Cyberhaven
Fetches DLP incidents from the Cyberhaven data security platform and enables investigation of events and data lineage.
Data Enrichment & Threat Intelligence · Cyberhaven
Details
| ID | Cyberhaven |
|---|---|
| Provider | Cyberhaven |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 6.10.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
| Supported Modules | Agentix XSIAM |
README
Fetches DLP incidents from the Cyberhaven data security platform and enables investigation of events and data lineage.
This integration was integrated and tested with version 2 of Cyberhaven API.
Configure Cyberhaven in Cortex
| Parameter | Description | Required |
|---|---|---|
| Server URL (e.g., https://example.cyberhaven.io) | URL of the Cyberhaven tenant. | True |
| Refresh Token | Provide the Refresh Token for authentication. | True |
| Fetch incidents | Whether to fetch DLP incidents as XSOAR Incidents. | False |
| Incident type | Select Incident type as “Cyberhaven Incident”. | False |
| First fetch time | The date or relative timestamp from which to begin fetching DLP Incidents. Default value is ‘3 days’. The maximum is ‘30 days’. If the value is greater than ‘30 days’, it will be considered as ‘30 days’. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2026, 01 May 2026 04:45:33, 2026-05-17T14:05:44Z. |
False |
| Max Fetch | The maximum number of DLP Incidents to fetch each time. Default value is 100. The maximum is 200. If the value is greater than 200, it will be considered as 200. |
False |
| Status of incidents to fetch | Filter the DLP incidents by Status. Default value is ‘Open’. | False |
| Severity of incidents to fetch | Filter the DLP incidents by Severity. Default value is ‘Informational, Low, Medium, High, Critical’. | False |
| Enable Outgoing Mirroring (from XSOAR to Cyberhaven) | When enabled, updates to the following fields in XSOAR are synchronized to Cyberhaven: Status, Owner, Close Reason, and Close Notes. | False |
| Incidents Fetch Interval | The interval in minutes to fetch incidents. The default is 5 minute. | False |
| Trust any certificate (not secure) | Whether to allow connections without verifying SSL certificates validity. | False |
| Use system proxy settings | Whether to use XSOAR’s system proxy settings to connect to the API. | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
cyberhaven-incident-list
List and search Cyberhaven DLP incidents with optional filters.
Base Command
cyberhaven-incident-list
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | Max incidents to return. Default is 25. | Optional |
| start_time | Filter the incidents by start on or after the provided time. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. | Optional |
| end_time | Filter the incidents by end on or before the provided time. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. | Optional |
| severity | A comma-separated list of severity by which to filter the incidents. Possible values are: Informational, Low, Medium, High, Critical. | Optional |
| status | A comma-separated list of status by which to filter the incidents. Possible values are: Open, Closed. | Optional |
| assignee | Filter the incidents by assigned analyst email. | Optional |
| user | Filter the incidents by user who triggered the incident. | Optional |
| incident_ids | A comma-separated list of incident IDs to filter the results. | Optional |
| page_id | Page ID to retrieve the next set of the incidents. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Cyberhaven.Incident.id | String | The unique identifier of the incident. |
| Cyberhaven.Incident.user.id | String | The identifier of the user who triggered the incident. |
| Cyberhaven.Incident.user.local_username | String | The local machine username of the user who triggered the incident. |
| Cyberhaven.Incident.user.local_id | String | The local identifier of the user who triggered the incident. |
| Cyberhaven.Incident.event_lineage_id.start_event_id | String | The ID of the first event in the lineage chain. |
| Cyberhaven.Incident.event_lineage_id.end_event_id | String | The ID of the last event in the lineage chain. |
| Cyberhaven.Incident.blocked | Boolean | Whether the action that triggered the incident was blocked. |
| Cyberhaven.Incident.event_time | Date | The timestamp of the event that triggered the incident. |
| Cyberhaven.Incident.trigger_time | Date | The timestamp when the incident was triggered. |
| Cyberhaven.Incident.dataset.id | String | The identifier of the dataset involved in the incident. |
| Cyberhaven.Incident.dataset.name | String | The name of the dataset involved in the incident. |
| Cyberhaven.Incident.dataset.sensitivity | String | The sensitivity classification of the dataset involved. |
| Cyberhaven.Incident.user_risk_groups | String | The list of risk groups the user belongs to. |
| Cyberhaven.Incident.policy.id | String | The identifier of the DLP policy that was triggered. |
| Cyberhaven.Incident.policy.name | String | The name of the DLP policy that was triggered. |
| Cyberhaven.Incident.policy.severity | String | The severity level defined in the triggering DLP policy. |
| Cyberhaven.Incident.risk_score | Number | The numeric risk score assigned to the incident. |
| Cyberhaven.Incident.screenshot_guid | String | The GUID of the screenshot associated with the incident. |
| Cyberhaven.Incident.warning_status | String | The warning acknowledgement status of the incident. |
| Cyberhaven.Incident.user_reactions | String | The list of user reaction codes for the incident. |
| Cyberhaven.Incident.user_reaction_message | String | The message provided by the user when reacting to the warning. |
| Cyberhaven.Incident.reaction_time | Date | The timestamp when the user reacted to the warning. |
| Cyberhaven.Incident.assigned_to | String | The email of the analyst the incident is assigned to. |
| Cyberhaven.Incident.status | String | The current status of the incident (e.g. open, closed). |
| Cyberhaven.Incident.resolution_time | Date | The timestamp when the incident was resolved. |
| Cyberhaven.Incident.close_reason | String | The reason code provided when the incident was closed. |
| Cyberhaven.Incident.close_note | String | The free-text note provided when the incident was closed. |
| Cyberhaven.Incident.created_by | String | Indicates how the incident was created (e.g. created_by_policy). |
| Cyberhaven.Incident.ai_summary | String | The AI-generated summary of the incident. |
| Cyberhaven.Incident.ai_severity | String | The AI-assessed severity level of the incident. |
| Cyberhaven.Incident.last_modified | Date | The timestamp when the incident was last modified. |
| Cyberhaven.Incident.event_details.start_event.id | String | The ID of the start event. |
| Cyberhaven.Incident.event_details.start_event.timestamp | Date | The timestamp of the start event. |
| Cyberhaven.Incident.event_details.start_event.action.kind | String | The action kind performed in the start event (e.g. copy). |
| Cyberhaven.Incident.event_details.start_event.action.blocked | Boolean | Whether the action in the start event was blocked. |
| Cyberhaven.Incident.event_details.start_event.action.data_size | Number | The size of data involved in the start event action (bytes). |
| Cyberhaven.Incident.event_details.start_event.action.content.tags | String | The content classification tags detected in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.attributes | String | The content attributes of the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.upload_filename | String | The filename of the content being uploaded in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.inspected | Boolean | Whether the content was inspected in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.sensor_kind | String | The sensor type that detected the start event (e.g. endpoint). |
| Cyberhaven.Incident.event_details.start_event.action.hostname | String | The hostname of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.machine_serial_number | String | The serial number of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.ip_address | String | The IP address of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.device_type | String | The device management type for the start event (e.g. managed). |
| Cyberhaven.Incident.event_details.start_event.action.temporary_blocked | Boolean | Whether the start event action was temporarily blocked. |
| Cyberhaven.Incident.event_details.start_event.action.fail_close_statuses | String | The list of fail-close status objects for the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.process_id | Number | The process ID of the process that triggered the start event. |
| Cyberhaven.Incident.event_details.start_event.action.parent_process_id | Number | The parent process ID of the process that triggered the start event. |
| Cyberhaven.Incident.event_details.start_event.user.id | String | The identifier of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.user.local_username | String | The local username of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.user.local_id | String | The local ID of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.id | String | The ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.display_name | String | The display name of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.datastore_id | String | The datastore ID associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.dataset_sensitivity | String | The sensitivity classification of the dataset in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.dataset_ids | String | The list of dataset IDs associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.object_type | String | The object type (e.g. file, removable_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.state | String | The state of the object (e.g. active) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.tags | String | The content classification tags in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.attributes | String | The content attributes in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.upload_filename | String | The upload filename of the content in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.inspected | Boolean | Whether the content was inspected in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.data.labels | String | The data classification labels in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.data.label_ids | String | The data classification label IDs in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.name | String | The name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.description | String | The description of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.package_name | String | The package name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.binary_path | String | The binary path of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.command_line | String | The command line of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.main_window_title | String | The main window title of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.name | String | The file name in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.extension | String | The file extension in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.size | Number | The file size (bytes) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.md5_hash | String | The MD5 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.sha256_hash | String | The SHA-256 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.created_at | Date | The creation timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.modified_at | Date | The last modification timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.owner.name | String | The name of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.owner.id | String | The ID of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.local_file.id | String | The local file ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.local_file.path | String | The local file system path in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.network_share.hostname | String | The hostname of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.network_share.path | String | The path of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.id | String | The ID of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.from | String | The sender of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.to | String | The recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.cc | String | The CC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.bcc | String | The BCC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.subject | String | The subject of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email_attachment.id | String | The ID of the email attachment in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.url | String | The URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.domain | String | The domain of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.download_url | String | The download URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.title | String | The page title of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.user_agent | String | The user-agent string of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.provider | String | The cloud provider (e.g. google) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.name | String | The name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_name | String | The username in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_email | String | The user email in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_id | String | The instance ID of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_name | String | The instance name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.id | String | The ID of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.content_uri | String | The content URI of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.path | String | The path of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.scope | String | The sharing scope in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.role | String | The role of the cloud share recipient in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.name | String | The name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.description | String | The description of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.physical_location | String | The physical location of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.server | String | The print server hostname in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.share_name | String | The share name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.port | String | The port of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.driver | String | The driver name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.is_local | Boolean | Whether the printer is local in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.job_id | String | The print job ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.connectivity | String | The connectivity type of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.id | String | The ID of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.name | String | The name of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.product_id | String | The USB product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.sender | String | The sender of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_users | String | The recipient users of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_groups | String | The recipient groups of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.domain | String | The domain of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.workspace | String | The workspace of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.organization | String | The organization of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.name | String | The name of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.branch | String | The branch of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.id | String | The ID of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.labels | String | The labels applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.label_ids | String | The label IDs applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.matched_policies | String | The list of DLP policies matched by the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.issues | String | The list of DLP issues detected on the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.outline | String | The outline description of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.type | String | The endpoint type (e.g. endpoint, removable_media) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.domain | String | The domain of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.discovered_at | Date | The timestamp when the object was first discovered in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.updated_at | Date | The timestamp when the object was last updated in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.id | String | The ID of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.action_kind | String | The action kind of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.timestamp | Date | The timestamp of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.id | String | The user ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_username | String | The local username in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_id | String | The local ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.version_id | String | The version ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.id | String | The ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.type | String | The type of cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.name | String | The name of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.account_id | String | The account ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.id | String | The ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.display_name | String | The display name of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.datastore_id | String | The datastore ID associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.dataset_ids | String | The list of dataset IDs associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.object_type | String | The object type (e.g. file, removable_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.state | String | The state of the object (e.g. active) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.tags | String | The content classification tags in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.attributes | String | The content attributes in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.upload_filename | String | The upload filename of the content in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.inspected | Boolean | Whether the content was inspected in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.data.labels | String | The data classification labels in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.data.label_ids | String | The data classification label IDs in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.name | String | The name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.description | String | The description of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.package_name | String | The package name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.binary_path | String | The binary path of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.command_line | String | The command line of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.main_window_title | String | The main window title of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.name | String | The file name in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.extension | String | The file extension in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.size | Number | The file size (bytes) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.md5_hash | String | The MD5 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.sha256_hash | String | The SHA-256 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.created_at | Date | The creation timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.modified_at | Date | The last modification timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.owner.name | String | The name of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.owner.id | String | The ID of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.local_file.id | String | The local file ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.local_file.path | String | The local file system path in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.network_share.hostname | String | The hostname of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.network_share.path | String | The path of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.id | String | The ID of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.from | String | The sender of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.to | String | The recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.cc | String | The CC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.bcc | String | The BCC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.subject | String | The subject of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email_attachment.id | String | The ID of the email attachment in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.url | String | The URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.domain | String | The domain of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.download_url | String | The download URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.title | String | The page title of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.user_agent | String | The user-agent string of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.provider | String | The cloud provider (e.g. google) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.name | String | The name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_name | String | The username in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_email | String | The user email in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_id | String | The instance ID of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_name | String | The instance name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.id | String | The ID of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.content_uri | String | The content URI of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.path | String | The path of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.scope | String | The sharing scope in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.name | String | The name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.description | String | The description of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.physical_location | String | The physical location of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.server | String | The print server hostname in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.share_name | String | The share name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.port | String | The port of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.driver | String | The driver name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.is_local | Boolean | Whether the printer is local in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.job_id | String | The print job ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.connectivity | String | The connectivity type of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.id | String | The ID of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.name | String | The name of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.product_id | String | The USB product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.sender | String | The sender of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_users | String | The recipient users of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_groups | String | The recipient groups of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.domain | String | The domain of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.workspace | String | The workspace of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.organization | String | The organization of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.name | String | The name of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.branch | String | The branch of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.id | String | The ID of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.labels | String | The labels applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.label_ids | String | The label IDs applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.matched_policies | String | The list of DLP policies matched by the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.issues | String | The list of DLP issues detected on the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.outline | String | The outline description of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.type | String | The endpoint type (e.g. endpoint, removable_media) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.domain | String | The domain of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.discovered_at | Date | The timestamp when the object was first discovered in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.updated_at | Date | The timestamp when the object was last updated in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.id | String | The ID of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.action_kind | String | The action kind of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.timestamp | Date | The timestamp of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.id | String | The user ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_username | String | The local username in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_id | String | The local ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.version_id | String | The version ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.id | String | The ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.type | String | The type of cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.name | String | The name of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.account_id | String | The account ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.end_event.id | String | The ID of the end event. |
| Cyberhaven.Incident.event_details.end_event.timestamp | Date | The timestamp of the end event. |
| Cyberhaven.Incident.event_details.end_event.action.kind | String | The action kind performed in the end event (e.g. copy). |
| Cyberhaven.Incident.event_details.end_event.action.blocked | Boolean | Whether the action in the end event was blocked. |
| Cyberhaven.Incident.event_details.end_event.action.data_size | Number | The size of data involved in the end event action (bytes). |
| Cyberhaven.Incident.event_details.end_event.action.content.tags | String | The content classification tags detected in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.attributes | String | The content attributes of the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.upload_filename | String | The filename of the content being uploaded in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.inspected | Boolean | Whether the content was inspected in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.sensor_kind | String | The sensor type that detected the end event (e.g. endpoint). |
| Cyberhaven.Incident.event_details.end_event.action.hostname | String | The hostname of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.machine_serial_number | String | The serial number of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.ip_address | String | The IP address of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.device_type | String | The device management type for the end event (e.g. managed). |
| Cyberhaven.Incident.event_details.end_event.action.temporary_blocked | Boolean | Whether the end event action was temporarily blocked. |
| Cyberhaven.Incident.event_details.end_event.action.fail_close_statuses | String | The list of fail-close status objects for the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.process_id | Number | The process ID of the process that triggered the end event. |
| Cyberhaven.Incident.event_details.end_event.action.parent_process_id | Number | The parent process ID of the process that triggered the end event. |
