In aSymantec Endpoint Detection and Response (SEDR)database search, an event labeled withoperation:1corresponds to aFile Openaction. This identifier is part of SEDR’s internal operation codes used to log file interactions. When querying or analyzing events in the SEDR database, recognizing this code helps Incident Responders understand that the action recorded was an attempt to access or open a file on the endpoint, which may be relevant in tracking suspicious or malicious activities.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit