catocli 1.0.21__py3-none-any.whl → 2.0.1__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of catocli might be problematic. Click here for more details.

Files changed (139) hide show
  1. catocli/Utils/clidriver.py +112 -25
  2. catocli/Utils/profile_manager.py +188 -0
  3. catocli/Utils/version_checker.py +192 -0
  4. catocli/__init__.py +1 -1
  5. catocli/parsers/configure/__init__.py +115 -0
  6. catocli/parsers/configure/configure.py +307 -0
  7. catocli/parsers/custom/__init__.py +8 -0
  8. catocli/parsers/custom/export_rules/__init__.py +36 -0
  9. catocli/parsers/custom/export_rules/export_rules.py +361 -0
  10. catocli/parsers/custom/import_rules_to_tf/__init__.py +58 -0
  11. catocli/parsers/custom/import_rules_to_tf/import_rules_to_tf.py +577 -0
  12. catocli/parsers/mutation_admin_addAdmin/README.md +1 -1
  13. catocli/parsers/mutation_hardware/README.md +7 -0
  14. catocli/parsers/mutation_hardware/__init__.py +23 -0
  15. catocli/parsers/mutation_hardware_updateHardwareShipping/README.md +17 -0
  16. catocli/parsers/mutation_site_addBgpPeer/README.md +1 -1
  17. catocli/parsers/mutation_site_addNetworkRange/README.md +1 -1
  18. catocli/parsers/mutation_site_updateBgpPeer/README.md +1 -1
  19. catocli/parsers/mutation_site_updateNetworkRange/README.md +1 -1
  20. catocli/parsers/mutation_sites_addBgpPeer/README.md +1 -1
  21. catocli/parsers/mutation_sites_addNetworkRange/README.md +1 -1
  22. catocli/parsers/mutation_sites_updateBgpPeer/README.md +1 -1
  23. catocli/parsers/mutation_sites_updateNetworkRange/README.md +1 -1
  24. catocli/parsers/query_auditFeed/README.md +1 -1
  25. catocli/parsers/query_catalogs/README.md +19 -0
  26. catocli/parsers/query_catalogs/__init__.py +17 -0
  27. catocli/parsers/query_devices/README.md +19 -0
  28. catocli/parsers/query_devices/__init__.py +17 -0
  29. catocli/parsers/query_eventsFeed/README.md +1 -1
  30. catocli/parsers/query_hardware/README.md +17 -0
  31. catocli/parsers/query_hardware/__init__.py +17 -0
  32. catocli/parsers/query_sandbox/README.md +1 -1
  33. {catocli-1.0.21.dist-info → catocli-2.0.1.dist-info}/METADATA +1 -1
  34. {catocli-1.0.21.dist-info → catocli-2.0.1.dist-info}/RECORD +139 -114
  35. {catocli-1.0.21.dist-info → catocli-2.0.1.dist-info}/top_level.txt +1 -0
  36. graphql_client/api/call_api.py +4 -0
  37. graphql_client/api_client_types.py +4 -3
  38. graphql_client/configuration.py +2 -0
  39. models/mutation.admin.addAdmin.json +130 -0
  40. models/mutation.hardware.updateHardwareShipping.json +2506 -0
  41. models/mutation.policy.appTenantRestriction.addRule.json +11 -11
  42. models/mutation.policy.appTenantRestriction.createPolicyRevision.json +11 -11
  43. models/mutation.policy.appTenantRestriction.discardPolicyRevision.json +11 -11
  44. models/mutation.policy.appTenantRestriction.moveRule.json +11 -11
  45. models/mutation.policy.appTenantRestriction.publishPolicyRevision.json +11 -11
  46. models/mutation.policy.appTenantRestriction.removeRule.json +11 -11
  47. models/mutation.policy.appTenantRestriction.updatePolicy.json +11 -11
  48. models/mutation.policy.appTenantRestriction.updateRule.json +11 -11
  49. models/mutation.policy.dynamicIpAllocation.addRule.json +4 -4
  50. models/mutation.policy.dynamicIpAllocation.createPolicyRevision.json +4 -4
  51. models/mutation.policy.dynamicIpAllocation.discardPolicyRevision.json +4 -4
  52. models/mutation.policy.dynamicIpAllocation.moveRule.json +4 -4
  53. models/mutation.policy.dynamicIpAllocation.publishPolicyRevision.json +4 -4
  54. models/mutation.policy.dynamicIpAllocation.removeRule.json +4 -4
  55. models/mutation.policy.dynamicIpAllocation.updatePolicy.json +4 -4
  56. models/mutation.policy.dynamicIpAllocation.updateRule.json +4 -4
  57. models/mutation.policy.internetFirewall.addRule.json +63 -63
  58. models/mutation.policy.internetFirewall.createPolicyRevision.json +45 -45
  59. models/mutation.policy.internetFirewall.discardPolicyRevision.json +45 -45
  60. models/mutation.policy.internetFirewall.moveRule.json +45 -45
  61. models/mutation.policy.internetFirewall.publishPolicyRevision.json +45 -45
  62. models/mutation.policy.internetFirewall.removeRule.json +45 -45
  63. models/mutation.policy.internetFirewall.updatePolicy.json +45 -45
  64. models/mutation.policy.internetFirewall.updateRule.json +63 -63
  65. models/mutation.policy.remotePortFwd.addRule.json +5 -5
  66. models/mutation.policy.remotePortFwd.createPolicyRevision.json +5 -5
  67. models/mutation.policy.remotePortFwd.discardPolicyRevision.json +5 -5
  68. models/mutation.policy.remotePortFwd.moveRule.json +5 -5
  69. models/mutation.policy.remotePortFwd.publishPolicyRevision.json +5 -5
  70. models/mutation.policy.remotePortFwd.removeRule.json +5 -5
  71. models/mutation.policy.remotePortFwd.updatePolicy.json +5 -5
  72. models/mutation.policy.remotePortFwd.updateRule.json +5 -5
  73. models/mutation.policy.socketLan.addRule.json +3580 -125
  74. models/mutation.policy.socketLan.createPolicyRevision.json +3580 -125
  75. models/mutation.policy.socketLan.discardPolicyRevision.json +3580 -125
  76. models/mutation.policy.socketLan.moveRule.json +3580 -125
  77. models/mutation.policy.socketLan.publishPolicyRevision.json +3580 -125
  78. models/mutation.policy.socketLan.removeRule.json +3580 -125
  79. models/mutation.policy.socketLan.updatePolicy.json +3580 -125
  80. models/mutation.policy.socketLan.updateRule.json +3580 -125
  81. models/mutation.policy.wanFirewall.addRule.json +77 -77
  82. models/mutation.policy.wanFirewall.createPolicyRevision.json +59 -59
  83. models/mutation.policy.wanFirewall.discardPolicyRevision.json +59 -59
  84. models/mutation.policy.wanFirewall.moveRule.json +59 -59
  85. models/mutation.policy.wanFirewall.publishPolicyRevision.json +59 -59
  86. models/mutation.policy.wanFirewall.removeRule.json +59 -59
  87. models/mutation.policy.wanFirewall.updatePolicy.json +59 -59
  88. models/mutation.policy.wanFirewall.updateRule.json +77 -77
  89. models/mutation.policy.wanNetwork.addRule.json +49 -49
  90. models/mutation.policy.wanNetwork.createPolicyRevision.json +49 -49
  91. models/mutation.policy.wanNetwork.discardPolicyRevision.json +49 -49
  92. models/mutation.policy.wanNetwork.moveRule.json +49 -49
  93. models/mutation.policy.wanNetwork.publishPolicyRevision.json +49 -49
  94. models/mutation.policy.wanNetwork.removeRule.json +49 -49
  95. models/mutation.policy.wanNetwork.updatePolicy.json +49 -49
  96. models/mutation.policy.wanNetwork.updateRule.json +49 -49
  97. models/mutation.site.addBgpPeer.json +2812 -217
  98. models/mutation.site.addNetworkRange.json +114 -0
  99. models/mutation.site.addSocketSite.json +18 -0
  100. models/mutation.site.removeBgpPeer.json +667 -1
  101. models/mutation.site.updateBgpPeer.json +3152 -559
  102. models/mutation.site.updateNetworkRange.json +114 -0
  103. models/mutation.sites.addBgpPeer.json +2812 -217
  104. models/mutation.sites.addNetworkRange.json +114 -0
  105. models/mutation.sites.addSocketSite.json +18 -0
  106. models/mutation.sites.removeBgpPeer.json +667 -1
  107. models/mutation.sites.updateBgpPeer.json +3152 -559
  108. models/mutation.sites.updateNetworkRange.json +114 -0
  109. models/mutation.xdr.addStoryComment.json +2 -2
  110. models/mutation.xdr.analystFeedback.json +182 -42
  111. models/mutation.xdr.deleteStoryComment.json +2 -2
  112. models/query.accountMetrics.json +112 -0
  113. models/query.accountSnapshot.json +62 -0
  114. models/query.admin.json +46 -0
  115. models/query.admins.json +46 -0
  116. models/query.appStats.json +528 -0
  117. models/query.appStatsTimeSeries.json +396 -0
  118. models/query.auditFeed.json +273 -3336
  119. models/query.catalogs.json +9840 -0
  120. models/query.devices.json +15469 -0
  121. models/query.events.json +4606 -4318
  122. models/query.eventsFeed.json +1167 -1095
  123. models/query.eventsTimeSeries.json +3459 -3243
  124. models/query.hardware.json +5730 -0
  125. models/query.hardwareManagement.json +8 -2
  126. models/query.licensing.json +3 -3
  127. models/query.policy.json +3743 -298
  128. models/query.sandbox.json +6 -4
  129. models/query.site.json +1329 -4
  130. models/query.xdr.stories.json +182 -42
  131. models/query.xdr.story.json +182 -42
  132. schema/catolib.py +105 -28
  133. scripts/catolib.py +62 -0
  134. scripts/export_if_rules_to_json.py +188 -0
  135. scripts/export_wf_rules_to_json.py +111 -0
  136. scripts/import_wf_rules_to_tfstate.py +331 -0
  137. {catocli-1.0.21.dist-info → catocli-2.0.1.dist-info}/LICENSE +0 -0
  138. {catocli-1.0.21.dist-info → catocli-2.0.1.dist-info}/WHEEL +0 -0
  139. {catocli-1.0.21.dist-info → catocli-2.0.1.dist-info}/entry_points.txt +0 -0
models/query.eventsFeed.json CHANGED
@@ -381,155 +381,119 @@
381
381
  "definition": {
382
382
  "description": null,
383
383
  "enumValues": [
384
- {
385
- "deprecationReason": "use src_site_id/src_site_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
386
- "description": "Name of site or user initiating the connection",
387
- "isDeprecated": true,
388
- "name": "src_site"
389
- },
390
- {
391
- "deprecationReason": null,
392
- "description": "Unique internal Cato ID for the site or remote user",
393
- "isDeprecated": false,
394
- "name": "src_site_id"
395
- },
396
384
  {
397
385
  "deprecationReason": null,
398
- "description": "Static host",
386
+ "description": "Identifies system access software or device",
399
387
  "isDeprecated": false,
400
- "name": "static_host"
388
+ "name": "access_method"
401
389
  },
402
390
  {
403
391
  "deprecationReason": null,
404
- "description": "User ID",
392
+ "description": "Account ID",
405
393
  "isDeprecated": false,
406
- "name": "user_id"
407
- },
408
- {
409
- "deprecationReason": "use dest_site_id/dest_site_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
410
- "description": "For WAN traffic, name of destination site or SDP user",
411
- "isDeprecated": true,
412
- "name": "dest_site"
394
+ "name": "account_id"
413
395
  },
414
396
  {
415
397
  "deprecationReason": null,
416
- "description": "Unique internal Cato ID for the destination site or remote user",
398
+ "description": "Firewall, QoS or LAG action",
417
399
  "isDeprecated": false,
418
- "name": "dest_site_id"
419
- },
420
- {
421
- "deprecationReason": "please use src_site_id and dest_site_id instead. Planned end-of-life (EoL) date: June 30, 2025.",
422
- "description": "Source or destination site or remote user ID.\nThis field can only be used in filter.",
423
- "isDeprecated": true,
424
- "name": "src_or_dest_site_id"
425
- },
426
- {
427
- "deprecationReason": "use rule_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
428
- "description": "Name of security rule related to the event",
429
- "isDeprecated": true,
430
- "name": "rule"
400
+ "name": "action"
431
401
  },
432
402
  {
433
403
  "deprecationReason": null,
434
- "description": "The ISP related to this event (when the IP address isn't provided by the ISP, then the event message is IP Addresses are assigned statically)",
404
+ "description": "A list of actions taken, if more than one action was taken as defined by a policy",
435
405
  "isDeprecated": false,
436
- "name": "ISP_name"
406
+ "name": "actions_taken"
437
407
  },
438
408
  {
439
409
  "deprecationReason": null,
440
- "description": "Name for Socket interface",
410
+ "description": "Active Directory name",
441
411
  "isDeprecated": false,
442
- "name": "socket_interface"
443
- },
444
- {
445
- "deprecationReason": "use custom_category_id/custom_category_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
446
- "description": "Name for the custom category defined in the Cato Management Application",
447
- "isDeprecated": true,
448
- "name": "custom_category"
412
+ "name": "ad_name"
449
413
  },
450
414
  {
451
415
  "deprecationReason": null,
452
- "description": "Host name of Domain Controller that created LDAP event",
416
+ "description": "A unique identifier of the alert notification",
453
417
  "isDeprecated": false,
454
- "name": "directory_host_name"
418
+ "name": "alert_id"
455
419
  },
456
420
  {
457
421
  "deprecationReason": null,
458
- "description": "Destination port",
422
+ "description": "Always-on Configuration",
459
423
  "isDeprecated": false,
460
- "name": "dest_port"
424
+ "name": "always_on_configuration"
461
425
  },
462
426
  {
463
427
  "deprecationReason": null,
464
- "description": "BGP ASN for remote peer",
428
+ "description": "Analyst Verdict",
465
429
  "isDeprecated": false,
466
- "name": "bgp_peer_asn"
430
+ "name": "analyst_verdict"
467
431
  },
468
432
  {
469
433
  "deprecationReason": null,
470
- "description": "For Block/Prompt page, reference ID to report incorrect category",
434
+ "description": "The name of the API, e.g. eventsFeed",
471
435
  "isDeprecated": false,
472
- "name": "user_reference_id"
436
+ "name": "api_name"
473
437
  },
474
438
  {
475
439
  "deprecationReason": null,
476
- "description": "Internal port number",
440
+ "description": "Specifies whether the API is a query (read) or a mutation (create/update/delete)",
477
441
  "isDeprecated": false,
478
- "name": "src_port"
442
+ "name": "api_type"
479
443
  },
480
444
  {
481
445
  "deprecationReason": null,
482
- "description": "Data that measures the packet loss for a specific link",
446
+ "description": "Name of application activity",
483
447
  "isDeprecated": false,
484
- "name": "link_health_pkt_loss"
448
+ "name": "app_activity"
485
449
  },
486
450
  {
487
451
  "deprecationReason": null,
488
- "description": "Name of PoP location",
452
+ "description": "SaaS user activities into categories.",
489
453
  "isDeprecated": false,
490
- "name": "pop_name"
454
+ "name": "app_activity_category"
491
455
  },
492
456
  {
493
457
  "deprecationReason": null,
494
- "description": "IP address of host related to event",
458
+ "description": "Activity type",
495
459
  "isDeprecated": false,
496
- "name": "host_ip"
460
+ "name": "app_activity_type"
497
461
  },
498
462
  {
499
463
  "deprecationReason": null,
500
- "description": "Cato's description of the event",
464
+ "description": "Related Apps",
501
465
  "isDeprecated": false,
502
- "name": "event_message"
466
+ "name": "app_stack"
503
467
  },
504
468
  {
505
- "deprecationReason": null,
506
- "description": "Source site or remote user",
507
- "isDeprecated": false,
508
- "name": "src_site_name"
469
+ "deprecationReason": "use application_id/application_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
470
+ "description": "For Internet firewall, app for this event",
471
+ "isDeprecated": true,
472
+ "name": "application"
509
473
  },
510
474
  {
511
475
  "deprecationReason": null,
512
- "description": "Domain name based on the SSL SNI, HTTP host name, or DNS name",
476
+ "description": "Application ID of the flow",
513
477
  "isDeprecated": false,
514
- "name": "domain_name"
478
+ "name": "application_id"
515
479
  },
516
480
  {
517
481
  "deprecationReason": null,
518
- "description": "Destination IP address",
482
+ "description": "The name of the application associated with the flow",
519
483
  "isDeprecated": false,
520
- "name": "dest_ip"
484
+ "name": "application_name"
521
485
  },
522
486
  {
523
487
  "deprecationReason": null,
524
- "description": "File hash",
488
+ "description": "Application risk score",
525
489
  "isDeprecated": false,
526
- "name": "file_hash"
490
+ "name": "application_risk"
527
491
  },
528
492
  {
529
493
  "deprecationReason": null,
530
- "description": "IP address provided by ISP to site or Client",
494
+ "description": "Connectivity authentication method: unauthenticated, OATH2, LDAP or VPN",
531
495
  "isDeprecated": false,
532
- "name": "src_isp_ip"
496
+ "name": "auth_method"
533
497
  },
534
498
  {
535
499
  "deprecationReason": null,
@@ -539,105 +503,99 @@
539
503
  },
540
504
  {
541
505
  "deprecationReason": null,
542
- "description": "Rule name",
506
+ "description": "BGP ASN for Cato peer",
543
507
  "isDeprecated": false,
544
- "name": "rule_name"
508
+ "name": "bgp_cato_asn"
545
509
  },
546
510
  {
547
511
  "deprecationReason": null,
548
- "description": "Result of LDAP Domain Controller sync event",
512
+ "description": "BGP IP for Cato peer",
549
513
  "isDeprecated": false,
550
- "name": "directory_sync_result"
514
+ "name": "bgp_cato_ip"
551
515
  },
552
516
  {
553
517
  "deprecationReason": null,
554
- "description": "MAC address of host related to event",
518
+ "description": "BGP disconnect error code",
555
519
  "isDeprecated": false,
556
- "name": "host_mac"
520
+ "name": "bgp_error_code"
557
521
  },
558
522
  {
559
523
  "deprecationReason": null,
560
- "description": "Type of malware event",
524
+ "description": "BGP ASN for remote peer",
561
525
  "isDeprecated": false,
562
- "name": "threat_type"
526
+ "name": "bgp_peer_asn"
563
527
  },
564
528
  {
565
529
  "deprecationReason": null,
566
- "description": "Result of malware event (clean indicates a safe file)",
530
+ "description": "BGP IP for remote peer",
567
531
  "isDeprecated": false,
568
- "name": "threat_verdict"
532
+ "name": "bgp_peer_ip"
569
533
  },
570
534
  {
571
535
  "deprecationReason": null,
572
- "description": "Name for device related to the event",
536
+ "description": "CIDR for BGP route",
573
537
  "isDeprecated": false,
574
- "name": "device_name"
538
+ "name": "bgp_route_cidr"
575
539
  },
576
540
  {
577
541
  "deprecationReason": null,
578
- "description": "Link type \u2013 Cato, Alt. WAN or LAG",
542
+ "description": "BGP disconnect error message",
579
543
  "isDeprecated": false,
580
- "name": "link_type"
544
+ "name": "bgp_suberror_code"
581
545
  },
582
546
  {
583
547
  "deprecationReason": null,
584
- "description": "Login action, values are: User portal (myvpn.catonetworks.com) or VPN client (Client or site traffic)",
548
+ "description": "Always-On Bypass Duration In Seconds",
585
549
  "isDeprecated": false,
586
- "name": "login_type"
550
+ "name": "bypass_duration_sec"
587
551
  },
588
552
  {
589
553
  "deprecationReason": null,
590
- "description": "For hosts configured with a static IP in the Cato Management Application, the host name",
554
+ "description": "Always-On Bypass Method",
591
555
  "isDeprecated": false,
592
- "name": "configured_host_name"
593
- },
594
- {
595
- "deprecationReason": "use event_id instead. Planned end-of-life (EoL) date: May 1, 2025.",
596
- "description": "Cato Internal-use only",
597
- "isDeprecated": true,
598
- "name": "internalId"
556
+ "name": "bypass_method"
599
557
  },
600
558
  {
601
559
  "deprecationReason": null,
602
- "description": "Event Id",
560
+ "description": "Always-On Bypass Reason",
603
561
  "isDeprecated": false,
604
- "name": "event_id"
562
+ "name": "bypass_reason"
605
563
  },
606
564
  {
607
565
  "deprecationReason": null,
608
- "description": "Type of LDAP Domain Controller sync event",
566
+ "description": "Cato system category",
609
567
  "isDeprecated": false,
610
- "name": "directory_sync_type"
568
+ "name": "categories"
611
569
  },
612
570
  {
613
571
  "deprecationReason": null,
614
- "description": "User\u2019s email address",
572
+ "description": "Cato application name",
615
573
  "isDeprecated": false,
616
- "name": "vpn_user_email"
574
+ "name": "cato_app"
617
575
  },
618
576
  {
619
577
  "deprecationReason": null,
620
- "description": "Type of process generating this traffic",
578
+ "description": "Activity classification, e.g. FALSE_POSITIVE",
621
579
  "isDeprecated": false,
622
- "name": "client_class"
580
+ "name": "classification"
623
581
  },
624
582
  {
625
583
  "deprecationReason": null,
626
- "description": "For MDR service, a true/false value that indicates if this event is: A summary that aggregates many events (true) Raw network flows for a single event (false)",
584
+ "description": "Expiration date for Client certificate",
627
585
  "isDeprecated": false,
628
- "name": "incident_aggregation"
586
+ "name": "client_cert_expires"
629
587
  },
630
588
  {
631
589
  "deprecationReason": null,
632
- "description": "Type of Socket reset (Hardware/Software)",
590
+ "description": "Name of Client certificate",
633
591
  "isDeprecated": false,
634
- "name": "socket_reset"
592
+ "name": "client_cert_name"
635
593
  },
636
594
  {
637
595
  "deprecationReason": null,
638
- "description": "User that generated the event",
596
+ "description": "Type of process generating this traffic",
