epic siem

Expression

product = "epic siem"

Fields

There are no fields for this extension.

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-activity	app	Default			✓
	resource	Default			✓
	local_user_name
	src_host	Default		✓
	result	Default			✓
	src_ip	Default		✓
	event_id	Default			✓
	additional_info	Default			✓
	user_id	Default			✓
	dest_ip	Default		✓
	dest_host	Default		✓
	user	Default		✓
	account	Default		✓
	object	Default			✓
app-authentication	dest_host	Default		✓
	src_host	Default		✓
app-login	resource	Default			✓
	additional_info	Default			✓
	dest_ip	Default		✓
	dest_host	Default		✓
	src_host	Default		✓
	operation	Default			✓
user-password-modify	src_ip	Default		✓
	event_id	Default			✓
	resource	Default			✓
	additional_info	Default			✓
	user_id	Default			✓
	dest_ip	Default		✓
	src_host	Default		✓
	operation	Default			✓
	object	Default			✓
user-switch	result
	additional_info
	dest_host
	src_host
	operation