endpoint

Expression

product = "endpoint"

Fields

There are no fields for this extension.

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
alert-trigger	src_ip	Legacy	✓	✓
	malware_file_name
	process_name	Legacy		✓
	alert_id	Legacy			✓
	dest_ip	Legacy	✓	✓
	domain
	action	Legacy			✓
	malware_url
	domain_user_name
	src_host	Legacy	✓	✓
	user	Legacy		✓