639
597
  "isDeprecated": false,
640
- "name": "user_name"
598
+ "name": "client_class"
641
599
  },
642
600
  {
643
601
  "deprecationReason": null,
@@ -647,747 +605,735 @@
647
605
  },
648
606
  {
649
607
  "deprecationReason": null,
650
- "description": "File size",
608
+ "description": "Shows the display name of the target user involved in an activity",
651
609
  "isDeprecated": false,
652
- "name": "file_size"
610
+ "name": "collaborator_name"
653
611
  },
654
612
  {
655
613
  "deprecationReason": null,
656
- "description": "Registration code used the first time that a SDP user authenticates (the code is partially obfuscated)",
614
+ "description": "For SaaS Security API, email addresses of the users that received the file",
657
615
  "isDeprecated": false,
658
- "name": "registration_code"
616
+ "name": "collaborators"
659
617
  },
660
618
  {
661
619
  "deprecationReason": null,
662
- "description": "BGP disconnect error code",
620
+ "description": "Confidence Level",
663
621
  "isDeprecated": false,
664
- "name": "bgp_error_code"
665
- },
666
- {
667
- "deprecationReason": "Planned end-of-life (EoL) date: April 15, 2025.",
668
- "description": "Description from Cato Management Application for BGP peer",
669
- "isDeprecated": true,
670
- "name": "bgp_peer_description"
622
+ "name": "confidence_level"
671
623
  },
672
624
  {
673
625
  "deprecationReason": null,
674
- "description": "For anti-malware events, malware name For IPS events, explains the reason why the traffic was blocked",
626
+ "description": "For hosts configured with a static IP in the Cato Management Application, the host name",
675
627
  "isDeprecated": false,
676
- "name": "threat_name"
628
+ "name": "configured_host_name"
677
629
  },
678
630
  {
679
631
  "deprecationReason": null,
680
- "description": "For QoS, the time that this QoS event started. The event is generated when the QoS event finishes",
632
+ "description": "The algorithm that is used (CUBIC /NewReno / BBR)",
681
633
  "isDeprecated": false,
682
- "name": "qos_reported_time"
634
+ "name": "congestion_algorithm"
683
635
  },
684
636
  {
685
637
  "deprecationReason": null,
686
- "description": "Network protocol for this event",
638
+ "description": "Connect on boot Enabled/Disabled",
687
639
  "isDeprecated": false,
688
- "name": "ip_protocol"
640
+ "name": "connect_on_boot"
689
641
  },
690
642
  {
691
643
  "deprecationReason": null,
692
- "description": "BGP ASN for Cato peer",
644
+ "description": "Connection Origin",
693
645
  "isDeprecated": false,
694
- "name": "bgp_cato_asn"
646
+ "name": "connection_origin"
695
647
  },
696
648
  {
697
649
  "deprecationReason": null,
698
- "description": "IP for host or Cato Client",
650
+ "description": "For SaaS Security API, name of the connector",
699
651
  "isDeprecated": false,
700
- "name": "src_ip"
652
+ "name": "connector_name"
701
653
  },
702
654
  {
703
655
  "deprecationReason": null,
704
- "description": "Link to external malware reference",
656
+ "description": "For SaaS Security API, status of the connector",
705
657
  "isDeprecated": false,
706
- "name": "threat_reference"
658
+ "name": "connector_status"
707
659
  },
708
660
  {
709
661
  "deprecationReason": null,
710
- "description": "Firewall, QoS or LAG action",
662
+ "description": "For SaaS Security API, SaaS app for the connector",
711
663
  "isDeprecated": false,
712
- "name": "action"
664
+ "name": "connector_type"
713
665
  },
714
666
  {
715
667
  "deprecationReason": null,
716
- "description": "For LDAP sync events, name of the AD domain",
668
+ "description": "IoC Container Name",
717
669
  "isDeprecated": false,
718
- "name": "windows_domain_name"
670
+ "name": "container_name"
719
671
  },
720
672
  {
721
673
  "deprecationReason": null,
722
- "description": "(IPS or SAM event) Indicates the overall impact of a threat for the host or network: Low \u2013 ie. adware Medium \u2013 ie. network scans High \u2013 ie. spyware or worms",
674
+ "description": "An external system identifier used for correlation between related Cato entities. Example: external ticket id that correlates Cato XDR stories.",
723
675
  "isDeprecated": false,
724
- "name": "risk_level"
676
+ "name": "correlation_id"
725
677
  },
726
678
  {
727
679
  "deprecationReason": null,
728
- "description": "For Socket upgrade, previous version number",
680
+ "description": "Criticality",
729
681
  "isDeprecated": false,
730
- "name": "socket_old_version"
682
+ "name": "criticality"
731
683
  },
732
684
  {
733
- "deprecationReason": null,
734
- "description": "Round Trip Delay in Milliseconds that it takes a packet to travel between the source and the PoP",
735
- "isDeprecated": false,
736
- "name": "link_health_latency"
685
+ "deprecationReason": "use custom_category_id/custom_category_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
686
+ "description": "Unique Cato ID for the custom category",
687
+ "isDeprecated": true,
688
+ "name": "custom_categories"
737
689
  },
738
690
  {
739
- "deprecationReason": null,
740
- "description": "Protocol for the tunnel",
741
- "isDeprecated": false,
742
- "name": "tunnel_protocol"
691
+ "deprecationReason": "use custom_category_id/custom_category_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
692
+ "description": "Name for the custom category defined in the Cato Management Application",
693
+ "isDeprecated": true,
694
+ "name": "custom_category"
743
695
  },
744
696
  {
745
697
  "deprecationReason": null,
746
- "description": "For Socket upgrades, new version number",
698
+ "description": "Custom category ID",
747
699
  "isDeprecated": false,
748
- "name": "socket_new_version"
700
+ "name": "custom_category_id"
749
701
  },
750
702
  {
751
703
  "deprecationReason": null,
752
- "description": "Socket version number",
753
- "isDeprecated": false,
754
- "name": "socket_version"
755
- },
756
- {
757
- "deprecationReason": null,
758
- "description": "Data that measures the jitter for a specific link",
704
+ "description": "Custom category name",
759
705
  "isDeprecated": false,
760
- "name": "link_health_jitter"
706
+ "name": "custom_category_name"
761
707
  },
762
708
  {
763
709
  "deprecationReason": null,
764
- "description": "Socket upgrade start time (Linux epoch format)",
710
+ "description": "For Internet traffic, country where the destination host is located",
765
711
  "isDeprecated": false,
766
- "name": "upgrade_start_time"
712
+ "name": "dest_country"
767
713
  },
768
714
  {
769
715
  "deprecationReason": null,
770
- "description": "BGP IP for Cato peer",
716
+ "description": "For Internet traffic, the two letter country code where the destination host is located (based on ISO 3166-1 alpha-2)",
771
717
  "isDeprecated": false,
772
- "name": "bgp_cato_ip"
718
+ "name": "dest_country_code"
773
719
  },
774
720
  {
775
721
  "deprecationReason": null,
776
- "description": "Cato system category",
722
+ "description": "The unique identifier by the SaaS vendor for the target group in an activity.",
777
723
  "isDeprecated": false,
778
- "name": "categories"
724
+ "name": "dest_group_id"
779
725
  },
780
726
  {
781
727
  "deprecationReason": null,
782
- "description": "Unique Cato ID for the security rule related to the event",
728
+ "description": "Identifies the target group involved in an activity",
783
729
  "isDeprecated": false,
784
- "name": "rule_id"
730
+ "name": "dest_group_name"
785
731
  },
786
732
  {
787
733
  "deprecationReason": null,
788
- "description": "For Socket HA events, indicates if the Socket is primary or secondary",
734
+ "description": "Destination IP address",
789
735
  "isDeprecated": false,
790
- "name": "socket_role"
736
+ "name": "dest_ip"
791
737
  },
792
738
  {
793
739
  "deprecationReason": null,
794
- "description": "Number of targets (servers) associated with this event",
740
+ "description": "For WAN traffic, destination is site or SDP user",
795
741
  "isDeprecated": false,
796
- "name": "targets_cardinality"
742
+ "name": "dest_is_site_or_vpn"
797
743
  },
798
744
  {
799
745
  "deprecationReason": null,
800
- "description": "Indicates if the Socket upgrade occurred during the maintenance window or initiated by Support (Cato Admin)",
746
+ "description": "The destination process ID",
801
747
  "isDeprecated": false,
802
- "name": "upgrade_initiated_by"
748
+ "name": "dest_pid"
803
749
  },
804
750
  {
805
751
  "deprecationReason": null,
806
- "description": "For WAN traffic, destination is site or SDP user",
752
+ "description": "Destination port",
807
753
  "isDeprecated": false,
808
- "name": "dest_is_site_or_vpn"
754
+ "name": "dest_port"
809
755
  },
810
756
  {
811
757
  "deprecationReason": null,
812
- "description": "BGP IP for remote peer",
758
+ "description": "Destination process command line",
813
759
  "isDeprecated": false,
814
- "name": "bgp_peer_ip"
760
+ "name": "dest_process_cmdline"
815
761
  },
816
762
  {
817
763
  "deprecationReason": null,
818
- "description": "Source type: site or remote user",
764
+ "description": "Destination process parent file path",
819
765
  "isDeprecated": false,
820
- "name": "src_is_site_or_vpn"
766
+ "name": "dest_process_parent_path"
821
767
  },
822
768
  {
823
769
  "deprecationReason": null,
824
- "description": "Active Directory name",
770
+ "description": "Destination process parent process ID",
825
771
  "isDeprecated": false,
826
- "name": "ad_name"
772
+ "name": "dest_process_parent_pid"
827
773
  },
828
774
  {
829
775
  "deprecationReason": null,
830
- "description": "Method used to get identity with User Awareness (such as Identity Agent)",
776
+ "description": "Destination process file path",
831
777
  "isDeprecated": false,
832
- "name": "user_awareness_method"
778
+ "name": "dest_process_path"
833
779
  },
834
780
  {
835
- "deprecationReason": null,
836
- "description": "Data that measures the congestion for a specific link",
837
- "isDeprecated": false,
838
- "name": "link_health_is_congested"
781
+ "deprecationReason": "use dest_site_id/dest_site_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
782
+ "description": "For WAN traffic, name of destination site or SDP user",
783
+ "isDeprecated": true,
784
+ "name": "dest_site"
839
785
  },
840
786
  {
841
787
  "deprecationReason": null,
842
- "description": "Name of subnet as defined in Cato Management Application",
788
+ "description": "Unique internal Cato ID for the destination site or remote user",
843
789
  "isDeprecated": false,
844
- "name": "subnet_name"
790
+ "name": "dest_site_id"
845
791
  },
846
792
  {
847
793
  "deprecationReason": null,
848
- "description": "OS version for the device (such as 14.3.0)",
794
+ "description": "The name of the destination site",
849
795
  "isDeprecated": false,
850
- "name": "os_version"
796
+ "name": "dest_site_name"
851
797
  },
852
798
  {
853
799
  "deprecationReason": null,
854
- "description": "Sub-type for Routing, Security, Connectivity, System or Sockets Management event",
800
+ "description": "Short description of the detection",
855
801
  "isDeprecated": false,
856
- "name": "event_sub_type"
802
+ "name": "detection_name"
857
803
  },
858
804
  {
859
805
  "deprecationReason": null,
860
- "description": "Host OS or tunnel device",
806
+ "description": "Triggered when malware has been detected EPP Behavioral engines and has been dealt with:\n\u2022 on_detection: the event is triggered upon malware detection;\n\u2022 on_end_disinfect: the event is triggered upon detection and followed disinfection;\n\u2022 on_inject: the event is triggered upon code injection.",
861
807
  "isDeprecated": false,
862
- "name": "os_type"
808
+ "name": "detection_stage"
863
809
  },
864
810
  {
865
811
  "deprecationReason": null,
866
- "description": "Direction of network traffic for this event, values are inbound or outbound",
812
+ "description": "Device Categories",
867
813
  "isDeprecated": false,
868
- "name": "traffic_direction"
814
+ "name": "device_categories"
869
815
  },
870
816
  {
871
817
  "deprecationReason": null,
872
- "description": "BGP disconnect error message",
818
+ "description": "Device Certificate Validated/Not Validated",
873
819
  "isDeprecated": false,
874
- "name": "bgp_suberror_code"
820
+ "name": "device_certificate"
875
821
  },
876
822
  {
877
823
  "deprecationReason": null,
878
- "description": "CIDR for BGP route",
824
+ "description": "Unique Cato ID for devices",
879
825
  "isDeprecated": false,
880
- "name": "bgp_route_cidr"
826
+ "name": "device_id"
881
827
  },
882
828
  {
883
829
  "deprecationReason": null,
884
- "description": "Unique Cato ID that identifies this security incident",
830
+ "description": "Device Manufacturer",
885
831
  "isDeprecated": false,
886
- "name": "incident_id"
887
- },
888
- {
889
- "deprecationReason": "use application_id/application_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
890
- "description": "For Internet firewall, app for this event",
891
- "isDeprecated": true,
892
- "name": "application"
832
+ "name": "device_manufacturer"
893
833
  },
894
834
  {
895
835
  "deprecationReason": null,
896
- "description": "The name of the application associated with the flow",
836
+ "description": "Device Model",
897
837
  "isDeprecated": false,
898
- "name": "application_name"
838
+ "name": "device_model"
899
839
  },
900
840
  {
901
841
  "deprecationReason": null,
902
- "description": "Application ID of the flow",
842
+ "description": "Name for device related to the event",
903
843
  "isDeprecated": false,
904
- "name": "application_id"
844
+ "name": "device_name"
905
845
  },
906
846
  {
907
847
  "deprecationReason": null,
908
- "description": "Socket upgrade end time (Linux epoch format):",
848
+ "description": "Device OS Type",
909
849
  "isDeprecated": false,
910
- "name": "upgrade_end_time"
850
+ "name": "device_os_type"
911
851
  },
912
852
  {
913
853
  "deprecationReason": null,
914
- "description": "Socket interface ID",
854
+ "description": "Device posture profiles",
915
855
  "isDeprecated": false,
916
- "name": "socket_interface_id"
856
+ "name": "device_posture_profile"
917
857
  },
918
858
  {
919
- "deprecationReason": "use custom_category_id/custom_category_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
920
- "description": "Unique Cato ID for the custom category",
859
+ "deprecationReason": "use device_posture_profile instead. Planned end-of-life (EoL) date: May 1, 2025.",
860
+ "description": "Device posture profiles",
921
861
  "isDeprecated": true,
922
- "name": "custom_categories"
862
+ "name": "device_posture_profiles"
923
863
  },
924
864
  {
925
865
  "deprecationReason": null,
926
- "description": "Custom category ID",
866
+ "description": "Device Type",
927
867
  "isDeprecated": false,
928
- "name": "custom_category_id"
868
+ "name": "device_type"
929
869
  },
930
870
  {
931
871
  "deprecationReason": null,
932
- "description": "Custom category name",
872
+ "description": "Host name of Domain Controller that created LDAP event",
933
873
  "isDeprecated": false,
934
- "name": "custom_category_name"
874
+ "name": "directory_host_name"
935
875
  },
936
876
  {
937
877
  "deprecationReason": null,
938
- "description": "Country in which the source host is located (detected via public IP address)",
878
+ "description": "IP address of Domain Controller that created LDAP event",
939
879
  "isDeprecated": false,
940
- "name": "src_country"
880
+ "name": "directory_ip"
941
881
  },
942
882
  {
943
883
  "deprecationReason": null,
944
- "description": "Country Code of country in which the source host is located (detected via public IP address)",
884
+ "description": "Result of LDAP Domain Controller sync event",
945
885
  "isDeprecated": false,
946
- "name": "src_country_code"
886
+ "name": "directory_sync_result"
947
887
  },
948
888
  {
949
889
  "deprecationReason": null,
950
- "description": "Count for events that are repeated multiple times during one minute",
890
+ "description": "Type of LDAP Domain Controller sync event",
951
891
  "isDeprecated": false,
952
- "name": "event_count"
892
+ "name": "directory_sync_type"
953
893
  },
954
894
  {
955
895
  "deprecationReason": null,
956
- "description": "File name",
896
+ "description": "If policy is set to disinfect, return the result of this action",
957
897
  "isDeprecated": false,
958
- "name": "file_name"
898
+ "name": "disinfect_result"
959
899
  },
960
900
  {
961
901
  "deprecationReason": null,
962
- "description": "IP address of Domain Controller that created LDAP event",
902
+ "description": "Describes the behavior when the DLP system encounters a failure",
963
903
  "isDeprecated": false,
964
- "name": "directory_ip"
904
+ "name": "dlp_fail_mode"
965
905
  },
966
906
  {
967
907
  "deprecationReason": null,
968
- "description": "Time stamp of event (Linux epoch format)",
908
+ "description": "DLP profiles related to the event",
969
909
  "isDeprecated": false,
970
- "name": "time"
910
+ "name": "dlp_profiles"
971
911
  },
972
912
  {
973
913
  "deprecationReason": null,
974
- "description": "URL associated with the event",
914
+ "description": "Defines the scanning methods used by the DLP system",
975
915
  "isDeprecated": false,
976
- "name": "url"
916
+ "name": "dlp_scan_types"
977
917
  },
978
918
  {
979
919
  "deprecationReason": null,
980
- "description": "For Internet traffic, country where the destination host is located",
920
+ "description": "Cato\u2019s DNS Protection type that matched the DNS request",
981
921
  "isDeprecated": false,
982
- "name": "dest_country"
922
+ "name": "dns_protection_category"
983
923
  },
984
924
  {
985
925
  "deprecationReason": null,
986
- "description": "For Internet traffic, the two letter country code where the destination host is located (based on ISO 3166-1 alpha-2)",
926
+ "description": "Domain queried in the DNS request",
987
927
  "isDeprecated": false,
988
- "name": "dest_country_code"
928
+ "name": "dns_query"
989
929
  },
990
930
  {
991
931
  "deprecationReason": null,
992
- "description": "Amount of flows for a given incident",
932
+ "description": "Domain name based on the SSL SNI, HTTP host name, or DNS name",
993
933
  "isDeprecated": false,
994
- "name": "flows_cardinality"
934
+ "name": "domain_name"
995
935
  },
996
936
  {
997
937
  "deprecationReason": null,
998
- "description": "The name of the destination site",
938
+ "description": "Egress PoP Name",
999
939
  "isDeprecated": false,
1000
- "name": "dest_site_name"
940
+ "name": "egress_pop_name"
1001
941
  },
1002
942
  {
1003
943
  "deprecationReason": null,
1004
- "description": "Routing, Security, Connectivity, System or Sockets Management event",
944
+ "description": "Egress Site Name for backhauling traffic",
1005
945
  "isDeprecated": false,
1006
- "name": "event_type"
946
+ "name": "egress_site_name"
1007
947
  },
1008
948
  {
1009
949
  "deprecationReason": null,
1010
- "description": "Account ID",
950
+ "description": "Email Subject",
1011
951
  "isDeprecated": false,
1012
- "name": "account_id"
952
+ "name": "email_subject"
1013
953
  },
1014
954
  {
1015
955
  "deprecationReason": null,
1016
- "description": "For IPS and SAM, ID of the IPS signature",
956
+ "description": "The ID for the endpoint",
1017
957
  "isDeprecated": false,
1018
- "name": "signature_id"
958
+ "name": "endpoint_id"
1019
959
  },
1020
960
  {
1021
961
  "deprecationReason": null,
1022
- "description": "Expiration date for Client certificate",
962
+ "description": "The Endpoint Protection Engine that detected the malware",
1023
963
  "isDeprecated": false,
1024
- "name": "client_cert_expires"
964
+ "name": "epp_engine_type"
1025
965
  },
1026
966
  {
1027
967
  "deprecationReason": null,
1028
- "description": "Name of Client certificate",
968
+ "description": "The profile assigned to the endpoint upon detection of the malware",
1029
969
  "isDeprecated": false,
1030
- "name": "client_cert_name"
970
+ "name": "epp_profile"
1031
971
  },
1032
972
  {
1033
973
  "deprecationReason": null,
1034
- "description": "Is the app for this event defined as a sanctioned app? (True/False)",
974
+ "description": "Count for events that are repeated multiple times during one minute",
1035
975
  "isDeprecated": false,
1036
- "name": "is_sanctioned_app"
976
+ "name": "event_count"
1037
977
  },
1038
978
  {
1039
979
  "deprecationReason": null,
1040
- "description": "Name of application activity",
980
