...
These are the fields displayed in this tablethese tables:
| Rw ui tabs macro |
|---|
| Rw tab |
|---|
| title | av.symantec.dcs_sa.auditing |
|---|
|
Field | Type | Source field name | Extra fields |
|---|
eventdate | timestamp
| | | machine | str
| vmachine | | OPERATION_D | str
| | | OSTYPE_D | str
| | | RULE_NAME | str
| | | DISPOSITION_D | str
| | | USER_NAME | str
| | | TARGET_INFO | str
| | | EVENT_DT | timestamp
| | | AGENTNAME | str
| | | EVENT_TYPE_D | str
| | | HOSTNAME | str
| | | PROCESS_NAME | str
| | | POST_DT | timestamp
| | | DESCRIPTION | str
| | | EVENT_SEVERITY_D | str
| | | HOSTADDR | str
| | | EVENT_ID | int4
| | | EVENT_CATEGORY_D | str
| | | RESOURCE_NAME | str
| | | hostchain | str
| | ✓ | tag | str
| | ✓ | rawMessage | str
| | ✓ |
| Rw tab |
|---|
| title | av.symantec.dcs_sa.events |
|---|
|
Field | Type | Source field name | Extra fields |
|---|
eventdate | timestamp
| | | machine | str
| vmachine | | OPERATION_D | str
| | | PROCESS_PATH | str
| | | EVENT_TYPE | str
| | | OSTYPE_D | str
| | | USER_NAME | str
| | | DOMAIN_NAME | str
| | | EVENT_DT | timestamp
| | | ASSET_RID | int4
| | | AGENTNAME | str
| | | POLICY_NAME | str
| | | EVENT_SEQ | int8
| | | EVENT_SOURCE_D | str
| | | EVENT_TYPE_D | str
| | | HOSTNAME | str
| | | OSVERSION | str
| | | PROCESS_NAME | str
| | | POST_DT | timestamp
| | | DESCRIPTION | str
| | | EVENT_SEVERITY_D | str
| | | HOSTADDR | ip4
| | | EVENT_ID | int8
| | | EVENT_CATEGORY_D | str
| | | REMOTEIP | str
| | | LOCALPORT | str
| | | REMOTEPORT | str
| | | DISPOSITION_D | str
| | | RULE_NAME | str
| | | hostchain | str
| | ✓ | tag | str
| | ✓ | rawMessage | str
| | ✓ |
| Rw tab |
|---|
| title | av.symantec.sep.mail |
|---|
|
Field | Type | Source field name | Extra fields |
|---|
eventdate | timestamp
| | | machine | str
| vmachine | | message | str
| | | hostchain | str
| | ✓ | tag | str
| | ✓ | rawMessage | str
| | ✓ |
| Rw tab |
|---|
| title | av.symantec.sepc.events |
|---|
|
Field | Type | Field transformation | Source field name | Extra fields |
|---|
eventdate | timestamp
| | | | machine | str
| | vmachine | | srcHost | str
| | | | serverdate | str
| | | | eventId | int8
| | | | sourceName | str
| | | | username | str
| | | | logType | str
| | | | category | str
| | | | threat | str
| | Code Block |
|---|
(eventId = 9) ? trim(subs(message, "(.*)Risk name:([^,]*+),(.*)", "\\2")) : null("") |
| message eventId | | action | str
| | Code Block |
|---|
(eventId = 9) ? trim(subs(message, "(.*)Actual action:([^,]*+),(.*)", "\\2")) : null("") |
| message eventId | | message | str
| | | | hostchain | str
| | | ✓ | tag | str
| | | ✓ | rawMessage | str
| | | ✓ |
|
