microsoft windows
December 9, 2025 · View on GitHub
Expression
product = microsoft windows
Fields
There are no fields for this extension.
Activity Types
| Activity Type | Field | Status | Core | Detection | Informational |
|---|---|---|---|---|---|
| alert-trigger | login_id | ||||
| process_id | |||||
| event_name_code | |||||
| service_type_text | ✓ | ||||
| event_name_name | |||||
| threat_id | |||||
| domain_user_name | |||||
| result | |||||
| event_id | |||||
| additional_info | |||||
| process_name | Legacy | ✓ | |||
| domain | |||||
| hash_md5 | |||||
| user_sid | |||||
| operation_id | |||||
| malware_url | |||||
| provider_name | |||||
| user | Legacy | ✓ | |||
| auth_process |