symantec dlp

Expression

product = "symantec dlp"

Fields

Field	Core	Detection	Informational
src_ip		✓
domain		✓
fallback_user_name
domain_user_name
src_host	✓	✓
user	✓	✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
alert-trigger	email_id
	file_path	Legacy			✓
	local_user_name
	device_type
	result
	src_ip	Legacy	✓	✓
	external_address
	protocol	Legacy		✓
	process_name	Legacy		✓
	alert_id	Legacy			✓
	occured_time
	direction
	email_attachment
	device_id
	os
	file_name	Legacy	✓
	file_dir	Legacy			✓
	original_user
	process_dir
	src_host	Legacy	✓	✓
	url
	recorded_time
	target
	file_ext
	additional_info
	sender	Legacy	✓
	web_domain
	bytes	Legacy		✓
	recipients
	dest_ip	Legacy	✓	✓
	recipient
	dest_host	Legacy		✓
	process_path	Legacy		✓
	operation
	email_subject
	user	Legacy		✓
file-delete	device_id				✓
	bytes_in			✓
	process_name	Legacy			✓
	process_dir	Legacy			✓
	device_type			✓
	process_path	Legacy			✓
file-read	device_id	Legacy		✓
	bytes_in			✓
	process_name	Legacy			✓
	process_dir	Legacy			✓
	device_type	Legacy			✓
	process_path	Legacy		✓
file-write	device_id	Legacy		✓
	bytes_in			✓
	process_name	Legacy			✓
	process_dir	Legacy			✓
	device_type	Legacy			✓
	process_path	Legacy		✓
peripheral_storage-activity	file_path	Default			✓
	device_product				✓
	file_name	Default			✓
	file_dir	Default			✓
	device_description				✓
	process_dir	Default			✓
	file_ext	Default			✓
	process_name	Default			✓
	bytes	Default			✓
	device_pid				✓
	device_class				✓
	process_path	Default			✓
	device_vendor				✓
	device_vid				✓
peripheral_storage-insert	device_product				✓
	device_pid				✓
	device_description				✓
	device_class				✓
	device_vendor				✓
	device_vid				✓
	operation_details				✓