+ "description": "Event Id",
1041
981
  "isDeprecated": false,
1042
- "name": "app_activity"
982
+ "name": "event_id"
1043
983
  },
1044
984
  {
1045
985
  "deprecationReason": null,
1046
- "description": "Activity type",
986
+ "description": "Cato's description of the event",
1047
987
  "isDeprecated": false,
1048
- "name": "app_activity_type"
988
+ "name": "event_message"
1049
989
  },
1050
990
  {
1051
991
  "deprecationReason": null,
1052
- "description": "Device posture profiles",
992
+ "description": "Sub-type for Routing, Security, Connectivity, System or Sockets Management event",
1053
993
  "isDeprecated": false,
1054
- "name": "device_posture_profile"
994
+ "name": "event_sub_type"
1055
995
  },
1056
996
  {
1057
- "deprecationReason": "use device_posture_profile instead. Planned end-of-life (EoL) date: May 1, 2025.",
1058
- "description": "Device posture profiles",
1059
- "isDeprecated": true,
1060
- "name": "device_posture_profiles"
997
+ "deprecationReason": null,
998
+ "description": "Routing, Security, Connectivity, System or Sockets Management event",
999
+ "isDeprecated": false,
1000
+ "name": "event_type"
1061
1001
  },
1062
1002
  {
1063
1003
  "deprecationReason": null,
1064
- "description": "Full path URL application activity",
1004
+ "description": "Provides details about why a specific action or process failed",
1065
1005
  "isDeprecated": false,
1066
- "name": "full_path_url"
1006
+ "name": "failure_reason"
1067
1007
  },
1068
1008
  {
1069
1009
  "deprecationReason": null,
1070
- "description": "Application risk score",
1010
+ "description": "File hash",
1071
1011
  "isDeprecated": false,
1072
- "name": "application_risk"
1012
+ "name": "file_hash"
1073
1013
  },
1074
1014
  {
1075
1015
  "deprecationReason": null,
1076
- "description": "Mitre attack techniques",
1016
+ "description": "File name",
1077
1017
  "isDeprecated": false,
1078
- "name": "mitre_attack_techniques"
1018
+ "name": "file_name"
1079
1019
  },
1080
1020
  {
1081
1021
  "deprecationReason": null,
1082
- "description": "Mitre attack subtechniques",
1022
+ "description": "The file operation when this event occurred",
1083
1023
  "isDeprecated": false,
1084
- "name": "mitre_attack_subtechniques"
1024
+ "name": "file_operation"
1085
1025
  },
1086
1026
  {
1087
1027
  "deprecationReason": null,
1088
- "description": "Mitre attack tactics",
1028
+ "description": "File size",
1089
1029
  "isDeprecated": false,
1090
- "name": "mitre_attack_tactics"
1030
+ "name": "file_size"
1091
1031
  },
1092
1032
  {
1093
1033
  "deprecationReason": null,
1094
- "description": "Indicator",
1034
+ "description": "File type",
1095
1035
  "isDeprecated": false,
1096
- "name": "indicator"
1036
+ "name": "file_type"
1097
1037
  },
1098
1038
  {
1099
1039
  "deprecationReason": null,
1100
- "description": "For SaaS Security API, SaaS app for the connector",
1040
+ "description": "The final status for this object after performing actions as defined by the policy",
1101
1041
  "isDeprecated": false,
1102
- "name": "connector_type"
1042
+ "name": "final_object_status"
1103
1043
  },
1104
1044
  {
1105
1045
  "deprecationReason": null,
1106
- "description": "For SaaS Security API, name of the connector",
1046
+ "description": "Amount of flows for a given incident",
1107
1047
  "isDeprecated": false,
1108
- "name": "connector_name"
1048
+ "name": "flows_cardinality"
1109
1049
  },
1110
1050
  {
1111
1051
  "deprecationReason": null,
1112
- "description": "For SaaS Security API, status of the connector",
1052
+ "description": "Full path URL application activity",
1113
1053
  "isDeprecated": false,
1114
- "name": "connector_status"
1054
+ "name": "full_path_url"
1115
1055
  },
1116
1056
  {
1117
1057
  "deprecationReason": null,
1118
- "description": "For SaaS Security API, parent Microsoft 365 connector",
1058
+ "description": "An identifier for a guest user using Cato through a Captive Portal",
1119
1059
  "isDeprecated": false,
1120
- "name": "parent_connector_name"
1060
+ "name": "guest_user"
1121
1061
  },
1122
1062
  {
1123
1063
  "deprecationReason": null,
1124
- "description": "File type",
1064
+ "description": "IP address of host related to event",
1125
1065
  "isDeprecated": false,
1126
- "name": "file_type"
1066
+ "name": "host_ip"
1127
1067
  },
1128
1068
  {
1129
1069
  "deprecationReason": null,
1130
- "description": "Describes the behavior when the DLP system encounters a failure",
1070
+ "description": "MAC address of host related to event",
1131
1071
  "isDeprecated": false,
1132
- "name": "dlp_fail_mode"
1072
+ "name": "host_mac"
1133
1073
  },
1134
1074
  {
1135
1075
  "deprecationReason": null,
1136
- "description": "DLP profiles related to the event",
1076
+ "description": "HTTP request method (ie. Get, Post)",
1137
1077
  "isDeprecated": false,
1138
- "name": "dlp_profiles"
1078
+ "name": "http_request_method"
1139
1079
  },
1140
1080
  {
1141
1081
  "deprecationReason": null,
1142
- "description": "Matched DLP data types related to the event",
1082
+ "description": "For MDR service, a true/false value that indicates if this event is: A summary that aggregates many events (true) Raw network flows for a single event (false)",
1143
1083
  "isDeprecated": false,
1144
- "name": "matched_data_types"
1084
+ "name": "incident_aggregation"
1145
1085
  },
1146
1086
  {
1147
1087
  "deprecationReason": null,
1148
- "description": "Severity defined for the rule",
1088
+ "description": "Unique Cato ID that identifies this security incident",
1149
1089
  "isDeprecated": false,
1150
- "name": "severity"
1090
+ "name": "incident_id"
1151
1091
  },
1152
1092
  {
1153
1093
  "deprecationReason": null,
1154
- "description": "For SaaS Security API, email address of the file owner",
1094
+ "description": "Indication",
1155
1095
  "isDeprecated": false,
1156
- "name": "owner"
1096
+ "name": "indication"
1157
1097
  },
1158
1098
  {
1159
1099
  "deprecationReason": null,
1160
- "description": "For SaaS Security API, email addresses of the users that received the file",
1100
+ "description": "Indicator",
1161
1101
  "isDeprecated": false,
1162
- "name": "collaborators"
1102
+ "name": "indicator"
1163
1103
  },
1164
1104
  {
1165
1105
  "deprecationReason": null,
1166
- "description": "Email Subject",
1106
+ "description": "The initial status of the object, before any policy was applied",
1167
1107
  "isDeprecated": false,
1168
- "name": "email_subject"
1108
+ "name": "initial_object_status"
1109
+ },
1110
+ {
1111
+ "deprecationReason": "use event_id instead. Planned end-of-life (EoL) date: May 1, 2025.",
1112
+ "description": "Cato Internal-use only",
1113
+ "isDeprecated": true,
1114
+ "name": "internalId"
1169
1115
  },
1170
1116
  {
1171
1117
  "deprecationReason": null,
1172
- "description": "Sharing Options for the file (such as SharePoint)",
1118
+ "description": "Network protocol for this event",
1173
1119
  "isDeprecated": false,
1174
- "name": "sharing_scope"
1120
+ "name": "ip_protocol"
1175
1121
  },
1176
1122
  {
1177
1123
  "deprecationReason": null,
1178
- "description": "Cato\u2019s DNS Protection type that matched the DNS request",
1124
+ "description": "Classifies users based on their permissions.",
1179
1125
  "isDeprecated": false,
1180
- "name": "dns_protection_category"
1126
+ "name": "is_admin"
1181
1127
  },
1182
1128
  {
1183
1129
  "deprecationReason": null,
1184
- "description": "If the events was part of the sinkhole flow",
1130
+ "description": "Indicates whether an activity requires administrative permissions.",
1185
1131
  "isDeprecated": false,
1186
- "name": "is_sinkhole"
1132
+ "name": "is_admin_activity"
1187
1133
  },
1188
1134
  {
1189
1135
  "deprecationReason": null,
1190
- "description": "The ID for the endpoint",
1136
+ "description": "Is Compliant",
1191
1137
  "isDeprecated": false,
1192
- "name": "endpoint_id"
1138
+ "name": "is_compliant"
1193
1139
  },
1194
1140
  {
1195
1141
  "deprecationReason": null,
1196
- "description": "The Endpoint Protection Engine that detected the malware",
1142
+ "description": "Is Managed",
1197
1143
  "isDeprecated": false,
1198
- "name": "epp_engine_type"
1144
+ "name": "is_managed"
1199
1145
  },
1200
1146
  {
1201
1147
  "deprecationReason": null,
1202
- "description": "The file operation when this event occurred",
1148
+ "description": "Is the app for this event defined as a sanctioned app? (True/False)",
1203
1149
  "isDeprecated": false,
1204
- "name": "file_operation"
1150
+ "name": "is_sanctioned_app"
1205
1151
  },
1206
1152
  {
1207
1153
  "deprecationReason": null,
1208
- "description": null,
1154
+ "description": "If the events was part of the sinkhole flow",
1209
1155
  "isDeprecated": false,
1210
- "name": "final_object_status"
1156
+ "name": "is_sinkhole"
1211
1157
  },
1212
1158
  {
1213
1159
  "deprecationReason": null,
1214
- "description": null,
1160
+ "description": "The ISP related to this event (when the IP address isn't provided by the ISP, then the event message is IP Addresses are assigned statically)",
1215
1161
  "isDeprecated": false,
1216
- "name": "object_name"
1162
+ "name": "ISP_name"
1217
1163
  },
1218
1164
  {
1219
1165
  "deprecationReason": null,
1220
- "description": null,
1166
+ "description": "Name defined for the public API Key in the Cato Management Application",
1221
1167
  "isDeprecated": false,
1222
- "name": "object_type"
1168
+ "name": "key_name"
1223
1169
  },
1224
1170
  {
1225
1171
  "deprecationReason": null,
1226
- "description": null,
1172
+ "description": "A list of labels providing additional context for the event",
1227
1173
  "isDeprecated": false,
1228
- "name": "object_id"
1174
+ "name": "labels"
1229
1175
  },
1230
1176
  {
1231
1177
  "deprecationReason": null,
1232
- "description": null,
1178
+ "description": "Data that measures the congestion for a specific link",
1233
1179
  "isDeprecated": false,
1234
- "name": "alert_id"
1180
+ "name": "link_health_is_congested"
1235
1181
  },
1236
1182
  {
1237
1183
  "deprecationReason": null,
1238
- "description": "The vendor that identified the incident, such as Cato or Microsoft",
1184
+ "description": "Data that measures the jitter for a specific link",
1239
1185
  "isDeprecated": false,
1240
- "name": "vendor"
1186
+ "name": "link_health_jitter"
1241
1187
  },
1242
1188
  {
1243
1189
  "deprecationReason": null,
1244
- "description": null,
1190
+ "description": "Round Trip Delay in Milliseconds that it takes a packet to travel between the source and the PoP",
1245
1191
  "isDeprecated": false,
1246
- "name": "vendor_user_id"
1192
+ "name": "link_health_latency"
1247
1193
  },
1248
1194
  {
1249
1195
  "deprecationReason": null,
1250
- "description": null,
1196
+ "description": "Data that measures the packet loss for a specific link",
1251
1197
  "isDeprecated": false,
1252
- "name": "status"
1198
+ "name": "link_health_pkt_loss"
1253
1199
  },
1254
1200
  {
1255
1201
  "deprecationReason": null,
1256
- "description": null,
1202
+ "description": "Link type \u2013 Cato, Alt. WAN or LAG",
1257
1203
  "isDeprecated": false,
1258
- "name": "classification"
1204
+ "name": "link_type"
1259
1205
  },
1260
1206
  {
1261
1207
  "deprecationReason": null,
1262
- "description": null,
1208
+ "description": "The user logged into this endpoint during this event",
1263
1209
  "isDeprecated": false,
1264
- "name": "quarantine_folder_path"
1210
+ "name": "logged_in_user"
1265
1211
  },
1266
1212
  {
1267
1213
  "deprecationReason": null,
1268
- "description": null,
1214
+ "description": "Login action, values are: User portal (myvpn.catonetworks.com) or VPN client (Client or site traffic)",
1269
1215
  "isDeprecated": false,
1270
- "name": "title"
1216
+ "name": "login_type"
1271
1217
  },
1272
1218
  {
1273
1219
  "deprecationReason": null,
1274
- "description": null,
1220
+ "description": "Matched DLP data types related to the event",
1275
1221
  "isDeprecated": false,
1276
- "name": "recommended_actions"
1222
+ "name": "matched_data_types"
1277
1223
  },
1278
1224
  {
1279
- "deprecationReason": "use src_pid instead. Planned end-of-life (EoL) date: March 1, 2025.",
1280
- "description": null,
1281
- "isDeprecated": true,
1282
- "name": "pid"
1225
+ "deprecationReason": null,
1226
+ "description": "Mitre attack subtechniques",
1227
+ "isDeprecated": false,
1228
+ "name": "mitre_attack_subtechniques"
1283
1229
  },
1284
1230
  {
1285
- "deprecationReason": "use src_process_parent_pid instead. Planned end-of-life (EoL) date: March 1, 2025.",
1286
- "description": null,
1287
- "isDeprecated": true,
1288
- "name": "parent_pid"
1231
+ "deprecationReason": null,
1232
+ "description": "Mitre attack tactics",
1233
+ "isDeprecated": false,
1234
+ "name": "mitre_attack_tactics"
1289
1235
  },
1290
1236
  {
1291
- "deprecationReason": "use src_process_path instead. Planned end-of-life (EoL) date: March 1, 2025.",
1292
- "description": null,
1293
- "isDeprecated": true,
1294
- "name": "process_path"
1237
+ "deprecationReason": null,
1238
+ "description": "Mitre attack techniques",
1239
+ "isDeprecated": false,
1240
+ "name": "mitre_attack_techniques"
1295
1241
  },
1296
1242
  {
1297
1243
  "deprecationReason": null,
1298
- "description": null,
1244
+ "description": "Network Access",
1299
1245
  "isDeprecated": false,
1300
- "name": "failure_reason"
1246
+ "name": "network_access"
1301
1247
  },
1302
1248
  {
1303
1249
  "deprecationReason": null,
1304
- "description": null,
1250
+ "description": "Matched network rule",
1305
1251
  "isDeprecated": false,
1306
- "name": "out_of_band_access"
1252
+ "name": "network_rule"
1307
1253
  },
1308
1254
  {
1309
1255
  "deprecationReason": null,
1310
- "description": "A Unique ID for the quarantined file",
1256
+ "description": "For SaaS Security API, API Error of Apps Security Notification",
1311
1257
  "isDeprecated": false,
1312
- "name": "quarantine_uuid"
1258
+ "name": "notification_api_error"
1313
1259
  },
1314
1260
  {
1315
1261
  "deprecationReason": null,
1316
- "description": null,
1262
+ "description": "For SaaS Security API, description of Apps Security Notification",
1317
1263
  "isDeprecated": false,
1318
- "name": "logged_in_user"
1264
+ "name": "notification_description"
1319
1265
  },
1320
1266
  {
1321
1267
  "deprecationReason": null,
1322
- "description": "The profile assigned to the endpoint upon detection of the malware",
1268
+ "description": "Unique identifier by the 3rd party App of the object being referenced",
1323
1269
  "isDeprecated": false,
1324
- "name": "epp_profile"
1270
+ "name": "object_id"
1325
1271
  },
1326
1272
  {
1327
1273
  "deprecationReason": null,
1328
- "description": "Source process ID",
1274
+ "description": "The name of the object for this event (for example: file name)",
1329
1275
  "isDeprecated": false,
1330
- "name": "src_pid"
1276
+ "name": "object_name"
1331
1277
  },
1332
1278
  {
1333
1279
  "deprecationReason": null,
1334
- "description": "Source process file path",
1280
+ "description": "Specifies the type of object being acted upon (e.g., file, folder)",
1335
1281
  "isDeprecated": false,
1336
- "name": "src_process_path"
1282
+ "name": "object_type"
1337
1283
  },
1338
1284
  {
1339
1285
  "deprecationReason": null,
1340
- "description": "Source process command line",
1286
+ "description": "Office mode Enabled/Disabled",
1341
1287
  "isDeprecated": false,
1342
- "name": "src_process_cmdline"
1288
+ "name": "office_mode"
1343
1289
  },
1344
1290
  {
1345
1291
  "deprecationReason": null,
1346
- "description": "Source process parent process ID",
1292
+ "description": "Host OS or tunnel device",
1347
1293
  "isDeprecated": false,
1348
- "name": "src_process_parent_pid"
1294
+ "name": "os_type"
1349
1295
  },
1350
1296
  {
1351
1297
  "deprecationReason": null,
1352
- "description": "Source process parent file path",
1298
+ "description": "OS version for the device (such as 14.3.0)",
1353
1299
  "isDeprecated": false,
1354
- "name": "src_process_parent_path"
1300
+ "name": "os_version"
1355
1301
  },
1356
1302
  {
1357
1303
  "deprecationReason": null,
1358
- "description": "The destination process ID",
1304
+ "description": "Indicate if the Access to the 3rd Party SaaS App occurs without passing through Cato Cloud (direct access to saas App)",
1359
1305
  "isDeprecated": false,
1360
- "name": "dest_pid"
1306
+ "name": "out_of_band_access"
1361
1307
  },
1362
1308
  {
1363
1309
  "deprecationReason": null,
1364
- "description": "Destination process file path",
1310
+ "description": "For SaaS Security API, email address of the file owner",
1365
1311
  "isDeprecated": false,
1366
- "name": "dest_process_path"
1312
+ "name": "owner"
1367
1313
  },
1368
1314
  {
1369
1315
  "deprecationReason": null,
1370
- "description": "Destination process command line",
1316
+ "description": "Pac File Enabled/Disabled",
1371
1317
  "isDeprecated": false,
1372
- "name": "dest_process_cmdline"
1318
+ "name": "pac_file"
1373
1319
  },
1374
1320
  {
1375
1321
  "deprecationReason": null,
1376
- "description": "Destination process parent process ID",
1322
+ "description": "For SaaS Security API, parent Microsoft 365 connector",
1377
1323
  "isDeprecated": false,
1378
- "name": "dest_process_parent_pid"
1324
+ "name": "parent_connector_name"
1379
1325
  },
1380
1326
  {
1381
1327
  "deprecationReason": null,
1382
- "description": "Destination process parent file path",
1328
+ "description": "Name of PoP location",
1383
1329
  "isDeprecated": false,
1384
- "name": "dest_process_parent_path"
1330
+ "name": "pop_name"
1385
1331
  },
1386
1332
  {
1387
1333
  "deprecationReason": null,
1388
- "description": "If policy is set to disinfect, return the result of this action",
1334
+ "description": "Precedence",
1389
1335
  "isDeprecated": false,
1390
- "name": "disinfect_result"
1336
+ "name": "precedence"
1391
1337
  },
1392
1338
  {
1393
1339
  "deprecationReason": null,
@@ -1397,494 +1343,584 @@
1397
1343
  },
1398
1344
  {
1399
1345
  "deprecationReason": null,
1400
- "description": "HTTP request method (ie. Get, Post)",
1346
+ "description": "Producer",
1401
1347
  "isDeprecated": false,
1402
- "name": "http_request_method"
1348
+ "name": "producer"
1403
1349
  },
1404
1350
  {
1405
1351
  "deprecationReason": null,
1406
- "description": "XFF HTTP header indicates the original IP address for the connections",
1352
+ "description": "Prompt Page Selected Action",
1407
1353
  "isDeprecated": false,
1408
- "name": "xff"
1354
+ "name": "prompt_action"
1409
1355
  },
1410
1356
  {
1411
1357
  "deprecationReason": null,
1412
- "description": "Domain queried in the DNS request",
1358
+ "description": "Public source IP",
1413
1359
  "isDeprecated": false,
1414
- "name": "dns_query"
1360
+ "name": "public_ip"
1415
1361
  },
1416
1362
  {
1417
1363
  "deprecationReason": null,
1418
- "description": "Name defined for the public API Key in the Cato Management Application",
1364
+ "description": "QoS Priority value",
1419
1365
  "isDeprecated": false,
1420
- "name": "key_name"
1366
+ "name": "qos_priority"
1421
1367
  },
1422
1368
  {
1423
1369
  "deprecationReason": null,
1424
- "description": null,
1370
+ "description": "For QoS, the time that this QoS event started. The event is generated when the QoS event finishes",
1425
1371
  "isDeprecated": false,
1426
- "name": "api_type"
1372
+ "name": "qos_reported_time"
1427
1373
  },
1428
1374
  {
1429
1375
  "deprecationReason": null,
1430
- "description": null,
1376
+ "description": "Specifies the path to a quarantine folder for isolated files",
1431
1377
  "isDeprecated": false,
1432
- "name": "api_name"
1378
+ "name": "quarantine_folder_path"
1433
1379
  },
1434
1380
  {
1435
1381
  "deprecationReason": null,
1436
- "description": "Related Apps",
1382
+ "description": "A Unique ID for the quarantined file",
1437
1383
  "isDeprecated": false,
1438
- "name": "app_stack"
1384
+ "name": "quarantine_uuid"
1439
1385
  },
1440
1386
  {
1441
1387
  "deprecationReason": null,
1442
- "description": "TLS Inspection rule name",
1388
+ "description": "Raw Data",
1443
1389
  "isDeprecated": false,
1444
- "name": "tls_rule_name"
1390
+ "name": "raw_data"
1445
1391
  },
1446
1392
  {
1447
1393
  "deprecationReason": null,
1448
- "description": "TLS Certificate Error",
1394
+ "description": "Textual recommendation of the steps to take",
1449
1395
  "isDeprecated": false,
1450
- "name": "tls_certificate_error"
1396
+ "name": "recommended_actions"
1451
