assetview
October 17, 2024 · View on GitHub
Expression
product = "assetview"
Fields
| Field | Core | Detection | Informational |
|---|---|---|---|
| domain | ✓ | ||
| fallback_user_name | |||
| domain_user_name | |||
| user | ✓ | ✓ |
Activity Types
| Activity Type | Field | Status | Core | Detection | Informational |
|---|---|---|---|---|---|
| file-download | process_name | Legacy | ✓ | ||
| file-write | process_name | Legacy | ✓ | ||
| asset_id | ✓ | ||||
| peripheral_storage-insert | device_product | ✓ | |||
| usb_vendor | ✓ | ||||
| device_pid | ✓ | ||||
| vendor_id | ✓ | ||||
| device_description | ✓ | ||||
| device_class | ✓ | ||||
| device_vendor | ✓ | ||||
| device_vid | ✓ | ||||
| usb_serial_number | ✓ | ||||
| printer-activity | file_name | Legacy | ✓ | ✓ | |
| num_pages | Legacy | ✓ | |||
| printer_name | Legacy | ✓ | ✓ | ||
| asset_id | ✓ |