airlock waf

Expression

product = "airlock waf"

Fields

Field	Core	Detection	Informational
action			✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-login	file_path	Default			✓
	file_name	Default			✓
	alert_severity	Default			✓
	file_dir	Default			✓
	session_id	Default			✓
	src_port	Default			✓
	src_ip	Default		✓
	file_ext	Default			✓
	event_code	Default			✓
	bytes	Default			✓
	dest_ip	Default		✓
	event_name	Default			✓
	dest_port	Default			✓
file-delete	src_port
	src_ip
	event_code
	bytes
	alert_severity
	dest_ip
	domain
	session_id
	event_name
	domain_user_name
	user	Legacy	✓	✓
	dest_port
file-download	src_port
	src_ip
	event_code
	bytes	Legacy		✓
	alert_severity
	dest_ip
	domain
	session_id
	event_name
	domain_user_name
	user	Legacy	✓	✓
	dest_port
file-upload	src_port
	src_ip
	event_code
	bytes
	alert_severity
	dest_ip
	domain
	session_id
	event_name
	domain_user_name
	user	Legacy	✓	✓
	dest_port
file-write	src_port
	src_ip
	event_code
	bytes	Legacy		✓
	alert_severity
	dest_ip
	domain
	session_id
	event_name
	domain_user_name
	user	Legacy	✓	✓
	dest_port
http-session	additional_info	Default			✓
	result_code	Default			✓
network-session	file_path	Default			✓
	file_ext	Default			✓
	event_code	Default			✓
	file_name	Default			✓
	alert_severity	Default			✓
	domain	Default			✓
	file_dir	Default			✓
	session_id	Default			✓
	event_name	Default			✓
	domain_user_name
	operation	Default			✓
	user	Default		✓
vpn-logout	src_port
	file_path
	file_ext
	event_code
	bytes
	file_name
	alert_severity
	dest_ip
	file_dir
	session_id
	event_name
	dest_port