anyconnect

Expression

product = "anyconnect"

Fields

Field	Core	Detection	Informational
dest_host		✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
network-session	system_manufacturer	Default			✓
	os	Default			✓
	bytes_in	Default			✓
	module_hash_names	Default			✓
	parent_process_name	Default			✓
	parent_process_hash	Default			✓
	os_version	Default			✓
	domain_user_name
	os_environment	Default			✓
	bytes_out	Default			✓
	process_hash	Default			✓
	virtual_station_name	Default			✓
	system_type	Default			✓
	process_name	Default			✓
	domain	Default			✓
	packet_rate	Default			✓
	udid	Default			✓
	user	Default		✓
vpn-login	src_translated_ip	Default			✓
	os	Default			✓
	event_code	Default			✓
	dest_ip	Default		✓
	realm	Default			✓
	priority	Default			✓
vpn-logout	dest_ip			✓
	realm	Legacy			✓
	src_host			✓
	session_duration	Legacy		✓
	dest_port			✓