bitglass casb

Expression

product = "bitglass casb"

Fields

Field	Core	Detection	Informational
os		✓
domain		✓
fallback_user_name
domain_user_name
user	✓	✓
user_agent		✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
alert-trigger	file_ext
	additional_info
	file_name	Legacy	✓
	process_name	Legacy		✓
	user	Legacy		✓
	target
app-login	src_ip	Default		✓
	additional_info	Default			✓
	dest_ip	Default		✓
	event_name	Default			✓
	user_group_name	Default			✓
email-send	src_ip	Default		✓
file-download	additional_info				✓
	dest_ip			✓
	event_name				✓
	user_group_name			✓
file-read	src_ip			✓
	file_url			✓
	access	Legacy		✓
file-write	src_ip			✓
	file_url			✓
	access	Legacy		✓