slack

Expression

product = "slack"

Fields

Field	Core	Detection	Informational
user_id			✓
file_type			✓
dest_ip			✓
dest_host			✓
user_agent			✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-login	file_ext	Default			✓
	file_name	Default			✓
app-logout	app	Default			✓
	domain	Default			✓
	operation	Default			✓
	object	Default			✓
channel-create	operation	Default			✓
channel-delete	src_ip	Default		✓
	app	Default			✓
	operation	Default			✓
	object	Default			✓
channel-member-join	app	Default			✓
	operation	Default			✓
	object	Default			✓
channel-member-leave	app	Default			✓
	operation	Default			✓
	object	Default			✓
channel-modify	src_ip	Default		✓
	app	Default			✓
	operation	Default			✓
	object	Default			✓
file-download	domain
	domain_user_name
	user	Legacy	✓	✓
file-share	domain	Default			✓
	domain_user_name
	user	Default		✓
file-upload	domain
	domain_user_name
	user	Legacy	✓	✓
group-member-add	src_ip
	app
	domain	Legacy			✓
	domain_user_name
	user	Legacy	✓	✓
	operation
	object
group-member-remove	src_ip
	app
	domain	Legacy			✓
	domain_user_name
	user	Legacy	✓	✓
	operation
	object
group-role-assign	src_ip	Default		✓
	app	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	object	Default			✓
group-role-modify	src_ip	Default		✓
	app	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	object	Default			✓
group-role-revoke	src_ip	Default		✓
	app	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	object	Default			✓
user-create	src_ip
	app
	domain	Legacy			✓
	domain_user_name
	user	Legacy	✓	✓
	operation
	object
user-disable	app
	domain	Legacy			✓
	domain_user_name
	operation
	user	Legacy	✓	✓
	object
user-enable	src_ip
	app
	domain	Legacy			✓
	domain_user_name
	user	Legacy	✓	✓
	operation
	object
user-modify	src_ip
	app
	domain	Legacy			✓
	domain_user_name
	user	Legacy	✓
	operation
	object
user-permission-modify	src_ip
	app
	domain	Legacy			✓
	domain_user_name
	user	Legacy	✓
	operation
	object
user-role-assign	src_ip	Default		✓
	app	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	object	Default			✓
user-role-modify	src_ip	Default		✓
	app	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	object	Default			✓
user-role-revoke	src_ip	Default		✓
	app	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	object	Default			✓
workspace-create	src_ip	Default		✓
	app	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	object	Default			✓
workspace-delete	src_ip	Default		✓
	app	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	object	Default			✓
workspace-member-add	src_ip	Default		✓
	app	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
	object	Default			✓