safend dps
October 17, 2024 · View on GitHub
Expression
product = "safend dps"
Fields
| Field | Core | Detection | Informational |
|---|---|---|---|
| domain | ✓ | ||
| fallback_user_name | |||
| domain_user_name | |||
| user | ✓ | ✓ | |
| operation | ✓ |
Activity Types
| Activity Type | Field | Status | Core | Detection | Informational |
|---|---|---|---|---|---|
| file-read | device_id | Legacy | ✓ | ||
| os | ✓ | ||||
| bytes_out | ✓ | ||||
| device_type | Legacy | ✓ | |||
| file-write | device_id | Legacy | ✓ | ||
| os | ✓ | ||||
| bytes_in | ✓ | ||||
| device_type | Legacy | ✓ | |||
| peripheral_storage-activity | device_product | ✓ | |||
| device_pid | ✓ | ||||
| device_description | ✓ | ||||
| device_class | ✓ | ||||
| device_vendor | ✓ | ||||
| device_vid | ✓ |