All alerts that have iv_alert.alertType = 13 are NTBA worm alerts.
The worm alert has anomaly measure data block, hosts block, and 3 sets of data blocks with base and observed values showing the deviation. The hosts block contains a list of host IDs which were involved in the worm attack. The observed and base data blocks are for bi-directional out connection and sent received ratios.
Worm alert type specific data
.png "GUID-F852B01F-28AC-4899-ABDF-67FFBF0FEF1C-low.png")