| Cyberhaven.Incident.event_details.end_event.user.id | String | The identifier of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.user.local_username | String | The local username of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.user.local_id | String | The local ID of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.id | String | The ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.display_name | String | The display name of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.datastore_id | String | The datastore ID associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.dataset_sensitivity | String | The sensitivity classification of the dataset in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.dataset_ids | String | The list of dataset IDs associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.object_type | String | The object type (e.g. file, removable_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.state | String | The state of the object (e.g. active) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.tags | String | The content classification tags in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.attributes | String | The content attributes in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.upload_filename | String | The upload filename of the content in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.inspected | Boolean | Whether the content was inspected in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.data.labels | String | The data classification labels in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.data.label_ids | String | The data classification label IDs in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.name | String | The name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.description | String | The description of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.package_name | String | The package name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.binary_path | String | The binary path of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.command_line | String | The command line of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.main_window_title | String | The main window title of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.name | String | The file name in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.extension | String | The file extension in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.size | Number | The file size (bytes) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.md5_hash | String | The MD5 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.sha256_hash | String | The SHA-256 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.created_at | Date | The creation timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.modified_at | Date | The last modification timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.owner.name | String | The name of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.owner.id | String | The ID of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.local_file.id | String | The local file ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.local_file.path | String | The local file system path in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.network_share.hostname | String | The hostname of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.network_share.path | String | The path of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.id | String | The ID of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.from | String | The sender of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.to | String | The recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.cc | String | The CC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.bcc | String | The BCC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.subject | String | The subject of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email_attachment.id | String | The ID of the email attachment in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.url | String | The URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.domain | String | The domain of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.download_url | String | The download URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.title | String | The page title of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.user_agent | String | The user-agent string of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.provider | String | The cloud provider (e.g. google) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.name | String | The name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_name | String | The username in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_email | String | The user email in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_id | String | The instance ID of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_name | String | The instance name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.id | String | The ID of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.content_uri | String | The content URI of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.path | String | The path of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.scope | String | The sharing scope in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.role | String | The role of the cloud share recipient in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.name | String | The name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.description | String | The description of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.physical_location | String | The physical location of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.server | String | The print server hostname in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.share_name | String | The share name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.port | String | The port of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.driver | String | The driver name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.is_local | Boolean | Whether the printer is local in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.job_id | String | The print job ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.connectivity | String | The connectivity type of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.id | String | The ID of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.name | String | The name of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.product_id | String | The USB product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.sender | String | The sender of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_users | String | The recipient users of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_groups | String | The recipient groups of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.domain | String | The domain of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.workspace | String | The workspace of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.organization | String | The organization of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.name | String | The name of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.branch | String | The branch of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.id | String | The ID of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.labels | String | The labels applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.label_ids | String | The label IDs applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.matched_policies | String | The list of DLP policies matched by the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.issues | String | The list of DLP issues detected on the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.outline | String | The outline description of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.type | String | The endpoint type (e.g. endpoint, removable_media) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.domain | String | The domain of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.discovered_at | Date | The timestamp when the object was first discovered in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.updated_at | Date | The timestamp when the object was last updated in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.id | String | The ID of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.action_kind | String | The action kind of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.timestamp | Date | The timestamp of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.id | String | The user ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_username | String | The local username in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_id | String | The local ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.version_id | String | The version ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.id | String | The ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.type | String | The type of cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.name | String | The name of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.account_id | String | The account ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.id | String | The ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.display_name | String | The display name of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.datastore_id | String | The datastore ID associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.dataset_ids | String | The list of dataset IDs associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.object_type | String | The object type (e.g. file, removable_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.state | String | The state of the object (e.g. active) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.tags | String | The content classification tags in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.attributes | String | The content attributes in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.upload_filename | String | The upload filename of the content in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.inspected | Boolean | Whether the content was inspected in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.data.labels | String | The data classification labels in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.data.label_ids | String | The data classification label IDs in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.name | String | The name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.description | String | The description of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.package_name | String | The package name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.binary_path | String | The binary path of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.command_line | String | The command line of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.main_window_title | String | The main window title of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.name | String | The file name in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.extension | String | The file extension in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.size | Number | The file size (bytes) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.md5_hash | String | The MD5 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.sha256_hash | String | The SHA-256 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.created_at | Date | The creation timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.modified_at | Date | The last modification timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.owner.name | String | The name of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.owner.id | String | The ID of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.local_file.id | String | The local file ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.local_file.path | String | The local file system path in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.network_share.hostname | String | The hostname of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.network_share.path | String | The path of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.id | String | The ID of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.from | String | The sender of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.to | String | The recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.cc | String | The CC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.bcc | String | The BCC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.subject | String | The subject of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email_attachment.id | String | The ID of the email attachment in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.url | String | The URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.domain | String | The domain of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.download_url | String | The download URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.title | String | The page title of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.user_agent | String | The user-agent string of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.provider | String | The cloud provider (e.g. google) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.name | String | The name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_name | String | The username in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_email | String | The user email in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_id | String | The instance ID of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_name | String | The instance name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.id | String | The ID of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.content_uri | String | The content URI of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.path | String | The path of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.scope | String | The sharing scope in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.name | String | The name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.description | String | The description of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.physical_location | String | The physical location of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.server | String | The print server hostname in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.share_name | String | The share name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.port | String | The port of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.driver | String | The driver name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.is_local | Boolean | Whether the printer is local in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.job_id | String | The print job ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.connectivity | String | The connectivity type of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.id | String | The ID of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.name | String | The name of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.product_id | String | The USB product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.sender | String | The sender of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_users | String | The recipient users of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_groups | String | The recipient groups of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.domain | String | The domain of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.workspace | String | The workspace of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.organization | String | The organization of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.name | String | The name of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.branch | String | The branch of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.id | String | The ID of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.labels | String | The labels applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.label_ids | String | The label IDs applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.matched_policies | String | The list of DLP policies matched by the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.issues | String | The list of DLP issues detected on the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.outline | String | The outline description of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.type | String | The endpoint type (e.g. endpoint, removable_media) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.domain | String | The domain of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.discovered_at | Date | The timestamp when the object was first discovered in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.updated_at | Date | The timestamp when the object was last updated in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.id | String | The ID of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.action_kind | String | The action kind of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.timestamp | Date | The timestamp of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.id | String | The user ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_username | String | The local username in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_id | String | The local ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.version_id | String | The version ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.id | String | The ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.type | String | The type of cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.name | String | The name of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.account_id | String | The account ID of the cloud connector in the end event. |
| Cyberhaven.IncidentPage.next_id | String | The opaque cursor for the next page of results. Pass this value as page_id to retrieve the next page. |
| Cyberhaven.IncidentPage.total | Number | The total number of incidents for the provided filters. |
Command example
!cyberhaven-incident-list limit=2 start_time="3 days"
Context Example
{
"Cyberhaven": {
"Incidents": [
{
"id": "inc_a1b2c3d4e5f6",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"department": "Engineering",
"manager_email": "jane.smith@company.com",
"employee_id": "EMP-10042",
"location": "US-NYC",
"role": "Senior Software Engineer"
}
},
"event_lineage_id": {
"start_event_id": "evt_start_001abc",
"end_event_id": "evt_end_002xyz"
},
"blocked": false,
"event_time": "2026-01-15T10:28:45Z",
"trigger_time": "2026-01-15T10:29:02Z",
"dataset": {
"id": "ds_hr_confidential",
"name": "HR Confidential Records",
"sensitivity": "high",
"custom_data": {
"classification_level": "confidential",
"data_owner": "hr@company.com"
}
},
"user_risk_groups": [
{
"id": "rg_high_risk_users",
"name": "High Risk Users",
"risk_multiplier": 1.5,
"custom_data": {
"criteria": "multiple_policy_violations"
}
}
],
"policy": {
"id": "pol_dlp_hr_001",
"name": "HR Data Exfiltration Prevention",
"severity": "high",
"custom_data": {
"policy_owner": "security@company.com",
"enforcement_mode": "block",
"review_cycle": "quarterly",
"compliance_framework": "SOC2"
}
},
"risk_score": 8.5,
"screenshot_guid": "scrn_7f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
"warning_status": "warning_shown",
"user_reactions": [
"reaction_acknowledged"
],
"user_reaction_message": "I was transferring files for an approved project backup.",
"reaction_time": "2026-01-15T10:31:15Z",
"assigned_to": "analyst@company.com",
"status": "open",
"resolution_time": "2026-01-15T14:45:00Z",
"close_reason": "policy_violation",
"close_note": "User violated data exfiltration policy. Escalated to HR.",
"custom_data": {
"ticket_id": "JIRA-4521"
},
"created_by": "created_by_system",
"ai_summary": "User john.doe attempted to copy confidential HR records to a removable USB drive. The action was detected by endpoint DLP and flagged as a high-severity policy violation.",
"ai_severity": "high",
"last_modified": "2026-01-15T11:00:00Z",
"event_details": {
"start_event": {
"id": "evt_start_001abc",
"timestamp": "2026-01-15T10:28:45Z",
"action": {
"kind": "copy",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"encoding": "UTF-8"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"ad_group": "Domain Users",
"upn": "john.doe@company.com",
"last_login": "2026-01-15T08:05:00Z"
}
},
"source": {
"id": "src_local_001abc",
"display_name": "employee_salaries_2026.xlsx",
"datastore_id": "dstore_endpoint_01",
"dataset_sensitivity": "sensitivity_high",
"dataset_ids": [
"ds_hr_confidential"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"classification": "confidential",
"last_scan": "2026-01-10T09:00:00Z",
"scan_result": "contains_pii",
"owner_department": "HR"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential",
"HR Data"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Microsoft Excel",
"description": "Microsoft Office Spreadsheet Application",
"package_name": "com.microsoft.excel",
"binary_path": "C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE",
"command_line": "\"EXCEL.EXE\" /e",
"main_window_title": "employee_salaries_2026.xlsx - Excel",
"custom_data": {
"version": "16.0.17126.20132",
"publisher": "Microsoft Corporation",
"signed": "true",
"install_date": "2023-06-01",
"auto_update": "enabled"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"creator": "john.doe",
"last_modified_by": "jane.smith"
},
"created_at": "2026-01-10T09:00:00Z",
"modified_at": "2026-01-15T08:30:00Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_001abc",
"path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>",
"x_mailer": "Microsoft Outlook 16.0"
}
},
"email_attachment": {
"id": "attach_src_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload",
"custom_data": {
"referrer": "https://drive.google.com/",
"request_method": "POST"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Data/employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"revision_id": "rev_001"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12",
"duplex": "false"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"file_system": "NTFS",
"capacity_gb": "64"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_001abc"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private",
"default_branch": "main",
"last_commit": "a1b2c3d4e5f6",
"language": "Python"
},
"branch": "main",
"id": "repo_001"
},
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection",
"rule_confidential_data"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:28:45Z"
}
],
"issues": [
{
"id": "issue_001abc",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:45Z"
}
],
"custom_data": {
"data_classification": "confidential",
"retention_policy": "7_years",
"gdpr_relevant": "true",
"ccpa_relevant": "true"
},
"outline": "Spreadsheet containing employee salary and compensation data for 250 employees in the Engineering department.",
"type": "removable_media",
"domain": "company.com",
"discovered_at": "2026-01-10T09:00:00Z",
"updated_at": "2026-01-15T10:28:45Z",
"update_event": {
"id": "upd_evt_001",
"action_kind": "copy",
"timestamp": "2026-01-15T10:28:45Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_001abc",
"cloud_connector": {
"id": "cc_box_001",
"type": "box",
"name": "Company Box Integration",
"onboarding_account": "admin@company.com",
"account_id": "box_acct_001"
}
},
"destination": {
"id": "dst_usb_001abc",
"display_name": "SanDisk Ultra 64GB (E:)",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "removable_storage",
"state": "active",
"content": {
"tags": [
"external",
"removable"
],
"attributes": {
"file_count": 1,
"total_size": 2048576
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"destination_path": "E:\\Backup\\HR",
"overwrite": "false"
},
"inspected": true
},
"data": {
"labels": [
"External Storage"
],
"label_ids": [
"lbl_external_storage"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe /select,\"E:\\Backup\\HR\\employee_salaries_2026.xlsx\"",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"destination_created": "true",
"is_copy": "true",
"original_path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_dst_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\Backup\\HR",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>"
}
},
"email_attachment": {
"id": "attach_dst_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"file_size": "2048576",
"sanitized": "false"
}
},
"web": {
"url": "https://drive.google.com/upload/resumable",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload Complete",
"custom_data": {
"upload_session_id": "upload_sess_001"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"upload_complete": "true"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"upload_timestamp": "2026-01-15T10:29:00Z",
"file_id": "1abc123xyz"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true",
"link_type": "restricted"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"drive_letter": "E",
"free_space_gb": "45"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_dst_001",
"channel": "direct",
"platform": "teams",
"thread_id": "thread_001",
"is_external": "true"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_dst_001"
},
"labels": [
"External Storage",
"Removable Media"
],
"label_ids": [
"lbl_external_storage",
"lbl_removable_media"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_removable_001",
"version": 2,
"definition_rule_ids": [
"rule_removable_media_write"
],
"action_rule_id": "action_rule_alert",
"matched_at": "2026-01-15T10:28:50Z"
}
],
"issues": [
{
"id": "issue_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_removable_001",
"policy_action_rule_id": "action_rule_alert",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:50Z"
}
],
"custom_data": {
"endpoint_risk": "high",
"device_approved": "false"
},
"outline": "USB removable storage device used as destination for confidential HR file transfer.",
"type": "share",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:45Z",
"updated_at": "2026-01-15T10:28:50Z",
"update_event": {
"id": "upd_evt_dst_001",
"action_kind": "write",
"timestamp": "2026-01-15T10:28:50Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_dst_001",
"cloud_connector": {
"id": "cc_gcs_001",
"type": "gcs",
"name": "Company GCS Integration",
"onboarding_account": "gcs-service@company.iam.gserviceaccount.com",
"account_id": "gcs_acct_001"
}
}
},
"end_event": {
"id": "evt_end_002xyz",
"timestamp": "2026-01-15T10:29:00Z",
"action": {
"kind": "upload",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500,
"page_count": 3
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"encoding": "UTF-8",
"compressed": "false",
"checksum_verified": "true"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2",
"network_zone": "internal"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
},
"source": {
"id": "src_end_001abc",
"display_name": "E:\\Backup\\HR\\employee_salaries_2026.xlsx",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"drive_letter": "E"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_end_src_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB",
"mount_point": "Z:"
}
},
"email": {
"id": "email_end_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102900.002@company.com>"
}
},
"email_attachment": {
"id": "attach_end_src_001",
"custom_data": {
"attachment_index": "0"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive",
"custom_data": {
"referrer": "https://drive.google.com/",
"request_method": "POST",
"response_code": "200"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1",
"auth_method": "oauth2"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_end_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"file_id": "1abc123xyz",
"revision": "1"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4522",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_end_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"file_system": "NTFS",
"drive_letter": "E"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_end_001",
"platform": "teams",
"thread_id": "thread_001",
"channel_type": "direct_message"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_end_src_001"
},
"labels": [
"External Storage",
"PII"
],
"label_ids": [
"lbl_external_storage",
"lbl_pii"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:29:00Z"
}
],
"issues": [
{
"id": "issue_end_src_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:29:00Z"
}
],
"custom_data": {
"data_classification": "confidential",
"risk_level": "high",
"source_type": "removable_media"
},
"outline": "File read from USB removable storage during end event of the data transfer sequence.",
"type": "endpoint",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:50Z",
"updated_at": "2026-01-15T10:29:00Z",
"update_event": {
"id": "upd_evt_end_src_001",
"action_kind": "read",
"timestamp": "2026-01-15T10:29:00Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_end_src_001",
"cloud_connector": {
"id": "cc_salesforce_001",
"type": "salesforce",
"name": "Company Salesforce Integration",
"onboarding_account": "admin@company.com",
"account_id": "sf_acct_001"
}
},
"destination": {
"id": "dst_end_001abc",
"display_name": "Google Drive - Personal",
"datastore_id": "dstore_gdrive_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_external_cloud"
],
"object_type": "cloud_file",
"state": "active",
"content": {
"tags": [
"external",
"cloud"
],
"attributes": {
"file_count": 1,
"total_size": 2048576,
"upload_chunks": 2,
"retry_count": 0,
"transfer_duration_ms": 1250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"upload_method": "resumable",
"destination_folder": "/My Drive/HR Backup",
"overwrite_existing": "false"
},
"inspected": true
},
"data": {
"labels": [
"External",
"Cloud Storage"
],
"label_ids": [
"lbl_external",
"lbl_cloud_storage"
]
},
"app": {
"name": "Google Chrome",
"description": "Google Chrome Web Browser",
"package_name": "com.google.chrome",
"binary_path": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
"command_line": "chrome.exe --profile-directory=Default",
"main_window_title": "Google Drive - Google Chrome",
"custom_data": {
"version": "120.0.6099.130",
"profile": "Default"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"cloud_file_id": "1abc123xyz",
"upload_session": "upload_sess_001"
},
"created_at": "2026-01-15T10:29:05Z",
"modified_at": "2026-01-15T10:29:05Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_end_dst_001",
"path": "C:\\Users\\john.doe\\Downloads\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "EXTERNAL-SHARE-01",
"path": "\\\\EXTERNAL-SHARE-01\\Public",
"custom_data": {
"share_type": "SMB",
"external_network": "true"
}
},
"email": {
"id": "email_end_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102900.002@company.com>",
"smtp_server": "smtp.gmail.com"
}
},
"email_attachment": {
"id": "attach_end_dst_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"file_size": "2048576",
"sanitized": "false"
}
},
"web": {
"url": "https://drive.google.com/file/d/1abc123xyz/view",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/uc?id=1abc123xyz&export=download",
"title": "employee_salaries_2026.xlsx - Google Drive",
"custom_data": {
"file_id": "1abc123xyz",
"sharing_status": "private"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"account_type": "personal"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_end_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123xyz/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"file_id": "1abc123xyz",
"revision_id": "rev_001",
"upload_complete": "true"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002",
"external_user_003"
],
"role": "role_editor",
"custom_data": {
"expiry_date": "2026-12-31",
"link_type": "restricted",
"notify_on_download": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4523",
"custom_data": {
"pages_printed": "12",
"color": "false"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_end_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_end_dst_001"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private",
"language": "Python",
"size_kb": "1024"
},
"branch": "main",
"id": "repo_end_dst_001"
},
"labels": [
"External",
"Cloud Storage",
"Personal Account"
],
"label_ids": [
"lbl_external",
"lbl_cloud_storage"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_cloud_upload_001",
"version": 1,
"definition_rule_ids": [
"rule_cloud_upload_block"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:29:00Z"
}
],
"issues": [
{
"id": "issue_end_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_cloud_upload_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:29:00Z"
}
],
"custom_data": {
"upload_destination": "personal_cloud",
"risk_level": "critical"
},
"outline": "Personal Google Drive account used as destination for unauthorized data upload containing HR confidential records.",
"type": "removable_media",
"domain": "drive.google.com",
"discovered_at": "2026-01-15T10:29:00Z",
"updated_at": "2026-01-15T10:29:05Z",
"update_event": {
"id": "upd_evt_end_dst_001",
"action_kind": "upload",
"timestamp": "2026-01-15T10:29:05Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_end_dst_001",
"cloud_connector": {
"id": "cc_teams_001",
"type": "teams",
"name": "Company Teams Integration",
"onboarding_account": "teams-admin@company.com",
"account_id": "teams_acct_001"
}
}
}
}
}
]
}
}
Human Readable Output
Cyberhaven Incidents
ID Policy Severity Status Blocked Event Time Start Event ID End Event ID AI Summary inc_a1b2c3d4e5f6 HR Data Exfiltration Prevention high open false 2026-01-15T10:28:45Z evt_start_001abc evt_end_002xyz User john.doe attempted to copy confidential HR records to a removable USB drive. The action was detected by endpoint DLP and flagged as a high-severity policy violation.
cyberhaven-incident-update
Update the status, assignment, or close reason of a Cyberhaven incident.