1397
  },
1452
1398
  {
1453
1399
  "deprecationReason": null,
1454
- "description": "TLS Version",
1400
+ "description": "The URL that links directly to the object involved in the activity",
1455
1401
  "isDeprecated": false,
1456
- "name": "tls_version"
1402
+ "name": "reference_url"
1457
1403
  },
1458
1404
  {
1459
1405
  "deprecationReason": null,
1460
- "description": "TLS Error Type",
1406
+ "description": "Registration code used the first time that a SDP user authenticates (the code is partially obfuscated)",
1461
1407
  "isDeprecated": false,
1462
- "name": "tls_error_type"
1408
+ "name": "registration_code"
1463
1409
  },
1464
1410
  {
1465
1411
  "deprecationReason": null,
1466
- "description": "TLS Error Description",
1412
+ "description": "(IPS or SAM event) Indicates the overall impact of a threat for the host or network: Low \u2013 ie. adware Medium \u2013 ie. network scans High \u2013 ie. spyware or worms",
1467
1413
  "isDeprecated": false,
1468
- "name": "tls_error_description"
1414
+ "name": "risk_level"
1469
1415
  },
1470
1416
  {
1471
- "deprecationReason": null,
1472
- "description": "Cato application name",
1473
- "isDeprecated": false,
1474
- "name": "cato_app"
1417
+ "deprecationReason": "use rule_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
1418
+ "description": "Name of security rule related to the event",
1419
+ "isDeprecated": true,
1420
+ "name": "rule"
1475
1421
  },
1476
1422
  {
1477
1423
  "deprecationReason": null,
1478
- "description": "Prompt Page Selected Action",
1424
+ "description": "Unique Cato ID for the security rule related to the event",
1479
1425
  "isDeprecated": false,
1480
- "name": "prompt_action"
1426
+ "name": "rule_id"
1481
1427
  },
1482
1428
  {
1483
1429
  "deprecationReason": null,
1484
- "description": "Unique Cato ID for devices",
1430
+ "description": "Rule name",
1485
1431
  "isDeprecated": false,
1486
- "name": "device_id"
1432
+ "name": "rule_name"
1487
1433
  },
1488
1434
  {
1489
1435
  "deprecationReason": null,
1490
- "description": "Unique Cato Visible ID for devices",
1436
+ "description": "Severity defined for the rule",
1491
1437
  "isDeprecated": false,
1492
- "name": "visible_device_id"
1438
+ "name": "severity"
1493
1439
  },
1494
1440
  {
1495
1441
  "deprecationReason": null,
1496
- "description": "Connectivity authentication method: unauthenticated, OATH2, LDAP or VPN",
1442
+ "description": "Sharing Options for the file (such as SharePoint)",
1497
1443
  "isDeprecated": false,
1498
- "name": "auth_method"
1444
+ "name": "sharing_scope"
1499
1445
  },
1500
1446
  {
1501
1447
  "deprecationReason": null,
1502
- "description": "Always-On Bypass Method",
1448
+ "description": "Sign In Types",
1503
1449
  "isDeprecated": false,
1504
- "name": "bypass_method"
1450
+ "name": "sign_in_event_types"
1505
1451
  },
1506
1452
  {
1507
1453
  "deprecationReason": null,
1508
- "description": "Always-On Bypass Duration In Seconds",
1454
+ "description": "For IPS and SAM, ID of the IPS signature",
1509
1455
  "isDeprecated": false,
1510
- "name": "bypass_duration_sec"
1456
+ "name": "signature_id"
1511
1457
  },
1512
1458
  {
1513
1459
  "deprecationReason": null,
1514
- "description": "Always-On Bypass Reason",
1460
+ "description": "Name for Socket interface",
1515
1461
  "isDeprecated": false,
1516
- "name": "bypass_reason"
1462
+ "name": "socket_interface"
1517
1463
  },
1518
1464
  {
1519
1465
  "deprecationReason": null,
1520
- "description": "Sign In Types",
1466
+ "description": "Socket interface ID",
1521
1467
  "isDeprecated": false,
1522
- "name": "sign_in_event_types"
1468
+ "name": "socket_interface_id"
1523
1469
  },
1524
1470
  {
1525
1471
  "deprecationReason": null,
1526
- "description": "Unique identifier for the tenant within a multi-tenant environment",
1472
+ "description": "For Socket upgrades, new version number",
1527
1473
  "isDeprecated": false,
1528
- "name": "tenant_id"
1474
+ "name": "socket_new_version"
1529
1475
  },
1530
1476
  {
1531
1477
  "deprecationReason": null,
1532
- "description": "Tenant Name",
1478
+ "description": "For Socket upgrade, previous version number",
1533
1479
  "isDeprecated": false,
1534
- "name": "tenant_name"
1480
+ "name": "socket_old_version"
1535
1481
  },
1536
1482
  {
1537
1483
  "deprecationReason": null,
1538
- "description": "User Agent",
1484
+ "description": "Type of Socket reset (Hardware/Software)",
1539
1485
  "isDeprecated": false,
1540
- "name": "user_agent"
1486
+ "name": "socket_reset"
1541
1487
  },
1542
1488
  {
1543
1489
  "deprecationReason": null,
1544
- "description": "Vendor Event Id",
1490
+ "description": "For Socket HA events, indicates if the Socket is primary or secondary",
1545
1491
  "isDeprecated": false,
1546
- "name": "vendor_event_id"
1492
+ "name": "socket_role"
1547
1493
  },
1548
1494
  {
1549
1495
  "deprecationReason": null,
1550
- "description": "Vendor Device Id",
1496
+ "description": "Socket serial number",
1551
1497
  "isDeprecated": false,
1552
- "name": "vendor_device_id"
1498
+ "name": "socket_serial"
1553
1499
  },
1554
1500
  {
1555
1501
  "deprecationReason": null,
1556
- "description": "Vendor Device Name",
1502
+ "description": "Socket version number",
1557
1503
  "isDeprecated": false,
1558
- "name": "vendor_device_name"
1504
+ "name": "socket_version"
1559
1505
  },
1560
1506
  {
1561
1507
  "deprecationReason": null,
1562
- "description": "Is Compliant",
1508
+ "description": "Split Tunnel Configuration",
1563
1509
  "isDeprecated": false,
1564
- "name": "is_compliant"
1510
+ "name": "split_tunnel_configuration"
1565
1511
  },
1566
1512
  {
1567
1513
  "deprecationReason": null,
1568
- "description": "Is Managed",
1514
+ "description": "Country in which the source host is located (detected via public IP address)",
1569
1515
  "isDeprecated": false,
1570
- "name": "is_managed"
1516
+ "name": "src_country"
1571
1517
  },
1572
1518
  {
1573
1519
  "deprecationReason": null,
1574
- "description": "Trust Type",
1520
+ "description": "Country Code of country in which the source host is located (detected via public IP address)",
1575
1521
  "isDeprecated": false,
1576
- "name": "trust_type"
1522
+ "name": "src_country_code"
1577
1523
  },
1578
1524
  {
1579
1525
  "deprecationReason": null,
1580
- "description": "Confidence Level",
1526
+ "description": "IP for host or Cato Client",
1581
1527
  "isDeprecated": false,
1582
- "name": "confidence_level"
1528
+ "name": "src_ip"
1583
1529
  },
1584
1530
  {
1585
1531
  "deprecationReason": null,
1586
- "description": "Defines the scanning methods used by the DLP system",
1532
+ "description": "Source type: site or remote user",
1587
1533
  "isDeprecated": false,
1588
- "name": "dlp_scan_types"
1534
+ "name": "src_is_site_or_vpn"
1589
1535
  },
1590
1536
  {
1591
1537
  "deprecationReason": null,
1592
- "description": "Network Access",
1538
+ "description": "IP address provided by ISP to site or Client",
1593
1539
  "isDeprecated": false,
1594
- "name": "network_access"
1540
+ "name": "src_isp_ip"
1541
+ },
1542
+ {
1543
+ "deprecationReason": "please use src_site_id and dest_site_id instead. Planned end-of-life (EoL) date: June 30, 2025.",
1544
+ "description": "Source or destination site or remote user ID.\nThis field can only be used in filter.",
1545
+ "isDeprecated": true,
1546
+ "name": "src_or_dest_site_id"
1595
1547
  },
1596
1548
  {
1597
1549
  "deprecationReason": null,
1598
- "description": "Analyst Verdict",
1550
+ "description": "Source process ID",
1599
1551
  "isDeprecated": false,
1600
- "name": "analyst_verdict"
1552
+ "name": "src_pid"
1601
1553
  },
1602
1554
  {
1603
1555
  "deprecationReason": null,
1604
- "description": "Criticality",
1556
+ "description": "Internal port number",
1605
1557
  "isDeprecated": false,
1606
- "name": "criticality"
1558
+ "name": "src_port"
1607
1559
  },
1608
1560
  {
1609
1561
  "deprecationReason": null,
1610
- "description": "Indication",
1562
+ "description": "Source process command line",
1611
1563
  "isDeprecated": false,
1612
- "name": "indication"
1564
+ "name": "src_process_cmdline"
1613
1565
  },
1614
1566
  {
1615
1567
  "deprecationReason": null,
1616
- "description": "Producer",
1568
+ "description": "Source process parent file path",
1617
1569
  "isDeprecated": false,
1618
- "name": "producer"
1570
+ "name": "src_process_parent_path"
1619
1571
  },
1620
1572
  {
1621
1573
  "deprecationReason": null,
1622
- "description": "Story Id",
1574
+ "description": "Source process parent process ID",
1623
1575
  "isDeprecated": false,
1624
- "name": "story_id"
1576
+ "name": "src_process_parent_pid"
1625
1577
  },
1626
1578
  {
1627
1579
  "deprecationReason": null,
1628
- "description": "Raw Data",
1580
+ "description": "Source process file path",
1629
1581
  "isDeprecated": false,
1630
- "name": "raw_data"
1582
+ "name": "src_process_path"
1583
+ },
1584
+ {
1585
+ "deprecationReason": "use src_site_id/src_site_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
1586
+ "description": "Name of site or user initiating the connection",
1587
+ "isDeprecated": true,
1588
+ "name": "src_site"
1631
1589
  },
1632
1590
  {
1633
1591
  "deprecationReason": null,
1634
- "description": "Trigger",
1592
+ "description": "Unique internal Cato ID for the site or remote user",
1635
1593
  "isDeprecated": false,
1636
- "name": "trigger"
1594
+ "name": "src_site_id"
1637
1595
  },
1638
1596
  {
1639
1597
  "deprecationReason": null,
1640
- "description": "Matched network rule",
1598
+ "description": "Source site or remote user",
1641
1599
  "isDeprecated": false,
1642
- "name": "network_rule"
1600
+ "name": "src_site_name"
1643
1601
  },
1644
1602
  {
1645
1603
  "deprecationReason": null,
1646
- "description": "The algorithm that is used (CUBIC /NewReno / BBR)",
1604
+ "description": "Static host",
1647
1605
  "isDeprecated": false,
1648
- "name": "congestion_algorithm"
1606
+ "name": "static_host"
1649
1607
  },
1650
1608
  {
1651
1609
  "deprecationReason": null,
1652
- "description": "Shows if traffic was TCP accelerated or not",
1610
+ "description": "The story status.\nPossible values: Open, Pending Analysis, Pending more info, Closed, Reopened, Monitoring",
1653
1611
  "isDeprecated": false,
1654
- "name": "tcp_acceleration"
1612
+ "name": "status"
1655
1613
  },
1656
1614
  {
1657
1615
  "deprecationReason": null,
1658
- "description": "Shows if traffic was TLS inspected or not",
1616
+ "description": "Story Id",
1659
1617
  "isDeprecated": false,
1660
- "name": "tls_inspection"
1618
+ "name": "story_id"
1661
1619
  },
1662
1620
  {
1663
1621
  "deprecationReason": null,
1664
- "description": "Public source IP",
1622
+ "description": "Name of subnet as defined in Cato Management Application",
1665
1623
  "isDeprecated": false,
1666
- "name": "public_ip"
1624
+ "name": "subnet_name"
1667
1625
  },
1668
1626
  {
1669
1627
  "deprecationReason": null,
1670
- "description": "Egress Site Name for backhauling traffic",
1628
+ "description": "Number of targets (servers) associated with this event",
1671
1629
  "isDeprecated": false,
1672
- "name": "egress_site_name"
1630
+ "name": "targets_cardinality"
1673
1631
  },
1674
1632
  {
1675
1633
  "deprecationReason": null,
1676
- "description": "Egress PoP Name",
1634
+ "description": "Shows if traffic was TCP accelerated or not",
1677
1635
  "isDeprecated": false,
1678
- "name": "egress_pop_name"
1636
+ "name": "tcp_acceleration"
1679
1637
  },
1680
1638
  {
1681
1639
  "deprecationReason": null,
1682
- "description": "QoS Priority value",
1640
+ "description": "Unique identifier for the tenant within a multi-tenant environment",
1683
1641
  "isDeprecated": false,
1684
- "name": "qos_priority"
1642
+ "name": "tenant_id"
1685
1643
  },
1686
1644
  {
1687
1645
  "deprecationReason": null,
1688
- "description": "Split Tunnel Configuration",
1646
+ "description": "Tenant Name",
1689
1647
  "isDeprecated": false,
1690
- "name": "split_tunnel_configuration"
1648
+ "name": "tenant_name"
1691
1649
  },
1692
1650
  {
1693
1651
  "deprecationReason": null,
1694
- "description": "Pac File Enabled/Disabled",
1652
+ "description": "Tenant Restriction Rule Name",
1695
1653
  "isDeprecated": false,
1696
- "name": "pac_file"
1654
+ "name": "tenant_restriction_rule_name"
1697
1655
  },
1698
1656
  {
1699
1657
  "deprecationReason": null,
1700
- "description": "Always-on Configuration",
1658
+ "description": "Contains the detection risk level. Could be one of the following:\n\u2022 Info - this is information-only event, the activity is not malicious;\n\u2022 Suspicious - the event is suspicious. It may be malicious, but there is not enough information\n\u2022 Malware - the event is malicious activity",
1701
1659
  "isDeprecated": false,
1702
- "name": "always_on_configuration"
1660
+ "name": "threat_confidence"
1703
1661
  },
1704
1662
  {
1705
1663
  "deprecationReason": null,
1706
- "description": "Lan access Allowed / Blocked",
1664
+ "description": "For anti-malware events, malware name For IPS events, explains the reason why the traffic was blocked",
1707
1665
  "isDeprecated": false,
1708
- "name": "vpn_lan_access"
1666
+ "name": "threat_name"
1709
1667
  },
1710
1668
  {
1711
1669
  "deprecationReason": null,
1712
- "description": "Connect on boot Enabled/Disabled",
1670
+ "description": "Link to external malware reference",
1713
1671
  "isDeprecated": false,
1714
- "name": "connect_on_boot"
1672
+ "name": "threat_reference"
1715
1673
  },
1716
1674
  {
1717
1675
  "deprecationReason": null,
1718
- "description": "Trusted networks Enabled/Disabled",
1676
+ "description": "The higher the score, the more dangerous the event. In range between 1 - 100 inclusive",
1719
1677
  "isDeprecated": false,
1720
- "name": "trusted_networks"
1678
+ "name": "threat_score"
1721
1679
  },
1722
1680
  {
1723
1681
  "deprecationReason": null,
1724
- "description": "Office mode Enabled/Disabled",
1682
+ "description": "Type of malware event",
1725
1683
  "isDeprecated": false,
1726
- "name": "office_mode"
1684
+ "name": "threat_type"
1727
1685
  },
1728
1686
  {
1729
1687
  "deprecationReason": null,
1730
- "description": "Device Certificate Validated/Not Validated",
1688
+ "description": "Result of malware event (clean indicates a safe file)",
1731
1689
  "isDeprecated": false,
1732
- "name": "device_certificate"
1690
+ "name": "threat_verdict"
1733
1691
  },
1734
1692
  {
1735
1693
  "deprecationReason": null,
1736
- "description": "Tunnel Protocol TCP/UDP",
1694
+ "description": "Time stamp of the event (Linux epoch format)",
1737
1695
  "isDeprecated": false,
1738
- "name": "tunnel_ip_protocol"
1696
+ "name": "time"
1739
1697
  },
1740
1698
  {
1741
1699
  "deprecationReason": null,
1742
- "description": "For SaaS Security API, description of Apps Security Notification",
1700
+ "description": "Time stamp of the event (Human-readable format)",
1743
1701
  "isDeprecated": false,
1744
- "name": "notification_description"
1702
+ "name": "time_str"
1745
1703
  },
1746
1704
  {
1747
1705
  "deprecationReason": null,
1748
- "description": "For SaaS Security API, API Error of Apps Security Notification",
1706
+ "description": "A short summary of the activity",
1749
1707
  "isDeprecated": false,
1750
- "name": "notification_api_error"
1708
+ "name": "title"
1751
1709
  },
1752
1710
  {
1753
1711
  "deprecationReason": null,
1754
- "description": "The URL that links directly to the object involved in the activity",
1712
+ "description": "TLS Certificate Error",
1755
1713
  "isDeprecated": false,
1756
- "name": "reference_url"
1714
+ "name": "tls_certificate_error"
1757
1715
  },
1758
1716
  {
1759
1717
  "deprecationReason": null,
1760
- "description": "SaaS user activities into categories.",
1718
+ "description": "TLS Error Description",
1761
1719
  "isDeprecated": false,
1762
- "name": "app_activity_category"
1720
+ "name": "tls_error_description"
1763
1721
  },
1764
1722
  {
1765
1723
  "deprecationReason": null,
1766
- "description": "Indicates whether an activity requires administrative permissions.",
1724
+ "description": "TLS Error Type",
1767
1725
  "isDeprecated": false,
1768
- "name": "is_admin_activity"
1726
+ "name": "tls_error_type"
1769
1727
  },
1770
1728
  {
1771
1729
  "deprecationReason": null,
1772
- "description": "Classifies users based on their permissions.",
1730
+ "description": "Shows if traffic was TLS inspected or not",
1773
1731
  "isDeprecated": false,
1774
- "name": "is_admin"
1732
+ "name": "tls_inspection"
1775
1733
  },
1776
1734
  {
1777
1735
  "deprecationReason": null,
1778
- "description": "Shows the display name of the target user involved in an activity",
1736
+ "description": "TLS Inspection rule name",
1779
1737
  "isDeprecated": false,
1780
- "name": "collaborator_name"
1738
+ "name": "tls_rule_name"
1781
1739
  },
1782
1740
  {
1783
1741
  "deprecationReason": null,
1784
- "description": "The unique identifier by the SaaS vendor for the target group in an activity.",
1742
+ "description": "TLS Version",
1785
1743
  "isDeprecated": false,
1786
- "name": "dest_group_id"
1744
+ "name": "tls_version"
1787
1745
  },
1788
1746
  {
1789
1747
  "deprecationReason": null,
1790
- "description": "Identifies the target group involved in an activity",
1748
+ "description": "Direction of network traffic for this event, values are inbound or outbound",
1791
1749
  "isDeprecated": false,
1792
- "name": "dest_group_name"
1750
+ "name": "traffic_direction"
1793
1751
  },
1794
1752
  {
1795
1753
  "deprecationReason": null,
1796
- "description": "Identifies system access software or device",
1754
+ "description": "Translated Client IP",
1797
1755
  "isDeprecated": false,
1798
- "name": "access_method"
1756
+ "name": "translated_client_ip"
1799
1757
  },
1800
1758
  {
1801
1759
  "deprecationReason": null,
1802
- "description": "Shows the id of the target user involved in an activity",
1760
+ "description": "Translated Server IP",
1803
1761
  "isDeprecated": false,
1804
- "name": "vendor_collaborator_id"
1762
+ "name": "translated_server_ip"
1805
1763
  },
1806
1764
  {
1807
1765
  "deprecationReason": null,
1808
- "description": "Device Categories",
1766
+ "description": "Trigger",
1809
1767
  "isDeprecated": false,
1810
- "name": "device_categories"
1768
+ "name": "trigger"
1811
1769
  },
1812
1770
  {
1813
1771
  "deprecationReason": null,
1814
- "description": "Device Manufacturer",
1772
+ "description": "Trust Type",
1815
1773
  "isDeprecated": false,
1816
- "name": "device_manufacturer"
1774
+ "name": "trust_type"
1817
1775
  },
1818
1776
  {
1819
1777
  "deprecationReason": null,
1820
- "description": "Device Model",
1778
+ "description": "Trusted networks Enabled/Disabled",
1821
1779
  "isDeprecated": false,
1822
- "name": "device_model"
1780
+ "name": "trusted_networks"
1823
1781
  },
1824
1782
  {
1825
1783
  "deprecationReason": null,
1826
- "description": "Device OS Type",
1784
+ "description": "Tunnel Protocol TCP/UDP",
1827
1785
  "isDeprecated": false,
1828
- "name": "device_os_type"
1786
+ "name": "tunnel_ip_protocol"
1829
1787
  },
1830
1788
  {
1831
1789
  "deprecationReason": null,
1832
- "description": "Device Type",
1790
+ "description": "Protocol for the tunnel",
1833
1791
  "isDeprecated": false,
1834
- "name": "device_type"
1792
+ "name": "tunnel_protocol"
1835
1793
  },
1836
1794
  {
1837
1795
  "deprecationReason": null,
1838
- "description": "Tenant Restriction Rule Name",
1796
+ "description": "Socket upgrade end time (Linux epoch format):",
1839
1797
  "isDeprecated": false,
1840
- "name": "tenant_restriction_rule_name"
1798
+ "name": "upgrade_end_time"
1841
1799
  },
1842
1800
  {
1843
1801
  "deprecationReason": null,
1844
- "description": "Connection Origin",
1802
+ "description": "Indicates if the Socket upgrade occurred during the maintenance window or initiated by Support (Cato Admin)",
1845
1803
  "isDeprecated": false,
1846
- "name": "connection_origin"
1804
+ "name": "upgrade_initiated_by"
1847
1805
  },
1848
1806
  {
1849
1807
  "deprecationReason": null,
1850
- "description": "Translated Server IP",
1808
+ "description": "Socket upgrade start time (Linux epoch format)",
1851
1809
  "isDeprecated": false,
1852
- "name": "translated_server_ip"
1810
+ "name": "upgrade_start_time"
1853
1811
  },
1854
1812
  {
1855
1813
  "deprecationReason": null,
1856
- "description": "Translated Client IP",
1814
