectTextByTask(TaskID))
$ObjectInSandboxText	= s_ObjectInSandboxText(PID && PID != #PIDProduct && PID != #PIDSystem && f_isSandboxed(PID))
$ObjectSizeText         = if(ObjectID && ExtraInfoSub2, f_ObjSize(ExtraInfoSub2))
$ObjectIcon             = if(ObjectType, s_ObjectTypeIcon(ObjectType, $ObjectIdText))
$OldObjectIdText        = f_ObjectIdText(c_object(OldObjectID, object(OldObjectID)))
$OldObjectText          = if(OldObjectID, $OldObjectIdText)
$OldObjectPathText      = if(OldObjectID && s_HasPath(ObjectType), objdir($OldObjectIdText))
$OldObjectNameText      = if(OldObjectID, if(ObjectType != #eMailMessage, objfile($OldObjectIdText)))
$OldObjectSizeText      = if(OldObjectID && ExtraInfoSub2, f_ObjSize(ExtraInfoSub2))
$OldObjectIcon          = if(OldObjectID && ObjectType, s_ObjectTypeIcon(ObjectType, $OldObjectIdText))
$DetectNameText         = f_IsAccessDetected(DetectType) ? s_ResGroupName(hipsGroup($DetectNameTextRaw,2)) : $DetectNameTextRaw
$DetectNameTextRaw		= c_detect(DetectName, DetectType == #eVulnerability ? f_VulnerUrl(object(DetectName)) : object(DetectName))
$AppName                = s_AppName(AppID)
$AppPath                = if(AppID && AppID != #AppIdProduct, f_AppPath(f_AppInfo(AppID)))
$AppModule              = AppID ? (AppID != #AppIdProduct ? objfile(f_AppImagePath(f_AppInfo(AppID))) : $ProductName) : $UnknownApp
$AppIcon                = s_AppIcon(AppID)
$AppIconBig             = s_AppIconBig(AppID)
$hasNativePID			= (PID && PID != #PIDProduct && PID > #PIDSystem)
$AppNativePID           = if($hasNativePID, f_ProcessInfo(PID).NativePid)
$AppCmdLine             = if(PID && PID != #PIDProduct && PID != #PIDSystem, f_ProcessInfo(PID).sCmdLine)
$AppGroup               = (val ? s_AppName(val) : $NullObj)
$TaskObjectText         = if(ObjectType == #eTask, (TaskID == #eTASK_SCAN ? format_struct(profile(ExtraInfoSub1), "ProfileName") : s_TaskID(TaskID)))
$TaskText               = s_TaskID(TaskID)
$IsTaskStateEvent       = s_IsTaskStateEvent(Verdict)
$IsEventObjInfected     = s_IsEventObjInfected(Verdict)
$IsVerdictProductStatusId = ((Verdict >= #ePROTECTION) && (Verdict <= (#ePROTECTION + 64)))
$Verdict2ProductStatusId = (Verdict - #ePROTECTION)
$IsEventObjSer          = s_IsEventObjSer(ObjectType)

$GVF_AV       = !ctl.Report.value || ctl.Report.value == #eTASK_GROUP_AV || ctl.Report.value == #eTASK_GROUP_SCAN
$GVF_NOT_SCAN = ctl.Report.value != #eTASK_GROUP_SCAN
$GVF_HIPS     = !ctl.Report.value && f_isInstalled("HipsTask") || ctl.Report.value == #eTASK_GROUP_HIPS
$GVF_NOT_CF   = ctl.Report.value != #eTASK_GROUP_UC && ctl.Report.value != #eTASK_GROUP_OS
$GVF_OS       = !ctl.Report.value && f_isInstalled("OnlineSecurity") || ctl.Report.value == #eTASK_GROUP_OS
$GVF_UC       = !ctl.Report.value && (f_isInstalled("Anti_Spam") || f_isInstalled("AdBlocker") || f_isInstalled("ParCtl")) || ctl.Report.value == #eTASK_GROUP_UC
$GVF_HAS_STAT = (ctl.Report.value == #eTASK_GROUP_PROTECTION || ctl.Report.value == #eTASK_GROUP_UC || ctl.Report.value == #eTASK_GROUP_OS || ctl.Report.value == #eTASK_GROUP_AV)