Base Command
cyberhaven-incident-update
Input
| Argument Name | Description | Required |
|---|---|---|
| incident_id | Specify the Cyberhaven incident ID. Note: Use ‘cyberhaven-incident-list’ to retrieve the incident ID. |
Required |
| status | Specify the status of the incident. Possible values are: Open, Closed. | Optional |
| close_reason | Specify the close reason while closing the incident. Possible values are: Resolved, False Positive, False Positive - Destination Not at Risk, False Positive - User Exempt, Other. | Optional |
| close_note | Provide the meaningful note when closing. | Optional |
| assigned_to | Provide analyst email to whom incident will assign. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Cyberhaven.Incident.id | String | The unique identifier of the incident. |
| Cyberhaven.Incident.user.id | String | The identifier of the user who triggered the incident. |
| Cyberhaven.Incident.user.local_username | String | The local machine username of the user who triggered the incident. |
| Cyberhaven.Incident.user.local_id | String | The local identifier of the user who triggered the incident. |
| Cyberhaven.Incident.event_lineage_id.start_event_id | String | The ID of the first event in the lineage chain. |
| Cyberhaven.Incident.event_lineage_id.end_event_id | String | The ID of the last event in the lineage chain. |
| Cyberhaven.Incident.blocked | Boolean | Whether the action that triggered the incident was blocked. |
| Cyberhaven.Incident.event_time | Date | The timestamp of the event that triggered the incident. |
| Cyberhaven.Incident.trigger_time | Date | The timestamp when the incident was triggered. |
| Cyberhaven.Incident.dataset.id | String | The identifier of the dataset involved in the incident. |
| Cyberhaven.Incident.dataset.name | String | The name of the dataset involved in the incident. |
| Cyberhaven.Incident.dataset.sensitivity | String | The sensitivity classification of the dataset involved. |
| Cyberhaven.Incident.user_risk_groups | String | The list of risk groups the user belongs to. |
| Cyberhaven.Incident.policy.id | String | The identifier of the DLP policy that was triggered. |
| Cyberhaven.Incident.policy.name | String | The name of the DLP policy that was triggered. |
| Cyberhaven.Incident.policy.severity | String | The severity level defined in the triggering DLP policy. |
| Cyberhaven.Incident.risk_score | Number | The numeric risk score assigned to the incident. |
| Cyberhaven.Incident.screenshot_guid | String | The GUID of the screenshot associated with the incident. |
| Cyberhaven.Incident.warning_status | String | The warning acknowledgement status of the incident. |
| Cyberhaven.Incident.user_reactions | String | The list of user reaction codes for the incident. |
| Cyberhaven.Incident.user_reaction_message | String | The message provided by the user when reacting to the warning. |
| Cyberhaven.Incident.reaction_time | Date | The timestamp when the user reacted to the warning. |
| Cyberhaven.Incident.assigned_to | String | The email of the analyst the incident is assigned to. |
| Cyberhaven.Incident.status | String | The current status of the incident (e.g. open, closed). |
| Cyberhaven.Incident.resolution_time | Date | The timestamp when the incident was resolved. |
| Cyberhaven.Incident.close_reason | String | The reason code provided when the incident was closed. |
| Cyberhaven.Incident.close_note | String | The free-text note provided when the incident was closed. |
| Cyberhaven.Incident.created_by | String | Indicates how the incident was created (e.g. created_by_policy). |
| Cyberhaven.Incident.ai_summary | String | The AI-generated summary of the incident. |
| Cyberhaven.Incident.ai_severity | String | The AI-assessed severity level of the incident. |
| Cyberhaven.Incident.last_modified | Date | The timestamp when the incident was last modified. |
| Cyberhaven.Incident.event_details.start_event.id | String | The ID of the start event. |
| Cyberhaven.Incident.event_details.start_event.timestamp | Date | The timestamp of the start event. |
| Cyberhaven.Incident.event_details.start_event.action.kind | String | The action kind performed in the start event (e.g. copy). |
| Cyberhaven.Incident.event_details.start_event.action.blocked | Boolean | Whether the action in the start event was blocked. |
| Cyberhaven.Incident.event_details.start_event.action.data_size | Number | The size of data involved in the start event action (bytes). |
| Cyberhaven.Incident.event_details.start_event.action.content.tags | String | The content classification tags detected in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.attributes | String | The content attributes of the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.upload_filename | String | The filename of the content being uploaded in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.inspected | Boolean | Whether the content was inspected in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.sensor_kind | String | The sensor type that detected the start event (e.g. endpoint). |
| Cyberhaven.Incident.event_details.start_event.action.hostname | String | The hostname of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.machine_serial_number | String | The serial number of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.ip_address | String | The IP address of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.device_type | String | The device management type for the start event (e.g. managed). |
| Cyberhaven.Incident.event_details.start_event.action.temporary_blocked | Boolean | Whether the start event action was temporarily blocked. |
| Cyberhaven.Incident.event_details.start_event.action.fail_close_statuses | String | The list of fail-close status objects for the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.process_id | Number | The process ID of the process that triggered the start event. |
| Cyberhaven.Incident.event_details.start_event.action.parent_process_id | Number | The parent process ID of the process that triggered the start event. |
| Cyberhaven.Incident.event_details.start_event.user.id | String | The identifier of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.user.local_username | String | The local username of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.user.local_id | String | The local ID of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.id | String | The ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.display_name | String | The display name of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.datastore_id | String | The datastore ID associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.dataset_sensitivity | String | The sensitivity classification of the dataset in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.dataset_ids | String | The list of dataset IDs associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.object_type | String | The object type (e.g. file, removable_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.state | String | The state of the object (e.g. active) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.tags | String | The content classification tags in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.attributes | String | The content attributes in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.upload_filename | String | The upload filename of the content in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.inspected | Boolean | Whether the content was inspected in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.data.labels | String | The data classification labels in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.data.label_ids | String | The data classification label IDs in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.name | String | The name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.description | String | The description of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.package_name | String | The package name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.binary_path | String | The binary path of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.command_line | String | The command line of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.main_window_title | String | The main window title of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.name | String | The file name in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.extension | String | The file extension in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.size | Number | The file size (bytes) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.md5_hash | String | The MD5 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.sha256_hash | String | The SHA-256 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.created_at | Date | The creation timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.modified_at | Date | The last modification timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.owner.name | String | The name of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.owner.id | String | The ID of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.local_file.id | String | The local file ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.local_file.path | String | The local file system path in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.network_share.hostname | String | The hostname of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.network_share.path | String | The path of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.id | String | The ID of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.from | String | The sender of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.to | String | The recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.cc | String | The CC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.bcc | String | The BCC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.subject | String | The subject of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email_attachment.id | String | The ID of the email attachment in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.url | String | The URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.domain | String | The domain of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.download_url | String | The download URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.title | String | The page title of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.user_agent | String | The user-agent string of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.provider | String | The cloud provider (e.g. google) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.name | String | The name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_name | String | The username in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_email | String | The user email in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_id | String | The instance ID of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_name | String | The instance name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.id | String | The ID of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.content_uri | String | The content URI of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.path | String | The path of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.scope | String | The sharing scope in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.role | String | The role of the cloud share recipient in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.name | String | The name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.description | String | The description of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.physical_location | String | The physical location of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.server | String | The print server hostname in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.share_name | String | The share name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.port | String | The port of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.driver | String | The driver name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.is_local | Boolean | Whether the printer is local in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.job_id | String | The print job ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.connectivity | String | The connectivity type of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.id | String | The ID of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.name | String | The name of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.product_id | String | The USB product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.sender | String | The sender of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_users | String | The recipient users of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_groups | String | The recipient groups of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.domain | String | The domain of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.workspace | String | The workspace of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.organization | String | The organization of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.name | String | The name of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.branch | String | The branch of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.id | String | The ID of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.labels | String | The labels applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.label_ids | String | The label IDs applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.matched_policies | String | The list of DLP policies matched by the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.issues | String | The list of DLP issues detected on the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.outline | String | The outline description of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.type | String | The endpoint type (e.g. endpoint, removable_media) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.domain | String | The domain of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.discovered_at | Date | The timestamp when the object was first discovered in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.updated_at | Date | The timestamp when the object was last updated in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.id | String | The ID of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.action_kind | String | The action kind of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.timestamp | Date | The timestamp of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.id | String | The user ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_username | String | The local username in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_id | String | The local ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.version_id | String | The version ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.id | String | The ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.type | String | The type of cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.name | String | The name of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.account_id | String | The account ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.id | String | The ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.display_name | String | The display name of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.datastore_id | String | The datastore ID associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.dataset_ids | String | The list of dataset IDs associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.object_type | String | The object type (e.g. file, removable_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.state | String | The state of the object (e.g. active) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.tags | String | The content classification tags in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.attributes | String | The content attributes in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.upload_filename | String | The upload filename of the content in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.inspected | Boolean | Whether the content was inspected in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.data.labels | String | The data classification labels in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.data.label_ids | String | The data classification label IDs in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.name | String | The name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.description | String | The description of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.package_name | String | The package name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.binary_path | String | The binary path of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.command_line | String | The command line of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.main_window_title | String | The main window title of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.name | String | The file name in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.extension | String | The file extension in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.size | Number | The file size (bytes) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.md5_hash | String | The MD5 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.sha256_hash | String | The SHA-256 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.created_at | Date | The creation timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.modified_at | Date | The last modification timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.owner.name | String | The name of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.owner.id | String | The ID of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.local_file.id | String | The local file ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.local_file.path | String | The local file system path in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.network_share.hostname | String | The hostname of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.network_share.path | String | The path of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.id | String | The ID of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.from | String | The sender of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.to | String | The recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.cc | String | The CC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.bcc | String | The BCC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.subject | String | The subject of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email_attachment.id | String | The ID of the email attachment in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.url | String | The URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.domain | String | The domain of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.download_url | String | The download URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.title | String | The page title of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.user_agent | String | The user-agent string of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.provider | String | The cloud provider (e.g. google) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.name | String | The name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_name | String | The username in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_email | String | The user email in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_id | String | The instance ID of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_name | String | The instance name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.id | String | The ID of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.content_uri | String | The content URI of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.path | String | The path of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.scope | String | The sharing scope in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.name | String | The name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.description | String | The description of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.physical_location | String | The physical location of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.server | String | The print server hostname in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.share_name | String | The share name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.port | String | The port of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.driver | String | The driver name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.is_local | Boolean | Whether the printer is local in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.job_id | String | The print job ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.connectivity | String | The connectivity type of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.id | String | The ID of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.name | String | The name of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.product_id | String | The USB product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.sender | String | The sender of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_users | String | The recipient users of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_groups | String | The recipient groups of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.domain | String | The domain of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.workspace | String | The workspace of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.organization | String | The organization of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.name | String | The name of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.branch | String | The branch of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.id | String | The ID of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.labels | String | The labels applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.label_ids | String | The label IDs applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.matched_policies | String | The list of DLP policies matched by the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.issues | String | The list of DLP issues detected on the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.outline | String | The outline description of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.type | String | The endpoint type (e.g. endpoint, removable_media) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.domain | String | The domain of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.discovered_at | Date | The timestamp when the object was first discovered in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.updated_at | Date | The timestamp when the object was last updated in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.id | String | The ID of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.action_kind | String | The action kind of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.timestamp | Date | The timestamp of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.id | String | The user ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_username | String | The local username in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_id | String | The local ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.version_id | String | The version ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.id | String | The ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.type | String | The type of cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.name | String | The name of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.account_id | String | The account ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.end_event.id | String | The ID of the end event. |
| Cyberhaven.Incident.event_details.end_event.timestamp | Date | The timestamp of the end event. |
| Cyberhaven.Incident.event_details.end_event.action.kind | String | The action kind performed in the end event (e.g. copy). |
| Cyberhaven.Incident.event_details.end_event.action.blocked | Boolean | Whether the action in the end event was blocked. |
| Cyberhaven.Incident.event_details.end_event.action.data_size | Number | The size of data involved in the end event action (bytes). |
| Cyberhaven.Incident.event_details.end_event.action.content.tags | String | The content classification tags detected in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.attributes | String | The content attributes of the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.upload_filename | String | The filename of the content being uploaded in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.inspected | Boolean | Whether the content was inspected in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.sensor_kind | String | The sensor type that detected the end event (e.g. endpoint). |
| Cyberhaven.Incident.event_details.end_event.action.hostname | String | The hostname of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.machine_serial_number | String | The serial number of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.ip_address | String | The IP address of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.device_type | String | The device management type for the end event (e.g. managed). |
| Cyberhaven.Incident.event_details.end_event.action.temporary_blocked | Boolean | Whether the end event action was temporarily blocked. |
| Cyberhaven.Incident.event_details.end_event.action.fail_close_statuses | String | The list of fail-close status objects for the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.process_id | Number | The process ID of the process that triggered the end event. |
| Cyberhaven.Incident.event_details.end_event.action.parent_process_id | Number | The parent process ID of the process that triggered the end event. |
