powertech identity & access manager

Expression

product = "powertech identity & access manager"

Fields

Field	Core	Detection	Informational
domain			✓
fallback_user_name
domain_user_name
user		✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
endpoint-login
file-delete	src_ip			✓
	event_code				✓
file-read	src_ip			✓
	event_code				✓
file-write	src_ip			✓
	event_code				✓
process-create	src_ip	Default		✓
	event_code	Default			✓
user-switch	event_code				✓
	dest_ip			✓