advanced analytics

Expression

product = "advanced analytics"

Fields

There are no fields for this extension.

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
alert-trigger	trigger_type
	rule
	domain_user_name
	rule_usecases
	src_ip	Legacy	✓	✓
	trigger_entity
	rule_description
	incident_creation_time
	session_id				✓
	src_host	Legacy	✓	✓
	original_risk_score
	event_category
	log_time
	url				✓
	rule_id
	base_risk_score
	event_id				✓
	rule_reason
	domain
	dest_ip	Legacy	✓	✓
	dest_host	Legacy		✓
	mitre_labels
	asset_labels
	user	Legacy		✓
	event_time				✓
	container_id