/
edr.all.threats
Document toolboxDocument toolbox

edr.all.threats

Owned by Former user (Deleted)
Last updated: Apr 08, 2025 by Laszlo Frazer
[ 1 Introduction ] [ 2 Source tables ] [ 3 Table structure ]

Introduction

This union table collects events generated by Endpoint Detection and Response (EDR) systems from different technologies to address possible threats.

Source tables

The information displayed is extracted from the following tables:

  • av.sentinelone.rfc_5424

  • cef0.bit9CarbonblackJson.cbResponse

  • cef0.paloAltoNetworks.cortexXdr

  • cef0.paloAltoNetworks.cortexXdrAgent

  • cloud.sophos.central.alerts

  • cloud.sophos.central.events

  • edr.carbonblack.alert

  • edr.carbonblack.protect

  • edr.cbef.alert.cb_analytics

  • edr.cbef.alert.watchlist

  • edr.cortex_xdr.alerts

  • edr.cortex_xdr.incident_alert

  • edr.crowdstrike.cannon

  • edr.crowdstrike.falcon

  • edr.crowdstrike.falconstreaming.detection_summary

  • edr.crowdstrike.falconstreaming.epp_detection_summary

  • edr.cylance.device

  • edr.cylance.threats

  • edr.fireeye.alerts

  • edr.microsoft_defender.endpoint.alerts

  • edr.minervalabs.events

  • edr.sentinelone.agent.threats

  • edr.symantec.events

  • edr.tanium.events

  • edr.tanium.threats

  • endpoint.carbonblack.protection

  • xdr.cynet.alerts.events

Table structure

This is the set of columns displayed by this union table, which is the result of the collection of columns present in all source tables:

Extra columns

Fields marked as Extra in the table below are not shown by default in data tables and need to be explicitly requested in the query. You can find them marked as Extra when you perform a query so they can be easily identified. Learn more about this in Selecting unrevealed columns.

Field

Type

Source field name

Extra fields

Field

Type

Source field name

Extra fields

eventdate

timestamp

 

 

source

str

 

 

ip

ip4

 

 

mac

str

 

 

sha256

str

sha256hash

 

sha1

str

SHA1Hash

 

md5

str

MD5Hash

 

file_name

str

filename

 

file_path

str

path

 

message

str

 

 

status

str

 

 

rule

str

 

 

hostname

str

host

 

threat_name

str

threat

 

severity

str

severityuser

 

user

str

 

 

threat_type

str

type

 

pid

str

processIDstr

 

parent_pid

str

parentProcessID

 

rawMessage

str

rawSource

✓

hostchain

str

 

✓

tag

str

 

✓

Special Sophos Information

The Sophos source cloud.sophos.central.alerts does not contain sha256. If the SHA 256 hash is required, use source cloud.sophos.central.events. Otherwise, the alerts source is suitable.

Related content