#dbGlobalObjects      = 0
#dbRTP                = 1
#dbScan               = 2
#dbUpdate             = 3
#dbNetworkPackets     = 4
#dbProcesses          = 5
#dbAppStatistic       = 6
#dbBLStatistic        = 7
#dbStatistics         = 7
#dbUpdStatistic       = 8
#dbNetworkPacketRules = 9
#dbBackup             = 10
#dbAvz                = 11

#eTASK_GROUP_PROTECTION = 0x00
#eTASK_GROUP_AV      = 0x01
#eTASK_GROUP_OS      = 0x02
#eTASK_GROUP_UC      = 0x03
#eTASK_GROUP_HIPS    = 0x04
#eTASK_GROUP_SCAN    = 0x05
#eTASK_GROUP_UPDATER = 0x06
#eTASK_GROUP_BACKUP  = 0x07
#eTASK_GROUP_AVZ     = 0x08
#eTASK_GROUP_PDM     = 0x09
#eTASK_GROUP_FW      = 0x0A

#eTASK_F_RUNTIME	 = 0x80
#eTASK_PROTECTION	 = 0x00
#eTASK_FAV	         = 0x01
#eTASK_MAV	         = 0x02
#eTASK_HTTP	         = 0x04
#eTASK_AP	         = 0x05
#eTASK_AD	         = 0x06
#eTASK_IDS	         = 0x07
#eTASK_AB	         = 0x08
#eTASK_AS	         = 0x09
#eTASK_PC	         = 0x0A
#eTASK_HIPS	         = 0x0B
#eTASK_SW            = 0x0C
#eTASK_SELFPROT      = 0x0D
#eTASK_PDM           = 0x0E
#eTASK_LIC           = 0x0F
#eTASK_FIREWALL      = 0x10
#eTASK_TRAFMON       = 0x11
#eTASK_IM_CHECK		 = 0x12
#eTASK_COMMON_BLTASK = 0x13
#eTASK_SANDBOX       = 0x14
#eTASK_NETWORK_WATCHER     = 0x15
#eTASK_SCAN          = 0x80
#eTASK_UPDATER       = 0x81
#eTASK_ROLLBACK      = 0x82
#eTASK_SNIFFER       = 0x83
#eTASK_BACKUP        = 0x84
#eTASK_AVZ_COLLECT   = 0x85
#eTASK_AVZ_SCAN      = 0x86
#eUnknown               = 0

