unix

Expression

product = unix

Fields

There are no fields for this extension.

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
alert-trigger	parent_process_id
	file_path	Legacy			✓
	process_id
	operation_type
	service_name
	local_user_name
	file_owner
	process_command_line
	src_host	Legacy	✓	✓
	event_subtype
	event_category
	result
	src_ip	Legacy	✓	✓
	path
	group_id
	process_name	Legacy		✓
	arg
	dest_host	Legacy		✓
	user	Legacy		✓
email-receive	protocol	Default			✓
	bytes	Default			✓
	num_recipients	Default			✓
email-send	bytes	Default			✓
endpoint-authentication	src_ip	Default		✓
	process_id	Default			✓
	auth_method	Default			✓
	operation_type	Default			✓
	group_id	Default			✓
	process_name	Default			✓
	dest_ip	Default		✓
	file_owner	Default			✓
	src_host	Default		✓
	process_command_line	Default			✓
	event_category	Default			✓
endpoint-login	parent_process_id	Default			✓
	login_id	Default			✓
	file_path	Default			✓
	process_id	Default			✓
	operation_type	Default			✓
	auth	Default			✓
	service_name	Default			✓
	file_owner	Default			✓
	session_id	Default			✓
	process_dir	Default			✓
	process_command_line	Default			✓
	src_host	Default		✓
	event_category	Default			✓
	src_port	Default			✓
	src_ip	Default		✓
	group_id	Default			✓
	user_id	Default			✓
	event_code	Default			✓
	process_name	Default			✓
	dest_ip	Default		✓
	event_name	Default			✓
	dest_port	Default			✓
file-delete	dest_ip
file-permission-modify	parent_process_id				✓
	process_id			✓
	access	Legacy		✓
	operation_type				✓
	service_name				✓
	local_user_name
	file_owner				✓
	process_command_line				✓
	src_host			✓
	event_subtype				✓
	event_category				✓
	src_ip			✓
	group_id				✓
	user_id				✓
	bytes				✓
	process_name	Legacy			✓
	operation				✓
	user	Legacy	✓	✓
	account
file-read	parent_process_id				✓
	process_id			✓
	access	Legacy		✓
	operation_type				✓
	service_name				✓
	local_user_name
	file_owner				✓
	process_command_line				✓
	src_host	Legacy		✓
	event_subtype				✓
	event_category				✓
	src_ip			✓
	group_id				✓
	user_id				✓
	bytes	Legacy			✓
	process_name	Legacy			✓
	operation				✓
	user	Legacy	✓	✓
	account
file-write
group-member-add	src_ip
group-member-remove	parent_process_id
	file_path
	process_id
	operation_type
	service_name
	local_user_name
	file_owner
	process_command_line
	src_host	Legacy		✓
	event_category
	src_ip
	group_id	Legacy		✓
	user_id
	process_name
	dest_user_id
	user	Legacy	✓	✓
process-create	process_relative_dir	Default			✓
	operation_type	Default			✓
	user_id	Default			✓
	group_id	Default			✓
	additional_info	Default			✓
	current_working_dir	Default			✓
	session_id	Default			✓
	process_relative_path	Default			✓
	object	Default			✓
user-create	parent_process_id
	file_path
	process_id
	operation_type
	service_name
	local_user_name
	file_owner
	process_command_line
	src_host	Legacy		✓
	event_category
	src_ip
	group_id
	user_id
	process_name
	dest_user_id
	user	Legacy	✓	✓
user-delete	parent_process_id
	file_path
	process_id
	operation_type
	service_name
	local_user_name
	file_owner
	process_command_line
	src_host
	event_category
	src_ip
	group_id
	user_id
	process_name
	dest_user_id
	user	Legacy	✓	✓
user-lock	src_ip			✓
	auth_method				✓
	event_code				✓
user-password-modify	parent_process_id	Default			✓
	file_path	Default			✓
	process_id	Default			✓
	operation_type	Default			✓
	service_name	Default			✓
	local_user_name
	file_owner	Default			✓
	process_command_line	Default			✓
	src_host	Default		✓
	event_category	Default			✓
	src_ip	Default		✓
	group_id	Default			✓
	user_id	Default			✓
	process_name	Default			✓
	dest_ip	Default		✓
	dest_user_id	Default			✓
	user	Default		✓
user-switch	process_relative_dir	Default			✓
	current_working_dir	Default			✓
	process_relative_path	Default			✓