ibm resource access control facility

Expression

product = "ibm resource access control facility"

Fields

Field	Core	Detection	Informational
additional_info			✓
dest_ip			✓
db_user			✓
fallback_user_name
user			✓
database_user_name
object			✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-activity	identifier	Default			✓
	group_name	Default			✓
	dest_user	Default		✓
	terminal	Default			✓
	src_host	Default		✓
	alert_type	Default			✓
	manager_name	Default			✓
	environment	Default			✓
	dest_domain_user_name
	user_id	Default			✓
	additional_info	Default			✓
	event_code	Default			✓
	process_name	Default			✓
	domain	Default			✓
	dest_host	Default		✓
	manager_email	Default			✓
app-login	manager_name	Default			✓
	identifier	Default			✓
	environment	Default			✓
	manager	Default			✓
	user_id	Default			✓
	group_name	Default			✓
	process_name	Default			✓
	dest_host	Default		✓
	src_host	Default		✓
	terminal	Default			✓
	operation	Default			✓
	alert_type	Default			✓
database-activity	event_name	Default			✓
	command	Default			✓