; enVerdict
#eCLEAN		            = 1
#eDETECTED              = 2
#eSUSPICION             = 4
#eARCHIVED	            = 5
#ePACKED	            = 6
#eENCRYPTED	            = 7
#eCORRUPTED	            = 8
#ePASSWORD_PROTECTED    = 19
#ePROCESSING_ERROR      = 18
#eCANTCHANGEATTR        = 20
#eALLOWED               = 34
#eDENIED                = 33
#eREJECTED              = 40
#eNOT_PROCESSED         = 17
#eADDEDTOEXCLUDE        = 30
#eTERMINATED            = 38
#eTERMINATE_FAILED      = 39
#eDISINFECTED           = 9
#eDISINFECTED_ON_REBOOT = 25
#eDISINFECT_ON_REBOOT_FAILED = 26
#eNOT_DISINFECTED       = 10
#eCURED                 = 28
#eDELETED               = 11
#eDELETED_ON_REBOOT     = 23
#eDELETE_ON_REBOOT_FAILED = 24
#eNOT_DELETED           = 12
#eOVERWRITED	        = 27
#eQUARANTINED           = 15
#eQUARANTINED_ON_REBOOT = 31
#eNOT_QUARANTINED       = 16
#eRESTORED              = 32
#eRENAMED               = 35
#eNOT_RENAMED           = 37
#eROLLBACKED            = 43
#eROLLBACK_FAILED       = 44
#eBACKUPED              = 13
#eBACKUP_FAILED         = 14
#eREPARED               = 45
#eREPAIR_FAILED         = 46
#eDISABLED              = 47
#eCONNECTED             = 48
#eCOPIED				= 49
#eNOT_COPIED			= 50
#eSSL_ESTABLISHED       = 60
#eSSL_NOT_ESTABLISHED   = 61
#eSSL_TRY_TO_DECODE     = 62
#ePROTECTION            = 80
#eTASK_STARTED          = 0x91
#eTASK_STOPPED          = 0x92
#eTASK_FAILED           = 0x93
#eTASK_COMPLETED        = 0x94
#eUPDATER_ERROR         = 0x101
#eUPDATER               = 0x102
#eUPDATER_SOURCE_SELECTED                   = (#eUPDATER + 0x0064)
#eUPDATER_ADMIN_KIT_SOURCE_SELECTED         = (#eUPDATER + 0x0065)
#eUPDATER_PROXY_SERVER_SELECTED             = (#eUPDATER + 0x0066)
#eUPDATER_DOWNLOAD_FILE_STARTED             = (#eUPDATER + 0x0067)
#eUPDATER_FILE_DOWNLOADED                   = (#eUPDATER + 0x0068)
#eUPDATER_NEW_FILE_INSTALLED                = (#eUPDATER + 0x0069)
#eUPDATER_FILE_UPDATED                      = (#eUPDATER + 0x006B)
#eUPDATER_FILE_ROLLED_BACK                  = (#eUPDATER + 0x006C)
#eUPDATER_StartInstallFilesForUpdate		= (#eUPDATER + 0x0070)
#eUPDATER_StartInstallFilesForRetranslation = (#eUPDATER + 0x0071)
#eUPDATER_StartCopyFilesForRollback         = (#eUPDATER + 0x0072)
#eUPDATER_DNS_NAME_RESOLVED                 = (#eUPDATER + 0x0074)
#eUPDATER_ComponentIsNotUpdated             = (#eUPDATER + 0x0075)
#eUPDATER_GeneratingFileListToDownload      = (#eUPDATER + 0x0076)
#eUPDATER_ComponentIsNotRetranslated        = (#eUPDATER + 0x0077)
#eURLFLT_SWITCHPROFILE   = 0x0200
#eURLFLT_HEURISTICSTATUS = 0x0201
#eANTISPAM_NOT_SPAM = 0x0300
#eANTISPAM_PROBABLE_SPAM = 0x0301
#eANTISPAM_SPAM = 0x0302


; enObjType
#eFile        = 0x01
#eDirectory   = 0x02
#eRegKey      = 0x03
#eRegValue    = 0x04
#eProcess     = 0x05
#eThread      = 0x06
#eModule      = 0x07
#eLogSector   = 0x08
#ePhysSector  = 0x09
#eMemory	  = 0x0A
#eMailMessage = 0x0B
#eMailAttach  = 0x0C
#eURL         = 0x0D
#eScript      = 0x0E
#ePort        = 0x0F
#eConnection  = 0x10
#ePacket      = 0x11
#eDialStr     = 0x12
#eDetectName  = 0x13
#eLogicalDisk = 0x14
#eDevice      = 0x15
#eVolume      = 0x16
#eString      = 0x17
#eRegRoot     = 0x18
#eTask        = 0x19
#eNetwork     = 0x1a
#eNetworkAddr = 0x1c
#eFirewallLog = 0x1d
#eNetArpChangeInfo = 0x1e
#eDriver      = 0x1f
#eUserName    = 0x20
#ePagerData	  = 0x21
#eHipsAppGroup= 0x22