| Cyberhaven.Incident.event_details.end_event.user.id | String | The identifier of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.user.local_username | String | The local username of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.user.local_id | String | The local ID of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.id | String | The ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.display_name | String | The display name of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.datastore_id | String | The datastore ID associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.dataset_sensitivity | String | The sensitivity classification of the dataset in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.dataset_ids | String | The list of dataset IDs associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.object_type | String | The object type (e.g. file, removable_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.state | String | The state of the object (e.g. active) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.tags | String | The content classification tags in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.attributes | String | The content attributes in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.upload_filename | String | The upload filename of the content in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.inspected | Boolean | Whether the content was inspected in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.data.labels | String | The data classification labels in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.data.label_ids | String | The data classification label IDs in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.name | String | The name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.description | String | The description of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.package_name | String | The package name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.binary_path | String | The binary path of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.command_line | String | The command line of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.main_window_title | String | The main window title of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.name | String | The file name in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.extension | String | The file extension in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.size | Number | The file size (bytes) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.md5_hash | String | The MD5 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.sha256_hash | String | The SHA-256 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.created_at | Date | The creation timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.modified_at | Date | The last modification timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.owner.name | String | The name of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.owner.id | String | The ID of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.local_file.id | String | The local file ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.local_file.path | String | The local file system path in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.network_share.hostname | String | The hostname of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.network_share.path | String | The path of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.id | String | The ID of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.from | String | The sender of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.to | String | The recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.cc | String | The CC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.bcc | String | The BCC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.subject | String | The subject of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email_attachment.id | String | The ID of the email attachment in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.url | String | The URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.domain | String | The domain of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.download_url | String | The download URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.title | String | The page title of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.user_agent | String | The user-agent string of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.provider | String | The cloud provider (e.g. google) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.name | String | The name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_name | String | The username in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_email | String | The user email in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_id | String | The instance ID of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_name | String | The instance name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.id | String | The ID of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.content_uri | String | The content URI of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.path | String | The path of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.scope | String | The sharing scope in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.role | String | The role of the cloud share recipient in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.name | String | The name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.description | String | The description of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.physical_location | String | The physical location of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.server | String | The print server hostname in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.share_name | String | The share name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.port | String | The port of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.driver | String | The driver name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.is_local | Boolean | Whether the printer is local in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.job_id | String | The print job ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.connectivity | String | The connectivity type of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.id | String | The ID of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.name | String | The name of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.product_id | String | The USB product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.sender | String | The sender of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_users | String | The recipient users of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_groups | String | The recipient groups of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.domain | String | The domain of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.workspace | String | The workspace of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.organization | String | The organization of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.name | String | The name of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.branch | String | The branch of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.id | String | The ID of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.labels | String | The labels applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.label_ids | String | The label IDs applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.matched_policies | String | The list of DLP policies matched by the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.issues | String | The list of DLP issues detected on the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.outline | String | The outline description of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.type | String | The endpoint type (e.g. endpoint, removable_media) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.domain | String | The domain of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.discovered_at | Date | The timestamp when the object was first discovered in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.updated_at | Date | The timestamp when the object was last updated in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.id | String | The ID of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.action_kind | String | The action kind of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.timestamp | Date | The timestamp of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.id | String | The user ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_username | String | The local username in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_id | String | The local ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.version_id | String | The version ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.id | String | The ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.type | String | The type of cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.name | String | The name of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.account_id | String | The account ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.id | String | The ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.display_name | String | The display name of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.datastore_id | String | The datastore ID associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.dataset_ids | String | The list of dataset IDs associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.object_type | String | The object type (e.g. file, removable_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.state | String | The state of the object (e.g. active) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.tags | String | The content classification tags in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.attributes | String | The content attributes in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.upload_filename | String | The upload filename of the content in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.inspected | Boolean | Whether the content was inspected in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.data.labels | String | The data classification labels in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.data.label_ids | String | The data classification label IDs in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.name | String | The name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.description | String | The description of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.package_name | String | The package name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.binary_path | String | The binary path of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.command_line | String | The command line of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.main_window_title | String | The main window title of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.name | String | The file name in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.extension | String | The file extension in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.size | Number | The file size (bytes) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.md5_hash | String | The MD5 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.sha256_hash | String | The SHA-256 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.created_at | Date | The creation timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.modified_at | Date | The last modification timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.owner.name | String | The name of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.owner.id | String | The ID of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.local_file.id | String | The local file ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.local_file.path | String | The local file system path in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.network_share.hostname | String | The hostname of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.network_share.path | String | The path of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.id | String | The ID of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.from | String | The sender of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.to | String | The recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.cc | String | The CC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.bcc | String | The BCC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.subject | String | The subject of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email_attachment.id | String | The ID of the email attachment in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.url | String | The URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.domain | String | The domain of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.download_url | String | The download URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.title | String | The page title of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.user_agent | String | The user-agent string of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.provider | String | The cloud provider (e.g. google) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.name | String | The name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_name | String | The username in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_email | String | The user email in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_id | String | The instance ID of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_name | String | The instance name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.id | String | The ID of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.content_uri | String | The content URI of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.path | String | The path of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.scope | String | The sharing scope in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.name | String | The name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.description | String | The description of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.physical_location | String | The physical location of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.server | String | The print server hostname in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.share_name | String | The share name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.port | String | The port of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.driver | String | The driver name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.is_local | Boolean | Whether the printer is local in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.job_id | String | The print job ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.connectivity | String | The connectivity type of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.id | String | The ID of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.name | String | The name of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.product_id | String | The USB product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.sender | String | The sender of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_users | String | The recipient users of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_groups | String | The recipient groups of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.domain | String | The domain of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.workspace | String | The workspace of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.organization | String | The organization of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.name | String | The name of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.branch | String | The branch of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.id | String | The ID of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.labels | String | The labels applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.label_ids | String | The label IDs applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.matched_policies | String | The list of DLP policies matched by the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.issues | String | The list of DLP issues detected on the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.outline | String | The outline description of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.type | String | The endpoint type (e.g. endpoint, removable_media) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.domain | String | The domain of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.discovered_at | Date | The timestamp when the object was first discovered in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.updated_at | Date | The timestamp when the object was last updated in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.id | String | The ID of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.action_kind | String | The action kind of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.timestamp | Date | The timestamp of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.id | String | The user ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_username | String | The local username in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_id | String | The local ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.version_id | String | The version ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.id | String | The ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.type | String | The type of cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.name | String | The name of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.account_id | String | The account ID of the cloud connector in the end event. |
Command example
!cyberhaven-incident-update incident_id="inc_a1b2c3d4e5f6" status="Closed"
Context Example
{
"Cyberhaven": {
"Incidents": [
{
"id": "inc_a1b2c3d4e5f6",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"department": "Engineering",
"manager_email": "jane.smith@company.com",
"employee_id": "EMP-10042",
"location": "US-NYC",
"role": "Senior Software Engineer"
}
},
"event_lineage_id": {
"start_event_id": "evt_start_001abc",
"end_event_id": "evt_end_002xyz"
},
"blocked": false,
"event_time": "2026-01-15T10:28:45Z",
"trigger_time": "2026-01-15T10:29:02Z",
"dataset": {
"id": "ds_hr_confidential",
"name": "HR Confidential Records",
"sensitivity": "high",
"custom_data": {
"classification_level": "confidential",
"data_owner": "hr@company.com"
}
},
"user_risk_groups": [
{
"id": "rg_high_risk_users",
"name": "High Risk Users",
"risk_multiplier": 1.5,
"custom_data": {
"criteria": "multiple_policy_violations"
}
}
],
"policy": {
"id": "pol_dlp_hr_001",
"name": "HR Data Exfiltration Prevention",
"severity": "high",
"custom_data": {
"policy_owner": "security@company.com",
"enforcement_mode": "block",
"review_cycle": "quarterly",
"compliance_framework": "SOC2"
}
},
"risk_score": 8.5,
"screenshot_guid": "scrn_7f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
"warning_status": "warning_shown",
"user_reactions": [
"reaction_acknowledged"
],
"user_reaction_message": "I was transferring files for an approved project backup.",
"reaction_time": "2026-01-15T10:31:15Z",
"assigned_to": "analyst@company.com",
"status": "closed",
"resolution_time": "2026-01-15T14:45:00Z",
"close_reason": "policy_violation",
"close_note": "User violated data exfiltration policy. Escalated to HR.",
"custom_data": {
"ticket_id": "JIRA-4521"
},
"created_by": "created_by_system",
"ai_summary": "User john.doe attempted to copy confidential HR records to a removable USB drive. The action was detected by endpoint DLP and flagged as a high-severity policy violation.",
"ai_severity": "high",
"last_modified": "2026-01-15T11:00:00Z",
"event_details": {
"start_event": {
"id": "evt_start_001abc",
"timestamp": "2026-01-15T10:28:45Z",
"action": {
"kind": "copy",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"encoding": "UTF-8"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"ad_group": "Domain Users",
"upn": "john.doe@company.com",
"last_login": "2026-01-15T08:05:00Z"
}
},
"source": {
"id": "src_local_001abc",
"display_name": "employee_salaries_2026.xlsx",
"datastore_id": "dstore_endpoint_01",
"dataset_sensitivity": "sensitivity_high",
"dataset_ids": [
"ds_hr_confidential"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"classification": "confidential",
"last_scan": "2026-01-10T09:00:00Z",
"scan_result": "contains_pii",
"owner_department": "HR"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential",
"HR Data"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Microsoft Excel",
"description": "Microsoft Office Spreadsheet Application",
"package_name": "com.microsoft.excel",
"binary_path": "C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE",
"command_line": "\"EXCEL.EXE\" /e",
"main_window_title": "employee_salaries_2026.xlsx - Excel",
"custom_data": {
"version": "16.0.17126.20132",
"publisher": "Microsoft Corporation",
"signed": "true",
"install_date": "2023-06-01",
"auto_update": "enabled"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"creator": "john.doe",
"last_modified_by": "jane.smith"
},
"created_at": "2026-01-10T09:00:00Z",
"modified_at": "2026-01-15T08:30:00Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_001abc",
"path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>",
"x_mailer": "Microsoft Outlook 16.0"
}
},
"email_attachment": {
"id": "attach_src_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload",
"custom_data": {
"referrer": "https://drive.google.com/",
"request_method": "POST"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Data/employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"revision_id": "rev_001"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12",
"duplex": "false"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"file_system": "NTFS",
"capacity_gb": "64"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_001abc"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private",
"default_branch": "main",
"last_commit": "a1b2c3d4e5f6",
"language": "Python"
},
"branch": "main",
"id": "repo_001"
},
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection",
"rule_confidential_data"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:28:45Z"
}
],
"issues": [
{
"id": "issue_001abc",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:45Z"
}
],
"custom_data": {
"data_classification": "confidential",
"retention_policy": "7_years",
"gdpr_relevant": "true",
"ccpa_relevant": "true"
},
"outline": "Spreadsheet containing employee salary and compensation data for 250 employees in the Engineering department.",
"type": "removable_media",
"domain": "company.com",
"discovered_at": "2026-01-10T09:00:00Z",
"updated_at": "2026-01-15T10:28:45Z",
"update_event": {
"id": "upd_evt_001",
"action_kind": "copy",
"timestamp": "2026-01-15T10:28:45Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_001abc",
"cloud_connector": {
"id": "cc_box_001",
"type": "box",
"name": "Company Box Integration",
"onboarding_account": "admin@company.com",
"account_id": "box_acct_001"
}
},
"destination": {
"id": "dst_usb_001abc",
"display_name": "SanDisk Ultra 64GB (E:)",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "removable_storage",
"state": "active",
"content": {
"tags": [
"external",
"removable"
],
"attributes": {
"file_count": 1,
"total_size": 2048576
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"destination_path": "E:\\Backup\\HR",
"overwrite": "false"
},
"inspected": true
},
"data": {
"labels": [
"External Storage"
],
"label_ids": [
"lbl_external_storage"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe /select,\"E:\\Backup\\HR\\employee_salaries_2026.xlsx\"",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"destination_created": "true",
"is_copy": "true",
"original_path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_dst_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\Backup\\HR",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>"
}
},
"email_attachment": {
"id": "attach_dst_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"file_size": "2048576",
"sanitized": "false"
}
},
"web": {
"url": "https://drive.google.com/upload/resumable",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload Complete",
"custom_data": {
"upload_session_id": "upload_sess_001"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"upload_complete": "true"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"upload_timestamp": "2026-01-15T10:29:00Z",
"file_id": "1abc123xyz"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true",
"link_type": "restricted"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"drive_letter": "E",
"free_space_gb": "45"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_dst_001",
"channel": "direct",
"platform": "teams",
"thread_id": "thread_001",
"is_external": "true"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_dst_001"
},
"labels": [
"External Storage",
"Removable Media"
],
"label_ids": [
"lbl_external_storage",
"lbl_removable_media"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_removable_001",
"version": 2,
"definition_rule_ids": [
"rule_removable_media_write"
],
"action_rule_id": "action_rule_alert",
"matched_at": "2026-01-15T10:28:50Z"
}
],
"issues": [
{
"id": "issue_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_removable_001",
"policy_action_rule_id": "action_rule_alert",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:50Z"
}
],
"custom_data": {
"endpoint_risk": "high",
"device_approved": "false"
},
"outline": "USB removable storage device used as destination for confidential HR file transfer.",
"type": "share",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:45Z",
"updated_at": "2026-01-15T10:28:50Z",
"update_event": {
"id": "upd_evt_dst_001",
"action_kind": "write",
"timestamp": "2026-01-15T10:28:50Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_dst_001",
"cloud_connector": {
"id": "cc_gcs_001",
"type": "gcs",
"name": "Company GCS Integration",
"onboarding_account": "gcs-service@company.iam.gserviceaccount.com",
"account_id": "gcs_acct_001"
}
}
},
"end_event": {
"id": "evt_end_002xyz",
"timestamp": "2026-01-15T10:29:00Z",
"action": {
"kind": "upload",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500,
"page_count": 3
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"encoding": "UTF-8",
"compressed": "false",
"checksum_verified": "true"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2",
"network_zone": "internal"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
},
"source": {
"id": "src_end_001abc",
"display_name": "E:\\Backup\\HR\\employee_salaries_2026.xlsx",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"drive_letter": "E"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_end_src_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB",
"mount_point": "Z:"
}
},
"email": {
"id": "email_end_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102900.002@company.com>"
}
},
"email_attachment": {
"id": "attach_end_src_001",
"custom_data": {
"attachment_index": "0"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive",
"custom_data": {
"referrer": "https://drive.google.com/",
"request_method": "POST",
"response_code": "200"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1",
"auth_method": "oauth2"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_end_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"file_id": "1abc123xyz",
"revision": "1"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4522",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_end_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"file_system": "NTFS",
"drive_letter": "E"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_end_001",
"platform": "teams",
"thread_id": "thread_001",
"channel_type": "direct_message"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_end_src_001"
},
"labels": [
"External Storage",
"PII"
],
"label_ids": [
"lbl_external_storage",
"lbl_pii"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:29:00Z"
}
],
"issues": [
{
"id": "issue_end_src_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:29:00Z"
}
],
"custom_data": {
"data_classification": "confidential",
"risk_level": "high",
"source_type": "removable_media"
},
"outline": "File read from USB removable storage during end event of the data transfer sequence.",
"type": "endpoint",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:50Z",
"updated_at": "2026-01-15T10:29:00Z",
"update_event": {
"id": "upd_evt_end_src_001",
"action_kind": "read",
"timestamp": "2026-01-15T10:29:00Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_end_src_001",
"cloud_connector": {
"id": "cc_salesforce_001",
"type": "salesforce",
"name": "Company Salesforce Integration",
"onboarding_account": "admin@company.com",
"account_id": "sf_acct_001"
}
},
"destination": {
"id": "dst_end_001abc",
"display_name": "Google Drive - Personal",
"datastore_id": "dstore_gdrive_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_external_cloud"
],
"object_type": "cloud_file",
"state": "active",
"content": {
"tags": [
"external",
"cloud"
],
"attributes": {
"file_count": 1,
"total_size": 2048576,
"upload_chunks": 2,
"retry_count": 0,
"transfer_duration_ms": 1250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"upload_method": "resumable",
"destination_folder": "/My Drive/HR Backup",
"overwrite_existing": "false"
},
"inspected": true
},
"data": {
"labels": [
"External",
"Cloud Storage"
],
"label_ids": [
"lbl_external",
"lbl_cloud_storage"
]
},
"app": {
"name": "Google Chrome",
"description": "Google Chrome Web Browser",
"package_name": "com.google.chrome",
"binary_path": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
"command_line": "chrome.exe --profile-directory=Default",
"main_window_title": "Google Drive - Google Chrome",
"custom_data": {
"version": "120.0.6099.130",
"profile": "Default"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"cloud_file_id": "1abc123xyz",
"upload_session": "upload_sess_001"
},
"created_at": "2026-01-15T10:29:05Z",
"modified_at": "2026-01-15T10:29:05Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_end_dst_001",
"path": "C:\\Users\\john.doe\\Downloads\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "EXTERNAL-SHARE-01",
"path": "\\\\EXTERNAL-SHARE-01\\Public",
"custom_data": {
"share_type": "SMB",
"external_network": "true"
}
},
"email": {
"id": "email_end_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102900.002@company.com>",
"smtp_server": "smtp.gmail.com"
}
},
"email_attachment": {
"id": "attach_end_dst_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"file_size": "2048576",
"sanitized": "false"
}
},
"web": {
"url": "https://drive.google.com/file/d/1abc123xyz/view",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/uc?id=1abc123xyz&export=download",
"title": "employee_salaries_2026.xlsx - Google Drive",
"custom_data": {
"file_id": "1abc123xyz",
"sharing_status": "private"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"account_type": "personal"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_end_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123xyz/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"file_id": "1abc123xyz",
"revision_id": "rev_001",
"upload_complete": "true"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002",
"external_user_003"
],
"role": "role_editor",
"custom_data": {
"expiry_date": "2026-12-31",
"link_type": "restricted",
"notify_on_download": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4523",
"custom_data": {
"pages_printed": "12",
"color": "false"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_end_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_end_dst_001"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private",
"language": "Python",
"size_kb": "1024"
},
"branch": "main",
"id": "repo_end_dst_001"
},
"labels": [
"External",
"Cloud Storage",
"Personal Account"
],
"label_ids": [
"lbl_external",
"lbl_cloud_storage"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_cloud_upload_001",
"version": 1,
"definition_rule_ids": [
"rule_cloud_upload_block"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:29:00Z"
}
],
"issues": [
{
"id": "issue_end_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_cloud_upload_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:29:00Z"
}
],
"custom_data": {
"upload_destination": "personal_cloud",
"risk_level": "critical"
},
"outline": "Personal Google Drive account used as destination for unauthorized data upload containing HR confidential records.",
"type": "removable_media",
"domain": "drive.google.com",
"discovered_at": "2026-01-15T10:29:00Z",
"updated_at": "2026-01-15T10:29:05Z",
"update_event": {
"id": "upd_evt_end_dst_001",
"action_kind": "upload",
"timestamp": "2026-01-15T10:29:05Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_end_dst_001",
"cloud_connector": {
"id": "cc_teams_001",
"type": "teams",
"name": "Company Teams Integration",
"onboarding_account": "teams-admin@company.com",
"account_id": "teams_acct_001"
}
}
}
}
}
]
}
}
Human Readable Output
Incident inc_a1b2c3d4e5f6 updated successfully
ID Policy Severity Status Blocked Event Time Start Event ID End Event ID AI Summary inc_a1b2c3d4e5f6 HR Data Exfiltration Prevention high closed false 2026-01-15T10:28:45Z evt_start_001abc evt_end_002xyz User john.doe attempted to copy confidential HR records to a removable USB drive. The action was detected by endpoint DLP and flagged as a high-severity policy violation.
cyberhaven-event-details-get
Retrieves full details for one or more Cyberhaven events by ID.
Base Command
cyberhaven-event-details-get
Input
| Argument Name | Description | Required |
|---|---|---|
| event_ids | A comma-separated list of event UUIDs to get the events. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Cyberhaven.Event.id | String | The unique identifier of the event. |
| Cyberhaven.Event.timestamp | Date | The timestamp when the event occurred. |
| Cyberhaven.Event.action.kind | String | The kind of action performed (e.g. copy, upload). |
| Cyberhaven.Event.action.blocked | Boolean | Whether the action was blocked by policy. |
| Cyberhaven.Event.action.data_size | Number | The size of data involved in the action (bytes). |
| Cyberhaven.Event.action.content.tags | String | The content classification tags detected in the action. |
| Cyberhaven.Event.action.content.attributes | String | The content attributes of the action. |
| Cyberhaven.Event.action.content.upload_filename | String | The filename of the content being uploaded in the action. |
| Cyberhaven.Event.action.content.inspected | Boolean | Whether the content was inspected in the action. |
| Cyberhaven.Event.action.sensor_kind | String | The sensor type that detected the action (e.g. endpoint). |
| Cyberhaven.Event.action.hostname | String | The hostname of the machine where the action occurred. |
| Cyberhaven.Event.action.machine_serial_number | String | The serial number of the machine where the action occurred. |
| Cyberhaven.Event.action.ip_address | String | The IP address of the machine where the action occurred. |
| Cyberhaven.Event.action.device_type | String | The device management type (e.g. managed). |
