servicenow

Expression

product = "servicenow"

Fields

Field	Core	Detection	Informational
src_ip			✓
resource			✓
event_name			✓
object			✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-activity	app	Default			✓
	file_path	Default			✓
	file_name	Default			✓
	domain_user_name
	table_name	Default			✓
	dproc	Default			✓
	file_ext	Default			✓
	additional_info	Default			✓
	bytes	Default			✓
	file_type	Default			✓
	domain	Default			✓
	event_name	Default			✓
	user	Default		✓
	new_value	Default			✓
	table	Default			✓
app-login
file-delete	bytes
	file_type	Legacy			✓
	domain
	action
	domain_user_name
	old_value
	user	Legacy	✓	✓
	operation
	table_name
	table
	new_value
	dproc
file-download	bytes	Legacy		✓
	file_type	Legacy			✓
	domain
	action
	domain_user_name
	old_value
	user	Legacy	✓	✓
	operation
	table_name
	table
	new_value
	dproc
file-read	bytes	Legacy			✓
	file_type	Legacy			✓
	domain
	action
	domain_user_name
	old_value
	user	Legacy	✓	✓
	operation
	table_name
	table
	new_value
	dproc
file-upload	bytes
	file_type	Legacy			✓
	domain
	action
	domain_user_name
	old_value
	user	Legacy	✓	✓
	operation
	table_name
	table
	new_value
	dproc