vmware identity manager

Expression

product = "vmware identity manager"

Fields

Field	Core	Detection	Informational
app			✓
os			✓
object_type			✓
os_version			✓
resource_type			✓
fallback_user_name
domain_user_name
device_type			✓
src_host		✓
object_id			✓
src_ip		✓
auth_method			✓
domain		✓
object_name			✓
os_type			✓
event_name			✓
user	✓	✓
operation			✓
user_agent		✓
redirect_url			✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-activity	app	Default			✓
	result	Default			✓
	additional_info	Default			✓
	user_id	Default			✓
app-authentication	app	Default			✓
	result	Default			✓
	additional_info	Default			✓
	user_id	Default			✓
app-login