observeit

Expression

product = "observeit"

Fields

Field	Core	Detection	Informational
src_ip		✓
os			✓
domain		✓
session_id			✓
dest_host		✓
fallback_user_name
domain_user_name
user	✓	✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
alert-trigger	src_ip	Legacy	✓	✓
	os
	additional_info
	process_name	Legacy		✓
	alert_id	Legacy			✓
	domain
	dest_host	Legacy		✓
	session_id
	domain_user_name
	src_host	Legacy	✓	✓
	user	Legacy		✓
	target
app-activity	additional_info	Default			✓
	dest_ip	Default		✓
	src_host	Default		✓
	object	Default			✓
app-login
database-activity	dest_local_user_name
	db_name	Default			✓
	process_name	Default			✓
	dest_user	Default		✓
	src_host	Default		✓
	db_object	Default			✓
endpoint-login
process-create