Antivirus

This group includes tags that start with the level av. These tags identify data generated by antivirus and protection software.

Company	Product / service	Valid tags
	Mobile Threat Prevention	`av.checkpoint.mtp.audit` `av.checkpoint.mtp.event`
	F-Secure Internet Gatekeeper	`av.fsecure.igk.access`
	McAfee ePolicy Orchestrator (McAfee ePO)	`av.mcafee.epo.events` `av.mcafee.epo.threat`
	SentinelOne Endpoint Protection Platform (EPP)	`av.sentinelone.events`
	Sophos AntiVirus	`av.sophos.applicationcontrol` `av.sophos.devicecontrol` `av.sophos.enterprise` `av.sophos.events` `av.sophos.tamperprotection` `av.sophos.threatinstances` `av.sophos.threats`
	Symantec Endpoint Protection	`av.symantec.sep.mail`
	Symantec Endpoint Protection Cloud	`av.symantec.sepc.events`
	Deep Security Software	`av.trendmicro.deepsec.agent` `av.trendmicro.deepsec.console` `av.trendmicro.deepsec.manager`
	InterScan Web Security Virtual Appliance	`av.trendmicro.iwsva.event`