Activity and Alert Events

Vendor Documentation

https://www.websense.com/content/support/library/casb/admin_guide/casb_admin_guide.pdf

Classification

Rule Name	Rule Type	Classification	Common Event
Activity and Alert Events	Base Rule	Activity	General Activity

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
Device Vendor	N/A	N/A	N/A
Device Product	N/A	N/A	N/A
Device Version	N/A	N/A	N/A
Device Event Class ID	N/A	N/A	A unique ID identifying the activity.
Name	N/A	N/A	The name of the action taken.
Severity	<severity>	Number	The severity assigned with the Forcepoint CASB policy breached by the activity. If more than one policy was breached, the highest severity across these policies is displayed. This column is empty if no policy was breached. 6 = Info 7 = Low 8 = Medium 9 = High 10 = Critical
act	<action>	Text/String	The mitigation action taken by Forcepoint CASB as a result of the policies breached by the activity.
app	N/A	N/A	Application level protocol (https, http, imap, etc).
cat	N/A	N/A	The data object category (i.e., logical group based on the cloud service modules).
cs1	<policy>	Text/String	The policy rules breached by the activity.
destinationServiceName	N/A	N/A	The asset name assigned with the cloud service (e.g., My Office365).
deviceExternalId	N/A	N/A	The endpoint client assigned ID.
deviceFacility	N/A	N/A	If the IP address is external, this displays "True."
deviceProcessName	N/A	N/A	The cloud service object accessed.
dhost	N/A	N/A	N/A
dpriv	N/A	N/A	A flag indicating if the user performing the activity is an administrator (Admin) or a user (User).
dst	<dip>	IP Address	The IP address of the cloud service.
duser	<account>	Text/String	Target user SAM account name.
dvc	N/A	N/A	N/A
dvchost	N/A	N/A	N/A
end	N/A	N/A	The date the activity took place in Epoch.
externalId	<session>	Text/String	Session ID.
fsize	<size>	Number	File size.
msg	N/A	N/A	Title / Department / sourceCountry / destCountry.
outcome	<status>	Text/String	The activity status (Success / Failure / Unknown).
proto	N/A	N/A	The sub-service used (e.g., Outlook Web Access or SharePoint Online for Office 365).
reason	<subject>	Text/String	The activity performed by the user (e.g., view page, delete file).
request	<url>	Text/String	URL.
requestClientApplication	<useragent>	Text/String	Endpoint type / Endpoint OS / UserAgent.
rt	N/A	N/A	Activity date in Epoch.
sourceServiceName	N/A	N/A	A flag indicating if the device used to access the service is “Managed” or “Unmanaged” by Forcepoint CASB.
src	<sip>	IP Address	The source IP address for the activity.
start	N/A	N/A	Activity date in Epoch.
suser	<login>	Text/String	SAM account name.
cs2	N/A	N/A	The data types detected in the activity.
cs3	<objecttype>	Text/String	The type of the file related to the activity.
cs5	N/A	N/A	A flag indicating whether the data detected in the activity is sensitive (TRUE) or not sensitive (FALSE).
cs6	N/A	N/A	The data types detected in the activity.
dproc	N/A	N/A	Authentication type.
destinationProcessName	N/A	N/A	N/A
record	<object>	Text/String	The record type depends on the action type. For example, when the user action is File Upload, the record contains the file name.
cs4	N/A	N/A	The full name of the user. This data is retrieved from the Active Directory if integration is in place; otherwise it is empty.
suid	N/A	N/A	Username.
duid	N/A	N/A	The activity's destination subject (e.g., the email destination, the person/group a file is shared with, the user account when an admin changes permissions)
fname	N/A	N/A	The ID assigned to the data object.
oldFileName	N/A	N/A	The activity subject (e.g., the email subject, chat message, or searched content).
cn1	N/A	N/A	The monetary value of the activity.
cn2	N/A	N/A	The impact score given to the activity by Forcepoint CASB.
oldFileId	N/A	N/A	General properties relevant to the type of activity.
flexString2	N/A	N/A	The mitigation actions taken after the activity is detected (e.g., Remove sharing permissions).
AD.IPReputationCategory	N/A	N/A	IP reputation category name.
AD.TORNetworks	N/A	N/A	The IP addresses of the Tor networks detected in the activity.
AD.SuspiciousIPs	N/A	N/A	The suspicious IP addresses of the Tor networks detected in the activity.
AD.AnonymousProxies	N/A	N/A	The anonymous proxy IP addresses of the Tor networks detected in the activity.
AD.IPChain	N/A	N/A	The IP chain of the client in the activity.
AD.IPOrigin	N/A	N/A	A flag indicating whether the endpoint client IP address is considered an external location (External) or an internal location (Internal). This is based on your organization's internal IP ranges settings. If the location cannot be determined, this flag displays "Unknown".
AD.samAccountName	N/A	N/A	Account name.