sftp
March 22, 2023 · View on GitHub
Expression
product = "sftp"
Fields
| Field | Core | Detection | Informational |
|---|---|---|---|
| src_ip | ✓ | ||
| access | ✓ | ||
| bytes | ✓ | ||
| dest_ip | ✓ | ||
| src_host | ✓ | ||
| dest_port | ✓ | ||
| user_agent | ✓ |
Activity Types
| Activity Type | Field | Status | Core | Detection | Informational |
|---|---|---|---|---|---|
| app-login | |||||
| file-delete | user | Legacy | ✓ | ✓ | |
| file-download | user | Legacy | ✓ | ✓ | |
| file-read | user | Legacy | ✓ | ✓ | |
| file-upload | user | Legacy | ✓ | ✓ | |
| file-write | user | Legacy | ✓ | ✓ |