+ "description": "URL associated with the event",
1857
1815
  "isDeprecated": false,
1858
- "name": "translated_client_ip"
1816
+ "name": "url"
1859
1817
  },
1860
1818
  {
1861
1819
  "deprecationReason": null,
1862
- "description": "IoC Container Name",
1820
+ "description": "User Agent",
1863
1821
  "isDeprecated": false,
1864
- "name": "container_name"
1822
+ "name": "user_agent"
1865
1823
  },
1866
1824
  {
1867
1825
  "deprecationReason": null,
1868
- "description": "An external system identifier used for correlation between related Cato entities. Example: external ticket id that correlates Cato XDR stories.",
1826
+ "description": "Method used to get identity with User Awareness (such as Identity Agent)",
1869
1827
  "isDeprecated": false,
1870
- "name": "correlation_id"
1828
+ "name": "user_awareness_method"
1871
1829
  },
1872
1830
  {
1873
1831
  "deprecationReason": null,
1874
- "description": "Precedence",
1832
+ "description": "User ID",
1875
1833
  "isDeprecated": false,
1876
- "name": "precedence"
1834
+ "name": "user_id"
1877
1835
  },
1878
1836
  {
1879
1837
  "deprecationReason": null,
1880
- "description": "A list of labels providing additional context for the event",
1838
+ "description": "User that generated the event",
1881
1839
  "isDeprecated": false,
1882
- "name": "labels"
1883
- }
1884
- ],
1885
- "fields": null,
1886
- "inputFields": null,
1887
- "interfaces": null,
1840
+ "name": "user_name"
1841
+ },
1842
+ {
1843
+ "deprecationReason": null,
1844
+ "description": "For Block/Prompt page, reference ID to report incorrect category",
1845
+ "isDeprecated": false,
1846
+ "name": "user_reference_id"
1847
+ },
1848
+ {
1849
+ "deprecationReason": null,
1850
+ "description": "User risk level category",
1851
+ "isDeprecated": false,
1852
+ "name": "user_risk_level"
1853
+ },
1854
+ {
1855
+ "deprecationReason": null,
1856
+ "description": "The vendor that identified the incident, such as Cato or Microsoft",
1857
+ "isDeprecated": false,
1858
+ "name": "vendor"
1859
+ },
1860
+ {
1861
+ "deprecationReason": null,
1862
+ "description": "Shows the id of the target user involved in an activity",
1863
+ "isDeprecated": false,
1864
+ "name": "vendor_collaborator_id"
1865
+ },
1866
+ {
1867
+ "deprecationReason": null,
1868
+ "description": "Vendor Device Id",
1869
+ "isDeprecated": false,
1870
+ "name": "vendor_device_id"
1871
+ },
1872
+ {
1873
+ "deprecationReason": null,
1874
+ "description": "Vendor Device Name",
1875
+ "isDeprecated": false,
1876
+ "name": "vendor_device_name"
1877
+ },
1878
+ {
1879
+ "deprecationReason": null,
1880
+ "description": "Vendor Event Id",
1881
+ "isDeprecated": false,
1882
+ "name": "vendor_event_id"
1883
+ },
1884
+ {
1885
+ "deprecationReason": null,
1886
+ "description": "Identifies the user in the vendor\u2019s system",
1887
+ "isDeprecated": false,
1888
+ "name": "vendor_user_id"
1889
+ },
1890
+ {
1891
+ "deprecationReason": null,
1892
+ "description": "Unique Cato Visible ID for devices",
1893
+ "isDeprecated": false,
1894
+ "name": "visible_device_id"
1895
+ },
1896
+ {
1897
+ "deprecationReason": null,
1898
+ "description": "Lan access Allowed / Blocked",
1899
+ "isDeprecated": false,
1900
+ "name": "vpn_lan_access"
1901
+ },
1902
+ {
1903
+ "deprecationReason": null,
1904
+ "description": "User\u2019s email address",
1905
+ "isDeprecated": false,
1906
+ "name": "vpn_user_email"
1907
+ },
1908
+ {
1909
+ "deprecationReason": null,
1910
+ "description": "For LDAP sync events, name of the AD domain",
1911
+ "isDeprecated": false,
1912
+ "name": "windows_domain_name"
1913
+ },
1914
+ {
1915
+ "deprecationReason": null,
1916
+ "description": "XFF HTTP header indicates the original IP address for the connections",
1917
+ "isDeprecated": false,
1918
+ "name": "xff"
1919
+ }
1920
+ ],
1921
+ "fields": null,
1922
+ "inputFields": null,
1923
+ "interfaces": null,
1888
1924
  "kind": "ENUM",
1889
1925
  "name": "EventFieldName",
1890
1926
  "possibleTypes": null
@@ -1998,208 +2034,244 @@
1998
2034
  "description": null,
1999
2035
  "enumValues": [
2000
2036
  {
2001
- "deprecationReason": "use src_site_id/src_site_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
2002
- "description": "Name of site or user initiating the connection",
2003
- "isDeprecated": true,
2004
- "name": "src_site"
2037
+ "deprecationReason": null,
2038
+ "description": "Identifies system access software or device",
2039
+ "isDeprecated": false,
2040
+ "name": "access_method"
2005
2041
  },
2006
2042
  {
2007
2043
  "deprecationReason": null,
2008
- "description": "Unique internal Cato ID for the site or remote user",
2044
+ "description": "Account ID",
2009
2045
  "isDeprecated": false,
2010
- "name": "src_site_id"
2046
+ "name": "account_id"
2011
2047
  },
2012
2048
  {
2013
2049
  "deprecationReason": null,
2014
- "description": "Static host",
2050
+ "description": "Firewall, QoS or LAG action",
2015
2051
  "isDeprecated": false,
2016
- "name": "static_host"
2052
+ "name": "action"
2017
2053
  },
2018
2054
  {
2019
2055
  "deprecationReason": null,
2020
- "description": "User ID",
2056
+ "description": "A list of actions taken, if more than one action was taken as defined by a policy",
2021
2057
  "isDeprecated": false,
2022
- "name": "user_id"
2058
+ "name": "actions_taken"
2023
2059
  },
2024
2060
  {
2025
- "deprecationReason": "use dest_site_id/dest_site_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
2026
- "description": "For WAN traffic, name of destination site or SDP user",
2027
- "isDeprecated": true,
2028
- "name": "dest_site"
2061
+ "deprecationReason": null,
2062
+ "description": "Active Directory name",
2063
+ "isDeprecated": false,
2064
+ "name": "ad_name"
2029
2065
  },
2030
2066
  {
2031
2067
  "deprecationReason": null,
2032
- "description": "Unique internal Cato ID for the destination site or remote user",
2068
+ "description": "A unique identifier of the alert notification",
2033
2069
  "isDeprecated": false,
2034
- "name": "dest_site_id"
2070
+ "name": "alert_id"
2035
2071
  },
2036
2072
  {
2037
- "deprecationReason": "please use src_site_id and dest_site_id instead. Planned end-of-life (EoL) date: June 30, 2025.",
2038
- "description": "Source or destination site or remote user ID.\nThis field can only be used in filter.",
2039
- "isDeprecated": true,
2040
- "name": "src_or_dest_site_id"
2073
+ "deprecationReason": null,
2074
+ "description": "Always-on Configuration",
2075
+ "isDeprecated": false,
2076
+ "name": "always_on_configuration"
2041
2077
  },
2042
2078
  {
2043
- "deprecationReason": "use rule_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
2044
- "description": "Name of security rule related to the event",
2045
- "isDeprecated": true,
2046
- "name": "rule"
2079
+ "deprecationReason": null,
2080
+ "description": "Analyst Verdict",
2081
+ "isDeprecated": false,
2082
+ "name": "analyst_verdict"
2047
2083
  },
2048
2084
  {
2049
2085
  "deprecationReason": null,
2050
- "description": "The ISP related to this event (when the IP address isn't provided by the ISP, then the event message is IP Addresses are assigned statically)",
2086
+ "description": "The name of the API, e.g. eventsFeed",
2051
2087
  "isDeprecated": false,
2052
- "name": "ISP_name"
2088
+ "name": "api_name"
2053
2089
  },
2054
2090
  {
2055
2091
  "deprecationReason": null,
2056
- "description": "Name for Socket interface",
2092
+ "description": "Specifies whether the API is a query (read) or a mutation (create/update/delete)",
2057
2093
  "isDeprecated": false,
2058
- "name": "socket_interface"
2094
+ "name": "api_type"
2059
2095
  },
2060
2096
  {
2061
- "deprecationReason": "use custom_category_id/custom_category_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
2062
- "description": "Name for the custom category defined in the Cato Management Application",
2097
+ "deprecationReason": null,
2098
+ "description": "Name of application activity",
2099
+ "isDeprecated": false,
2100
+ "name": "app_activity"
2101
+ },
2102
+ {
2103
+ "deprecationReason": null,
2104
+ "description": "SaaS user activities into categories.",
2105
+ "isDeprecated": false,
2106
+ "name": "app_activity_category"
2107
+ },
2108
+ {
2109
+ "deprecationReason": null,
2110
+ "description": "Activity type",
2111
+ "isDeprecated": false,
2112
+ "name": "app_activity_type"
2113
+ },
2114
+ {
2115
+ "deprecationReason": null,
2116
+ "description": "Related Apps",
2117
+ "isDeprecated": false,
2118
+ "name": "app_stack"
2119
+ },
2120
+ {
2121
+ "deprecationReason": "use application_id/application_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
2122
+ "description": "For Internet firewall, app for this event",
2063
2123
  "isDeprecated": true,
2064
- "name": "custom_category"
2124
+ "name": "application"
2065
2125
  },
2066
2126
  {
2067
2127
  "deprecationReason": null,
2068
- "description": "Host name of Domain Controller that created LDAP event",
2128
+ "description": "Application ID of the flow",
2069
2129
  "isDeprecated": false,
2070
- "name": "directory_host_name"
2130
+ "name": "application_id"
2071
2131
  },
2072
2132
  {
2073
2133
  "deprecationReason": null,
2074
- "description": "Destination port",
2134
+ "description": "The name of the application associated with the flow",
2075
2135
  "isDeprecated": false,
2076
- "name": "dest_port"
2136
+ "name": "application_name"
2077
2137
  },
2078
2138
  {
2079
2139
  "deprecationReason": null,
2080
- "description": "BGP ASN for remote peer",
2140
+ "description": "Application risk score",
2081
2141
  "isDeprecated": false,
2082
- "name": "bgp_peer_asn"
2142
+ "name": "application_risk"
2083
2143
  },
2084
2144
  {
2085
2145
  "deprecationReason": null,
2086
- "description": "For Block/Prompt page, reference ID to report incorrect category",
2146
+ "description": "Connectivity authentication method: unauthenticated, OATH2, LDAP or VPN",
2087
2147
  "isDeprecated": false,
2088
- "name": "user_reference_id"
2148
+ "name": "auth_method"
2089
2149
  },
2090
2150
  {
2091
2151
  "deprecationReason": null,
2092
- "description": "Internal port number",
2152
+ "description": "Examples: MFA or password",
2093
2153
  "isDeprecated": false,
2094
- "name": "src_port"
2154
+ "name": "authentication_type"
2095
2155
  },
2096
2156
  {
2097
2157
  "deprecationReason": null,
2098
- "description": "Data that measures the packet loss for a specific link",
2158
+ "description": "BGP ASN for Cato peer",
2099
2159
  "isDeprecated": false,
2100
- "name": "link_health_pkt_loss"
2160
+ "name": "bgp_cato_asn"
2101
2161
  },
2102
2162
  {
2103
2163
  "deprecationReason": null,
2104
- "description": "Name of PoP location",
2164
+ "description": "BGP IP for Cato peer",
2105
2165
  "isDeprecated": false,
2106
- "name": "pop_name"
2166
+ "name": "bgp_cato_ip"
2107
2167
  },
2108
2168
  {
2109
2169
  "deprecationReason": null,
2110
- "description": "IP address of host related to event",
2170
+ "description": "BGP disconnect error code",
2111
2171
  "isDeprecated": false,
2112
- "name": "host_ip"
2172
+ "name": "bgp_error_code"
2113
2173
  },
2114
2174
  {
2115
2175
  "deprecationReason": null,
2116
- "description": "Cato's description of the event",
2176
+ "description": "BGP ASN for remote peer",
2117
2177
  "isDeprecated": false,
2118
- "name": "event_message"
2178
+ "name": "bgp_peer_asn"
2119
2179
  },
2120
2180
  {
2121
2181
  "deprecationReason": null,
2122
- "description": "Source site or remote user",
2182
+ "description": "BGP IP for remote peer",
2123
2183
  "isDeprecated": false,
2124
- "name": "src_site_name"
2184
+ "name": "bgp_peer_ip"
2125
2185
  },
2126
2186
  {
2127
2187
  "deprecationReason": null,
2128
- "description": "Domain name based on the SSL SNI, HTTP host name, or DNS name",
2188
+ "description": "CIDR for BGP route",
2129
2189
  "isDeprecated": false,
2130
- "name": "domain_name"
2190
+ "name": "bgp_route_cidr"
2131
2191
  },
2132
2192
  {
2133
2193
  "deprecationReason": null,
2134
- "description": "Destination IP address",
2194
+ "description": "BGP disconnect error message",
2135
2195
  "isDeprecated": false,
2136
- "name": "dest_ip"
2196
+ "name": "bgp_suberror_code"
2137
2197
  },
2138
2198
  {
2139
2199
  "deprecationReason": null,
2140
- "description": "File hash",
2200
+ "description": "Always-On Bypass Duration In Seconds",
2141
2201
  "isDeprecated": false,
2142
- "name": "file_hash"
2202
+ "name": "bypass_duration_sec"
2143
2203
  },
2144
2204
  {
2145
2205
  "deprecationReason": null,
2146
- "description": "IP address provided by ISP to site or Client",
2206
+ "description": "Always-On Bypass Method",
2147
2207
  "isDeprecated": false,
2148
- "name": "src_isp_ip"
2208
+ "name": "bypass_method"
2149
2209
  },
2150
2210
  {
2151
2211
  "deprecationReason": null,
2152
- "description": "Examples: MFA or password",
2212
+ "description": "Always-On Bypass Reason",
2153
2213
  "isDeprecated": false,
2154
- "name": "authentication_type"
2214
+ "name": "bypass_reason"
2155
2215
  },
2156
2216
  {
2157
2217
  "deprecationReason": null,
2158
- "description": "Rule name",
2218
+ "description": "Cato system category",
2159
2219
  "isDeprecated": false,
2160
- "name": "rule_name"
2220
+ "name": "categories"
2161
2221
  },
2162
2222
  {
2163
2223
  "deprecationReason": null,
2164
- "description": "Result of LDAP Domain Controller sync event",
2224
+ "description": "Cato application name",
2165
2225
  "isDeprecated": false,
2166
- "name": "directory_sync_result"
2226
+ "name": "cato_app"
2167
2227
  },
2168
2228
  {
2169
2229
  "deprecationReason": null,
2170
- "description": "MAC address of host related to event",
2230
+ "description": "Activity classification, e.g. FALSE_POSITIVE",
2171
2231
  "isDeprecated": false,
2172
- "name": "host_mac"
2232
+ "name": "classification"
2173
2233
  },
2174
2234
  {
2175
2235
  "deprecationReason": null,
2176
- "description": "Type of malware event",
2236
+ "description": "Expiration date for Client certificate",
2177
2237
  "isDeprecated": false,
2178
- "name": "threat_type"
2238
+ "name": "client_cert_expires"
2179
2239
  },
2180
2240
  {
2181
2241
  "deprecationReason": null,
2182
- "description": "Result of malware event (clean indicates a safe file)",
2242
+ "description": "Name of Client certificate",
2183
2243
  "isDeprecated": false,
2184
- "name": "threat_verdict"
2244
+ "name": "client_cert_name"
2185
2245
  },
2186
2246
  {
2187
2247
  "deprecationReason": null,
2188
- "description": "Name for device related to the event",
2248
+ "description": "Type of process generating this traffic",
2189
2249
  "isDeprecated": false,
2190
- "name": "device_name"
2250
+ "name": "client_class"
2191
2251
  },
2192
2252
  {
2193
2253
  "deprecationReason": null,
2194
- "description": "Link type \u2013 Cato, Alt. WAN or LAG",
2254
+ "description": "Socket or SDP Client version",
2195
2255
  "isDeprecated": false,
2196
- "name": "link_type"
2256
+ "name": "client_version"
2197
2257
  },
2198
2258
  {
2199
2259
  "deprecationReason": null,
2200
- "description": "Login action, values are: User portal (myvpn.catonetworks.com) or VPN client (Client or site traffic)",
2260
+ "description": "Shows the display name of the target user involved in an activity",
2201
2261
  "isDeprecated": false,
2202
- "name": "login_type"
2262
+ "name": "collaborator_name"
2263
+ },
2264
+ {
2265
+ "deprecationReason": null,
2266
+ "description": "For SaaS Security API, email addresses of the users that received the file",
2267
+ "isDeprecated": false,
2268
+ "name": "collaborators"
2269
+ },
2270
+ {
2271
+ "deprecationReason": null,
2272
+ "description": "Confidence Level",
2273
+ "isDeprecated": false,
2274
+ "name": "confidence_level"
2203
2275
  },
2204
2276
  {
2205
2277
  "deprecationReason": null,
@@ -2208,400 +2280,418 @@
2208
2280
  "name": "configured_host_name"
2209
2281
  },
2210
2282
  {
2211
- "deprecationReason": "use event_id instead. Planned end-of-life (EoL) date: May 1, 2025.",
2212
- "description": "Cato Internal-use only",
2213
- "isDeprecated": true,
2214
- "name": "internalId"
2283
+ "deprecationReason": null,
2284
+ "description": "The algorithm that is used (CUBIC /NewReno / BBR)",
2285
+ "isDeprecated": false,
2286
+ "name": "congestion_algorithm"
2215
2287
  },
2216
2288
  {
2217
2289
  "deprecationReason": null,
2218
- "description": "Event Id",
2290
+ "description": "Connect on boot Enabled/Disabled",
2219
2291
  "isDeprecated": false,
2220
- "name": "event_id"
2292
+ "name": "connect_on_boot"
2221
2293
  },
2222
2294
  {
2223
2295
  "deprecationReason": null,
2224
- "description": "Type of LDAP Domain Controller sync event",
2296
+ "description": "Connection Origin",
2225
2297
  "isDeprecated": false,
2226
- "name": "directory_sync_type"
2298
+ "name": "connection_origin"
2227
2299
  },
2228
2300
  {
2229
2301
  "deprecationReason": null,
2230
- "description": "User\u2019s email address",
2302
+ "description": "For SaaS Security API, name of the connector",
2231
2303
  "isDeprecated": false,
2232
- "name": "vpn_user_email"
2304
+ "name": "connector_name"
2233
2305
  },
2234
2306
  {
2235
2307
  "deprecationReason": null,
2236
- "description": "Type of process generating this traffic",
2308
+ "description": "For SaaS Security API, status of the connector",
2237
2309
  "isDeprecated": false,
2238
- "name": "client_class"
2310
+ "name": "connector_status"
2239
2311
  },
2240
2312
  {
2241
2313
  "deprecationReason": null,
2242
- "description": "For MDR service, a true/false value that indicates if this event is: A summary that aggregates many events (true) Raw network flows for a single event (false)",
2314
+ "description": "For SaaS Security API, SaaS app for the connector",
2243
2315
  "isDeprecated": false,
2244
- "name": "incident_aggregation"
2316
+ "name": "connector_type"
2245
2317
  },
2246
2318
  {
2247
2319
  "deprecationReason": null,
2248
- "description": "Type of Socket reset (Hardware/Software)",
2320
+ "description": "IoC Container Name",
2249
2321
  "isDeprecated": false,
2250
- "name": "socket_reset"
2322
+ "name": "container_name"
2251
2323
  },
2252
2324
  {
2253
2325
  "deprecationReason": null,
2254
- "description": "User that generated the event",
2326
+ "description": "An external system identifier used for correlation between related Cato entities. Example: external ticket id that correlates Cato XDR stories.",
2255
2327
  "isDeprecated": false,
2256
- "name": "user_name"
2328
+ "name": "correlation_id"
2257
2329
  },
2258
2330
  {
2259
2331
  "deprecationReason": null,
2260
- "description": "Socket or SDP Client version",
2332
+ "description": "Criticality",
2261
2333
  "isDeprecated": false,
2262
- "name": "client_version"
2334
+ "name": "criticality"
2335
+ },
2336
+ {
2337
+ "deprecationReason": "use custom_category_id/custom_category_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
2338
+ "description": "Unique Cato ID for the custom category",
2339
+ "isDeprecated": true,
2340
+ "name": "custom_categories"
2341
+ },
2342
+ {
2343
+ "deprecationReason": "use custom_category_id/custom_category_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
2344
+ "description": "Name for the custom category defined in the Cato Management Application",
2345
+ "isDeprecated": true,
2346
+ "name": "custom_category"
2263
2347
  },
2264
2348
  {
2265
2349
  "deprecationReason": null,
2266
- "description": "File size",
2350
+ "description": "Custom category ID",
2267
2351
  "isDeprecated": false,
2268
- "name": "file_size"
2352
+ "name": "custom_category_id"
2269
2353
  },
2270
2354
  {
2271
2355
  "deprecationReason": null,
2272
- "description": "Registration code used the first time that a SDP user authenticates (the code is partially obfuscated)",
2356
+ "description": "Custom category name",
2273
2357
  "isDeprecated": false,
2274
- "name": "registration_code"
2358
+ "name": "custom_category_name"
2275
2359
  },
2276
2360
  {
2277
2361
  "deprecationReason": null,
2278
- "description": "BGP disconnect error code",
2362
+ "description": "For Internet traffic, country where the destination host is located",
2279
2363
  "isDeprecated": false,
2280
- "name": "bgp_error_code"
2364
+ "name": "dest_country"
2281
2365
  },
2282
2366
  {
2283
- "deprecationReason": "Planned end-of-life (EoL) date: April 15, 2025.",
2284
- "description": "Description from Cato Management Application for BGP peer",
2285
- "isDeprecated": true,
2286
- "name": "bgp_peer_description"
2367