; enEventAction
#evtOpen             = 0x01
#evtCreate           = 0x02
#evtRead             = 0x03
#evtWrite            = 0x04
#evtModify           = 0x04
#evtDelete           = 0x05
#evtRename           = 0x06
#evtProcessStart     = 0x07
#evtProcessStop      = 0x08
#evtImageLoad        = 0x09
#evtImageUnload      = 0x0A
#evtSend             = 0x0B
#evtReceive          = 0x0C
#evtTerminate        = 0x0D
#evtHiddenRegistry     = 0x0F
#evtSetHook            = 0x10
#evtCodeInject         = 0x11
#evtWindowsShutDown    = 0x12
#evtKeyLogger          = 0x13
#evtSetHardLink        = 0x14
#evtSuspend            = 0x15
#evtSchedulerStart     = 0x16
#evtWMSend             = 0x17
#evtDrvStart           = 0x18
#evtServiceStart       = 0x19
#evtScreenShots        = 0x1A
#evtSelfStart          = 0x1B
#evtLLDiskAccess       = 0x1C
#evtLLFSAccess         = 0x1D
#evtClipBoardAcceess   = 0x1E
#evtCriticalCOMAccess  = 0x1F
#evtADSAccess          = 0x20
#evtDirectMemAccess    = 0x21
#evtReadProcMem        = 0x22
#evtSetDbgPrivilege    = 0x23
#evtChangeObjPrivilege = 0x24
#evtUseBrowserCL       = 0x25
#evtUseBrowserAPI      = 0x26
#evtUseDNS             = 0x27
#evtAddAppToGr         = 0x28
#evtRegistrySave       = 0x29
#evtPrtStgAccess       = 0x2a
#evtNetworkAccess      = 0x2b
#evtUseBITS            = 0x2c
#evtShellWindowsAcceess = 0x2d
#evtUserAccountAccess   = 0x2e
#evtAppGrChanged       = 0x2f
#evtOlePortAccess      = 0x30
#evtCreateKnownDlls    = 0x31

; enRDetectType
#eVirware           = 1
#eTrojware          = 2
#eMalware           = 3
#eAdware            = 4
#ePornware          = 5
#eRiskware          = 6
#eXFiles            = 20
#eSoftware          = 21
#eVulnerability     = 22
#eHidden            = 23
#ePhishing          = 30
#eDialing           = 31
#eAttack            = 32
#eBanner            = 40
#eUnwantedWebContent = 41
#eSpam              = 42
#eProbableSpam      = 43
#eHam               = 44
#eFileAccess        = 50
#eRegistryAccess	= 51
#eNetworkAccess	    = 52
#eHardwareAccess	= 53
#eSecurityAccess	= 54
#eSuspicionActivity = 60
#eScannedOjects     = 61

; enRDetectDanger
#eDDHigh		     = 1
#eDDMedium			 = 2
#eDDLow				 = 4
#eDDInformational	 = 8

; enIsExactDetect
#eExact		      = 0x01
#ePartial         = 0x02
#eHeuristic       = 0x03
#eProbably	      = 0x04