| Cyberhaven.Event.action.temporary_blocked | Boolean | Whether the action was temporarily blocked. |
| Cyberhaven.Event.action.fail_close_statuses | String | The list of fail-close status objects for the action. |
| Cyberhaven.Event.action.process_id | Number | The process ID of the process that triggered the action. |
| Cyberhaven.Event.action.parent_process_id | Number | The parent process ID of the process that triggered the action. |
| Cyberhaven.Event.user.id | String | The identifier of the user who triggered the event. |
| Cyberhaven.Event.user.local_username | String | The local machine username of the user who triggered the event. |
| Cyberhaven.Event.user.local_id | String | The local identifier of the user who triggered the event. |
| Cyberhaven.Event.source.id | String | The ID of the object. |
| Cyberhaven.Event.source.display_name | String | The display name of the object. |
| Cyberhaven.Event.source.datastore_id | String | The datastore ID associated with the object. |
| Cyberhaven.Event.source.dataset_sensitivity | String | The sensitivity classification of the dataset. |
| Cyberhaven.Event.source.dataset_ids | String | The list of dataset IDs associated with the object. |
| Cyberhaven.Event.source.object_type | String | The object type (e.g. file, removable_storage). |
| Cyberhaven.Event.source.state | String | The state of the object (e.g. active). |
| Cyberhaven.Event.source.content.tags | String | The content classification tags. |
| Cyberhaven.Event.source.content.attributes | String | The content attributes. |
| Cyberhaven.Event.source.content.upload_filename | String | The upload filename of the content. |
| Cyberhaven.Event.source.content.inspected | Boolean | Whether the content was inspected. |
| Cyberhaven.Event.source.data.labels | String | The data classification labels. |
| Cyberhaven.Event.source.data.label_ids | String | The data classification label IDs. |
| Cyberhaven.Event.source.app.name | String | The name of the associated application. |
| Cyberhaven.Event.source.app.description | String | The description of the associated application. |
| Cyberhaven.Event.source.app.package_name | String | The package name of the associated application. |
| Cyberhaven.Event.source.app.binary_path | String | The binary path of the associated application. |
| Cyberhaven.Event.source.app.command_line | String | The command line of the associated application. |
| Cyberhaven.Event.source.app.main_window_title | String | The main window title of the associated application. |
| Cyberhaven.Event.source.file.name | String | The file name. |
| Cyberhaven.Event.source.file.extension | String | The file extension. |
| Cyberhaven.Event.source.file.size | Number | The file size (bytes). |
| Cyberhaven.Event.source.file.md5_hash | String | The MD5 hash of the file. |
| Cyberhaven.Event.source.file.sha256_hash | String | The SHA-256 hash of the file. |
| Cyberhaven.Event.source.file.created_at | Date | The creation timestamp of the file. |
| Cyberhaven.Event.source.file.modified_at | Date | The last modification timestamp of the file. |
| Cyberhaven.Event.source.file.owner.name | String | The name of the file owner. |
| Cyberhaven.Event.source.file.owner.id | String | The ID of the file owner. |
| Cyberhaven.Event.source.local_file.id | String | The local file ID. |
| Cyberhaven.Event.source.local_file.path | String | The local file system path. |
| Cyberhaven.Event.source.network_share.hostname | String | The hostname of the network share. |
| Cyberhaven.Event.source.network_share.path | String | The path of the network share. |
| Cyberhaven.Event.source.email.id | String | The ID of the email. |
| Cyberhaven.Event.source.email.from | String | The sender of the email. |
| Cyberhaven.Event.source.email.to | String | The recipients of the email. |
| Cyberhaven.Event.source.email.cc | String | The CC recipients of the email. |
| Cyberhaven.Event.source.email.bcc | String | The BCC recipients of the email. |
| Cyberhaven.Event.source.email.subject | String | The subject of the email. |
| Cyberhaven.Event.source.email_attachment.id | String | The ID of the email attachment. |
| Cyberhaven.Event.source.web.url | String | The URL of the web endpoint. |
| Cyberhaven.Event.source.web.domain | String | The domain of the web endpoint. |
| Cyberhaven.Event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage). |
| Cyberhaven.Event.source.web.download_url | String | The download URL of the web endpoint. |
| Cyberhaven.Event.source.web.title | String | The page title of the web endpoint. |
| Cyberhaven.Event.source.web.user_agent | String | The user-agent string of the web endpoint. |
| Cyberhaven.Event.source.cloud_app.provider | String | The cloud provider (e.g. google). |
| Cyberhaven.Event.source.cloud_app.name | String | The name of the cloud application. |
| Cyberhaven.Event.source.cloud_app.user_name | String | The username in the cloud application. |
| Cyberhaven.Event.source.cloud_app.user_email | String | The user email in the cloud application. |
| Cyberhaven.Event.source.cloud_app.instance_id | String | The instance ID of the cloud application. |
| Cyberhaven.Event.source.cloud_app.instance_name | String | The instance name of the cloud application. |
| Cyberhaven.Event.source.cloud_file.id | String | The ID of the cloud file. |
| Cyberhaven.Event.source.cloud_file.content_uri | String | The content URI of the cloud file. |
| Cyberhaven.Event.source.cloud_file.path | String | The path of the cloud file. |
| Cyberhaven.Event.source.cloud_share_recipient.scope | String | The sharing scope. |
| Cyberhaven.Event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share. |
| Cyberhaven.Event.source.cloud_share_recipient.role | String | The role of the cloud share recipient. |
| Cyberhaven.Event.source.printer.name | String | The name of the printer. |
| Cyberhaven.Event.source.printer.description | String | The description of the printer. |
| Cyberhaven.Event.source.printer.physical_location | String | The physical location of the printer. |
| Cyberhaven.Event.source.printer.server | String | The print server hostname. |
| Cyberhaven.Event.source.printer.share_name | String | The share name of the printer. |
| Cyberhaven.Event.source.printer.port | String | The port of the printer. |
| Cyberhaven.Event.source.printer.driver | String | The driver name of the printer. |
| Cyberhaven.Event.source.printer.is_local | Boolean | Whether the printer is local. |
| Cyberhaven.Event.source.printer.job_id | String | The print job ID. |
| Cyberhaven.Event.source.printer.connectivity | String | The connectivity type of the printer. |
| Cyberhaven.Event.source.removable_storage.id | String | The ID of the removable storage device. |
| Cyberhaven.Event.source.removable_storage.name | String | The name of the removable storage device. |
| Cyberhaven.Event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage. |
| Cyberhaven.Event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage. |
| Cyberhaven.Event.source.removable_storage.product_id | String | The USB product ID of the removable storage. |
| Cyberhaven.Event.source.im_message.sender | String | The sender of the IM message. |
| Cyberhaven.Event.source.im_message.recipient_users | String | The recipient users of the IM message. |
| Cyberhaven.Event.source.im_message.recipient_groups | String | The recipient groups of the IM message. |
| Cyberhaven.Event.source.im_message.domain | String | The domain of the IM message. |
| Cyberhaven.Event.source.im_message.workspace | String | The workspace of the IM message. |
| Cyberhaven.Event.source.source_code_repo.organization | String | The organization of the source code repository. |
| Cyberhaven.Event.source.source_code_repo.name | String | The name of the source code repository. |
| Cyberhaven.Event.source.source_code_repo.branch | String | The branch of the source code repository. |
| Cyberhaven.Event.source.source_code_repo.id | String | The ID of the source code repository. |
| Cyberhaven.Event.source.labels | String | The labels applied to the object. |
| Cyberhaven.Event.source.label_ids | String | The label IDs applied to the object. |
| Cyberhaven.Event.source.matched_policies | String | The list of DLP policies matched by the object. |
| Cyberhaven.Event.source.issues | String | The list of DLP issues detected on the object. |
| Cyberhaven.Event.source.outline | String | The outline description of the object. |
| Cyberhaven.Event.source.type | String | The endpoint type (e.g. endpoint, removable_media). |
| Cyberhaven.Event.source.domain | String | The domain of the object. |
| Cyberhaven.Event.source.discovered_at | Date | The timestamp when the object was first discovered. |
| Cyberhaven.Event.source.updated_at | Date | The timestamp when the object was last updated. |
| Cyberhaven.Event.source.update_event.id | String | The ID of the update event. |
| Cyberhaven.Event.source.update_event.action_kind | String | The action kind of the update event. |
| Cyberhaven.Event.source.update_event.timestamp | Date | The timestamp of the update event. |
| Cyberhaven.Event.source.update_event.user.id | String | The user ID in the update event. |
| Cyberhaven.Event.source.update_event.user.local_username | String | The local username in the update event. |
| Cyberhaven.Event.source.update_event.user.local_id | String | The local ID in the update event. |
| Cyberhaven.Event.source.version_id | String | The version ID of the object. |
| Cyberhaven.Event.source.cloud_connector.id | String | The ID of the cloud connector. |
| Cyberhaven.Event.source.cloud_connector.type | String | The type of cloud connector. |
| Cyberhaven.Event.source.cloud_connector.name | String | The name of the cloud connector. |
| Cyberhaven.Event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector. |
| Cyberhaven.Event.source.cloud_connector.account_id | String | The account ID of the cloud connector. |
| Cyberhaven.Event.destination.id | String | The ID of the object. |
| Cyberhaven.Event.destination.display_name | String | The display name of the object. |
| Cyberhaven.Event.destination.datastore_id | String | The datastore ID associated with the object. |
| Cyberhaven.Event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset. |
| Cyberhaven.Event.destination.dataset_ids | String | The list of dataset IDs associated with the object. |
| Cyberhaven.Event.destination.object_type | String | The object type (e.g. file, removable_storage). |
| Cyberhaven.Event.destination.state | String | The state of the object (e.g. active). |
| Cyberhaven.Event.destination.content.tags | String | The content classification tags. |
| Cyberhaven.Event.destination.content.attributes | String | The content attributes. |
| Cyberhaven.Event.destination.content.upload_filename | String | The upload filename of the content. |
| Cyberhaven.Event.destination.content.inspected | Boolean | Whether the content was inspected. |
| Cyberhaven.Event.destination.data.labels | String | The data classification labels. |
| Cyberhaven.Event.destination.data.label_ids | String | The data classification label IDs. |
| Cyberhaven.Event.destination.app.name | String | The name of the associated application. |
| Cyberhaven.Event.destination.app.description | String | The description of the associated application. |
| Cyberhaven.Event.destination.app.package_name | String | The package name of the associated application. |
| Cyberhaven.Event.destination.app.binary_path | String | The binary path of the associated application. |
| Cyberhaven.Event.destination.app.command_line | String | The command line of the associated application. |
| Cyberhaven.Event.destination.app.main_window_title | String | The main window title of the associated application. |
| Cyberhaven.Event.destination.file.name | String | The file name. |
| Cyberhaven.Event.destination.file.extension | String | The file extension. |
| Cyberhaven.Event.destination.file.size | Number | The file size (bytes). |
| Cyberhaven.Event.destination.file.md5_hash | String | The MD5 hash of the file. |
| Cyberhaven.Event.destination.file.sha256_hash | String | The SHA-256 hash of the file. |
| Cyberhaven.Event.destination.file.created_at | Date | The creation timestamp of the file. |
| Cyberhaven.Event.destination.file.modified_at | Date | The last modification timestamp of the file. |
| Cyberhaven.Event.destination.file.owner.name | String | The name of the file owner. |
| Cyberhaven.Event.destination.file.owner.id | String | The ID of the file owner. |
| Cyberhaven.Event.destination.local_file.id | String | The local file ID. |
| Cyberhaven.Event.destination.local_file.path | String | The local file system path. |
| Cyberhaven.Event.destination.network_share.hostname | String | The hostname of the network share. |
| Cyberhaven.Event.destination.network_share.path | String | The path of the network share. |
| Cyberhaven.Event.destination.email.id | String | The ID of the email. |
| Cyberhaven.Event.destination.email.from | String | The sender of the email. |
| Cyberhaven.Event.destination.email.to | String | The recipients of the email. |
| Cyberhaven.Event.destination.email.cc | String | The CC recipients of the email. |
| Cyberhaven.Event.destination.email.bcc | String | The BCC recipients of the email. |
| Cyberhaven.Event.destination.email.subject | String | The subject of the email. |
| Cyberhaven.Event.destination.email_attachment.id | String | The ID of the email attachment. |
| Cyberhaven.Event.destination.web.url | String | The URL of the web endpoint. |
| Cyberhaven.Event.destination.web.domain | String | The domain of the web endpoint. |
| Cyberhaven.Event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage). |
| Cyberhaven.Event.destination.web.download_url | String | The download URL of the web endpoint. |
| Cyberhaven.Event.destination.web.title | String | The page title of the web endpoint. |
| Cyberhaven.Event.destination.web.user_agent | String | The user-agent string of the web endpoint. |
| Cyberhaven.Event.destination.cloud_app.provider | String | The cloud provider (e.g. google). |
| Cyberhaven.Event.destination.cloud_app.name | String | The name of the cloud application. |
| Cyberhaven.Event.destination.cloud_app.user_name | String | The username in the cloud application. |
| Cyberhaven.Event.destination.cloud_app.user_email | String | The user email in the cloud application. |
| Cyberhaven.Event.destination.cloud_app.instance_id | String | The instance ID of the cloud application. |
| Cyberhaven.Event.destination.cloud_app.instance_name | String | The instance name of the cloud application. |
| Cyberhaven.Event.destination.cloud_file.id | String | The ID of the cloud file. |
| Cyberhaven.Event.destination.cloud_file.content_uri | String | The content URI of the cloud file. |
| Cyberhaven.Event.destination.cloud_file.path | String | The path of the cloud file. |
| Cyberhaven.Event.destination.cloud_share_recipient.scope | String | The sharing scope. |
| Cyberhaven.Event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share. |
| Cyberhaven.Event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient. |
| Cyberhaven.Event.destination.printer.name | String | The name of the printer. |
| Cyberhaven.Event.destination.printer.description | String | The description of the printer. |
| Cyberhaven.Event.destination.printer.physical_location | String | The physical location of the printer. |
| Cyberhaven.Event.destination.printer.server | String | The print server hostname. |
| Cyberhaven.Event.destination.printer.share_name | String | The share name of the printer. |
| Cyberhaven.Event.destination.printer.port | String | The port of the printer. |
| Cyberhaven.Event.destination.printer.driver | String | The driver name of the printer. |
| Cyberhaven.Event.destination.printer.is_local | Boolean | Whether the printer is local. |
| Cyberhaven.Event.destination.printer.job_id | String | The print job ID. |
| Cyberhaven.Event.destination.printer.connectivity | String | The connectivity type of the printer. |
| Cyberhaven.Event.destination.removable_storage.id | String | The ID of the removable storage device. |
| Cyberhaven.Event.destination.removable_storage.name | String | The name of the removable storage device. |
| Cyberhaven.Event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage. |
| Cyberhaven.Event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage. |
| Cyberhaven.Event.destination.removable_storage.product_id | String | The USB product ID of the removable storage. |
| Cyberhaven.Event.destination.im_message.sender | String | The sender of the IM message. |
| Cyberhaven.Event.destination.im_message.recipient_users | String | The recipient users of the IM message. |
| Cyberhaven.Event.destination.im_message.recipient_groups | String | The recipient groups of the IM message. |
| Cyberhaven.Event.destination.im_message.domain | String | The domain of the IM message. |
| Cyberhaven.Event.destination.im_message.workspace | String | The workspace of the IM message. |
| Cyberhaven.Event.destination.source_code_repo.organization | String | The organization of the source code repository. |
| Cyberhaven.Event.destination.source_code_repo.name | String | The name of the source code repository. |
| Cyberhaven.Event.destination.source_code_repo.branch | String | The branch of the source code repository. |
| Cyberhaven.Event.destination.source_code_repo.id | String | The ID of the source code repository. |
| Cyberhaven.Event.destination.labels | String | The labels applied to the object. |
| Cyberhaven.Event.destination.label_ids | String | The label IDs applied to the object. |
| Cyberhaven.Event.destination.matched_policies | String | The list of DLP policies matched by the object. |
| Cyberhaven.Event.destination.issues | String | The list of DLP issues detected on the object. |
| Cyberhaven.Event.destination.outline | String | The outline description of the object. |
| Cyberhaven.Event.destination.type | String | The endpoint type (e.g. endpoint, removable_media). |
| Cyberhaven.Event.destination.domain | String | The domain of the object. |
| Cyberhaven.Event.destination.discovered_at | Date | The timestamp when the object was first discovered. |
| Cyberhaven.Event.destination.updated_at | Date | The timestamp when the object was last updated. |
| Cyberhaven.Event.destination.update_event.id | String | The ID of the update event. |
| Cyberhaven.Event.destination.update_event.action_kind | String | The action kind of the update event. |
| Cyberhaven.Event.destination.update_event.timestamp | Date | The timestamp of the update event. |
| Cyberhaven.Event.destination.update_event.user.id | String | The user ID in the update event. |
| Cyberhaven.Event.destination.update_event.user.local_username | String | The local username in the update event. |
| Cyberhaven.Event.destination.update_event.user.local_id | String | The local ID in the update event. |
| Cyberhaven.Event.destination.version_id | String | The version ID of the object. |
| Cyberhaven.Event.destination.cloud_connector.id | String | The ID of the cloud connector. |
| Cyberhaven.Event.destination.cloud_connector.type | String | The type of cloud connector. |
| Cyberhaven.Event.destination.cloud_connector.name | String | The name of the cloud connector. |
| Cyberhaven.Event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector. |
| Cyberhaven.Event.destination.cloud_connector.account_id | String | The account ID of the cloud connector. |
Command example
!cyberhaven-event-details-get event_ids="evt_start_001abc"
Context Example
{
"Cyberhaven": {
"Event": [
{
"id": "evt_start_001abc",
"timestamp": "2026-01-15T10:28:45Z",
"action": {
"kind": "copy",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500,
"page_count": 3,
"record_count": 250,
"sensitivity_score": 95
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
},
"source": {
"id": "src_local_001abc",
"display_name": "employee_salaries_2026.xlsx",
"datastore_id": "dstore_endpoint_01",
"dataset_sensitivity": "sensitivity_high",
"dataset_ids": [
"ds_hr_confidential"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"classification": "confidential",
"last_scan": "2026-01-10T09:00:00Z",
"scan_result": "contains_pii",
"owner_department": "HR"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential",
"HR Data"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Microsoft Excel",
"description": "Microsoft Office Spreadsheet Application",
"package_name": "com.microsoft.excel",
"binary_path": "C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE",
"command_line": "\"EXCEL.EXE\" /e",
"main_window_title": "employee_salaries_2026.xlsx - Excel",
"custom_data": {
"version": "16.0.17126.20132",
"publisher": "Microsoft Corporation",
"signed": "true",
"install_date": "2023-06-01"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"creator": "john.doe",
"last_modified_by": "jane.smith",
"revision": "3"
},
"created_at": "2026-01-10T09:00:00Z",
"modified_at": "2026-01-15T08:30:00Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_001abc",
"path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB",
"mount_point": "Z:"
}
},
"email": {
"id": "email_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>"
}
},
"email_attachment": {
"id": "attach_src_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload",
"custom_data": {
"referrer": "https://drive.google.com/"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Data/employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"revision_id": "rev_001"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_001abc",
"platform": "teams"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_001"
},
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection",
"rule_confidential_data"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:28:45Z"
}
],
"issues": [
{
"id": "issue_001abc",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:45Z"
}
],
"custom_data": {
"data_classification": "confidential"
},
"outline": "Spreadsheet containing employee salary and compensation data for 250 employees in the Engineering department.",
"type": "website",
"domain": "company.com",
"discovered_at": "2026-01-10T09:00:00Z",
"updated_at": "2026-01-15T10:28:45Z",
"update_event": {
"id": "upd_evt_001",
"action_kind": "read",
"timestamp": "2026-01-15T10:28:45Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001",
"ad_group": "Domain Users"
}
}
},
"version_id": "ver_001abc",
"cloud_connector": {
"id": "cc_snowflake_001",
"type": "snowflake",
"name": "Company Snowflake Integration",
"onboarding_account": "snowflake-admin@company.com",
"account_id": "sf_snowflake_001"
}
},
"destination": {
"id": "dst_usb_001abc",
"display_name": "SanDisk Ultra 64GB (E:)",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "removable_storage",
"state": "active",
"content": {
"tags": [
"external",
"removable"
],
"attributes": {
"file_count": 1
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"destination_path": "E:\\Backup\\HR",
"overwrite": "false"
},
"inspected": true
},
"data": {
"labels": [
"External Storage",
"Removable Media"
],
"label_ids": [
"lbl_external_storage",
"lbl_removable_media"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe /select,\"E:\\Backup\\HR\\employee_salaries_2026.xlsx\"",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1",
"elevated": "false"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"destination_created": "true",
"is_copy": "true"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_dst_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\Backup\\HR",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>"
}
},
"email_attachment": {
"id": "attach_dst_001",
"custom_data": {
"attachment_index": "0"
}
},
"web": {
"url": "https://drive.google.com/upload/resumable",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload Complete",
"custom_data": {
"upload_session_id": "upload_sess_001"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"upload_complete": "true"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"upload_timestamp": "2026-01-15T10:29:00Z",
"file_id": "1abc123xyz",
"revision_id": "rev_001"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"drive_letter": "E"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_dst_001"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_dst_001"
},
"labels": [
"External Storage",
"Removable Media"
],
"label_ids": [
"lbl_external_storage",
"lbl_removable_media"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_removable_001",
"version": 2,
"definition_rule_ids": [
"rule_removable_media_write"
],
"action_rule_id": "action_rule_alert",
"matched_at": "2026-01-15T10:28:50Z"
}
],
"issues": [
{
"id": "issue_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_removable_001",
"policy_action_rule_id": "action_rule_alert",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:50Z"
}
],
"custom_data": {
"endpoint_risk": "high",
"device_approved": "false",
"destination_type": "removable_media",
"risk_assessment": "critical",
"flagged_by": "dlp_engine"
},
"outline": "SanDisk USB removable storage device used as unauthorized destination for confidential HR data transfer.",
"type": "cloud_apps",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:45Z",
"updated_at": "2026-01-15T10:28:50Z",
"update_event": {
"id": "upd_evt_dst_001",
"action_kind": "write",
"timestamp": "2026-01-15T10:28:50Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001",
"ad_group": "Domain Users"
}
}
},
"version_id": "ver_dst_001",
"cloud_connector": {
"id": "cc_salesforce_001",
"type": "salesforce",
"name": "Company Salesforce Integration",
"onboarding_account": "admin@company.com",
"account_id": "sf_acct_001"
}
}
}
]
}
}
Human Readable Output
Cyberhaven Event Details
ID Time User Action Source Destination evt_start_001abc 2026-01-15T10:28:45Z id: usr_john_doe_001
local_username: john.doe
local_id: S-1-5-21-3623811015-3361044348-030300820-1013
custom_data:
session_id: sess_20260115_001kind: copy
blocked: false
data_size: 2048576
content:
tags:
values: pii, confidential
attributes:
word_count: 1500
page_count: 3
record_count: 250
sensitivity_score: 95
upload_filename: employee_salaries_2026.xlsx
custom_data:
mime_type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
inspected: true
sensor_kind: endpoint
hostname: WORKSTATION-NYC-042
machine_serial_number: C02XK1JFHV2R
custom_data:
os_version: Windows 11 22H2
ip_address: 192.168.1.100
device_type: managed
temporary_blocked: false
fail_close_statuses:
- temporary_blocked: false
dlp_api_status: SUCCESS
dlp_precondition: DLP_PRECONDITION_MET
action_status: ACTION_STATUS_COMPLETED
process_id: 4821
parent_process_id: 1024id: src_local_001abc
display_name: employee_salaries_2026.xlsx
datastore_id: dstore_endpoint_01
dataset_sensitivity: sensitivity_high
dataset_ids:
values: ds_hr_confidential
object_type: file
state: active
content:
tags:
values: pii, confidential
attributes:
record_count: 250
upload_filename: employee_salaries_2026.xlsx
custom_data:
classification: confidential
last_scan: 2026-01-10T09:00:00Z
scan_result: contains_pii
owner_department: HR
inspected: true
data:
labels:
values: PII, Confidential, HR Data
label_ids:
values: lbl_pii, lbl_confidential
app:
name: Microsoft Excel
description: Microsoft Office Spreadsheet Application
package_name: com.microsoft.excel
binary_path: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
command_line: “EXCEL.EXE” /e
main_window_title: employee_salaries_2026.xlsx - Excel
custom_data:
version: 16.0.17126.20132
publisher: Microsoft Corporation
signed: true
install_date: 2023-06-01
file:
name: employee_salaries_2026.xlsx
extension: xlsx
size: 2048576
md5_hash: d41d8cd98f00b204e9800998ecf8427e
sha256_hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
custom_data:
creator: john.doe
last_modified_by: jane.smith
revision: 3
created_at: 2026-01-10T09:00:00Z
modified_at: 2026-01-15T08:30:00Z
owner:
name: john.doe
id: usr_john_doe_001
local_file:
id: lf_001abc
path: C:\Users\john.doe\Documents\HR\employee_salaries_2026.xlsx
network_share:
hostname: FILESERVER-01
path: \FILESERVER-01\HR\Compensation
custom_data:
share_type: SMB
mount_point: Z:
email:
id: email_src_001
from: john.doe@company.com
to:
values: personal@gmail.com
cc:
values: backup@gmail.com
bcc:
values: archive@gmail.com
subject: Salary Data Backup
custom_data:
message_id: 20260115102845.001@company.com
email_attachment:
id: attach_src_001
custom_data:
attachment_index: 0
content_type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
web:
url: https://drive.google.com/upload
domain: drive.google.com
category: cloud_storage
download_url: https://drive.google.com/file/d/1abc123/view
title: Google Drive - Upload
custom_data:
referrer: https://drive.google.com/
user_agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
cloud_app:
provider: google
name: google_drive
user_name: john.doe
user_email: john.doe@personal.com
custom_data:
tenant_id: tenant_google_001
app_version: 2026.1
instance_id: gdrive_inst_001
instance_name: Personal Google Drive
cloud_file:
id: cf_src_001
content_uri: https://drive.google.com/file/d/1abc123/content
path: /My Drive/HR Data/employee_salaries_2026.xlsx
custom_data:
mime_type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
revision_id: rev_001
cloud_share_recipient:
scope: share_external
user_ids:
values: external_user_001
role: role_viewer
custom_data:
expiry_date: 2026-12-31
printer:
name: HP LaserJet Pro M404n
description: Office Laser Printer - Floor 3
physical_location: 3rd Floor Copy Room
server: PRINTSERVER-01
share_name: HP-LaserJet-3F
port: IP_192.168.1.200
driver: HP LaserJet Pro M404n PCL 6
is_local: false
job_id: print_job_4521
custom_data:
pages_printed: 12
connectivity: network
removable_storage:
id: usb_src_001
name: SanDisk Ultra 64GB
usb_id: usb_0781_5581
vendor_id: 0781
product_id: 5581
custom_data:
serial_number: 4C530001041120115283
im_message:
sender: john.doe@company.com
recipient_users:
values: personal.contact@gmail.com
recipient_groups:
values: external-group-001
domain: teams.microsoft.com
workspace: Personal Chat
custom_data:
message_id: msg_001abc
platform: teams
source_code_repo:
organization: company-org
name: hr-data-scripts
custom_data:
visibility: private
branch: main
id: repo_001
labels:
values: PII, Confidential
label_ids:
values: lbl_pii, lbl_confidential
matched_policies:
- policy_type: dlp
id: pol_dlp_hr_001
version: 3
definition_rule_ids:
values: rule_pii_detection, rule_confidential_data
action_rule_id: action_rule_block
matched_at: 2026-01-15T10:28:45Z
issues:
- id: issue_001abc
policy_type: dlp
matched_policy_id: pol_dlp_hr_001
policy_action_rule_id: action_rule_block
severity: issue_severity_high
detected_at: 2026-01-15T10:28:45Z
custom_data:
data_classification: confidential
outline: Spreadsheet containing employee salary and compensation data for 250 employees in the Engineering department.
