forcepoint dlp

Expression

product = "forcepoint dlp"

Fields

There are no fields for this extension.

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
alert-trigger	email_attachment
	extension
	file_name	Legacy	✓
	last_name
	domain_user_name
	src_host	Legacy	✓	✓
	target_domain
	url
	target
	result
	src_ip	Legacy	✓	✓
	external_address
	full_name
	sender	Legacy	✓
	web_domain
	bytes	Legacy		✓
	recipients
	domain
	bytes_unit
	email_subject
	user	Legacy		✓
	first_name
peripheral_storage-activity	file_path	Default			✓
	device_product				✓
	file_ext	Default			✓
	file_name	Default			✓
	device_pid				✓
	file_dir	Default			✓
	device_description				✓
	device_class				✓
	device_vendor				✓
	device_vid				✓
	operation_details	Default			✓