; enDecisionReason
#eUSER                = 0x0001
#eREPORTONLY          = 0x0002
#ePOSTPONED           = 0x0003
#eTASKSTOPPED         = 0x0004
#eERROR               = 0x0005
#eDATABASE            = 0x0021
#eUSER_BLACK_LIST     = 0x0022
#eWHITE_LIST          = 0x0023
#eUSER_WHITE_LIST     = 0x0024
#eEMULATOR            = 0x0025
#eBB                  = 0x0026
#eHEURISTIC           = 0x0027
#eBAYES               = 0x0028
#eGSG                 = 0x0029
#ePDB                 = 0x0030
#eSFDB                = 0x0031
#eISWIFT              = 0x0032
#eALLOWED_SENDER      = 0x0033
#eBLOCKED_SENDER      = 0x0034
#eALLOWED_PHRASE      = 0x0035
#eBLOCKED_PHRASE      = 0x0036
#eRECENTTERMS         = 0x0037
#eUNCHANGED           = 0x0038
#eKSN                 = 0x0039
#eDETECT_BYHASH       = 0x0041
#eDETECT_INFORMATION  = 0x0042
#eSIZE                = 0x0081
#eTYPE                = 0x0082
#eEXCLUDE             = 0x0083
#eTIME                = 0x0084
#eNORIGHTS            = 0x0085
#eNOTFOUND            = 0x0086
#eLOCKED              = 0x0089
#eNONCURABLE          = 0x0102
#eWRITEPROTECT        = 0x0103
#eNONOVERWRITABLE     = 0x0106
#eCOPYFAILED          = 0x0107
#eWRITEERROR          = 0x0108
#eOUTOFSPACE          = 0x0109
#eREADERROR           = 0x0110
#eDEVICENOTREADY      = 0x0111
#eWRITENOTSUPPORTED   = 0x0112
#eCANNOTBACKUP        = 0x0113
#eANTISPAM_BASE       = 0x0210
#eANTISPAM_AddedToWhiteRecipient  = (#eANTISPAM_BASE + -3)
#eANTISPAM_HasBeenTrained         = (#eANTISPAM_BASE + -2)
#eANTISPAM_Training               = (#eANTISPAM_BASE + -1)
#eANTISPAM_NeedTraining           = (#eANTISPAM_BASE + 0)
#eANTISPAM_WhiteAddress           = (#eANTISPAM_BASE + 2)
#eANTISPAM_BlackAddress           = (#eANTISPAM_BASE + 3)
#eANTISPAM_WhiteString            = (#eANTISPAM_BASE + 4)
#eANTISPAM_BlackString            = (#eANTISPAM_BASE + 5)
#eANTISPAM_AntiFishing            = (#eANTISPAM_BASE + 6)
#eANTISPAM_WhiteAddress_NOTFOUND  = (#eANTISPAM_BASE + 7)
#eANTISPAM_BlackAddress_NOTFOUND  = (#eANTISPAM_BASE + 8)
#eANTISPAM_WhiteString_NOTFOUND   = (#eANTISPAM_BASE + 9)
#eANTISPAM_BlackString_NOTFOUND   = (#eANTISPAM_BASE + 10)
#eANTISPAM_AntiFishing_NOTFOUND   = (#eANTISPAM_BASE + 11)
#eANTISPAM_MailDispatcher         = (#eANTISPAM_BASE + 12)
#eANTISPAM_Eicar                  = (#eANTISPAM_BASE + 13)
#eANTISPAM_Banner                 = (#eANTISPAM_BASE + 14)
#eANTISPAM_Banner_NOTFOUND        = (#eANTISPAM_BASE + 15)
#eANTISPAM_InvalidHTML            = (#eANTISPAM_BASE + 16)
#eANTISPAM_InvalidHTML_NOTFOUND   = (#eANTISPAM_BASE + 17)
#eANTISPAM_ExternalObj            = (#eANTISPAM_BASE + 18)
#eANTISPAM_ExternalObj_NOTFOUND   = (#eANTISPAM_BASE + 19)
#eANTISPAM_InternalObj            = (#eANTISPAM_BASE + 20)
#eANTISPAM_InternalObj_NOTFOUND   = (#eANTISPAM_BASE + 21)
#eANTISPAM_EmptyMessage           = (#eANTISPAM_BASE + 22)
#eANTISPAM_EmptyMessage_NOTFOUND  = (#eANTISPAM_BASE + 23)
#eANTISPAM_NotForMe               = (#eANTISPAM_BASE + 24)
#eANTISPAM_NotForMe_NOTFOUND      = (#eANTISPAM_BASE + 25)
#eANTISPAM_NotEnglish             = (#eANTISPAM_BASE + 26)
#eANTISPAM_NotEnglish_NOTFOUND    = (#eANTISPAM_BASE + 27)
#eANTISPAM_RecipLimit             = (#eANTISPAM_BASE + 28)
#eANTISPAM_RecipLimit_NOTFOUND    = (#eANTISPAM_BASE + 29)
#eANTISPAM_InvalidHTML_UnknownDefsCount 	 = (#eANTISPAM_BASE + 32)
#eANTISPAM_InvalidHTML_SeemsColors		 = (#eANTISPAM_BASE + 33)
#eANTISPAM_InvalidHTML_SmallText			 = (#eANTISPAM_BASE + 34)
#eANTISPAM_InvalidHTML_InvisibleCharCount	 = (#eANTISPAM_BASE + 35)
#eANTISPAM_InvalidHTML_Scripts			 = (#eANTISPAM_BASE + 36)
#eANTISPAM_InvalidHTML_HiddenElements		 = (#eANTISPAM_BASE + 37)
#eANTISPAM_CannotBeSpam					 = (#eANTISPAM_BASE + 38)
#eANTISPAM_SPAMTEST               = (#eANTISPAM_BASE + 39)
#eANTISPAM_WMUF					  = (#eANTISPAM_BASE + 41)