type: website
domain: company.com
discovered_at: 2026-01-10T09:00:00Z
updated_at: 2026-01-15T10:28:45Z
update_event:
id: upd_evt_001
action_kind: read
timestamp: 2026-01-15T10:28:45Z
user:
id: usr_john_doe_001
local_username: john.doe
local_id: S-1-5-21-3623811015-3361044348-030300820-1013
custom_data:
session_id: sess_20260115_001
ad_group: Domain Users
version_id: ver_001abc
cloud_connector:
id: cc_snowflake_001
type: snowflake
name: Company Snowflake Integration
onboarding_account: snowflake-admin@company.com
account_id: sf_snowflake_001id: dst_usb_001abc
display_name: SanDisk Ultra 64GB (E:)
datastore_id: dstore_usb_01
dataset_sensitivity: sensitivity_unspecified
dataset_ids:
values: ds_removable_default
object_type: removable_storage
state: active
content:
tags:
values: external, removable
attributes:
file_count: 1
upload_filename: employee_salaries_2026.xlsx
custom_data:
destination_path: E:\Backup\HR
overwrite: false
inspected: true
data:
labels:
values: External Storage, Removable Media
label_ids:
values: lbl_external_storage, lbl_removable_media
app:
name: Windows Explorer
description: Windows File Explorer
package_name: com.microsoft.explorer
binary_path: C:\Windows\explorer.exe
command_line: explorer.exe /select,”E:\Backup\HR\employee_salaries_2026.xlsx”
main_window_title: E:\Backup\HR
custom_data:
version: 10.0.22621.1
elevated: false
file:
name: employee_salaries_2026.xlsx
extension: xlsx
size: 2048576
md5_hash: d41d8cd98f00b204e9800998ecf8427e
sha256_hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
custom_data:
destination_created: true
is_copy: true
created_at: 2026-01-15T10:28:50Z
modified_at: 2026-01-15T10:28:50Z
owner:
name: john.doe
id: usr_john_doe_001
local_file:
id: lf_dst_001
path: E:\Backup\HR\employee_salaries_2026.xlsx
network_share:
hostname: FILESERVER-01
path: \FILESERVER-01\Backup\HR
custom_data:
share_type: SMB
email:
id: email_dst_001
from: john.doe@company.com
to:
values: personal@gmail.com
cc:
values: backup@gmail.com
bcc:
values: archive@gmail.com
subject: Salary Data Backup
custom_data:
message_id: 20260115102845.001@company.com
email_attachment:
id: attach_dst_001
custom_data:
attachment_index: 0
web:
url: https://drive.google.com/upload/resumable
domain: drive.google.com
category: cloud_storage
download_url: https://drive.google.com/file/d/1abc123/view
title: Google Drive - Upload Complete
custom_data:
upload_session_id: upload_sess_001
user_agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
cloud_app:
provider: google
name: google_drive
user_name: john.doe
user_email: john.doe@personal.com
custom_data:
upload_complete: true
instance_id: gdrive_inst_001
instance_name: Personal Google Drive
cloud_file:
id: cf_dst_001
content_uri: https://drive.google.com/file/d/1abc123/content
path: /My Drive/HR Backup/employee_salaries_2026.xlsx
custom_data:
upload_timestamp: 2026-01-15T10:29:00Z
file_id: 1abc123xyz
revision_id: rev_001
cloud_share_recipient:
scope: share_external
user_ids:
values: external_user_001, external_user_002
role: role_viewer
custom_data:
expiry_date: 2026-12-31
notify_on_access: true
printer:
name: HP LaserJet Pro M404n
description: Office Laser Printer - Floor 3
physical_location: 3rd Floor Copy Room
server: PRINTSERVER-01
share_name: HP-LaserJet-3F
port: IP_192.168.1.200
driver: HP LaserJet Pro M404n PCL 6
is_local: false
job_id: print_job_4521
custom_data:
pages_printed: 12
connectivity: network
removable_storage:
id: usb_dst_001
name: SanDisk Ultra 64GB
usb_id: usb_0781_5581
vendor_id: 0781
product_id: 5581
custom_data:
serial_number: 4C530001041120115283
drive_letter: E
im_message:
sender: john.doe@company.com
recipient_users:
values: personal.contact@gmail.com
recipient_groups:
values: external-group-001
domain: teams.microsoft.com
workspace: Personal Chat
custom_data:
message_id: msg_dst_001
source_code_repo:
organization: personal-org
name: personal-backup-repo
custom_data:
visibility: private
branch: main
id: repo_dst_001
labels:
values: External Storage, Removable Media
label_ids:
values: lbl_external_storage, lbl_removable_media
matched_policies:
- policy_type: dlp
id: pol_dlp_removable_001
version: 2
definition_rule_ids:
values: rule_removable_media_write
action_rule_id: action_rule_alert
matched_at: 2026-01-15T10:28:50Z
issues:
- id: issue_dst_001
policy_type: dlp
matched_policy_id: pol_dlp_removable_001
policy_action_rule_id: action_rule_alert
severity: issue_severity_high
detected_at: 2026-01-15T10:28:50Z
custom_data:
endpoint_risk: high
device_approved: false
destination_type: removable_media
risk_assessment: critical
flagged_by: dlp_engine
outline: SanDisk USB removable storage device used as unauthorized destination for confidential HR data transfer.
type: cloud_apps
domain: company.com
discovered_at: 2026-01-15T10:28:45Z
updated_at: 2026-01-15T10:28:50Z
update_event:
id: upd_evt_dst_001
action_kind: write
timestamp: 2026-01-15T10:28:50Z
user:
id: usr_john_doe_001
local_username: john.doe
local_id: S-1-5-21-3623811015-3361044348-030300820-1013
custom_data:
session_id: sess_20260115_001
ad_group: Domain Users
version_id: ver_dst_001
cloud_connector:
id: cc_salesforce_001
type: salesforce
name: Company Salesforce Integration
onboarding_account: admin@company.com
account_id: sf_acct_001
cyberhaven-event-lineage-get
Retrieves the data lineage chain between two Cyberhaven event IDs.
Base Command
cyberhaven-event-lineage-get
Input
| Argument Name | Description | Required |
|---|---|---|
| start_event_id | Provide the UUID of the first event in the chain. | Required |
| end_event_id | Provide the UUID of the last event in the chain. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Cyberhaven.EventLineage.resources | String | The list of events ID in order. |
Command example
!cyberhaven-event-lineage-get start_event_id="evt-001" end_event_id="evt-003"
Context Example
{
"Cyberhaven": {
"EventLineage": [
{
"resources": [
"evt-001",
"evt-002",
"evt-003"
]
}
]
}
}
Human Readable Output
Event Lineage: evt-001 to evt-003
Number ID 1 evt-001 2 evt-002 3 evt-003
Troubleshoot
Getting a Connection Error
Summary:
While running Test Connectivity, it fails with an error message similar to:
Failed to execute test-module command. Error: Verify that the server URL parameter is correct and that you have access to the server from your host.
Troubleshooting:
- Verify the Server URL field is correctly formatted (e.g.,
https://example.cyberhaven.io) with no trailing slash. - Confirm XSOAR can reach the Cyberhaven tenant host from your network.
- If a proxy is in use, verify the proxy is configured correctly and enable the Use system proxy settings option in the integration configuration.
Invalid or Expired Refresh Token (401 Unauthorized)
Summary:
While running Test Connectivity or executing a command, the following error appears:
Error: Status code: 401. Unauthorized request.
Troubleshooting:
- Verify the Refresh Token in the integration configuration is correct and has not expired.
- Generate a new Refresh Token from the Cyberhaven platform and update the integration configuration.
- Confirm the token has the necessary permissions to access the Cyberhaven API.
No Incidents Fetched
Summary:
The integration is configured to fetch incidents, but no incidents appear in XSOAR.
Troubleshooting:
- Confirm Fetch incidents is enabled in the integration configuration.
- Verify the Incident type is set to
Cyberhaven Incident. - Check the First fetch time value. It cannot exceed 30 days; values greater than 30 days are automatically capped to 30 days.
- Check the Status of incidents to fetch and Severity of incidents to fetch filters. If the filters are too restrictive, no matching incidents may exist in Cyberhaven during the fetch window.
- Confirm the Cyberhaven tenant has DLP incidents within the configured fetch window.
Max Fetch Limit Exceeded
Summary:
The Max Fetch parameter is set to a value greater than 200, but only 200 incidents are fetched per cycle.
Troubleshooting:
- The maximum allowed value for Max Fetch is 200. Any value greater than 200 is automatically treated as 200. Adjust your expectations or the fetch interval accordingly.
Outgoing Mirroring Not Syncing to Cyberhaven
Summary:
Changes made in XSOAR (Status, Owner, Close Reason, Close Notes) are not reflected in Cyberhaven.
Troubleshooting:
- Confirm Enable Outgoing Mirroring (from XSOAR to Cyberhaven) is enabled in the integration configuration.
- Verify the Refresh Token has write permissions on the Cyberhaven platform.
- Only the following fields are mirrored from XSOAR to Cyberhaven: Status, Owner, Close Reason, and Close Notes. Changes to other fields are not synced.
- Check that the incident in XSOAR was created by this integration instance. Mirroring applies only to incidents fetched by Cyberhaven integration.
Execution Timeout
Summary:
A command fails due to a timeout error.
Troubleshooting:
- Use the
execution-timeoutargument to extend the command timeout (value in seconds):
| !cyberhaven-incident-list execution-timeout=120 |
| :—- |
For Any Other Errors
- Run the failing command with the
debug-mode=trueargument to generate a detailed log file:
| !<command_name> debug-mode=true Example: !cyberhaven-incident-list debug-mode=true |
| :—- |
- For fetch incident errors, run:
| !<integration_instance_name>-fetch debug-mode=true Example: !Cyberhaven_Instance_1-fetch debug-mode=true |
| :—- |
- Enable integration-level debug logging from the configuration page by setting the Log Level to
debug. Logs are written to/var/log/demisto/Integration-Instance.log.
Reference links:
Configuration parameters
url— Server URL (e.g., https://example.cyberhaven.io) (required)credentials— (required)isFetch— Fetch incidentsincidentType— Incident typefirst_fetch— First fetch timemax_fetch— Max Fetchstatus_filter— Status of incidents to fetchseverity_filter— Severity of incidents to fetchoutgoing_mirroring— Enable Outgoing Mirroring (from XSOAR to Cyberhaven)incidentFetchInterval— Incidents Fetch Intervalinsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (4)
-
cyberhaven-event-details-getRetrieves full details for one or more Cyberhaven events by ID.
-
cyberhaven-event-lineage-getRetrieves the data lineage chain between two Cyberhaven event IDs.
-
cyberhaven-incident-listList and search Cyberhaven DLP incidents with optional filters.
-
cyberhaven-incident-updateUpdate the status, assignment, or close reason of a Cyberhaven incident.
