symantec cloudsoc

Expression

product = "symantec cloudsoc"

Fields

There are no fields for this extension.

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
alert-trigger	file_path	Legacy			✓
	resource
	file_name	Legacy	✓
	file_dir	Legacy			✓
	domain_user_name
	src_ip	Legacy	✓	✓
	full_name
	process_name	Legacy		✓
	browser
	domain
	operation
	user	Legacy		✓
	user_agent
app-activity	app	Default			✓
	file_path	Default			✓
	object_type	Default			✓
	file_name	Default			✓
	file_dir	Default			✓
	domain_user_name
	src_ip	Default		✓
	file_ext	Default			✓
	additional_info	Default			✓
	domain	Default			✓
	user	Default		✓
	user_agent	Default			✓
	object	Default			✓