#eHIPS_UNKNOWN		  = 0x0301
#eHIPS_BYSIGNATURE	  = 0x0302
#eHIPS_BYKLSRL		  = 0x0303
#eHIPS_BYEMILRATING	  = 0x0304
#eHIPS_BYSCAN		  = 0x0305
#eHIPS_BYDETECTNAME	  = 0x0306

#ePDM_BYDEFAULT		  = 0x0320
#ePDM_BYUSER		  = 0x0321
#ePDM_BYSETTINGS	  = 0x0322
#ePDM_BYEXCLUDES	  = 0x0323
#ePDM_BYPREVDECISION  = 0x0324

#eSSL_INCORRECT_CERT  = 0x0400

[s_HasPath]
#eFile
#eDirectory
#eRegKey
#eRegValue
#eURL         = true

[s_TaskID]
#eTASK_PROTECTION    = $Protection
#eTASK_FAV	         = $File_Monitoring
#eTASK_MAV	         = $Mail_Monitoring
#eTASK_HTTP	         = $Web_Monitoring
#eTASK_IDS	         = $ids
#eTASK_AB	         = $AdBlocker
#eTASK_AS	         = $Anti_Spam
#eTASK_PC	         = $ParCtl
#eTASK_HIPS	         = $Hips
#eTASK_SW            = $SysWatch
#eTASK_FIREWALL      = $Fw
#eTASK_TRAFMON       = $TrafMon
#eTASK_SCAN          = $Scan_Objects
#eTASK_UPDATER       = $Updater
#eTASK_ROLLBACK      = $Rollback
#eTASK_SELFPROT      = $SelfProtection
#eTASK_PDM           = $Pdm
#eTASK_LIC           = $LicensingSubsystem
#eTASK_AVZ_COLLECT   = $AVZ_CollectSysInfo
#eTASK_AVZ_SCAN      = $AVZ_Scan
#eTASK_IM_CHECK      = $IM_Monitoring
#eTASK_NETWORK_WATCHER = $NetworkWatcher
def                  = "unk: " + @

[s_ObjectTypeIcon]
#eFile       = getIcon(@1, "file", 0, !@2, !@3, false)
#eLogSector
#ePhysSector = "bootsect"
#eMemory     = "memory"
#eMailMessage
#ePagerData
#eMailAttach = "mail"
#eRegKey
#eRegValue
#eThread
#eURL
#eScript
#ePort
#eConnection
#ePacket
#eDialStr    = "startupobj"
#eDirectory
#eProcess
#eModule     = getIcon(@1, "startupobj", 0, !@2, true, false)
#eTask       = "startupobj"
def          = if(@, "file")