import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 """Cyberhaven Integration for Cortex XSOAR This integration connects Cortex XSOAR to the Cyberhaven Data Security platform. It supports fetching DLP incidents as XSOAR incidents, querying event details, and tracing data lineage for investigation. Authentication -------------- Cyberhaven uses a two-step token model: 1. A long-lived refresh token is stored in XSOAR credentials. 2. Before each API call the Client exchanges the refresh token for a short-lived access token (valid for 15 minutes). The Client caches the access token in memory and re-fetches it only when it has expired. Supported Commands ------------------ - test-module - fetch-incidents - cyberhaven-incident-list List / search incidents with optional filters - cyberhaven-incident-update Update the status, assignment, or close reason of an incident - cyberhaven-event-details-get Retrieve full details for one or more events by ID - cyberhaven-event-lineage-get Retrieve the data lineage chain between two event IDs API Reference: https://your-tenant.cyberhaven.io/public/v2/ """ import json import time import urllib3 from collections.abc import Callable from datetime import datetime, timedelta from typing import Any urllib3.disable_warnings() """ CONSTANTS """ PACK_VERSION = get_pack_version() or "1.0.0" USER_AGENT = f"XSOAR-Cyberhaven-{PACK_VERSION}" UTM_PIVOT = f"?pivot={USER_AGENT}" DATE_FORMAT = "%Y-%m-%dT%H:%M:%SZ" DEFAULT_FIRST_FETCH = "3 days" DEFAULT_SORT_ORDER = "trigger_time" MAX_INCIDENTS_TO_FETCH = 200 DEFAULT_MAX_FETCH = 100 DEFAULT_PAGE_SIZE = 25 OK_CODES = (200, 401) STATUS_CODE_TO_RETRY = [429, *(status_code for status_code in requests.status_codes._codes if status_code >= 500)] # type: ignore MAX_RETRIES = 4 BACKOFF_FACTOR = 7.5 SEVERITY_FILTER_VALUES = ("informational", "low", "medium", "high", "critical") STATUS_FILTER_VALUES = ("open", "closed") CLOSE_REASON_VALUES = ( "Resolved", "False Positive", "False Positive - Destination Not at Risk", "False Positive - User Exempt", "Other", ) CLOSE_REASON_MAPPING = { "Resolved": "valid", "False Positive": "invalid_data_mislabled", "False Positive - Destination Not at Risk": "invalid_destination_not_risk", "False Positive - User Exempt": "invalid_user_exempt", "Other": "invalid_other", } CLOSE_REASON_REVERSE_MAPPING = {v: k for k, v in CLOSE_REASON_MAPPING.items()} ERROR_MESSAGES = { "INVALID_OBJECT": "Failed to parse {} object from response: {}", "UNAUTHORIZED_REQUEST": "Unauthorized request ({}): invalid refresh token. Details: {}.", "TOKEN_GENERATION_FAILED": "Failed to generate access token using the provided refresh token.", "INVALID_MIN_VALUE": "'{}' is an invalid value for '{}'. It must be greater than or equal to {}.", "INVALID_MAX_FETCH": "'{}' is an invalid value for 'max_fetch'. It must be between 1 and {}.", "INVALID_ARGUMENT": "'{}' is an invalid value for '{}'. Value must be in {}.", "INVALID_LIST_ARGUMENT": "{} are invalid values for '{}'. Value must be in {}.", "REQUIRED_ARGUMENT": "'{}' is required and cannot be empty.", "AT_LEAST_ONE_REQUIRED": "At least one of ({}) is required to update the incident.", "REQUIRED_BOTH_ARGUMENTS": "Both '{}' and '{}' are required and cannot be empty.", "INVALID_URL": "Invalid Server URL '{}'. Server URL must end with 'cyberhaven.io'.", "FIRST_FETCH_TOO_OLD": "Invalid 'First fetch time': value cannot be more than 30 days in the past.", "REFRESH_TOKEN_REQUIRED": "Refresh Token is required.", } TOKEN_ENDPOINT = "/public/v2/auth/token/access" INCIDENTS_ENDPOINT = "/public/v2/incidents/list" INCIDENT_PATCH_ENDPOINT = "/public/v2/incidents/{id}" EVENT_DETAILS_ENDPOINT = "/public/v2/event-details" EVENT_LINEAGE_ENDPOINT = "/public/v2/event-lineage" INCIDENT_PLATFORM_LINK = "/incidents?id={id}" EVENT_LINEAGE_LINK = '/overview?origin=dashboard&s={reference}&view="reports"' SEVERITY_MAP: dict[str, float] = { "informational": IncidentSeverity.INFO, "low": IncidentSeverity.LOW, "medium": IncidentSeverity.MEDIUM, "high": IncidentSeverity.HIGH, "critical": IncidentSeverity.CRITICAL, "unspecified": IncidentSeverity.UNKNOWN, } XSOAR_STATUS_TO_CH: dict[int, str] = {IncidentStatus.ACTIVE: "open", IncidentStatus.DONE: "closed"} CREATED_BY_LABEL: dict[str, str] = { "linea_ai": "Linea AI", "linea_ai_and_policy": "Linea AI + Policy", "policy": "Policy", } WARNING_STATUS_LABEL: dict[str, str] = { "not_applicable": "Not Applicable", "pending": "Pending", "shown": "Shown", "skipped_timeout": "Skipped (timeout)", "skipped_throttled": "Skipped (throttled)", "skipped_other": "Skipped (other)", } ACTION_KIND_LABEL: dict[str, str] = { "dar_scan": "DAR Scan", "dlp_scan": "DLP Scan", } """ CLIENT CLASS """ class Client(BaseClient): """Cyberhaven API client. Wraps all HTTP calls to the Cyberhaven public API. Handles automatic access-token refresh; callers do not need to manage tokens. Args: base_url (str): Base URL of the Cyberhaven tenant, e.g. https://your-tenant.cyberhaven.io refresh_token (str): Long-lived refresh token from integration credentials. verify (bool): Whether to verify SSL certificates. proxy (bool): Whether to route requests through the system proxy. """ def __init__(self, base_url: str, refresh_token: str, verify: bool, proxy: bool): super().__init__(base_url=base_url, verify=verify, proxy=proxy, headers={"User-Agent": USER_AGENT}) self._refresh_token = refresh_token integration_context = get_integration_context() self._access_token = integration_context.get("access_token", "") self._token_expiry = integration_context.get("token_expiry", 0.0) # epoch seconds if not self._access_token or time.time() >= self._token_expiry - 60: self._access_token, self._token_expiry = self._generate_access_token() def _generate_access_token(self) -> tuple[str, float]: """Fetch a new access token if the current one is missing or expired.""" demisto.debug("Cyberhaven: generating new access token.") response = self._http_request( method="POST", url_suffix=TOKEN_ENDPOINT, json_data={"refresh_token": self._refresh_token}, retries=MAX_RETRIES, backoff_factor=BACKOFF_FACTOR, status_list_to_retry=STATUS_CODE_TO_RETRY, ok_codes=OK_CODES, raise_on_status=True, resp_type="response", ) if response.status_code == 401: try: err_msg = ERROR_MESSAGES["UNAUTHORIZED_REQUEST"].format(response.status_code, str(response.json())) except ValueError: err_msg = ERROR_MESSAGES["UNAUTHORIZED_REQUEST"].format(response.status_code, response.text) raise DemistoException(err_msg) try: access_token = response.json().get("access_token") except ValueError as e: raise DemistoException( ERROR_MESSAGES["INVALID_OBJECT"].format("json", response.content), e, response, ) if not access_token: raise DemistoException(ERROR_MESSAGES["TOKEN_GENERATION_FAILED"]) # 15-minute access_token lifetime new_expiry = time.time() + 15 * 60 set_integration_context({"access_token": access_token, "token_expiry": new_expiry}) return access_token, new_expiry def http_request( self, method: str, url_suffix: str = "", params: dict[str, Any] | None = None, data: dict[str, Any] | None = None, json_data: dict[str, Any] | None = None, response_type: str = "response", _token_refreshed: bool = False, **kwargs, ): """ Makes an authenticated HTTP request to the Cyberhaven platform. On 401 the access token is refreshed once via _generate_access_token() and the request is retried. """ headers = {**self._headers, "Authorization": f"Bearer {self._access_token}"} log_header = {**headers, "Authorization": "Bearer ***********"} demisto.debug( f"Making API request at {method} {url_suffix} with headers:{log_header}, params:{params} and body:{data or json_data}" ) res = self._http_request( method=method, url_suffix=url_suffix, headers=headers, data=data, json_data=json_data, params=params, retries=MAX_RETRIES, status_list_to_retry=STATUS_CODE_TO_RETRY, ok_codes=OK_CODES, backoff_factor=BACKOFF_FACTOR, resp_type="response", raise_on_status=True, **kwargs, ) # Refresh the token once on 401 and retry the original request. if res.status_code == 401 and not _token_refreshed: demisto.debug("Received 401 from API, generating new access token and retrying the request.") self._access_token, self._token_expiry = self._generate_access_token() return self.http_request( method=method, url_suffix=url_suffix, params=params, data=data, json_data=json_data, response_type=response_type, _token_refreshed=True, **kwargs, ) elif res.status_code == 401: try: err_msg = ERROR_MESSAGES["UNAUTHORIZED_REQUEST"].format(res.status_code, str(res.json())) except ValueError: err_msg = ERROR_MESSAGES["UNAUTHORIZED_REQUEST"].format(res.status_code, str(res)) raise DemistoException(err_msg) if response_type == "json": try: return res.json() except ValueError as e: raise DemistoException(ERROR_MESSAGES["INVALID_OBJECT"].format(response_type, res.content), e, res) return res def list_incidents( self, page_id: str = "", page_size: int = DEFAULT_PAGE_SIZE, sort_by: str = DEFAULT_SORT_ORDER, start_time: str = "", end_time: str = "", incident_ids: list[str] | None = None, policy_severities: list[str] | None = None, resolution_statuses: list[str] | None = None, assignees: list[str] | None = None, users: list[str] | None = None, include_ai_summaries: bool = True, ) -> dict[str, Any]: """Call POST /v2/incidents/list. Args: page_id (str): Opaque cursor returned by a previous call (empty for first page). page_size (int): Number of incidents per page. start_time (str): ISO-8601 datetime; only incidents at or after this time are returned. end_time (str): ISO-8601 datetime; only incidents before this time are returned. incident_ids (list[str]): Filter by incidents IDs. policy_severities (list[str]): Filter by policy severity levels. resolution_statuses (list[str]): Filter by status (e.g. ["open"]). assignees (list[str]): Filter by assigned analyst email. users (list[str]): Filter by user(s) who triggered the incident. include_ai_summaries (bool): Whether to include AI-generated summaries. Returns: dict: Raw API response containing "resources" (list of incidents) and "page_response". """ filter_body: dict[str, Any] = assign_params( start_time=start_time, end_time=end_time, policy_severities=policy_severities, resolution_statuses=resolution_statuses, assignees=assignees, users=users, incident_ids=incident_ids, ) page_request_body: dict[str, Any] = assign_params(size=page_size, id=page_id, sort_by=sort_by) body: dict[str, Any] = assign_params( page_request=page_request_body, filter=filter_body, include_ai_summaries=include_ai_summaries, ) return self.http_request( method="POST", url_suffix=INCIDENTS_ENDPOINT, json_data=body, response_type="json", ) def update_incident( self, incident_id: str, status: str | None = None, close_reason: str | None = None, close_note: str | None = None, assigned_to: str | None = None, ) -> dict[str, Any]: """Call PATCH /v2/incidents/{id}. Args: incident_id (str): The Cyberhaven incident ID to update. status (str | None): New status ("open" or "closed"). close_reason (str | None): Reason for closing (e.g. "valid", "invalid_other"). close_note (str | None): Free-text note added when closing. assigned_to (str | None): Email of the analyst to assign. Returns: dict: Raw API response. """ patch_body = assign_params( status=status, close_reason=close_reason, close_note=close_note, assigned_to=assigned_to, ) return self.http_request( method="PATCH", url_suffix=INCIDENT_PATCH_ENDPOINT.format(id=incident_id), json_data=patch_body, response_type="json", ) def get_event_details(self, event_ids: list[str]) -> dict[str, Any]: """Call POST /v2/event-details to retrieve full event records. Args: event_ids (list[str]): One or more event UUIDs. Returns: dict: Raw API response. """ return self.http_request( method="POST", url_suffix=EVENT_DETAILS_ENDPOINT, json_data={"ids": event_ids}, response_type="json", ) def get_event_lineage(self, start_event_id: str, end_event_id: str) -> dict[str, Any]: """Call POST /v2/event-lineage to retrieve the lineage chain between two events. Args: start_event_id (str): UUID of the first event in the chain. end_event_id (str): UUID of the last event in the chain. Returns: dict: Raw API response. """ return self.http_request( method="POST", url_suffix=EVENT_LINEAGE_ENDPOINT, json_data={"start_event_id": start_event_id, "end_event_id": end_event_id}, response_type="json", ) """ HELPER FUNCTIONS """ def trim_spaces_from_args(args: dict) -> dict: """Trim spaces from string values in the supplied args dict.""" for key, val in args.items(): if isinstance(val, str): args[key] = val.strip() return args def check_empty(x: Any) -> bool: """ Check if input is empty (None, empty dict, empty list, or empty string). :param x: Input to check. :type x: Any :return: True if x is empty, False otherwise. :rtype: bool """ return x is None or x == {} or x == [] or x == "" def remove_empty_elements_for_fetch(d: Any) -> Any: """ Recursively remove empty lists, empty dicts, or None elements from a dictionary or list. :param d: Input dictionary or list. :return: Dictionary or list with all empty lists, and empty dictionaries removed. """ if not isinstance(d, dict | list): return d elif isinstance(d, list): return [v for v in (remove_empty_elements_for_fetch(v) for v in d) if not check_empty(v)] return {k: v for k, v in ((k, remove_empty_elements_for_fetch(v)) for k, v in d.items()) if not check_empty(v)} def nullify_sentinels(d: Any) -> Any: """Recursively replace protobuf zero-value sentinel strings (ending with unspecified) with None.""" if isinstance(d, str): return None if d.lower().endswith("unspecified") else d if isinstance(d, list): return [nullify_sentinels(v) for v in d] if isinstance(d, dict): return {k: nullify_sentinels(v) for k, v in d.items()} return d def apply_api_labels(resource: dict) -> dict: """Replace raw API enum values with human-readable labels for display and context.""" resource = dict(resource) if "created_by" in resource: resource["created_by"] = CREATED_BY_LABEL.get(resource.get("created_by", ""), resource.get("created_by", "")) if "warning_status" in resource: resource["warning_status"] = WARNING_STATUS_LABEL.get( resource.get("warning_status", ""), resource.get("warning_status", "") ) if "close_reason" in resource: resource["close_reason"] = CLOSE_REASON_REVERSE_MAPPING.get( resource.get("close_reason", ""), resource.get("close_reason", "") ) try: start_action = demisto.get(resource, "event_details.start_event.action") if "kind" in start_action: start_action["kind"] = ACTION_KIND_LABEL.get(start_action.get("kind", ""), start_action.get("kind", "")) except (KeyError, TypeError) as exc: demisto.debug(f"apply_api_labels: could not label start_event action kind, unexpected shape: {exc}") try: end_action = demisto.get(resource, "event_details.end_event.action") if "kind" in end_action: end_action["kind"] = ACTION_KIND_LABEL.get(end_action.get("kind", ""), end_action.get("kind", "")) except (KeyError, TypeError) as exc: demisto.debug(f"apply_api_labels: could not label end_event action kind, unexpected shape: {exc}") return resource def get_mirroring() -> dict: """Return mirror direction and instance name from integration Info.""" return { "mirror_direction": "Out", "mirror_instance": demisto.integrationInstance(), } def convert_severity(severity: str) -> float: """Map a Cyberhaven policy severity string to an XSOAR severity float. Args: severity (str): Cyberhaven severity label (e.g. "high"). Returns: float: XSOAR IncidentSeverity constant. """ return SEVERITY_MAP.get(severity.lower(), IncidentSeverity.UNKNOWN) def validate_cyberhaven_url(url: str) -> None: """Raise ValueError if *url* does not end with 'cyberhaven.io'.""" from urllib.parse import urlparse host = urlparse(url).hostname or "" if host != "cyberhaven.io" and not host.endswith(".cyberhaven.io"): raise ValueError(ERROR_MESSAGES["INVALID_URL"].format(url)) def validate_incident_list_args(args: dict[str, Any]) -> dict[str, Any]: """Validate and parse arguments for cyberhaven-incident-list. Args: args (dict): Command arguments from demisto.args(). Returns: dict: Parsed and validated parameters ready for the API call. Raises: ValueError: If limit is out of range, severity values are invalid, or status values are invalid. """ limit: int = arg_to_number(args.get("limit", DEFAULT_PAGE_SIZE), arg_name="limit") # type: ignore if limit < 1: raise ValueError(ERROR_MESSAGES["INVALID_MIN_VALUE"].format(limit, "limit", 1)) start_time = "" end_time = "" if start_raw := args.get("start_time", ""): parsed = arg_to_datetime(start_raw) start_time = parsed.strftime(DATE_FORMAT) if parsed else "" if end_raw := args.get("end_time", ""): parsed = arg_to_datetime(end_raw) end_time = parsed.strftime(DATE_FORMAT) if parsed else "" severity_filter = argToList(args.get("severity", ""), transform=lambda s: s.strip().lower()) status_filter = argToList(args.get("status", ""), transform=lambda s: s.strip().lower()) invalid_severities = [s for s in severity_filter if s not in SEVERITY_FILTER_VALUES] if invalid_severities: raise ValueError( ERROR_MESSAGES["INVALID_LIST_ARGUMENT"].format( invalid_severities, "severity", f"[{', '.join(s.title() for s in SEVERITY_FILTER_VALUES)}]" ) ) invalid_statuses = [s for s in status_filter if s not in STATUS_FILTER_VALUES] if invalid_statuses: raise ValueError( ERROR_MESSAGES["INVALID_LIST_ARGUMENT"].format( invalid_statuses, "status", f"[{', '.join(s.title() for s in STATUS_FILTER_VALUES)}]" ) ) return { "limit": limit, "start_time": start_time, "end_time": end_time, "severity_filter": severity_filter, "status_filter": status_filter, "assignees": argToList(args.get("assignee", ""), transform=lambda s: s.strip()), "users": argToList(args.get("user", ""), transform=lambda s: s.strip()), "incident_ids": argToList(args.get("incident_ids", ""), transform=lambda s: s.strip()), "page_id": args.get("page_id", ""), } def validate_incident_update_args(args: dict[str, Any]) -> dict[str, Any]: """Validate and parse arguments for cyberhaven-incident-update. Args: args (dict): Command arguments from demisto.args(). Returns: dict: Parsed and validated parameters ready for the API call. Raises: ValueError: If incident_id is missing, status or close_reason are invalid, or none of the updatable fields are provided. """ incident_id = args.get("incident_id", "") if not incident_id: raise ValueError(ERROR_MESSAGES["REQUIRED_ARGUMENT"].format("incident_id")) status = args.get("status", "").lower() close_reason = args.get("close_reason", "").lower() close_note = args.get("close_note", "") assigned_to = args.get("assigned_to", "") valid_close_reason_values = [k.lower() for k in CLOSE_REASON_VALUES] if status and status not in STATUS_FILTER_VALUES: raise ValueError( ERROR_MESSAGES["INVALID_ARGUMENT"].format(status, "status", f"[{', '.join(s.title() for s in STATUS_FILTER_VALUES)}]") ) if close_reason and close_reason not in valid_close_reason_values: raise ValueError( ERROR_MESSAGES["INVALID_ARGUMENT"].format(close_reason, "close_reason", f"[{', '.join(CLOSE_REASON_VALUES)}]") ) if not status and not close_reason and not close_note and not assigned_to: raise ValueError(ERROR_MESSAGES["AT_LEAST_ONE_REQUIRED"].format("status, close_reason, close_note, assigned_to")) return { "incident_id": incident_id, "status": status, "close_reason": close_reason, "close_note": close_note, "assigned_to": assigned_to, } def validate_fetch_filters(params: dict[str, Any], is_test: bool = False) -> tuple[datetime, list[str], list[str]]: """ Validate first_fetch, severity and status filter params. Returns (first_fetch_dt, valid_severity_filter, valid_status_filter). Raises ValueError on invalid values when is_test=True. """ thirty_days_ago = datetime.utcnow() - timedelta(days=30) first_fetch_dt: datetime = arg_to_datetime(params.get("first_fetch", DEFAULT_FIRST_FETCH)) # type: ignore if first_fetch_dt and first_fetch_dt.tzinfo is not None: # type: ignore first_fetch_dt = first_fetch_dt.replace(tzinfo=None) if first_fetch_dt < thirty_days_ago: # type: ignore if is_test: raise ValueError(ERROR_MESSAGES["FIRST_FETCH_TOO_OLD"]) demisto.debug("first_fetch is older than 30 days; capping to 30 days ago.") first_fetch_dt = thirty_days_ago severity_filter: list[str] = [s.lower() for s in argToList(params.get("severity_filter", ""))] status_filter: list[str] = [s.lower() for s in argToList(params.get("status_filter", ""))] valid_severity_filter = [s for s in severity_filter if s in SEVERITY_FILTER_VALUES] invalid_severity_filter = [s for s in severity_filter if s not in SEVERITY_FILTER_VALUES] valid_status_filter = [s for s in status_filter if s in STATUS_FILTER_VALUES] invalid_status_filter = [s for s in status_filter if s not in STATUS_FILTER_VALUES] if is_test: error_list = [] if invalid_severity_filter: error_list.append( ERROR_MESSAGES["INVALID_LIST_ARGUMENT"].format( invalid_severity_filter, "Severity of incidents to fetch", f"[{', '.join(s.title() for s