Event Integration Event Fields

This article explains the fields for events that are uploaded to third-party platform with the Events Integration.

Every event is represented by a separate JSON, and the JSONs are separated by a new line.

These are the event fields:

• 'anti_malware_reference'

• 'defined_host_name'

• 'dns_name'

• 'http_host_name'

• 'permittedRole'

• 'reason'

• 'socket_serial'

• 'throttled_event_sub_type'

• 'tls_certificate_error'

• 'tunnel_connection_description'

• 'vpn_release'

• 'socket_timeline_time'

• 'device_posture_profile'

• 'http_request_method'

• 'xff'

• 'logged_in_user'

• 'mw_db_version'

• 'epp_profile'

• 'quarantine_uuid'

• 'src_pid'

• 'src_process_path'

• 'src_process_cmdline'

• 'src_process_parent_pid'

• 'src_process_parent_path'

• 'dst_pid'

• 'dst_process_path'

• 'dst_process_cmdline'

• 'dst_process_parent_pid'

• 'dst_process_parent_path'

• 'detection_stage'

• 'detection_name'

• 'disinfect_result'

• 'processes_count'