globalprotect

Expression

product = "globalprotect"

Fields

Field	Core	Detection	Informational
src_ip		✓
os			✓
src_country			✓
domain		✓
fallback_user_name
domain_user_name
user	✓	✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-activity	app	Default			✓
	src_mac	Default			✓
	auth_method	Default			✓
	additional_info	Default			✓
	dest_ip	Default		✓
	vpn_client	Default			✓
	event_name	Default			✓
	device_type	Default			✓
	src_host	Default		✓
	object	Default			✓
app-login
configuration-modify	object				✓
vpn-authentication
vpn-login	vpn_client	Default			✓
vpn-logout	vpn_client				✓