in SEVERITY_FILTER_VALUES)}]", ) ) if invalid_status_filter: error_list.append( ERROR_MESSAGES["INVALID_LIST_ARGUMENT"].format( invalid_status_filter, "Status of incidents to fetch", f"[{', '.join(s.title() for s in STATUS_FILTER_VALUES)}]", ) ) if error_list: raise ValueError("\n\n".join(error_list)) return first_fetch_dt, valid_severity_filter, valid_status_filter def build_incident_readable(resources: list[dict], base_url: str, title: str) -> str: """Build a War Room markdown table for a list of incident resources. Args: resources (list[dict]): Incident resource dicts from the API response. base_url (str): Integration base URL used to construct platform deep-links. title (str): Table heading displayed above the markdown table. Returns: str: Markdown-formatted table string. """ table_data = [ { "ID": f"[{r.get('id')}]({urljoin(base_url, INCIDENT_PLATFORM_LINK.format(id=r.get('id')))})", "Policy": demisto.get(r, "policy.name"), "Severity": demisto.get(r, "policy.severity"), "User": demisto.get(r, "user.email"), "Status": r.get("status", ""), "Blocked": r.get("blocked", ""), "Event Time": r.get("event_time", ""), "Start Event ID": demisto.get(r, "event_lineage_id.start_event_id"), "End Event ID": demisto.get(r, "event_lineage_id.end_event_id"), "AI Summary": r.get("ai_summary", ""), } for r in resources ] return tableToMarkdown( title, table_data, headers=[ "ID", "Policy", "Severity", "User", "Status", "Blocked", "Event Time", "Start Event ID", "End Event ID", "AI Summary", ], removeNull=True, ) """ COMMAND FUNCTIONS """ def test_module(client: Client) -> str: """Validate connectivity and credentials by fetching a single incident. Args: client (Client): Initialised Cyberhaven client. Returns: str: "ok" if the test passes; a descriptive error message otherwise. """ params = demisto.params() is_fetch = params.get("isFetch", False) try: if is_fetch: fetch_incidents(client, {}, params, is_test=True) else: client.list_incidents(page_size=1) except DemistoException as exc: msg = str(exc) if "401" in msg or "403" in msg: return "Authorization Error: verify that the refresh token is correct and has not expired." raise return "ok" def fetch_incidents( client: Client, last_run: dict[str, Any], params: dict[str, Any], is_test: bool = False, ) -> tuple[list[dict[str, Any]], dict[str, Any]]: """Fetch new Cyberhaven incidents and convert them to XSOAR incidents. Uses cursor-based pagination so no incident is missed or duplicated even if multiple pages arrive within the same fetch window. Args: client (Client): Initialised Cyberhaven client. last_run (dict): State dict persisted from the previous run. Expected keys: "last_fetch" (ISO timestamp), "last_ids" (list of str). params (dict): Integration configuration parameters from demisto.params(). is_test (bool): When True, performs a single API call without creating incidents. Returns: tuple[list, dict]: (list of XSOAR incident dicts, next_run state dict) """ first_fetch_dt, valid_severity_filter, valid_status_filter = validate_fetch_filters(params, is_test) first_fetch_time: str = first_fetch_dt.strftime(DATE_FORMAT) # type: ignore max_fetch_raw: int = arg_to_number(params.get("max_fetch", str(DEFAULT_MAX_FETCH)), "Max Fetch") # type: ignore if max_fetch_raw < 1: raise ValueError(ERROR_MESSAGES["INVALID_MAX_FETCH"].format(max_fetch_raw, MAX_INCIDENTS_TO_FETCH)) max_fetch = min(int(max_fetch_raw), MAX_INCIDENTS_TO_FETCH) if max_fetch_raw > MAX_INCIDENTS_TO_FETCH: demisto.debug( f"max_fetch value {max_fetch_raw} exceeds the maximum allowed value {MAX_INCIDENTS_TO_FETCH}. " f"Setting max_fetch to {MAX_INCIDENTS_TO_FETCH}." ) filter_string = json.dumps( {"severity": sorted(valid_severity_filter), "status": sorted(valid_status_filter)}, sort_keys=True, ) stored_filter = last_run.get("filter_string", "") already_fetch_ids: list[str] = last_run.get("already_fetch_ids") or [] if stored_filter and filter_string == stored_filter: fetch_time: str = last_run.get("next_fetch_time") or first_fetch_time page_id: str = last_run.get("next_page_id") or "" else: demisto.debug( f"Cyberhaven fetch-incidents: filter changed (was={stored_filter!r}, now={filter_string!r}), " f"resetting fetch time to {last_run.get('first_fetch_time') or first_fetch_time}." ) fetch_time = last_run.get("first_fetch_time") or first_fetch_time page_id = "" demisto.debug(f"Cyberhaven fetch-incidents: {fetch_time=}, fetching up to {max_fetch} incidents.") incidents: list[dict[str, Any]] = [] response = client.list_incidents( page_id=page_id, page_size=max_fetch, start_time=fetch_time, resolution_statuses=valid_status_filter, policy_severities=valid_severity_filter, include_ai_summaries=True, ) response = nullify_sentinels(response) response = remove_empty_elements_for_fetch(response) resources: list[dict] = response.get("resources") or [] demisto.debug(f"Cyberhaven fetch-incidents: received {len(resources)} incidents from API.") for raw in resources: inc_id = raw.get("id", "") if inc_id in already_fetch_ids: demisto.debug(f"Cyberhaven fetch-incidents: skipping duplicate incident {inc_id}.") continue if argToBoolean(params.get("outgoing_mirroring", False)): mirror_params = get_mirroring() mirror_params["mirror_id"] = inc_id raw.update(mirror_params) raw["incident_link"] = urljoin(client._base_url, INCIDENT_PLATFORM_LINK.format(id=inc_id)) start_event: dict[str, str] = demisto.get(raw, "event_details.start_event") or {} raw["start_event_json_beautify"] = json.dumps(start_event, indent=8) end_event: dict[str, str] = demisto.get(raw, "event_details.end_event") or {} raw["end_event_json_beautify"] = json.dumps(end_event, indent=8) if start_event and end_event: start_event_id: str = start_event.get("id") or "" start_event_time: str = start_event.get("timestamp") or "" end_event_id: str = end_event.get("id") or "" end_event_time: str = end_event.get("timestamp") or "" if start_event_id and start_event_time and end_event_id and end_event_time: reference: dict[str, Any] = { "selectedCategories": ["all_categories"], "time-filter": {"start_time": start_event_time, "end_time": end_event_time}, "global-filter": f"(e.source.raw_id == '{start_event_id}' && e.destination.raw_id == '{end_event_id}')", } reference_str = base64.b64encode(json.dumps(reference, separators=(",", ":")).encode()).decode() raw["event_lineage_link"] = urljoin(client._base_url, EVENT_LINEAGE_LINK.format(reference=reference_str)) user_email = demisto.get(raw, "user.id") or demisto.get(raw, "user.local_id") or "" severity_label = demisto.get(raw, "policy.severity") or "unspecified" name = f"Cyberhaven: {demisto.get(raw, 'policy.name') or 'DLP Incident'}" if user_email: name += f" - {user_email}" occurred = raw.get("trigger_time") or "" incidents.append( { "name": name, "occurred": occurred, "details": raw.get("ai_summary", ""), "rawJSON": json.dumps(raw), "severity": convert_severity(severity_label), "closeReason": CLOSE_REASON_REVERSE_MAPPING.get(raw.get("close_reason", ""), raw.get("close_reason", "")) if raw.get("status", "").lower() == "closed" else "", "closeNotes": raw.get("close_note", "") if raw.get("status", "").lower() == "closed" else "", } ) already_fetch_ids.append(inc_id) page_response = response.get("page_response") or {} next_page_id = page_response.get("next_id", "") if incidents: last_raw = json.loads(incidents[-1]["rawJSON"]) new_last_fetch = last_raw.get("trigger_time") or fetch_time else: new_last_fetch = fetch_time next_run: dict[str, Any] = assign_params( next_fetch_time=new_last_fetch, already_fetch_ids=already_fetch_ids, next_page_id=next_page_id, filter_string=filter_string, first_fetch_time=first_fetch_time, ) demisto.debug(f"Cyberhaven fetch-incidents: next_run={next_run}, returning {len(incidents)} incident(s).") if is_test: return [], {} return incidents, next_run def cyberhaven_incident_list_command(client: Client, args: dict[str, Any]) -> list[CommandResults] | CommandResults: """cyberhaven-incident-list: Search and list Cyberhaven DLP incidents. Args: client (Client): Initialised Cyberhaven client. args (dict): Command arguments from demisto.args(): - limit (int): Maximum number of incidents to return (default 25, max 200). - start_time (str): Filter incidents at or after this time (e.g. "3 days ago"). - end_time (str): Filter incidents before this time. - severity (str): Comma-separated severity levels (informational, low, medium, high, critical). - status (str): Comma-separated statuses ("open", "closed"). - assignee (str): Filter by assigned analyst email. - user (str): Filter by user email/alias who triggered the incident. - incident_ids (str): Comma-separated list of incident IDs to filter by. Returns: CommandResults: Formatted results with human-readable table and context data. """ params = validate_incident_list_args(args) response = client.list_incidents( page_size=params.get("limit", ""), page_id=params.get("page_id", ""), start_time=params.get("start_time", ""), end_time=params.get("end_time", ""), incident_ids=params.get("incident_ids", ""), policy_severities=params.get("severity_filter", ""), resolution_statuses=params.get("status_filter", ""), assignees=params.get("assignees", ""), users=params.get("users", ""), sort_by=DEFAULT_SORT_ORDER, include_ai_summaries=True, ) resources: list[dict] = response.get("resources") or [] resources = nullify_sentinels(resources) resources = remove_empty_elements_for_fetch(resources) resources = [apply_api_labels(r) for r in resources] page_response = response.get("page_response") or {} if not resources: return CommandResults(readable_output="No incidents found matching the given filters.") readable = build_incident_readable(resources, client._base_url, "Cyberhaven Incidents") next_page_readable = tableToMarkdown( "Page Details", [{"Next Page ID": page_response.get("next_id", ""), "Total": page_response.get("total", "")}], headers=["Next Page ID", "Total"], removeNull=True, ) return [ CommandResults( readable_output=readable, outputs_prefix="Cyberhaven.Incident", outputs_key_field="id", outputs=resources, raw_response=response, ), CommandResults( readable_output=next_page_readable, outputs_prefix="Cyberhaven.IncidentPage", outputs_key_field="next_id", outputs=page_response, raw_response=response, ), ] def cyberhaven_incident_update_command(client: Client, args: dict[str, Any]) -> CommandResults: """cyberhaven-incident-update: Update the status, assignment, or closure of an incident. Args: client (Client): Initialised Cyberhaven client. args (dict): Command arguments from demisto.args(): - incident_id (str, required): The Cyberhaven incident ID. - status (str): New status: "open" or "closed". - close_reason (str): Reason code when closing (e.g. "valid", "invalid_other"). - close_note (str): Free-text closure note. - assigned_to (str): Analyst email to assign the incident to. Returns: CommandResults: Confirmation message and updated incident data in context. """ params = validate_incident_update_args(args) lower_close_reason_mapping = {k.lower(): v for k, v in CLOSE_REASON_MAPPING.items()} response = client.update_incident( incident_id=params.get("incident_id", ""), status=params.get("status", ""), close_reason=lower_close_reason_mapping.get(params.get("close_reason", "")), close_note=params.get("close_note", ""), assigned_to=params.get("assigned_to", ""), ) resources: list[dict] = response.get("resources") or [] resources = nullify_sentinels(resources) resources = remove_empty_elements_for_fetch(resources) resources = [apply_api_labels(r) for r in resources] readable = build_incident_readable( resources, client._base_url, f"Incident **{params.get('incident_id')}** updated successfully." ) return CommandResults( readable_output=readable, outputs_prefix="Cyberhaven.Incident", outputs_key_field="id", outputs=resources, raw_response=response, ) def cyberhaven_event_details_get_command(client: Client, args: dict[str, Any]) -> CommandResults: """cyberhaven-event-details-get: Retrieve full details for one or more Cyberhaven events. Args: client (Client): Initialised Cyberhaven client. args (dict): Command arguments from demisto.args(): - event_ids (str, required): Comma-separated list of event UUIDs. Returns: CommandResults: Event details in the War Room and in context. """ event_ids = argToList(args.get("event_ids"), transform=lambda s: s.strip()) if not event_ids: raise ValueError(ERROR_MESSAGES["REQUIRED_ARGUMENT"].format("event_ids")) response = client.get_event_details(event_ids) resources: list[dict] = response.get("resources") or [] resources = nullify_sentinels(resources) resources = remove_empty_elements_for_fetch(resources) table_data = [ { "ID": e.get("id"), "Time": e.get("timestamp"), "User": e.get("user"), "Action": e.get("action"), "Source": e.get("source"), "Destination": e.get("destination"), } for e in resources ] readable = tableToMarkdown( "Cyberhaven Event Details", table_data, headers=["ID", "Time", "User", "Action", "Source", "Destination"], removeNull=True, json_transform_mapping={ "User": JsonTransformer(), "Action": JsonTransformer(), "Source": JsonTransformer(), "Destination": JsonTransformer(), }, ) return CommandResults( readable_output=readable, outputs_prefix="Cyberhaven.Event", outputs_key_field="id", outputs=resources, raw_response=response, ) def cyberhaven_event_lineage_get_command(client: Client, args: dict[str, Any]) -> CommandResults: """cyberhaven-event-lineage-get: Retrieve the data lineage chain between two events. The lineage shows every transformation a piece of data underwent from the first event (e.g. a file creation) to the last event (e.g. an upload). Args: client (Client): Initialised Cyberhaven client. args (dict): Command arguments from demisto.args(): - start_event_id (str, required): UUID of the first event in the chain. - end_event_id (str, required): UUID of the last event in the chain. Returns: CommandResults: Lineage chain in the War Room and in context. """ start_event_id = args.get("start_event_id") end_event_id = args.get("end_event_id") if not start_event_id or not end_event_id: raise ValueError(ERROR_MESSAGES["REQUIRED_BOTH_ARGUMENTS"].format("start_event_id", "end_event_id")) response = client.get_event_lineage(start_event_id, end_event_id) events: list[dict] = response.get("resources") or [] context = nullify_sentinels(response) context = remove_empty_elements_for_fetch(context) table_data = [ { "Number": i + 1, "ID": e, } for i, e in enumerate(events) ] readable = tableToMarkdown( f"Event Lineage: {start_event_id} to {end_event_id}", table_data, headers=["Number", "ID"], removeNull=True, ) return CommandResults( readable_output=readable, outputs_prefix="Cyberhaven.EventLineage", outputs_key_field="resources", outputs=context, raw_response=response, ) def update_remote_system_command(client: Client, args: dict) -> str: """Outgoing mirror: push XSOAR analyst changes back to Cyberhaven via PATCH. Only the close (DONE) transition is mirrored to Cyberhaven; reopening an incident in XSOAR (ACTIVE) is not pushed back. Watches three XSOAR-owned delta fields per SYNC-01: owner, closeReason, closeNotes (only changed fields are sent, per SYNC-03/SYNC-05). The status transition itself is read directly from the incident's current status, not from the delta. """ parsed_args = UpdateRemoteSystemArgs(args) remote_incident_id = parsed_args.remote_incident_id incident_status = parsed_args.inc_status if not remote_incident_id: demisto.debug("Cyberhaven update_remote_system: no remote incident ID, skipping") return remote_incident_id or "" incident_changed = argToBoolean(parsed_args.incident_changed) if parsed_args.incident_changed is not None else False if not incident_changed: demisto.debug(f"Cyberhaven update_remote_system: no changes for {remote_incident_id}, skipping") return remote_incident_id raw_delta = parsed_args.delta or {} if isinstance(raw_delta, str): try: delta: dict = json.loads(raw_delta) if raw_delta else {} except (ValueError, json.JSONDecodeError): delta = {} else: delta = raw_delta watched = {"owner", "closeReason", "closeNotes"} changed = {k: v for k, v in delta.items() if k in watched} demisto.debug(f"Cyberhaven update_remote_system: {remote_incident_id} - changed fields: {list(changed.keys())}") patch_fields: list[str] = [] patch_status: str | None = None patch_close_reason: str | None = None patch_close_note: str | None = None patch_assigned_to: str | None = None if incident_status and incident_status == IncidentStatus.DONE: patch_status = XSOAR_STATUS_TO_CH.get(incident_status, "") try: response = client.list_incidents(incident_ids=[remote_incident_id]) except DemistoException as exc: demisto.error(f"Cyberhaven update_remote_system: failed to look up incident {remote_incident_id} in CH, error={exc}") return remote_incident_id resources: list[dict] = response.get("resources") or [] if not resources: demisto.debug(f"Cyberhaven update_remote_system: incident {remote_incident_id} not found in CH (404), discarding") return remote_incident_id external_status = resources[0].get("status") or "" if external_status != patch_status: patch_fields.append("status") if "closeReason" in changed: xsoar_reason = (changed.get("closeReason") or "").strip() ch_reason = CLOSE_REASON_MAPPING.get(xsoar_reason) if ch_reason: patch_close_reason = ch_reason patch_fields.append("close_reason") else: demisto.debug(f"Cyberhaven update_remote_system: closeReason '{xsoar_reason}' has no CH mapping, omitting") if "closeNotes" in changed: patch_close_note = changed.get("closeNotes") or "" patch_fields.append("close_note") else: demisto.debug( f"Cyberhaven update_remote_system: incident {remote_incident_id} is already closed, " "so not updating for close workflow" ) if "owner" in changed: owner_val = (changed.get("owner") or "").strip() if owner_val: patch_assigned_to = owner_val patch_fields.append("assigned_to") else: demisto.debug("Cyberhaven update_remote_system: owner is blank, omitting assigned_to from PATCH") if not patch_fields: demisto.debug(f"Cyberhaven update_remote_system: no mappable fields for {remote_incident_id}, skipping PATCH") return remote_incident_id demisto.debug(f"Cyberhaven update_remote_system: Patching {remote_incident_id} with fields={patch_fields}") try: client.update_incident( incident_id=remote_incident_id, status=patch_status, close_reason=patch_close_reason, close_note=patch_close_note, assigned_to=patch_assigned_to, ) demisto.debug(f"Cyberhaven update_remote_system: PATCH succeeded for {remote_incident_id}") except DemistoException as exc: err_msg = str(exc) if "404" in err_msg: demisto.debug(f"Cyberhaven update_remote_system: incident {remote_incident_id} not found in CH (404), discarding") else: demisto.error( f"Cyberhaven update_remote_system: PATCH failed for incident={remote_incident_id}, " f"fields={patch_fields}, error={err_msg}" ) return_warning( f"Cyberhaven reverse sync failed for incident `{remote_incident_id}`. " f"Fields attempted: {patch_fields}. Error: {err_msg}" ) return remote_incident_id """ MAIN FUNCTION """ def main() -> None: # pragma: no cover """Parse params, initialise the Client, and dispatch to the correct command function.""" params = demisto.params() params = trim_spaces_from_args(params) remove_nulls_from_dictionary(params) refresh_token: str = params.get("credentials", {}).get("password") or "" refresh_token = refresh_token.strip() base_url: str = params.get("url", "") verify_certificate: bool = not argToBoolean(params.get("insecure", False)) proxy: bool = argToBoolean(params.get("proxy", False)) command = demisto.command() demisto.debug(f"Cyberhaven: command={command}") commands: dict[str, Callable] = { "cyberhaven-incident-list": cyberhaven_incident_list_command, "cyberhaven-incident-update": cyberhaven_incident_update_command, "cyberhaven-event-details-get": cyberhaven_event_details_get_command, "cyberhaven-event-lineage-get": cyberhaven_event_lineage_get_command, } try: if not refresh_token: raise DemistoException(ERROR_MESSAGES["REFRESH_TOKEN_REQUIRED"]) validate_cyberhaven_url(base_url) result = None client = Client( base_url=base_url, refresh_token=refresh_token, verify=verify_certificate, proxy=proxy, ) args = demisto.args() args = trim_spaces_from_args(args) remove_nulls_from_dictionary(args) if command == "test-module": result = test_module(client) elif command == "fetch-incidents": last_run = demisto.getLastRun() incidents, next_run = fetch_incidents(client, last_run, params) demisto.incidents(incidents) demisto.setLastRun(next_run) elif command == "update-remote-system": result = update_remote_system_command(client, args) elif command in commands: result = commands[command](client, args) else: raise NotImplementedError(f"Command '{command}' is not implemented.") return_results(result) except Exception as exc: return_error(f"Failed to execute '{command}'.\nError: {str(exc)}") """ ENTRY POINT """ if __name__ in ("__main__", "__builtin__", "builtins"): main()