+ "deprecationReason": null,
2368
+ "description": "For Internet traffic, the two letter country code where the destination host is located (based on ISO 3166-1 alpha-2)",
2369
+ "isDeprecated": false,
2370
+ "name": "dest_country_code"
2287
2371
  },
2288
2372
  {
2289
2373
  "deprecationReason": null,
2290
- "description": "For anti-malware events, malware name For IPS events, explains the reason why the traffic was blocked",
2374
+ "description": "The unique identifier by the SaaS vendor for the target group in an activity.",
2291
2375
  "isDeprecated": false,
2292
- "name": "threat_name"
2376
+ "name": "dest_group_id"
2293
2377
  },
2294
2378
  {
2295
2379
  "deprecationReason": null,
2296
- "description": "For QoS, the time that this QoS event started. The event is generated when the QoS event finishes",
2380
+ "description": "Identifies the target group involved in an activity",
2297
2381
  "isDeprecated": false,
2298
- "name": "qos_reported_time"
2382
+ "name": "dest_group_name"
2299
2383
  },
2300
2384
  {
2301
2385
  "deprecationReason": null,
2302
- "description": "Network protocol for this event",
2386
+ "description": "Destination IP address",
2303
2387
  "isDeprecated": false,
2304
- "name": "ip_protocol"
2388
+ "name": "dest_ip"
2305
2389
  },
2306
2390
  {
2307
2391
  "deprecationReason": null,
2308
- "description": "BGP ASN for Cato peer",
2392
+ "description": "For WAN traffic, destination is site or SDP user",
2309
2393
  "isDeprecated": false,
2310
- "name": "bgp_cato_asn"
2394
+ "name": "dest_is_site_or_vpn"
2311
2395
  },
2312
2396
  {
2313
2397
  "deprecationReason": null,
2314
- "description": "IP for host or Cato Client",
2398
+ "description": "The destination process ID",
2315
2399
  "isDeprecated": false,
2316
- "name": "src_ip"
2400
+ "name": "dest_pid"
2317
2401
  },
2318
2402
  {
2319
2403
  "deprecationReason": null,
2320
- "description": "Link to external malware reference",
2404
+ "description": "Destination port",
2321
2405
  "isDeprecated": false,
2322
- "name": "threat_reference"
2406
+ "name": "dest_port"
2323
2407
  },
2324
2408
  {
2325
2409
  "deprecationReason": null,
2326
- "description": "Firewall, QoS or LAG action",
2410
+ "description": "Destination process command line",
2327
2411
  "isDeprecated": false,
2328
- "name": "action"
2412
+ "name": "dest_process_cmdline"
2329
2413
  },
2330
2414
  {
2331
2415
  "deprecationReason": null,
2332
- "description": "For LDAP sync events, name of the AD domain",
2416
+ "description": "Destination process parent file path",
2333
2417
  "isDeprecated": false,
2334
- "name": "windows_domain_name"
2418
+ "name": "dest_process_parent_path"
2335
2419
  },
2336
2420
  {
2337
2421
  "deprecationReason": null,
2338
- "description": "(IPS or SAM event) Indicates the overall impact of a threat for the host or network: Low \u2013 ie. adware Medium \u2013 ie. network scans High \u2013 ie. spyware or worms",
2422
+ "description": "Destination process parent process ID",
2339
2423
  "isDeprecated": false,
2340
- "name": "risk_level"
2424
+ "name": "dest_process_parent_pid"
2341
2425
  },
2342
2426
  {
2343
2427
  "deprecationReason": null,
2344
- "description": "For Socket upgrade, previous version number",
2428
+ "description": "Destination process file path",
2345
2429
  "isDeprecated": false,
2346
- "name": "socket_old_version"
2430
+ "name": "dest_process_path"
2347
2431
  },
2348
2432
  {
2349
- "deprecationReason": null,
2350
- "description": "Round Trip Delay in Milliseconds that it takes a packet to travel between the source and the PoP",
2351
- "isDeprecated": false,
2352
- "name": "link_health_latency"
2433
+ "deprecationReason": "use dest_site_id/dest_site_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
2434
+ "description": "For WAN traffic, name of destination site or SDP user",
2435
+ "isDeprecated": true,
2436
+ "name": "dest_site"
2353
2437
  },
2354
2438
  {
2355
2439
  "deprecationReason": null,
2356
- "description": "Protocol for the tunnel",
2440
+ "description": "Unique internal Cato ID for the destination site or remote user",
2357
2441
  "isDeprecated": false,
2358
- "name": "tunnel_protocol"
2442
+ "name": "dest_site_id"
2359
2443
  },
2360
2444
  {
2361
2445
  "deprecationReason": null,
2362
- "description": "For Socket upgrades, new version number",
2446
+ "description": "The name of the destination site",
2363
2447
  "isDeprecated": false,
2364
- "name": "socket_new_version"
2448
+ "name": "dest_site_name"
2365
2449
  },
2366
2450
  {
2367
2451
  "deprecationReason": null,
2368
- "description": "Socket version number",
2452
+ "description": "Short description of the detection",
2369
2453
  "isDeprecated": false,
2370
- "name": "socket_version"
2454
+ "name": "detection_name"
2371
2455
  },
2372
2456
  {
2373
2457
  "deprecationReason": null,
2374
- "description": "Data that measures the jitter for a specific link",
2458
+ "description": "Triggered when malware has been detected EPP Behavioral engines and has been dealt with:\n\u2022 on_detection: the event is triggered upon malware detection;\n\u2022 on_end_disinfect: the event is triggered upon detection and followed disinfection;\n\u2022 on_inject: the event is triggered upon code injection.",
2375
2459
  "isDeprecated": false,
2376
- "name": "link_health_jitter"
2460
+ "name": "detection_stage"
2377
2461
  },
2378
2462
  {
2379
2463
  "deprecationReason": null,
2380
- "description": "Socket upgrade start time (Linux epoch format)",
2464
+ "description": "Device Categories",
2381
2465
  "isDeprecated": false,
2382
- "name": "upgrade_start_time"
2466
+ "name": "device_categories"
2383
2467
  },
2384
2468
  {
2385
2469
  "deprecationReason": null,
2386
- "description": "BGP IP for Cato peer",
2470
+ "description": "Device Certificate Validated/Not Validated",
2387
2471
  "isDeprecated": false,
2388
- "name": "bgp_cato_ip"
2472
+ "name": "device_certificate"
2389
2473
  },
2390
2474
  {
2391
2475
  "deprecationReason": null,
2392
- "description": "Cato system category",
2476
+ "description": "Unique Cato ID for devices",
2393
2477
  "isDeprecated": false,
2394
- "name": "categories"
2478
+ "name": "device_id"
2395
2479
  },
2396
2480
  {
2397
2481
  "deprecationReason": null,
2398
- "description": "Unique Cato ID for the security rule related to the event",
2482
+ "description": "Device Manufacturer",
2399
2483
  "isDeprecated": false,
2400
- "name": "rule_id"
2484
+ "name": "device_manufacturer"
2401
2485
  },
2402
2486
  {
2403
2487
  "deprecationReason": null,
2404
- "description": "For Socket HA events, indicates if the Socket is primary or secondary",
2488
+ "description": "Device Model",
2405
2489
  "isDeprecated": false,
2406
- "name": "socket_role"
2490
+ "name": "device_model"
2407
2491
  },
2408
2492
  {
2409
2493
  "deprecationReason": null,
2410
- "description": "Number of targets (servers) associated with this event",
2494
+ "description": "Name for device related to the event",
2411
2495
  "isDeprecated": false,
2412
- "name": "targets_cardinality"
2496
+ "name": "device_name"
2413
2497
  },
2414
2498
  {
2415
2499
  "deprecationReason": null,
2416
- "description": "Indicates if the Socket upgrade occurred during the maintenance window or initiated by Support (Cato Admin)",
2500
+ "description": "Device OS Type",
2417
2501
  "isDeprecated": false,
2418
- "name": "upgrade_initiated_by"
2502
+ "name": "device_os_type"
2419
2503
  },
2420
2504
  {
2421
2505
  "deprecationReason": null,
2422
- "description": "For WAN traffic, destination is site or SDP user",
2506
+ "description": "Device posture profiles",
2423
2507
  "isDeprecated": false,
2424
- "name": "dest_is_site_or_vpn"
2508
+ "name": "device_posture_profile"
2509
+ },
2510
+ {
2511
+ "deprecationReason": "use device_posture_profile instead. Planned end-of-life (EoL) date: May 1, 2025.",
2512
+ "description": "Device posture profiles",
2513
+ "isDeprecated": true,
2514
+ "name": "device_posture_profiles"
2425
2515
  },
2426
2516
  {
2427
2517
  "deprecationReason": null,
2428
- "description": "BGP IP for remote peer",
2518
+ "description": "Device Type",
2429
2519
  "isDeprecated": false,
2430
- "name": "bgp_peer_ip"
2520
+ "name": "device_type"
2431
2521
  },
2432
2522
  {
2433
2523
  "deprecationReason": null,
2434
- "description": "Source type: site or remote user",
2524
+ "description": "Host name of Domain Controller that created LDAP event",
2435
2525
  "isDeprecated": false,
2436
- "name": "src_is_site_or_vpn"
2526
+ "name": "directory_host_name"
2437
2527
  },
2438
2528
  {
2439
2529
  "deprecationReason": null,
2440
- "description": "Active Directory name",
2530
+ "description": "IP address of Domain Controller that created LDAP event",
2441
2531
  "isDeprecated": false,
2442
- "name": "ad_name"
2532
+ "name": "directory_ip"
2443
2533
  },
2444
2534
  {
2445
2535
  "deprecationReason": null,
2446
- "description": "Method used to get identity with User Awareness (such as Identity Agent)",
2536
+ "description": "Result of LDAP Domain Controller sync event",
2447
2537
  "isDeprecated": false,
2448
- "name": "user_awareness_method"
2538
+ "name": "directory_sync_result"
2449
2539
  },
2450
2540
  {
2451
2541
  "deprecationReason": null,
2452
- "description": "Data that measures the congestion for a specific link",
2542
+ "description": "Type of LDAP Domain Controller sync event",
2453
2543
  "isDeprecated": false,
2454
- "name": "link_health_is_congested"
2544
+ "name": "directory_sync_type"
2455
2545
  },
2456
2546
  {
2457
2547
  "deprecationReason": null,
2458
- "description": "Name of subnet as defined in Cato Management Application",
2548
+ "description": "If policy is set to disinfect, return the result of this action",
2459
2549
  "isDeprecated": false,
2460
- "name": "subnet_name"
2550
+ "name": "disinfect_result"
2461
2551
  },
2462
2552
  {
2463
2553
  "deprecationReason": null,
2464
- "description": "OS version for the device (such as 14.3.0)",
2554
+ "description": "Describes the behavior when the DLP system encounters a failure",
2465
2555
  "isDeprecated": false,
2466
- "name": "os_version"
2556
+ "name": "dlp_fail_mode"
2467
2557
  },
2468
2558
  {
2469
2559
  "deprecationReason": null,
2470
- "description": "Sub-type for Routing, Security, Connectivity, System or Sockets Management event",
2560
+ "description": "DLP profiles related to the event",
2471
2561
  "isDeprecated": false,
2472
- "name": "event_sub_type"
2562
+ "name": "dlp_profiles"
2473
2563
  },
2474
2564
  {
2475
2565
  "deprecationReason": null,
2476
- "description": "Host OS or tunnel device",
2566
+ "description": "Defines the scanning methods used by the DLP system",
2477
2567
  "isDeprecated": false,
2478
- "name": "os_type"
2568
+ "name": "dlp_scan_types"
2479
2569
  },
2480
2570
  {
2481
2571
  "deprecationReason": null,
2482
- "description": "Direction of network traffic for this event, values are inbound or outbound",
2572
+ "description": "Cato\u2019s DNS Protection type that matched the DNS request",
2483
2573
  "isDeprecated": false,
2484
- "name": "traffic_direction"
2574
+ "name": "dns_protection_category"
2485
2575
  },
2486
2576
  {
2487
2577
  "deprecationReason": null,
2488
- "description": "BGP disconnect error message",
2578
+ "description": "Domain queried in the DNS request",
2489
2579
  "isDeprecated": false,
2490
- "name": "bgp_suberror_code"
2580
+ "name": "dns_query"
2491
2581
  },
2492
2582
  {
2493
2583
  "deprecationReason": null,
2494
- "description": "CIDR for BGP route",
2584
+ "description": "Domain name based on the SSL SNI, HTTP host name, or DNS name",
2495
2585
  "isDeprecated": false,
2496
- "name": "bgp_route_cidr"
2586
+ "name": "domain_name"
2497
2587
  },
2498
2588
  {
2499
2589
  "deprecationReason": null,
2500
- "description": "Unique Cato ID that identifies this security incident",
2590
+ "description": "Egress PoP Name",
2501
2591
  "isDeprecated": false,
2502
- "name": "incident_id"
2592
+ "name": "egress_pop_name"
2503
2593
  },
2504
2594
  {
2505
- "deprecationReason": "use application_id/application_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
2506
- "description": "For Internet firewall, app for this event",
2507
- "isDeprecated": true,
2508
- "name": "application"
2595
+ "deprecationReason": null,
2596
+ "description": "Egress Site Name for backhauling traffic",
2597
+ "isDeprecated": false,
2598
+ "name": "egress_site_name"
2509
2599
  },
2510
2600
  {
2511
2601
  "deprecationReason": null,
2512
- "description": "The name of the application associated with the flow",
2602
+ "description": "Email Subject",
2513
2603
  "isDeprecated": false,
2514
- "name": "application_name"
2604
+ "name": "email_subject"
2515
2605
  },
2516
2606
  {
2517
2607
  "deprecationReason": null,
2518
- "description": "Application ID of the flow",
2608
+ "description": "The ID for the endpoint",
2519
2609
  "isDeprecated": false,
2520
- "name": "application_id"
2610
+ "name": "endpoint_id"
2521
2611
  },
2522
2612
  {
2523
2613
  "deprecationReason": null,
2524
- "description": "Socket upgrade end time (Linux epoch format):",
2614
+ "description": "The Endpoint Protection Engine that detected the malware",
2525
2615
  "isDeprecated": false,
2526
- "name": "upgrade_end_time"
2616
+ "name": "epp_engine_type"
2527
2617
  },
2528
2618
  {
2529
2619
  "deprecationReason": null,
2530
- "description": "Socket interface ID",
2620
+ "description": "The profile assigned to the endpoint upon detection of the malware",
2531
2621
  "isDeprecated": false,
2532
- "name": "socket_interface_id"
2622
+ "name": "epp_profile"
2533
2623
  },
2534
2624
  {
2535
- "deprecationReason": "use custom_category_id/custom_category_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
2536
- "description": "Unique Cato ID for the custom category",
2537
- "isDeprecated": true,
2538
- "name": "custom_categories"
2625
+ "deprecationReason": null,
2626
+ "description": "Count for events that are repeated multiple times during one minute",
2627
+ "isDeprecated": false,
2628
+ "name": "event_count"
2539
2629
  },
2540
2630
  {
2541
2631
  "deprecationReason": null,
2542
- "description": "Custom category ID",
2632
+ "description": "Event Id",
2543
2633
  "isDeprecated": false,
2544
- "name": "custom_category_id"
2634
+ "name": "event_id"
2545
2635
  },
2546
2636
  {
2547
2637
  "deprecationReason": null,
2548
- "description": "Custom category name",
2638
+ "description": "Cato's description of the event",
2549
2639
  "isDeprecated": false,
2550
- "name": "custom_category_name"
2640
+ "name": "event_message"
2551
2641
  },
2552
2642
  {
2553
2643
  "deprecationReason": null,
2554
- "description": "Country in which the source host is located (detected via public IP address)",
2644
+ "description": "Sub-type for Routing, Security, Connectivity, System or Sockets Management event",
2555
2645
  "isDeprecated": false,
2556
- "name": "src_country"
2646
+ "name": "event_sub_type"
2557
2647
  },
2558
2648
  {
2559
2649
  "deprecationReason": null,
2560
- "description": "Country Code of country in which the source host is located (detected via public IP address)",
2650
+ "description": "Routing, Security, Connectivity, System or Sockets Management event",
2561
2651
  "isDeprecated": false,
2562
- "name": "src_country_code"
2652
+ "name": "event_type"
2563
2653
  },
2564
2654
  {
2565
2655
  "deprecationReason": null,
2566
- "description": "Count for events that are repeated multiple times during one minute",
2656
+ "description": "Provides details about why a specific action or process failed",
2567
2657
  "isDeprecated": false,
2568
- "name": "event_count"
2658
+ "name": "failure_reason"
2569
2659
  },
2570
2660
  {
2571
2661
  "deprecationReason": null,
2572
- "description": "File name",
2662
+ "description": "File hash",
2573
2663
  "isDeprecated": false,
2574
- "name": "file_name"
2664
+ "name": "file_hash"
2575
2665
  },
2576
2666
  {
2577
2667
  "deprecationReason": null,
2578
- "description": "IP address of Domain Controller that created LDAP event",
2668
+ "description": "File name",
2579
2669
  "isDeprecated": false,
2580
- "name": "directory_ip"
2670
+ "name": "file_name"
2581
2671
  },
2582
2672
  {
2583
2673
  "deprecationReason": null,
2584
- "description": "Time stamp of event (Linux epoch format)",
2674
+ "description": "The file operation when this event occurred",
2585
2675
  "isDeprecated": false,
2586
- "name": "time"
2676
+ "name": "file_operation"
2587
2677
  },
2588
2678
  {
2589
2679
  "deprecationReason": null,
2590
- "description": "URL associated with the event",
2680
+ "description": "File size",
2591
2681
  "isDeprecated": false,
2592
- "name": "url"
2682
+ "name": "file_size"
2593
2683
  },
2594
2684
  {
2595
2685
  "deprecationReason": null,
2596
- "description": "For Internet traffic, country where the destination host is located",
2686
+ "description": "File type",
2597
2687
  "isDeprecated": false,
2598
- "name": "dest_country"
2688
+ "name": "file_type"
2599
2689
  },
2600
2690
  {
2601
2691
  "deprecationReason": null,
2602
- "description": "For Internet traffic, the two letter country code where the destination host is located (based on ISO 3166-1 alpha-2)",
2692
+ "description": "The final status for this object after performing actions as defined by the policy",
2603
2693
  "isDeprecated": false,
2604
- "name": "dest_country_code"
2694
+ "name": "final_object_status"
2605
2695
  },
2606
2696
  {
2607
2697
  "deprecationReason": null,
@@ -2611,891 +2701,873 @@
2611
2701
  },
2612
2702
  {
2613
2703
  "deprecationReason": null,
2614
- "description": "The name of the destination site",
2704
+ "description": "Full path URL application activity",
2615
2705
  "isDeprecated": false,
2616
- "name": "dest_site_name"
2706
+ "name": "full_path_url"
2617
2707
  },
2618
2708
  {
2619
2709
  "deprecationReason": null,
2620
- "description": "Routing, Security, Connectivity, System or Sockets Management event",
2710
+ "description": "An identifier for a guest user using Cato through a Captive Portal",
2621
2711
  "isDeprecated": false,
2622
- "name": "event_type"
2712
+ "name": "guest_user"
2623
2713
  },
2624
2714
  {
2625
2715
  "deprecationReason": null,
2626
- "description": "Account ID",
2716
+ "description": "IP address of host related to event",
2627
2717
  "isDeprecated": false,
2628
- "name": "account_id"
2718
+ "name": "host_ip"
2629
2719
  },
2630
2720
  {
2631
2721
  "deprecationReason": null,
2632
- "description": "For IPS and SAM, ID of the IPS signature",
2722
+ "description": "MAC address of host related to event",
2633
2723
  "isDeprecated": false,
2634
- "name": "signature_id"
2724
+ "name": "host_mac"
2635
2725
  },
2636
2726
  {
2637
2727
  "deprecationReason": null,
2638
- "description": "Expiration date for Client certificate",
2728
+ "description": "HTTP request method (ie. Get, Post)",
2639
2729
  "isDeprecated": false,
2640
- "name": "client_cert_expires"
2730
+ "name": "http_request_method"
2641
2731
  },
2642
2732
  {
2643
2733
  "deprecationReason": null,
2644
- "description": "Name of Client certificate",
2734
+ "description": "For MDR service, a true/false value that indicates if this event is: A summary that aggregates many events (true) Raw network flows for a single event (false)",
2645
2735
  "isDeprecated": false,
2646
- "name": "client_cert_name"
2736
+ "name": "incident_aggregation"
2647
2737
  },
2648
2738
  {
2649
2739
  "deprecationReason": null,
2650
- "description": "Is the app for this event defined as a sanctioned app? (True/False)",
2740
+ "description": "Unique Cato ID that identifies this security incident",
2651
2741
  "isDeprecated": false,
2652
- "name": "is_sanctioned_app"
2742
+ "name": "incident_id"
2653
2743
  },
2654
2744
  {
2655
2745
  "deprecationReason": null,
2656
- "description": "Name of application activity",
2746
+ "description": "Indication",
2657
2747
  "isDeprecated": false,
2658
- "name": "app_activity"
2748
+ "name": "indication"
2659
2749
  },
2660
2750
  {
2661
2751
  "deprecationReason": null,
2662
- "description": "Activity type",
2752
+ "description": "Indicator",
2663
2753
  "isDeprecated": false,
2664
- "name": "app_activity_type"
2754
+ "name": "indicator"
2665
2755
  },
2666
2756
  {
2667
2757
  "deprecationReason": null,
2668
- "description": "Device posture profiles",
2758
+ "description": "The initial status of the object, before any policy was applied",
2669
2759
