cyberark privilege access manager

Expression

product = "cyberark privilege access manager"

Fields

Field	Core	Detection	Informational
src_ip			✓
event_code			✓
dest_ip			✓
dest_service_name			✓
dest_host			✓
safe_value			✓
dest_port			✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-activity	file_path	Default			✓
	resource	Default			✓
	file_name	Default			✓
	file_dir	Default			✓
	app_group	Default			✓
	domain_user_name
	src_host	Default		✓
	event_subtype	Default			✓
	file_ext	Default			✓
	additional_info	Default			✓
	file_type	Default			✓
	process_name	Default			✓
	domain	Default			✓
	user	Default		✓
	object	Default			✓
app-login	src_ip	Default		✓
	protocol	Default			✓
	event_code	Default			✓
	event_subtype	Default			✓
	src_host	Default		✓
	url	Default			✓
app-logout	domain	Default			✓
	operation	Default			✓
app-notification	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
endpoint-login	process_name	Default			✓
	src_host	Default		✓
	operation	Default			✓
	command	Default			✓
file-delete	db_name
	additional_info
	domain
	domain_user_name
	device_type
	src_host	Legacy		✓
	user	Legacy	✓	✓
	record_type
	safe_name
file-permission-modify	db_name
	additional_info
	domain
	domain_user_name
	device_type
	src_host
	user	Legacy	✓	✓
	record_type
	safe_name
file-property-delete	domain	Default			✓
	domain_user_name
	operation	Default			✓
	user	Default		✓
file-read	db_name
	additional_info
	domain
	domain_user_name
	device_type	Legacy			✓
	src_host	Legacy		✓
	user	Legacy	✓	✓
	record_type
	safe_name
file-write	db_name
	additional_info
	domain
	domain_user_name
	device_type	Legacy			✓
	src_host
	user	Legacy	✓	✓
	record_type
	safe_name
password-create	protocol	Default			✓
	process_name	Default			✓
	domain	Default			✓
	session_id	Default			✓
	src_host	Default		✓
	operation	Default			✓
	command	Default			✓
password-use	protocol	Default			✓
	process_name	Default			✓
	domain	Default			✓
	session_id	Default			✓
	src_host	Default		✓
	operation	Default			✓
	command	Default			✓
user-password-modify	src_host	Default		✓
user-password-read	gateway_station
	process_name	Legacy			✓
	event_code	Legacy			✓
	domain	Legacy			✓
	session_id
	domain_user_name
	src_host	Legacy			✓
	user	Legacy	✓
	command
user-password-reset	src_host