centrify zero trust privilege services

Expression

product = "centrify zero trust privilege services"

Fields

Field	Core	Detection	Informational
event_name			✓
object			✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-activity	src_ip	Default		✓
	auth_method	Default			✓
	os	Default			✓
	additional_info	Default			✓
	dest_ip	Default		✓
	domain	Default			✓
	dest_host	Default		✓
	domain_user_name
	user	Default		✓
	user_agent	Default			✓
role-create	src_ip	Default		✓
	os	Default			✓
	additional_info	Default			✓
	dest_ip	Default		✓
	domain	Default			✓
	dest_host	Default		✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	user_agent	Default			✓
role-delete	src_ip	Default		✓
	os	Default			✓
	additional_info	Default			✓
	dest_ip	Default		✓
	domain	Default			✓
	dest_host	Default		✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	user_agent	Default			✓
role-modify	src_ip	Default		✓
	os	Default			✓
	additional_info	Default			✓
	dest_ip	Default		✓
	domain	Default			✓
	dest_host	Default		✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	user_agent	Default			✓
user-create	src_ip
	os
	additional_info
	dest_ip
	domain	Legacy			✓
	dest_host	Legacy		✓
	domain_user_name
	user	Legacy	✓	✓
	operation
	user_agent
user-delete	src_ip
	os
	additional_info
	dest_ip
	domain	Legacy			✓
	dest_host	Legacy			✓
	domain_user_name
	user	Legacy	✓	✓
	operation
	user_agent
user-password-modify	src_ip	Default		✓
	os	Default			✓
	additional_info	Default			✓
	dest_ip	Default		✓
	domain	Default			✓
	dest_host	Default		✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	user_agent	Default			✓
user-switch	process_id
	process_name
	service_name
	process_dir
	process_path