  "isDeprecated": false,
2670
- "name": "device_posture_profile"
2760
+ "name": "initial_object_status"
2671
2761
  },
2672
2762
  {
2673
- "deprecationReason": "use device_posture_profile instead. Planned end-of-life (EoL) date: May 1, 2025.",
2674
- "description": "Device posture profiles",
2763
+ "deprecationReason": "use event_id instead. Planned end-of-life (EoL) date: May 1, 2025.",
2764
+ "description": "Cato Internal-use only",
2675
2765
  "isDeprecated": true,
2676
- "name": "device_posture_profiles"
2677
- },
2678
- {
2679
- "deprecationReason": null,
2680
- "description": "Full path URL application activity",
2681
- "isDeprecated": false,
2682
- "name": "full_path_url"
2683
- },
2684
- {
2685
- "deprecationReason": null,
2686
- "description": "Application risk score",
2687
- "isDeprecated": false,
2688
- "name": "application_risk"
2766
+ "name": "internalId"
2689
2767
  },
2690
2768
  {
2691
2769
  "deprecationReason": null,
2692
- "description": "Mitre attack techniques",
2770
+ "description": "Network protocol for this event",
2693
2771
  "isDeprecated": false,
2694
- "name": "mitre_attack_techniques"
2772
+ "name": "ip_protocol"
2695
2773
  },
2696
2774
  {
2697
2775
  "deprecationReason": null,
2698
- "description": "Mitre attack subtechniques",
2776
+ "description": "Classifies users based on their permissions.",
2699
2777
  "isDeprecated": false,
2700
- "name": "mitre_attack_subtechniques"
2778
+ "name": "is_admin"
2701
2779
  },
2702
2780
  {
2703
2781
  "deprecationReason": null,
2704
- "description": "Mitre attack tactics",
2782
+ "description": "Indicates whether an activity requires administrative permissions.",
2705
2783
  "isDeprecated": false,
2706
- "name": "mitre_attack_tactics"
2784
+ "name": "is_admin_activity"
2707
2785
  },
2708
2786
  {
2709
2787
  "deprecationReason": null,
2710
- "description": "Indicator",
2788
+ "description": "Is Compliant",
2711
2789
  "isDeprecated": false,
2712
- "name": "indicator"
2790
+ "name": "is_compliant"
2713
2791
  },
2714
2792
  {
2715
2793
  "deprecationReason": null,
2716
- "description": "For SaaS Security API, SaaS app for the connector",
2794
+ "description": "Is Managed",
2717
2795
  "isDeprecated": false,
2718
- "name": "connector_type"
2796
+ "name": "is_managed"
2719
2797
  },
2720
2798
  {
2721
2799
  "deprecationReason": null,
2722
- "description": "For SaaS Security API, name of the connector",
2800
+ "description": "Is the app for this event defined as a sanctioned app? (True/False)",
2723
2801
  "isDeprecated": false,
2724
- "name": "connector_name"
2802
+ "name": "is_sanctioned_app"
2725
2803
  },
2726
2804
  {
2727
2805
  "deprecationReason": null,
2728
- "description": "For SaaS Security API, status of the connector",
2806
+ "description": "If the events was part of the sinkhole flow",
2729
2807
  "isDeprecated": false,
2730
- "name": "connector_status"
2808
+ "name": "is_sinkhole"
2731
2809
  },
2732
2810
  {
2733
2811
  "deprecationReason": null,
2734
- "description": "For SaaS Security API, parent Microsoft 365 connector",
2812
+ "description": "The ISP related to this event (when the IP address isn't provided by the ISP, then the event message is IP Addresses are assigned statically)",
2735
2813
  "isDeprecated": false,
2736
- "name": "parent_connector_name"
2814
+ "name": "ISP_name"
2737
2815
  },
2738
2816
  {
2739
2817
  "deprecationReason": null,
2740
- "description": "File type",
2818
+ "description": "Name defined for the public API Key in the Cato Management Application",
2741
2819
  "isDeprecated": false,
2742
- "name": "file_type"
2820
+ "name": "key_name"
2743
2821
  },
2744
2822
  {
2745
2823
  "deprecationReason": null,
2746
- "description": "Describes the behavior when the DLP system encounters a failure",
2824
+ "description": "A list of labels providing additional context for the event",
2747
2825
  "isDeprecated": false,
2748
- "name": "dlp_fail_mode"
2826
+ "name": "labels"
2749
2827
  },
2750
2828
  {
2751
2829
  "deprecationReason": null,
2752
- "description": "DLP profiles related to the event",
2830
+ "description": "Data that measures the congestion for a specific link",
2753
2831
  "isDeprecated": false,
2754
- "name": "dlp_profiles"
2832
+ "name": "link_health_is_congested"
2755
2833
  },
2756
2834
  {
2757
2835
  "deprecationReason": null,
2758
- "description": "Matched DLP data types related to the event",
2836
+ "description": "Data that measures the jitter for a specific link",
2759
2837
  "isDeprecated": false,
2760
- "name": "matched_data_types"
2838
+ "name": "link_health_jitter"
2761
2839
  },
2762
2840
  {
2763
2841
  "deprecationReason": null,
2764
- "description": "Severity defined for the rule",
2842
+ "description": "Round Trip Delay in Milliseconds that it takes a packet to travel between the source and the PoP",
2765
2843
  "isDeprecated": false,
2766
- "name": "severity"
2844
+ "name": "link_health_latency"
2767
2845
  },
2768
2846
  {
2769
2847
  "deprecationReason": null,
2770
- "description": "For SaaS Security API, email address of the file owner",
2848
+ "description": "Data that measures the packet loss for a specific link",
2771
2849
  "isDeprecated": false,
2772
- "name": "owner"
2850
+ "name": "link_health_pkt_loss"
2773
2851
  },
2774
2852
  {
2775
2853
  "deprecationReason": null,
2776
- "description": "For SaaS Security API, email addresses of the users that received the file",
2854
+ "description": "Link type \u2013 Cato, Alt. WAN or LAG",
2777
2855
  "isDeprecated": false,
2778
- "name": "collaborators"
2856
+ "name": "link_type"
2779
2857
  },
2780
2858
  {
2781
2859
  "deprecationReason": null,
2782
- "description": "Email Subject",
2860
+ "description": "The user logged into this endpoint during this event",
2783
2861
  "isDeprecated": false,
2784
- "name": "email_subject"
2862
+ "name": "logged_in_user"
2785
2863
  },
2786
2864
  {
2787
2865
  "deprecationReason": null,
2788
- "description": "Sharing Options for the file (such as SharePoint)",
2866
+ "description": "Login action, values are: User portal (myvpn.catonetworks.com) or VPN client (Client or site traffic)",
2789
2867
  "isDeprecated": false,
2790
- "name": "sharing_scope"
2868
+ "name": "login_type"
2791
2869
  },
2792
2870
  {
2793
2871
  "deprecationReason": null,
2794
- "description": "Cato\u2019s DNS Protection type that matched the DNS request",
2872
+ "description": "Matched DLP data types related to the event",
2795
2873
  "isDeprecated": false,
2796
- "name": "dns_protection_category"
2874
+ "name": "matched_data_types"
2797
2875
  },
2798
2876
  {
2799
2877
  "deprecationReason": null,
2800
- "description": "If the events was part of the sinkhole flow",
2878
+ "description": "Mitre attack subtechniques",
2801
2879
  "isDeprecated": false,
2802
- "name": "is_sinkhole"
2880
+ "name": "mitre_attack_subtechniques"
2803
2881
  },
2804
2882
  {
2805
2883
  "deprecationReason": null,
2806
- "description": "The ID for the endpoint",
2884
+ "description": "Mitre attack tactics",
2807
2885
  "isDeprecated": false,
2808
- "name": "endpoint_id"
2886
+ "name": "mitre_attack_tactics"
2809
2887
  },
2810
2888
  {
2811
2889
  "deprecationReason": null,
2812
- "description": "The Endpoint Protection Engine that detected the malware",
2890
+ "description": "Mitre attack techniques",
2813
2891
  "isDeprecated": false,
2814
- "name": "epp_engine_type"
2892
+ "name": "mitre_attack_techniques"
2815
2893
  },
2816
2894
  {
2817
2895
  "deprecationReason": null,
2818
- "description": "The file operation when this event occurred",
2896
+ "description": "Network Access",
2819
2897
  "isDeprecated": false,
2820
- "name": "file_operation"
2898
+ "name": "network_access"
2821
2899
  },
2822
2900
  {
2823
2901
  "deprecationReason": null,
2824
- "description": null,
2902
+ "description": "Matched network rule",
2825
2903
  "isDeprecated": false,
2826
- "name": "final_object_status"
2904
+ "name": "network_rule"
2827
2905
  },
2828
2906
  {
2829
2907
  "deprecationReason": null,
2830
- "description": null,
2908
+ "description": "For SaaS Security API, API Error of Apps Security Notification",
2831
2909
  "isDeprecated": false,
2832
- "name": "object_name"
2910
+ "name": "notification_api_error"
2833
2911
  },
2834
2912
  {
2835
2913
  "deprecationReason": null,
2836
- "description": null,
2914
+ "description": "For SaaS Security API, description of Apps Security Notification",
2837
2915
  "isDeprecated": false,
2838
- "name": "object_type"
2916
+ "name": "notification_description"
2839
2917
  },
2840
2918
  {
2841
2919
  "deprecationReason": null,
2842
- "description": null,
2920
+ "description": "Unique identifier by the 3rd party App of the object being referenced",
2843
2921
  "isDeprecated": false,
2844
2922
  "name": "object_id"
2845
2923
  },
2846
2924
  {
2847
2925
  "deprecationReason": null,
2848
- "description": null,
2926
+ "description": "The name of the object for this event (for example: file name)",
2849
2927
  "isDeprecated": false,
2850
- "name": "alert_id"
2928
+ "name": "object_name"
2851
2929
  },
2852
2930
  {
2853
2931
  "deprecationReason": null,
2854
- "description": "The vendor that identified the incident, such as Cato or Microsoft",
2932
+ "description": "Specifies the type of object being acted upon (e.g., file, folder)",
2855
2933
  "isDeprecated": false,
2856
- "name": "vendor"
2934
+ "name": "object_type"
2857
2935
  },
2858
2936
  {
2859
2937
  "deprecationReason": null,
2860
- "description": null,
2938
+ "description": "Office mode Enabled/Disabled",
2861
2939
  "isDeprecated": false,
2862
- "name": "vendor_user_id"
2940
+ "name": "office_mode"
2863
2941
  },
2864
2942
  {
2865
2943
  "deprecationReason": null,
2866
- "description": null,
2944
+ "description": "Host OS or tunnel device",
2867
2945
  "isDeprecated": false,
2868
- "name": "status"
2946
+ "name": "os_type"
2869
2947
  },
2870
2948
  {
2871
2949
  "deprecationReason": null,
2872
- "description": null,
2950
+ "description": "OS version for the device (such as 14.3.0)",
2873
2951
  "isDeprecated": false,
2874
- "name": "classification"
2952
+ "name": "os_version"
2875
2953
  },
2876
2954
  {
2877
2955
  "deprecationReason": null,
2878
- "description": null,
2956
+ "description": "Indicate if the Access to the 3rd Party SaaS App occurs without passing through Cato Cloud (direct access to saas App)",
2879
2957
  "isDeprecated": false,
2880
- "name": "quarantine_folder_path"
2958
+ "name": "out_of_band_access"
2881
2959
  },
2882
2960
  {
2883
2961
  "deprecationReason": null,
2884
- "description": null,
2962
+ "description": "For SaaS Security API, email address of the file owner",
2885
2963
  "isDeprecated": false,
2886
- "name": "title"
2964
+ "name": "owner"
2887
2965
  },
2888
2966
  {
2889
2967
  "deprecationReason": null,
2890
- "description": null,
2968
+ "description": "Pac File Enabled/Disabled",
2891
2969
  "isDeprecated": false,
2892
- "name": "recommended_actions"
2893
- },
2894
- {
2895
- "deprecationReason": "use src_pid instead. Planned end-of-life (EoL) date: March 1, 2025.",
2896
- "description": null,
2897
- "isDeprecated": true,
2898
- "name": "pid"
2899
- },
2900
- {
2901
- "deprecationReason": "use src_process_parent_pid instead. Planned end-of-life (EoL) date: March 1, 2025.",
2902
- "description": null,
2903
- "isDeprecated": true,
2904
- "name": "parent_pid"
2905
- },
2906
- {
2907
- "deprecationReason": "use src_process_path instead. Planned end-of-life (EoL) date: March 1, 2025.",
2908
- "description": null,
2909
- "isDeprecated": true,
2910
- "name": "process_path"
2970
+ "name": "pac_file"
2911
2971
  },
2912
2972
  {
2913
2973
  "deprecationReason": null,
2914
- "description": null,
2974
+ "description": "For SaaS Security API, parent Microsoft 365 connector",
2915
2975
  "isDeprecated": false,
2916
- "name": "failure_reason"
2976
+ "name": "parent_connector_name"
2917
2977
  },
2918
2978
  {
2919
2979
  "deprecationReason": null,
2920
- "description": null,
2980
+ "description": "Name of PoP location",
2921
2981
  "isDeprecated": false,
2922
- "name": "out_of_band_access"
2982
+ "name": "pop_name"
2923
2983
  },
2924
2984
  {
2925
2985
  "deprecationReason": null,
2926
- "description": "A Unique ID for the quarantined file",
2986
+ "description": "Precedence",
2927
2987
  "isDeprecated": false,
2928
- "name": "quarantine_uuid"
2988
+ "name": "precedence"
2929
2989
  },
2930
2990
  {
2931
2991
  "deprecationReason": null,
2932
- "description": null,
2992
+ "description": "Indicate how many processes are part of this event",
2933
2993
  "isDeprecated": false,
2934
- "name": "logged_in_user"
2994
+ "name": "processes_count"
2935
2995
  },
2936
2996
  {
2937
2997
  "deprecationReason": null,
2938
- "description": "The profile assigned to the endpoint upon detection of the malware",
2998
+ "description": "Producer",
2939
2999
  "isDeprecated": false,
2940
- "name": "epp_profile"
3000
+ "name": "producer"
2941
3001
  },
2942
3002
  {
2943
3003
  "deprecationReason": null,
2944
- "description": "Source process ID",
3004
+ "description": "Prompt Page Selected Action",
2945
3005
  "isDeprecated": false,
2946
- "name": "src_pid"
3006
+ "name": "prompt_action"
2947
3007
  },
2948
3008
  {
2949
3009
  "deprecationReason": null,
2950
- "description": "Source process file path",
3010
+ "description": "Public source IP",
2951
3011
  "isDeprecated": false,
2952
- "name": "src_process_path"
3012
+ "name": "public_ip"
2953
3013
  },
2954
3014
  {
2955
3015
  "deprecationReason": null,
2956
- "description": "Source process command line",
3016
+ "description": "QoS Priority value",
2957
3017
  "isDeprecated": false,
2958
- "name": "src_process_cmdline"
3018
+ "name": "qos_priority"
2959
3019
  },
2960
3020
  {
2961
3021
  "deprecationReason": null,
2962
- "description": "Source process parent process ID",
3022
+ "description": "For QoS, the time that this QoS event started. The event is generated when the QoS event finishes",
2963
3023
  "isDeprecated": false,
2964
- "name": "src_process_parent_pid"
3024
+ "name": "qos_reported_time"
2965
3025
  },
2966
3026
  {
2967
3027
  "deprecationReason": null,
2968
- "description": "Source process parent file path",
3028
+ "description": "Specifies the path to a quarantine folder for isolated files",
2969
3029
  "isDeprecated": false,
2970
- "name": "src_process_parent_path"
3030
+ "name": "quarantine_folder_path"
2971
3031
  },
2972
3032
  {
2973
3033
  "deprecationReason": null,
2974
- "description": "The destination process ID",
3034
+ "description": "A Unique ID for the quarantined file",
2975
3035
  "isDeprecated": false,
2976
- "name": "dest_pid"
3036
+ "name": "quarantine_uuid"
2977
3037
  },
2978
3038
  {
2979
3039
  "deprecationReason": null,
2980
- "description": "Destination process file path",
3040
+ "description": "Raw Data",
2981
3041
  "isDeprecated": false,
2982
- "name": "dest_process_path"
3042
+ "name": "raw_data"
2983
3043
  },
2984
3044
  {
2985
3045
  "deprecationReason": null,
2986
- "description": "Destination process command line",
3046
+ "description": "Textual recommendation of the steps to take",
2987
3047
  "isDeprecated": false,
2988
- "name": "dest_process_cmdline"
3048
+ "name": "recommended_actions"
2989
3049
  },
2990
3050
  {
2991
3051
  "deprecationReason": null,
2992
- "description": "Destination process parent process ID",
3052
+ "description": "The URL that links directly to the object involved in the activity",
2993
3053
  "isDeprecated": false,
2994
- "name": "dest_process_parent_pid"
3054
+ "name": "reference_url"
2995
3055
  },
2996
3056
  {
2997
3057
  "deprecationReason": null,
2998
- "description": "Destination process parent file path",
3058
+ "description": "Registration code used the first time that a SDP user authenticates (the code is partially obfuscated)",
2999
3059
  "isDeprecated": false,
3000
- "name": "dest_process_parent_path"
3060
+ "name": "registration_code"
3001
3061
  },
3002
3062
  {
3003
3063
  "deprecationReason": null,
3004
- "description": "If policy is set to disinfect, return the result of this action",
3064
+ "description": "(IPS or SAM event) Indicates the overall impact of a threat for the host or network: Low \u2013 ie. adware Medium \u2013 ie. network scans High \u2013 ie. spyware or worms",
3005
3065
  "isDeprecated": false,
3006
- "name": "disinfect_result"
3066
+ "name": "risk_level"
3007
3067
  },
3008
3068
  {
3009
- "deprecationReason": null,
3010
- "description": "Indicate how many processes are part of this event",
3011
- "isDeprecated": false,
3012
- "name": "processes_count"
3069
+ "deprecationReason": "use rule_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
3070
+ "description": "Name of security rule related to the event",
3071
+ "isDeprecated": true,
3072
+ "name": "rule"
3013
3073
  },
3014
3074
  {
3015
3075
  "deprecationReason": null,
3016
- "description": "HTTP request method (ie. Get, Post)",
3076
+ "description": "Unique Cato ID for the security rule related to the event",
3017
3077
  "isDeprecated": false,
3018
- "name": "http_request_method"
3078
+ "name": "rule_id"
3019
3079
  },
3020
3080
  {
3021
3081
  "deprecationReason": null,
3022
- "description": "XFF HTTP header indicates the original IP address for the connections",
3082
+ "description": "Rule name",
3023
3083
  "isDeprecated": false,
3024
- "name": "xff"
3084
+ "name": "rule_name"
3025
3085
  },
3026
3086
  {
3027
3087
  "deprecationReason": null,
3028
- "description": "Domain queried in the DNS request",
3088
+ "description": "Severity defined for the rule",
3029
3089
  "isDeprecated": false,
3030
- "name": "dns_query"
3090
+ "name": "severity"
3031
3091
  },
3032
3092
  {
3033
3093
  "deprecationReason": null,
3034
- "description": "Name defined for the public API Key in the Cato Management Application",
3094
+ "description": "Sharing Options for the file (such as SharePoint)",
3035
3095
  "isDeprecated": false,
3036
- "name": "key_name"
3096
+ "name": "sharing_scope"
3037
3097
  },
3038
3098
  {
3039
3099
  "deprecationReason": null,
3040
- "description": null,
3100
+ "description": "Sign In Types",
3041
3101
  "isDeprecated": false,
3042
- "name": "api_type"
3102
+ "name": "sign_in_event_types"
3043
3103
  },
3044
3104
  {
3045
3105
  "deprecationReason": null,
3046
- "description": null,
3106
+ "description": "For IPS and SAM, ID of the IPS signature",
3047
3107
  "isDeprecated": false,
3048
- "name": "api_name"
3108
+ "name": "signature_id"
3049
3109
  },
3050
3110
  {
3051
3111
  "deprecationReason": null,
3052
- "description": "Related Apps",
3112
+ "description": "Name for Socket interface",
3053
3113
  "isDeprecated": false,
3054
- "name": "app_stack"
3114
+ "name": "socket_interface"
3055
3115
  },
3056
3116
  {
3057
3117
  "deprecationReason": null,
3058
- "description": "TLS Inspection rule name",
3118
+ "description": "Socket interface ID",
3059
3119
  "isDeprecated": false,
3060
- "name": "tls_rule_name"
3120
+ "name": "socket_interface_id"
3061
3121
  },
3062
3122
  {
3063
3123
  "deprecationReason": null,
3064
- "description": "TLS Certificate Error",
3124
+ "description": "For Socket upgrades, new version number",
3065
3125
  "isDeprecated": false,
3066
- "name": "tls_certificate_error"
3126
+ "name": "socket_new_version"
3067
3127
  },
3068
3128
  {
3069
3129
  "deprecationReason": null,
3070
- "description": "TLS Version",
3130
+ "description": "For Socket upgrade, previous version number",
3071
3131
  "isDeprecated": false,
3072
- "name": "tls_version"
3132
+ "name": "socket_old_version"
3073
3133
  },
3074
3134
  {
3075
3135
  "deprecationReason": null,
3076
- "description": "TLS Error Type",
3136
+ "description": "Type of Socket reset (Hardware/Software)",
3077
3137
  "isDeprecated": false,
3078
- "name": "tls_error_type"
3138
+ "name": "socket_reset"
3079
3139
  },
3080
3140
  {
3081
3141
  "deprecationReason": null,
3082
- "description": "TLS Error Description",
3142
+ "description": "For Socket HA events, indicates if the Socket is primary or secondary",
3083
3143
  "isDeprecated": false,
3084
- "name": "tls_error_description"
3144
+ "name": "socket_role"
3085
3145
  },
3086
3146
  {
3087
3147
  "deprecationReason": null,
3088
- "description": "Cato application name",
3148
+ "description": "Socket serial number",
3089
3149
  "isDeprecated": false,
3090
- "name": "cato_app"
3150
+ "name": "socket_serial"
3091
3151
  },
3092
3152
  {
3093
3153
