forcepoint insider threat

Expression

product = "forcepoint insider threat"

Fields

There are no fields for this extension.

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
alert-trigger	domain
	domain_user_name
	src_host	Legacy	✓	✓
	user	Legacy		✓
	target