Activity and Alert Events

Activity and Alert Events

Base Rule

Activity

General Activity

Device Vendor

N/A

N/A

N/A

Device Product

N/A

N/A

N/A

Device Version

N/A

N/A

N/A

Device Event Class ID

N/A

N/A

A unique ID identifying the activity.

Name

N/A

N/A

The name of the action taken.

Severity

<severity>

Number

The severity assigned with the Forcepoint CASB policy breached by the activity. If more than one policy was breached, the highest severity across these policies is displayed. This column is empty if no policy was breached.
6 = Info
7 = Low
8 = Medium
9 = High
10 = Critical

act

<action>

Text/String

The mitigation action taken by Forcepoint CASB as a result of the policies breached by the activity.

app

N/A

N/A

Application level protocol (https, http, imap, etc).

cat

N/A

N/A

The data object category (i.e., logical group based on the cloud service modules).

cs1

<policy>

Text/String

The policy rules breached by the activity.

destinationServiceName

N/A

N/A

The asset name assigned with the cloud service (e.g., My Office365).

deviceExternalId

N/A

N/A

The endpoint client assigned ID.

deviceFacility

N/A

N/A

If the IP address is external, this displays "True."

deviceProcessName

N/A

N/A

The cloud service object accessed.

dhost

N/A

N/A

N/A

dpriv

N/A

N/A

A flag indicating if the user performing the activity is an administrator (Admin) or a user (User).

dst

<dip>

IP Address

The IP address of the cloud service.

duser

<account>

Text/String

Target user SAM account name.

dvc

N/A

N/A

N/A

dvchost

N/A

N/A

N/A

end

N/A

N/A

The date the activity took place in Epoch.

externalId

<session>

Text/String

Session ID.

fsize

<size>

Number

File size.

msg

N/A

N/A

Title / Department / sourceCountry / destCountry.

outcome

<status>

Text/String

The activity status (Success / Failure / Unknown).

proto

N/A

N/A

The sub-service used (e.g., Outlook Web Access or SharePoint Online for Office 365).

reason

<subject>

Text/String

The activity performed by the user (e.g., view page, delete file).

request

<url>

Text/String

URL.

requestClientApplication

<useragent>

Text/String

Endpoint type / Endpoint OS / UserAgent.

rt

N/A

N/A

Activity date in Epoch.

sourceServiceName

N/A

N/A

A flag indicating if the device used to access the service is “Managed” or “Unmanaged” by Forcepoint CASB.

src

<sip>

IP Address

The source IP address for the activity.

start

N/A

N/A

Activity date in Epoch.

suser

<login>

Text/String

SAM account name.

cs2

N/A

N/A

The data types detected in the activity.

cs3

<objecttype>

Text/String

The type of the file related to the activity.

cs5

N/A

N/A

A flag indicating whether the data detected in the activity is sensitive (TRUE) or not sensitive (FALSE).

cs6

N/A

N/A

The data types detected in the activity.

dproc

N/A

N/A

Authentication type.

destinationProcessName

N/A

N/A

N/A

record

<object>

Text/String

The record type depends on the action type. For example, when the user action is File Upload, the record contains the file name.

cs4

N/A

N/A

The full name of the user. This data is retrieved from the Active Directory if integration is in place; otherwise it is empty.

suid

N/A

N/A

Username.

duid

N/A

N/A

The activity's destination subject (e.g., the email destination, the person/group a file is shared with, the user account when an admin changes permissions)

fname

N/A

N/A

The ID assigned to the data object.

oldFileName

N/A

N/A

The activity subject (e.g., the email subject, chat message, or searched content).

cn1

N/A

N/A

The monetary value of the activity.

cn2

N/A

N/A

The impact score given to the activity by Forcepoint CASB.

oldFileId

N/A

N/A

General properties relevant to the type of activity.

flexString2

N/A

N/A

The mitigation actions taken after the activity is detected (e.g., Remove sharing permissions).

AD.IPReputationCategory

N/A

N/A

IP reputation category name.

AD.TORNetworks

N/A

N/A

The IP addresses of the Tor networks detected in the activity.

AD.SuspiciousIPs

N/A

N/A

The suspicious IP addresses of the Tor networks detected in the activity.

AD.AnonymousProxies

N/A

N/A

The anonymous proxy IP addresses of the Tor networks detected in the activity.

AD.IPChain

N/A

N/A

The IP chain of the client in the activity.

AD.IPOrigin

N/A

N/A

A flag indicating whether the endpoint client IP address is considered an external location (External) or an internal location (Internal). This is based on your organization's internal IP ranges settings. If the location cannot be determined, this flag displays "Unknown".

AD.samAccountName

N/A

N/A

Account name.