  "deprecationReason": null,
3094
- "description": "Prompt Page Selected Action",
3154
+ "description": "Socket version number",
3095
3155
  "isDeprecated": false,
3096
- "name": "prompt_action"
3156
+ "name": "socket_version"
3097
3157
  },
3098
3158
  {
3099
3159
  "deprecationReason": null,
3100
- "description": "Unique Cato ID for devices",
3160
+ "description": "Split Tunnel Configuration",
3101
3161
  "isDeprecated": false,
3102
- "name": "device_id"
3162
+ "name": "split_tunnel_configuration"
3103
3163
  },
3104
3164
  {
3105
3165
  "deprecationReason": null,
3106
- "description": "Unique Cato Visible ID for devices",
3166
+ "description": "Country in which the source host is located (detected via public IP address)",
3107
3167
  "isDeprecated": false,
3108
- "name": "visible_device_id"
3168
+ "name": "src_country"
3109
3169
  },
3110
3170
  {
3111
3171
  "deprecationReason": null,
3112
- "description": "Connectivity authentication method: unauthenticated, OATH2, LDAP or VPN",
3172
+ "description": "Country Code of country in which the source host is located (detected via public IP address)",
3113
3173
  "isDeprecated": false,
3114
- "name": "auth_method"
3174
+ "name": "src_country_code"
3115
3175
  },
3116
3176
  {
3117
3177
  "deprecationReason": null,
3118
- "description": "Always-On Bypass Method",
3178
+ "description": "IP for host or Cato Client",
3119
3179
  "isDeprecated": false,
3120
- "name": "bypass_method"
3180
+ "name": "src_ip"
3121
3181
  },
3122
3182
  {
3123
3183
  "deprecationReason": null,
3124
- "description": "Always-On Bypass Duration In Seconds",
3184
+ "description": "Source type: site or remote user",
3125
3185
  "isDeprecated": false,
3126
- "name": "bypass_duration_sec"
3186
+ "name": "src_is_site_or_vpn"
3127
3187
  },
3128
3188
  {
3129
3189
  "deprecationReason": null,
3130
- "description": "Always-On Bypass Reason",
3190
+ "description": "IP address provided by ISP to site or Client",
3131
3191
  "isDeprecated": false,
3132
- "name": "bypass_reason"
3192
+ "name": "src_isp_ip"
3193
+ },
3194
+ {
3195
+ "deprecationReason": "please use src_site_id and dest_site_id instead. Planned end-of-life (EoL) date: June 30, 2025.",
3196
+ "description": "Source or destination site or remote user ID.\nThis field can only be used in filter.",
3197
+ "isDeprecated": true,
3198
+ "name": "src_or_dest_site_id"
3133
3199
  },
3134
3200
  {
3135
3201
  "deprecationReason": null,
3136
- "description": "Sign In Types",
3202
+ "description": "Source process ID",
3137
3203
  "isDeprecated": false,
3138
- "name": "sign_in_event_types"
3204
+ "name": "src_pid"
3139
3205
  },
3140
3206
  {
3141
3207
  "deprecationReason": null,
3142
- "description": "Unique identifier for the tenant within a multi-tenant environment",
3208
+ "description": "Internal port number",
3143
3209
  "isDeprecated": false,
3144
- "name": "tenant_id"
3210
+ "name": "src_port"
3145
3211
  },
3146
3212
  {
3147
3213
  "deprecationReason": null,
3148
- "description": "Tenant Name",
3214
+ "description": "Source process command line",
3149
3215
  "isDeprecated": false,
3150
- "name": "tenant_name"
3216
+ "name": "src_process_cmdline"
3151
3217
  },
3152
3218
  {
3153
3219
  "deprecationReason": null,
3154
- "description": "User Agent",
3220
+ "description": "Source process parent file path",
3155
3221
  "isDeprecated": false,
3156
- "name": "user_agent"
3222
+ "name": "src_process_parent_path"
3157
3223
  },
3158
3224
  {
3159
3225
  "deprecationReason": null,
3160
- "description": "Vendor Event Id",
3226
+ "description": "Source process parent process ID",
3161
3227
  "isDeprecated": false,
3162
- "name": "vendor_event_id"
3228
+ "name": "src_process_parent_pid"
3163
3229
  },
3164
3230
  {
3165
3231
  "deprecationReason": null,
3166
- "description": "Vendor Device Id",
3232
+ "description": "Source process file path",
3167
3233
  "isDeprecated": false,
3168
- "name": "vendor_device_id"
3234
+ "name": "src_process_path"
3235
+ },
3236
+ {
3237
+ "deprecationReason": "use src_site_id/src_site_name instead. Planned end-of-life (EoL) date: May 1, 2025.",
3238
+ "description": "Name of site or user initiating the connection",
3239
+ "isDeprecated": true,
3240
+ "name": "src_site"
3169
3241
  },
3170
3242
  {
3171
3243
  "deprecationReason": null,
3172
- "description": "Vendor Device Name",
3244
+ "description": "Unique internal Cato ID for the site or remote user",
3173
3245
  "isDeprecated": false,
3174
- "name": "vendor_device_name"
3246
+ "name": "src_site_id"
3175
3247
  },
3176
3248
  {
3177
3249
  "deprecationReason": null,
3178
- "description": "Is Compliant",
3250
+ "description": "Source site or remote user",
3179
3251
  "isDeprecated": false,
3180
- "name": "is_compliant"
3252
+ "name": "src_site_name"
3181
3253
  },
3182
3254
  {
3183
3255
  "deprecationReason": null,
3184
- "description": "Is Managed",
3256
+ "description": "Static host",
3185
3257
  "isDeprecated": false,
3186
- "name": "is_managed"
3258
+ "name": "static_host"
3187
3259
  },
3188
3260
  {
3189
3261
  "deprecationReason": null,
3190
- "description": "Trust Type",
3262
+ "description": "The story status.\nPossible values: Open, Pending Analysis, Pending more info, Closed, Reopened, Monitoring",
3191
3263
  "isDeprecated": false,
3192
- "name": "trust_type"
3264
+ "name": "status"
3193
3265
  },
3194
3266
  {
3195
3267
  "deprecationReason": null,
3196
- "description": "Confidence Level",
3268
+ "description": "Story Id",
3197
3269
  "isDeprecated": false,
3198
- "name": "confidence_level"
3270
+ "name": "story_id"
3199
3271
  },
3200
3272
  {
3201
3273
  "deprecationReason": null,
3202
- "description": "Defines the scanning methods used by the DLP system",
3274
+ "description": "Name of subnet as defined in Cato Management Application",
3203
3275
  "isDeprecated": false,
3204
- "name": "dlp_scan_types"
3276
+ "name": "subnet_name"
3205
3277
  },
3206
3278
  {
3207
3279
  "deprecationReason": null,
3208
- "description": "Network Access",
3280
+ "description": "Number of targets (servers) associated with this event",
3209
3281
  "isDeprecated": false,
3210
- "name": "network_access"
3282
+ "name": "targets_cardinality"
3211
3283
  },
3212
3284
  {
3213
3285
  "deprecationReason": null,
3214
- "description": "Analyst Verdict",
3286
+ "description": "Shows if traffic was TCP accelerated or not",
3215
3287
  "isDeprecated": false,
3216
- "name": "analyst_verdict"
3288
+ "name": "tcp_acceleration"
3217
3289
  },
3218
3290
  {
3219
3291
  "deprecationReason": null,
3220
- "description": "Criticality",
3292
+ "description": "Unique identifier for the tenant within a multi-tenant environment",
3221
3293
  "isDeprecated": false,
3222
- "name": "criticality"
3294
+ "name": "tenant_id"
3223
3295
  },
3224
3296
  {
3225
3297
  "deprecationReason": null,
3226
- "description": "Indication",
3298
+ "description": "Tenant Name",
3227
3299
  "isDeprecated": false,
3228
- "name": "indication"
3300
+ "name": "tenant_name"
3229
3301
  },
3230
3302
  {
3231
3303
  "deprecationReason": null,
3232
- "description": "Producer",
3304
+ "description": "Tenant Restriction Rule Name",
3233
3305
  "isDeprecated": false,
3234
- "name": "producer"
3306
+ "name": "tenant_restriction_rule_name"
3235
3307
  },
3236
3308
  {
3237
3309
  "deprecationReason": null,
3238
- "description": "Story Id",
3310
+ "description": "Contains the detection risk level. Could be one of the following:\n\u2022 Info - this is information-only event, the activity is not malicious;\n\u2022 Suspicious - the event is suspicious. It may be malicious, but there is not enough information\n\u2022 Malware - the event is malicious activity",
3239
3311
  "isDeprecated": false,
3240
- "name": "story_id"
3312
+ "name": "threat_confidence"
3241
3313
  },
3242
3314
  {
3243
3315
  "deprecationReason": null,
3244
- "description": "Raw Data",
3316
+ "description": "For anti-malware events, malware name For IPS events, explains the reason why the traffic was blocked",
3245
3317
  "isDeprecated": false,
3246
- "name": "raw_data"
3318
+ "name": "threat_name"
3247
3319
  },
3248
3320
  {
3249
3321
  "deprecationReason": null,
3250
- "description": "Trigger",
3322
+ "description": "Link to external malware reference",
3251
3323
  "isDeprecated": false,
3252
- "name": "trigger"
3324
+ "name": "threat_reference"
3253
3325
  },
3254
3326
  {
3255
3327
  "deprecationReason": null,
3256
- "description": "Matched network rule",
3328
+ "description": "The higher the score, the more dangerous the event. In range between 1 - 100 inclusive",
3257
3329
  "isDeprecated": false,
3258
- "name": "network_rule"
3330
+ "name": "threat_score"
3259
3331
  },
3260
3332
  {
3261
3333
  "deprecationReason": null,
3262
- "description": "The algorithm that is used (CUBIC /NewReno / BBR)",
3334
+ "description": "Type of malware event",
3263
3335
  "isDeprecated": false,
3264
- "name": "congestion_algorithm"
3336
+ "name": "threat_type"
3265
3337
  },
3266
3338
  {
3267
3339
  "deprecationReason": null,
3268
- "description": "Shows if traffic was TCP accelerated or not",
3340
+ "description": "Result of malware event (clean indicates a safe file)",
3269
3341
  "isDeprecated": false,
3270
- "name": "tcp_acceleration"
3342
+ "name": "threat_verdict"
3271
3343
  },
3272
3344
  {
3273
3345
  "deprecationReason": null,
3274
- "description": "Shows if traffic was TLS inspected or not",
3346
+ "description": "Time stamp of the event (Linux epoch format)",
3275
3347
  "isDeprecated": false,
3276
- "name": "tls_inspection"
3348
+ "name": "time"
3277
3349
  },
3278
3350
  {
3279
3351
  "deprecationReason": null,
3280
- "description": "Public source IP",
3352
+ "description": "Time stamp of the event (Human-readable format)",
3281
3353
  "isDeprecated": false,
3282
- "name": "public_ip"
3354
+ "name": "time_str"
3283
3355
  },
3284
3356
  {
3285
3357
  "deprecationReason": null,
3286
- "description": "Egress Site Name for backhauling traffic",
3358
+ "description": "A short summary of the activity",
3287
3359
  "isDeprecated": false,
3288
- "name": "egress_site_name"
3360
+ "name": "title"
3289
3361
  },
3290
3362
  {
3291
3363
  "deprecationReason": null,
3292
- "description": "Egress PoP Name",
3364
+ "description": "TLS Certificate Error",
3293
3365
  "isDeprecated": false,
3294
- "name": "egress_pop_name"
3366
+ "name": "tls_certificate_error"
3295
3367
  },
3296
3368
  {
3297
3369
  "deprecationReason": null,
3298
- "description": "QoS Priority value",
3370
+ "description": "TLS Error Description",
3299
3371
  "isDeprecated": false,
3300
- "name": "qos_priority"
3372
+ "name": "tls_error_description"
3301
3373
  },
3302
3374
  {
3303
3375
  "deprecationReason": null,
3304
- "description": "Split Tunnel Configuration",
3376
+ "description": "TLS Error Type",
3305
3377
  "isDeprecated": false,
3306
- "name": "split_tunnel_configuration"
3378
+ "name": "tls_error_type"
3307
3379
  },
3308
3380
  {
3309
3381
  "deprecationReason": null,
3310
- "description": "Pac File Enabled/Disabled",
3382
+ "description": "Shows if traffic was TLS inspected or not",
3311
3383
  "isDeprecated": false,
3312
- "name": "pac_file"
3384
+ "name": "tls_inspection"
3313
3385
  },
3314
3386
  {
3315
3387
  "deprecationReason": null,
3316
- "description": "Always-on Configuration",
3388
+ "description": "TLS Inspection rule name",
3317
3389
  "isDeprecated": false,
3318
- "name": "always_on_configuration"
3390
+ "name": "tls_rule_name"
3319
3391
  },
3320
3392
  {
3321
3393
  "deprecationReason": null,
3322
- "description": "Lan access Allowed / Blocked",
3394
+ "description": "TLS Version",
3323
3395
  "isDeprecated": false,
3324
- "name": "vpn_lan_access"
3396
+ "name": "tls_version"
3325
3397
  },
3326
3398
  {
3327
3399
  "deprecationReason": null,
3328
- "description": "Connect on boot Enabled/Disabled",
3400
+ "description": "Direction of network traffic for this event, values are inbound or outbound",
3329
3401
  "isDeprecated": false,
3330
- "name": "connect_on_boot"
3402
+ "name": "traffic_direction"
3331
3403
  },
3332
3404
  {
3333
3405
  "deprecationReason": null,
3334
- "description": "Trusted networks Enabled/Disabled",
3406
+ "description": "Translated Client IP",
3335
3407
  "isDeprecated": false,
3336
- "name": "trusted_networks"
3408
+ "name": "translated_client_ip"
3337
3409
  },
3338
3410
  {
3339
3411
  "deprecationReason": null,
3340
- "description": "Office mode Enabled/Disabled",
3412
+ "description": "Translated Server IP",
3341
3413
  "isDeprecated": false,
3342
- "name": "office_mode"
3414
+ "name": "translated_server_ip"
3343
3415
  },
3344
3416
  {
3345
3417
  "deprecationReason": null,
3346
- "description": "Device Certificate Validated/Not Validated",
3418
+ "description": "Trigger",
3347
3419
  "isDeprecated": false,
3348
- "name": "device_certificate"
3420
+ "name": "trigger"
3349
3421
  },
3350
3422
  {
3351
3423
  "deprecationReason": null,
3352
- "description": "Tunnel Protocol TCP/UDP",
3424
+ "description": "Trust Type",
3353
3425
  "isDeprecated": false,
3354
- "name": "tunnel_ip_protocol"
3426
+ "name": "trust_type"
3355
3427
  },
3356
3428
  {
3357
3429
  "deprecationReason": null,
3358
- "description": "For SaaS Security API, description of Apps Security Notification",
3430
+ "description": "Trusted networks Enabled/Disabled",
3359
3431
  "isDeprecated": false,
3360
- "name": "notification_description"
3432
+ "name": "trusted_networks"
3361
3433
  },
3362
3434
  {
3363
3435
  "deprecationReason": null,
3364
- "description": "For SaaS Security API, API Error of Apps Security Notification",
3436
+ "description": "Tunnel Protocol TCP/UDP",
3365
3437
  "isDeprecated": false,
3366
- "name": "notification_api_error"
3438
+ "name": "tunnel_ip_protocol"
3367
3439
  },
3368
3440
  {
3369
3441
  "deprecationReason": null,
3370
- "description": "The URL that links directly to the object involved in the activity",
3442
+ "description": "Protocol for the tunnel",
3371
3443
  "isDeprecated": false,
3372
- "name": "reference_url"
3444
+ "name": "tunnel_protocol"
3373
3445
  },
3374
3446
  {
3375
3447
  "deprecationReason": null,
3376
- "description": "SaaS user activities into categories.",
3448
+ "description": "Socket upgrade end time (Linux epoch format):",
3377
3449
  "isDeprecated": false,
3378
- "name": "app_activity_category"
3450
+ "name": "upgrade_end_time"
3379
3451
  },
3380
3452
  {
3381
3453
  "deprecationReason": null,
3382
- "description": "Indicates whether an activity requires administrative permissions.",
3454
+ "description": "Indicates if the Socket upgrade occurred during the maintenance window or initiated by Support (Cato Admin)",
3383
3455
  "isDeprecated": false,
3384
- "name": "is_admin_activity"
3456
+ "name": "upgrade_initiated_by"
3385
3457
  },
3386
3458
  {
3387
3459
  "deprecationReason": null,
3388
- "description": "Classifies users based on their permissions.",
3460
+ "description": "Socket upgrade start time (Linux epoch format)",
3389
3461
  "isDeprecated": false,
3390
- "name": "is_admin"
3462
+ "name": "upgrade_start_time"
3391
3463
  },
3392
3464
  {
3393
3465
  "deprecationReason": null,
3394
- "description": "Shows the display name of the target user involved in an activity",
3466
+ "description": "URL associated with the event",
3395
3467
  "isDeprecated": false,
3396
- "name": "collaborator_name"
3468
+ "name": "url"
3397
3469
  },
3398
3470
  {
3399
3471
  "deprecationReason": null,
3400
- "description": "The unique identifier by the SaaS vendor for the target group in an activity.",
3472
+ "description": "User Agent",
3401
3473
  "isDeprecated": false,
3402
- "name": "dest_group_id"
3474
+ "name": "user_agent"
3403
3475
  },
3404
3476
  {
3405
3477
  "deprecationReason": null,
3406
- "description": "Identifies the target group involved in an activity",
3478
+ "description": "Method used to get identity with User Awareness (such as Identity Agent)",
3407
3479
  "isDeprecated": false,
3408
- "name": "dest_group_name"
3480
+ "name": "user_awareness_method"
3409
3481
  },
3410
3482
  {
3411
3483
  "deprecationReason": null,
3412
- "description": "Identifies system access software or device",
3484
+ "description": "User ID",
3413
3485
  "isDeprecated": false,
3414
- "name": "access_method"
3486
+ "name": "user_id"
3415
3487
  },
3416
3488
  {
3417
3489
  "deprecationReason": null,
3418
- "description": "Shows the id of the target user involved in an activity",
3490
+ "description": "User that generated the event",
3419
3491
  "isDeprecated": false,
3420
- "name": "vendor_collaborator_id"
3492
+ "name": "user_name"
3421
3493
  },
3422
3494
  {
3423
3495
  "deprecationReason": null,
3424
- "description": "Device Categories",
3496
+ "description": "For Block/Prompt page, reference ID to report incorrect category",
3425
3497
  "isDeprecated": false,
3426
- "name": "device_categories"
3498
+ "name": "user_reference_id"
3427
3499
  },
3428
3500
  {
3429
3501
  "deprecationReason": null,
3430
- "description": "Device Manufacturer",
3502
+ "description": "User risk level category",
3431
3503
  "isDeprecated": false,
3432
- "name": "device_manufacturer"
3504
+ "name": "user_risk_level"
3433
3505
  },
3434
3506
  {
3435
3507
  "deprecationReason": null,
3436
- "description": "Device Model",
3508
+ "description": "The vendor that identified the incident, such as Cato or Microsoft",
3437
3509
  "isDeprecated": false,
3438
- "name": "device_model"
3510
+ "name": "vendor"
3439
3511
  },
3440
3512
  {
3441
3513
  "deprecationReason": null,
3442
- "description": "Device OS Type",
3514
+ "description": "Shows the id of the target user involved in an activity",
3443
3515
  "isDeprecated": false,
3444
- "name": "device_os_type"
3516
+ "name": "vendor_collaborator_id"
3445
3517
  },
3446
3518
  {
3447
3519
  "deprecationReason": null,
3448
- "description": "Device Type",
3520
+ "description": "Vendor Device Id",
3449
3521
  "isDeprecated": false,
3450
- "name": "device_type"
3522
+ "name": "vendor_device_id"
3451
3523
  },
3452
3524
  {
3453
3525
  "deprecationReason": null,
3454
- "description": "Tenant Restriction Rule Name",
3526
+ "description": "Vendor Device Name",
3455
3527
  "isDeprecated": false,
3456
- "name": "tenant_restriction_rule_name"
3528
+ "name": "vendor_device_name"
3457
3529
  },
3458
3530
  {
3459
3531
  "deprecationReason": null,
3460
- "description": "Connection Origin",
3532
+ "description": "Vendor Event Id",
3461
3533
  "isDeprecated": false,
3462
- "name": "connection_origin"
3534
+ "name": "vendor_event_id"
3463
3535
  },
3464
3536
  {
3465
3537
  "deprecationReason": null,
3466
- "description": "Translated Server IP",
3538
+ "description": "Identifies the user in the vendor\u2019s system",
3467
3539
  "isDeprecated": false,
3468
- "name": "translated_server_ip"
3540
+ "name": "vendor_user_id"
3469
3541
  },
3470
3542
  {
3471
3543
  "deprecationReason": null,
3472
- "description": "Translated Client IP",
3544
+ "description": "Unique Cato Visible ID for devices",
3473
3545
  "isDeprecated": false,
3474
- "name": "translated_client_ip"
3546
+ "name": "visible_device_id"
3475
3547
  },
3476
3548
  {
3477
3549
  "deprecationReason": null,
3478
- "description": "IoC Container Name",
3550
+ "description": "Lan access Allowed / Blocked",
3479
3551
  "isDeprecated": false,
3480
- "name": "container_name"
3552
+ "name": "vpn_lan_access"
3481
3553
  },
3482
3554
  {
3483
3555
  "deprecationReason": null,
3484
- "description": "An external system identifier used for correlation between related Cato entities. Example: external ticket id that correlates Cato XDR stories.",
3556
+ "description": "User\u2019s email address",
3485
3557
  "isDeprecated": false,
3486
- "name": "correlation_id"
3558
+ "name": "vpn_user_email"
3487
3559
  },
3488
3560
  {
3489
3561
  "deprecationReason": null,
3490
- "description": "Precedence",
3562
+ "description": "For LDAP sync events, name of the AD domain",
3491
3563
  "isDeprecated": false,
3492
- "name": "precedence"
3564
+ "name": "windows_domain_name"
3493
3565
  },
3494
3566
  {
3495
3567
  "deprecationReason": null,
3496
- "description": "A list of labels providing additional context for the event",
3568
+ "description": "XFF HTTP header indicates the original IP address for the connections",
3497
3569
  "isDeprecated": false,
3498
- "name": "labels"
3570
+ "name": "xff"
3499
3571
  }
3500
3572
  ],
3501
3573
  "fields": null,