code42 incydr

Expression

product = "code42 incydr"

Fields

There are no fields for this extension.

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
email-send	bytes	Default			✓
	file_type	Default			✓
	event_code	Default			✓
	log_source	Default			✓
	src_host	Default		✓
file-delete	mime
	tab_title
	domain_user_name
	device_type
	sync_destination
	email_dlp_from
	file_category
	process_name	Legacy			✓
	file_type	Legacy			✓
	removable_media_volume_name
	hash_md5
	time_created
	directory_id
	device_id
	service_name
	exposure_type
	file_owner
	src_host	Legacy		✓
	tab_url
	removable_media_capacity
	removable_media_partition_id
	time_modified
	additional_info
	sender
	removable_media_vendor
	domain
	removable_media_bus_type
	log_source
	file_id
	email_dlp_policy_names
	removable_media_serial_number
	cloud_drive_id
	shared
	device_size
	access	Legacy		✓
	removable_media_name
	private_ip
	src_ip
	src_translated_ip
	shared_with
	device_name
	event_code
	detection_source_alias
	process_owner
	url
	hash_sha256
	bytes
	file_exposure_changed_to
	dest_host	Legacy		✓
	removable_media_media_name
	device_vendor
	user	Legacy	✓	✓
	user_uid
file-download	mime
	tab_title
	domain_user_name
	device_type
	sync_destination
	email_dlp_from
	file_category
	process_name	Legacy			✓
	file_type	Legacy			✓
	removable_media_volume_name
	hash_md5
	time_created
	directory_id
	device_id
	service_name
	exposure_type
	file_owner
	src_host	Legacy			✓
	tab_url
	removable_media_capacity
	removable_media_partition_id
	time_modified
	additional_info
	sender
	removable_media_vendor
	domain
	removable_media_bus_type
	log_source
	file_id
	email_dlp_policy_names
	removable_media_serial_number
	cloud_drive_id
	shared
	device_size
	access
	removable_media_name
	private_ip
	src_ip
	src_translated_ip
	shared_with
	device_name
	event_code
	detection_source_alias
	process_owner
	url
	hash_sha256
	bytes	Legacy
	file_exposure_changed_to
	dest_host	Legacy			✓
	removable_media_media_name
	device_vendor
	user	Legacy	✓	✓
	user_uid
file-read	mime
	tab_title
	domain_user_name
	device_type	Legacy			✓
	sync_destination
	email_dlp_from
	file_category
	process_name	Legacy			✓
	file_type	Legacy			✓
	removable_media_volume_name
	hash_md5
	time_created
	directory_id
	device_id	Legacy		✓
	service_name
	exposure_type
	file_owner
	src_host	Legacy		✓
	tab_url
	removable_media_capacity
	removable_media_partition_id
	time_modified
	additional_info
	sender
	removable_media_vendor
	domain
	removable_media_bus_type
	log_source
	file_id
	email_dlp_policy_names
	removable_media_serial_number
	cloud_drive_id
	shared
	device_size
	access	Legacy		✓
	removable_media_name
	private_ip
	src_ip
	src_translated_ip
	shared_with
	device_name
	event_code
	detection_source_alias
	process_owner
	url
	hash_sha256
	bytes	Legacy
	file_exposure_changed_to
	dest_host	Legacy		✓
	removable_media_media_name
	device_vendor
	user	Legacy	✓	✓
	user_uid
file-upload	mime
	tab_title
	domain_user_name
	device_type
	sync_destination
	email_dlp_from
	file_category
	process_name	Legacy			✓
	file_type	Legacy			✓
	removable_media_volume_name
	hash_md5
	time_created
	directory_id
	device_id
	service_name
	exposure_type
	file_owner
	src_host	Legacy			✓
	tab_url
	removable_media_capacity
	removable_media_partition_id
	time_modified
	additional_info
	sender
	removable_media_vendor
	domain
	removable_media_bus_type
	log_source
	file_id
	email_dlp_policy_names
	removable_media_serial_number
	cloud_drive_id
	shared
	device_size
	access
	removable_media_name
	private_ip
	src_ip
	src_translated_ip
	shared_with
	device_name
	event_code
	detection_source_alias
	process_owner
	url
	hash_sha256
	bytes
	file_exposure_changed_to
	dest_host	Legacy			✓
	removable_media_media_name
	device_vendor
	user	Legacy	✓	✓
	user_uid
file-write	mime
	tab_title
	domain_user_name
	device_type	Legacy			✓
	sync_destination
	email_dlp_from
	file_category
	process_name	Legacy			✓
	file_type	Legacy			✓
	removable_media_volume_name
	hash_md5
	time_created
	directory_id
	device_id	Legacy		✓
	service_name
	exposure_type
	file_owner
	src_host
	tab_url
	removable_media_capacity
	removable_media_partition_id
	time_modified
	additional_info
	sender
	removable_media_vendor
	domain
	removable_media_bus_type
	log_source
	file_id
	email_dlp_policy_names
	removable_media_serial_number
	cloud_drive_id
	shared
	device_size
	access	Legacy		✓
	removable_media_name
	private_ip
	src_ip
	src_translated_ip
	shared_with
	device_name
	event_code
	detection_source_alias
	process_owner
	url
	hash_sha256
	bytes	Legacy
	file_exposure_changed_to
	dest_host	Legacy		✓
	removable_media_media_name
	device_vendor
	user	Legacy	✓	✓
	user_uid
peripheral_storage-insert	device_product				✓
	drive_letter
	device_description				✓
	vendor_name
	usb_serial_number
	src_translated_ip
	src_ip
	device_name
	usb_vendor
	user_id
	device_pid				✓
	device_class				✓
	device_vendor				✓
	device_vid				✓
	operation
printer-activity	src_ip
	device_id
	user_id
	event_code
	dest_ip
	log_source
	local_user_name
	printer_name	Legacy	✓	✓
	src_host	Legacy			✓
	user	Legacy	✓	✓
	object