search

Expression

product = "search"

Fields

There are no fields for this extension.

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
alert-trigger	trigger_type
	local_user_name
	src_host	Legacy	✓	✓
	rule_usecases				✓
	original_risk_score
	log_time
	base_risk_score
	event_id				✓
	trigger_entity
	dest_host	Legacy		✓
	mitre_labels				✓
	alert_reason				✓
	asset_labels				✓
	user	Legacy		✓
	event_time				✓
app-activity	src_ip	Default		✓
	additional_info	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
app-login	src_ip	Default		✓
	additional_info	Default			✓
app-notification	src_ip	Default		✓
	app	Default			✓
	additional_info	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
group-modify	src_ip
	app
	additional_info
	domain	Legacy			✓
	domain_user_name
	user	Legacy	✓
	operation
log_source-add	src_ip	Default		✓
	app	Default			✓
	additional_info	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
log_source-modify	src_ip	Default		✓
	app	Default			✓
	additional_info	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
role-delete	src_ip	Default		✓
	app	Default			✓
	additional_info	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
role-permission-modify	src_ip	Default		✓
	app	Default			✓
	additional_info	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
rule-create	src_ip	Default		✓
	app	Default			✓
	additional_info	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