[s_VerdictIcon]
#eCLEAN
#eDISINFECTED
#eDELETED
#eQUARANTINED
#eDISINFECTED_ON_REBOOT
#eOVERWRITED
#eCURED
#eQUARANTINED_ON_REBOOT
#eRESTORED
#eRENAMED
#eDENIED
#eTASK_COMPLETED
#eUPDATER_SOURCE_SELECTED
#eUPDATER_ADMIN_KIT_SOURCE_SELECTED
#eUPDATER_PROXY_SERVER_SELECTED
#eUPDATER_DOWNLOAD_FILE_STARTED
#eUPDATER_FILE_DOWNLOADED
#eUPDATER_NEW_FILE_INSTALLED
#eUPDATER_FILE_UPDATED
#eUPDATER_FILE_ROLLED_BACK
#ePROTECTION
#eANTISPAM_NOT_SPAM                  = "ok"
#eBACKUPED
#eARCHIVED
#ePACKED
#eENCRYPTED
#eCORRUPTED
#ePASSWORD_PROTECTED
#eADDEDTOEXCLUDE
#eTASK_STARTED
#eTASK_STOPPED
#eUPDATER_StartInstallFilesForUpdate
#eUPDATER_StartInstallFilesForRetranslation
#eUPDATER_StartCopyFilesForRollback
#eUPDATER_DNS_NAME_RESOLVED
#eUPDATER_GeneratingFileListToDownload      = "low"
#eDETECTED
#eNOT_DISINFECTED                           = DetectDanger == #eDDHigh ? "crit" : (DetectDanger == #eDDMedium ? "med" : "low")
#eTASK_FAILED
#eANTISPAM_SPAM                             = "crit"
#eUPDATER_ERROR                             = s_UpdaterActionIcon_Status(Error)
#eALLOWED
#eTERMINATE_FAILED
#eUPDATER_ComponentIsNotUpdated
#ePROTECTION + #ProdStateTasksDisabled
#eANTISPAM_PROBABLE_SPAM                    = "med"
def                                         = s_EventSeverityIcon(Severity)

[s_EventSeverityIcon]
#eNotifySeverityCritical
#eNotifySeverityError         = "crit"
#eNotifySeverityImportant     = "med"
def                           = "low"

[s_UpdaterActionIcon_Status]
#errUPDATER_RETRANSLATION_SUCCESSFUL = "low"
#errUPDATER_NOTHING_TO_UPDATE
#errUPDATER_CURRENT_VERSION_NEWER = "ok"
#errUPDATER_NotAllComponentsAreUpdated
#errUPDATER_ComponentRejectedByProduct
#errUPDATER_CANCELLED
#errUPDATER_NO_RESERVED_UPDATE_DESCRIPTION
#errUPDATER_UpdateSuccessfulRetranslationFailed = "med"
def = "crit"

[s_VerdictIconBacknd]
crit    = "EventErr"
med     = "EventWarn"

[s_VerdictIcon2ProdStateSeverity]
crit    = #eProtStateCrit
med     = #eProtStateWarn
def     = #eProtStateNormal

[s_ObjectTextByTask]
#eTASK_UPDATER 	= s_UpdaterObjectText(Verdict)
#eTASK_PC 		= s_ParCtlObjectText(Verdict)
def 			= if(ObjectType, $UnknownApp)

[f_ProcessInfo]
ret = c_PID(@, processInfo(@))

[f_AppInfo]
ret = c_APP(@, appInfo(@))

[s_AppName]
#AppIdProduct = $ProductName
#AppIdSystem  = $System
0			  = $NullObj
def           = f_AppNameEx(f_AppInfo(@))

[f_ProcessName]
ret = @ ? f_AppNameEx(f_ProcessInfo(@).Module) : $UnknownApp

[f_AppNameEx]
ret = @.sDescription ? @.sDescription : (@.sImagePath ? objfile(@.sImagePath) : $UnknownApp)

[f_AppPath]
ret = if(@.sImagePath, objdir(@.sImagePath))

[f_AppImagePath]
ret = @.sImagePath ? @.sImagePath : $UnknownApp

[s_AppIcon]
#AppIdProduct = "Main"
#AppIdSystem  = "system"
0	          = "unkobj"
def           = if(@, getIconAsync(f_AppInfo(@).sImagePath, "unkobj"))

