netwrix auditor

Expression

product = "netwrix auditor"

Fields

There are no fields for this extension.

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-activity	app	Default			✓
	resource	Default			✓
	object_type	Default			✓
	domain_user_name
	src_host	Default		✓
	monitoring_plan	Default			✓
	event_id	Default			✓
	additional_info	Default			✓
	event_code	Default			✓
	domain	Default			✓
	dest_host	Default		✓
	user	Default		✓
	object	Default			✓
app-login	additional_info	Default			✓
	src_host	Default		✓
database-activity	src_ip	Default		✓
	db_name	Default			✓
	additional_info	Default			✓
	service_name	Default			✓
	domain	Default			✓
	dest_host	Default		✓
	domain_user_name
	user	Default		✓
database-login	src_ip	Default		✓
	db_name	Default			✓
	additional_info	Default			✓
	service_name	Default			✓
	dest_host	Default		✓
ds_object-activity	additional_info	Default			✓
	domain	Default			✓
	domain_user_name
	src_host	Default		✓
	user	Default		✓
ds_object-create	event_id	Default			✓
	resource	Default			✓
	additional_info	Default			✓
	event_code	Default			✓
	domain	Default			✓
	dest_host	Default		✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	monitoring_plan	Default			✓
	object	Default			✓
ds_object-delete	event_id	Default			✓
	resource	Default			✓
	additional_info	Default			✓
	event_code	Default			✓
	domain	Default			✓
	dest_host	Default		✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	monitoring_plan	Default			✓
	object	Default			✓
ds_object-modify	event_id	Default			✓
	resource	Default			✓
	additional_info	Default			✓
	event_code	Default			✓
	domain	Default			✓
	dest_host	Default		✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	monitoring_plan	Default			✓
	object	Default			✓
file-delete	src_ip
	access	Legacy		✓
	event_id
	file_type	Legacy			✓
	event_code
	domain
	domain_user_name
	src_host	Legacy		✓
	user	Legacy	✓	✓
file-write	src_ip
	access	Legacy		✓
	event_id
	file_type	Legacy			✓
	event_code
	domain
	domain_user_name
	src_host
	user	Legacy	✓	✓
group-member-add	additional_info
	domain	Legacy			✓
	domain_user_name
	src_host	Legacy		✓
	user	Legacy	✓	✓
group-member-remove	additional_info
	domain	Legacy			✓
	domain_user_name
	src_host	Legacy		✓
	user	Legacy	✓	✓
role-create	event_id	Default			✓
	resource	Default			✓
	additional_info	Default			✓
	event_code	Default			✓
	domain	Default			✓
	dest_host	Default		✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	monitoring_plan	Default			✓
	object	Default			✓
user-create	event_id
	resource
	additional_info
	event_code
	domain	Legacy			✓
	dest_host	Legacy		✓
	domain_user_name
	user	Legacy	✓	✓
	operation
	monitoring_plan
	object
user-delete	event_id
	resource
	additional_info
	event_code
	domain	Legacy			✓
	dest_host	Legacy			✓
	domain_user_name
	user	Legacy	✓	✓
	operation
	monitoring_plan
	object
user-disable	additional_info
	domain	Legacy			✓
	domain_user_name
	src_host
	user	Legacy	✓	✓
user-lock	additional_info
	domain
	domain_user_name
	src_host	Legacy	✓	✓
	user	Legacy	✓	✓
user-modify	event_id
	resource
	additional_info
	event_code	Legacy			✓
	domain	Legacy			✓
	dest_host	Legacy			✓
	domain_user_name
	user	Legacy	✓
	operation
	monitoring_plan
	object
user-password-reset	additional_info
	src_host
user-unlock	additional_info
	domain
	domain_user_name
	src_host
	user	Legacy	✓	✓