The following table lists the Netskope Advanced Analytics Incidents event field names. This list is dynamic and may not contain each available field.
| AA Incident Name | Description | Category | Field Group |
|---|---|---|---|
| Assignee | Assignee name | Dimension | DLP |
| Assignee Last Update | Timestamp of when the assignee was last updated | Dimension | DLP |
| Attachment | Name of the attachment being sent through mail | Dimension | File |
| BCC | Field to search events based on users in the bcc field | Dimension | General |
| CC | Field to search events based on users in the cc field | Dimension | General |
| DLP Action | Search events based on a specific DLP profile action | Dimension | DLP |
| DLP Fingerprint Classification | Search events for the DLP fingerprint classification within the profile that matches the content | Dimension | File |
| DLP Fingerprint Match | Search events for the DLP fingerprint file within the profile that matches the content | Dimension | File |
| DLP Fingerprint Score | Search events for the DLP fingerprint score within the profile that matches the content | Dimension | File |
| DLP Incident Status | Status of the DLP incident (e.g. New, In Progress, Closed) | Dimension | DLP |
| DLP Incident Status Last Update | DLP incident status last updated timestamp | Dimension | DLP |
| DLP Severity Status | Status of DLP incident severity | Dimension | DLP |
| DLP Severity Status Last Update | DLP incident severity last updated timestamp | Dimension | DLP |
| Email Subject | Search events based on the email subject | Dimension | General |
| Incident ID | Incident Unique Identifier | Dimension | General |
| Incident Type | Type of incident includes: DLP, UEBA, Compromised Credentials, Malware, Malsite. | Dimension | General |
| Malsite Destination Country | Destination country of the malicious site | Dimension | Malsite |
| Malsite Destination Region | Destination region of the malicious site | Dimension | Malsite |
| Malsite First Seen | Malsite first seen date | Dimension | Malsite |
| Malsite Last Seen | Malsite last seen date | Dimension | Malsite |
| Transaction ID | Type of log message | Dimension | General |
Tip
To see specific alerts associated with each incident, use the ‘Merged Query’ feature and merge with the alerts table using the ‘Incident ID’ or ‘DLP Incident ID’ (DLP alerts only) fields.
Enriched Fields
The data fields below are enriched from the data in the Alerts data collection. Use these enriched fields coupled with the “Merged Query’ to view targeted details of your DLP incident.
- Access Method
- Activity
- Application
- Application Activity
- Attachment
- Browser
- CCL
- Connection ID
- Destination Country
- Destination IP
- Destination Location
- Destination Region
- Destination Timezone
- Destination Zipcode
- Device Classification
- Device Type
- DLP File Name
- DLP Fingerprint Classification
- DLP Fingerprint Match
- DLP Fingerprint Score
- DLP Incident ID
- DLP is Unique Count
- DLP Parent ID
- DLP Profile
- DLP Rule
- DLP Rule Count
- DLP Rule Severity
- Event Timestamp
- Exposure
- External Collaborator Count
- File ID
- File Language
- File Owner
- File Path
- File Size
- File Type
- From User
- Hostname
- Instance ID
- Internal Collaborator Count
- MD5
- MIME Type
- Object
- Object ID
- Object Type
- Original File Path
- OS
- OS Version
- Referrer
- Request ID
- Session ID
- Shared With
- Shared With Domains
- Site
- Source Country
- Source IP
- Source Location
- Source Region
- Source Zipcode
- Telemetry App
- To User
- Total Collaborator Count
- Transaction ID
- URL
- User
- User IP