[s_AppIconBig]
#AppIdProduct = "Main.big"
#AppIdSystem  = "system32"
0	          = "unkapp"
def           = if(@, getIconAsync(f_AppInfo(@).sImagePath, "unkobj", 1))

[s_PIDIcon]
#PIDProduct = "Main"
#PIDSystem  = "startupobj"
def         = if(@, getIconAsync(f_ProcessInfo(@).Module.sImagePath, "unkobj"))

[f_AppGroupName]
ret = s_AppGroupName(hipsGroup(@,1)) + hipsGroup(@,0)

[f_AppRootGroupName]
ret = s_AppGroupName(hipsGroup(@,1))

[s_PIDGroup]
#PIDProduct = $ProductName
#PIDSystem  = $System
0           = $NullObj
def         = f_PIDGroupAppText(f_ProcessInfo(@))

[f_ObjectIdText]
ret = ObjectType == #eHipsAppGroup ? f_AppRootGroupName(@) : (ObjectType == #eDevice ? s_ResGroupName(@) : @)

[s_IsTaskStateEvent]
#eTASK_STARTED
#eTASK_STOPPED
#eTASK_COMPLETED
#eTASK_FAILED           = 1

[f_IsAccessDetected]
ret = (@ == #eFileAccess || @ == #eRegistryAccess || @ == #eNetworkAccess || @ == #eHardwareAccess || @ == #eSecurityAccess)

[s_TaskId2TaskType]
#eTASK_FAV	         = "oas"
#eTASK_MAV	         = "mc"
#eTASK_HTTP	         = "wm"
#eTASK_IDS	         = "ids"
#eTASK_AB	         = "adblocker"
#eTASK_AS	         = "antispam"
#eTASK_PC	         = "parctl"
#eTASK_HIPS	         = "hips"
#eTASK_FIREWALL      = "firewall"
#eTASK_SW            = "SysWatch"
#eTASK_SELFPROT      = "selfprot"
#eTASK_PDM           = "pdm"
#eTASK_SCAN          = "ods"
#eTASK_UPDATER       = "updater"
#eTASK_ROLLBACK      = "rollback"
#eTASK_SNIFFER       = "sniffer"
#eTASK_IM_CHECK		 = "imc"

[s_TaskType2TaskId]
oas                  = #eTASK_FAV
mc                   = #eTASK_MAV
wm                   = #eTASK_HTTP
ids                  = #eTASK_IDS
adblocker            = #eTASK_AB
antispam             = #eTASK_AS
parctl               = #eTASK_PC
hips                 = #eTASK_HIPS
firewall             = #eTASK_FIREWALL
SysWatch             = #eTASK_SW
selfprot             = #eTASK_SELFPROT
pdm                  = #eTASK_PDM
ods                  = #eTASK_SCAN
updater              = #eTASK_UPDATER
rollback             = #eTASK_ROLLBACK
sniffer              = #eTASK_SNIFFER
imc					 = #eTASK_IM_CHECK

[s_IsEventObjInfected]
#eDETECTED
#eNOT_DISINFECTED
#eDISINFECTED
#eDISINFECTED_ON_REBOOT
#eDISINFECT_ON_REBOOT_FAILED
#eCURED
#eALLOWED
#eDENIED
#eDELETED
#eDELETED_ON_REBOOT
#eDELETE_ON_REBOOT_FAILED
#eNOT_DELETED
#eOVERWRITED
#eQUARANTINED
#eQUARANTINED_ON_REBOOT
#eNOT_QUARANTINED
#eRESTORED
#eRENAMED
#eNOT_RENAMED
#eROLLBACKED
#eROLLBACK_FAILED
#eBACKUP_FAILED
#eREPARED
#eTERMINATED
#eTERMINATE_FAILED
#eREPAIR_FAILED = 1

[s_IsEventObjSer]
#ePacket
#eFirewallLog
#eNetArpChangeInfo = 1

[s_ProcessBackndByGroupName]
KLAppRestrictedLow
KLAppRestrictedHi   = "EventWarn"
KLAppUntrusted      = "EventErr"
