Cyberhaven
Fetches DLP incidents from the Cyberhaven data security platform and enables investigation of events and data lineage.
Data Enrichment & Threat Intelligence · Cyberhaven
Details
| ID | Cyberhaven |
|---|---|
| Provider | Cyberhaven |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 6.10.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
| Supported Modules | Agentix XSIAM |
README
Fetches DLP incidents from the Cyberhaven data security platform and enables investigation of events and data lineage.
This integration was integrated and tested with version 2 of Cyberhaven API.
Configure Cyberhaven in Cortex
| Parameter | Description | Required |
|---|---|---|
| Server URL (e.g., https://example.cyberhaven.io) | URL of the Cyberhaven tenant. | True |
| Refresh Token | Provide the Refresh Token for authentication. | True |
| Fetch incidents | Whether to fetch DLP incidents as XSOAR Incidents. | False |
| Incident type | Select Incident type as “Cyberhaven Incident”. | False |
| First fetch time | The date or relative timestamp from which to begin fetching DLP Incidents. Default value is ‘3 days’. The maximum is ‘30 days’. If the value is greater than ‘30 days’, it will be considered as ‘30 days’. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2026, 01 May 2026 04:45:33, 2026-05-17T14:05:44Z. |
False |
| Max Fetch | The maximum number of DLP Incidents to fetch each time. Default value is 100. The maximum is 200. If the value is greater than 200, it will be considered as 200. |
False |
| Status of incidents to fetch | Filter the DLP incidents by Status. Default value is ‘Open’. | False |
| Severity of incidents to fetch | Filter the DLP incidents by Severity. Default value is ‘Informational, Low, Medium, High, Critical’. | False |
| Enable Outgoing Mirroring (from XSOAR to Cyberhaven) | When enabled, updates to the following fields in XSOAR are synchronized to Cyberhaven: Status, Owner, Close Reason, and Close Notes. | False |
| Incidents Fetch Interval | The interval in minutes to fetch incidents. The default is 5 minute. | False |
| Trust any certificate (not secure) | Whether to allow connections without verifying SSL certificates validity. | False |
| Use system proxy settings | Whether to use XSOAR’s system proxy settings to connect to the API. | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
cyberhaven-incident-list
List and search Cyberhaven DLP incidents with optional filters.
Base Command
cyberhaven-incident-list
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | Max incidents to return. Default is 25. | Optional |
| start_time | Filter the incidents by start on or after the provided time. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. | Optional |
| end_time | Filter the incidents by end on or before the provided time. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. | Optional |
| severity | A comma-separated list of severity by which to filter the incidents. Possible values are: Informational, Low, Medium, High, Critical. | Optional |
| status | A comma-separated list of status by which to filter the incidents. Possible values are: Open, Closed. | Optional |
| assignee | Filter the incidents by assigned analyst email. | Optional |
| user | Filter the incidents by user who triggered the incident. | Optional |
| incident_ids | A comma-separated list of incident IDs to filter the results. | Optional |
| page_id | Page ID to retrieve the next set of the incidents. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Cyberhaven.Incident.id | String | The unique identifier of the incident. |
| Cyberhaven.Incident.user.id | String | The identifier of the user who triggered the incident. |
| Cyberhaven.Incident.user.local_username | String | The local machine username of the user who triggered the incident. |
| Cyberhaven.Incident.user.local_id | String | The local identifier of the user who triggered the incident. |
| Cyberhaven.Incident.event_lineage_id.start_event_id | String | The ID of the first event in the lineage chain. |
| Cyberhaven.Incident.event_lineage_id.end_event_id | String | The ID of the last event in the lineage chain. |
| Cyberhaven.Incident.blocked | Boolean | Whether the action that triggered the incident was blocked. |
| Cyberhaven.Incident.event_time | Date | The timestamp of the event that triggered the incident. |
| Cyberhaven.Incident.trigger_time | Date | The timestamp when the incident was triggered. |
| Cyberhaven.Incident.dataset.id | String | The identifier of the dataset involved in the incident. |
| Cyberhaven.Incident.dataset.name | String | The name of the dataset involved in the incident. |
| Cyberhaven.Incident.dataset.sensitivity | String | The sensitivity classification of the dataset involved. |
| Cyberhaven.Incident.user_risk_groups | String | The list of risk groups the user belongs to. |
| Cyberhaven.Incident.policy.id | String | The identifier of the DLP policy that was triggered. |
| Cyberhaven.Incident.policy.name | String | The name of the DLP policy that was triggered. |
| Cyberhaven.Incident.policy.severity | String | The severity level defined in the triggering DLP policy. |
| Cyberhaven.Incident.risk_score | Number | The numeric risk score assigned to the incident. |
| Cyberhaven.Incident.screenshot_guid | String | The GUID of the screenshot associated with the incident. |
| Cyberhaven.Incident.warning_status | String | The warning acknowledgement status of the incident. |
| Cyberhaven.Incident.user_reactions | String | The list of user reaction codes for the incident. |
| Cyberhaven.Incident.user_reaction_message | String | The message provided by the user when reacting to the warning. |
| Cyberhaven.Incident.reaction_time | Date | The timestamp when the user reacted to the warning. |
| Cyberhaven.Incident.assigned_to | String | The email of the analyst the incident is assigned to. |
| Cyberhaven.Incident.status | String | The current status of the incident (e.g. open, closed). |
| Cyberhaven.Incident.resolution_time | Date | The timestamp when the incident was resolved. |
| Cyberhaven.Incident.close_reason | String | The reason code provided when the incident was closed. |
| Cyberhaven.Incident.close_note | String | The free-text note provided when the incident was closed. |
| Cyberhaven.Incident.created_by | String | Indicates how the incident was created (e.g. created_by_policy). |
| Cyberhaven.Incident.ai_summary | String | The AI-generated summary of the incident. |
| Cyberhaven.Incident.ai_severity | String | The AI-assessed severity level of the incident. |
| Cyberhaven.Incident.last_modified | Date | The timestamp when the incident was last modified. |
| Cyberhaven.Incident.event_details.start_event.id | String | The ID of the start event. |
| Cyberhaven.Incident.event_details.start_event.timestamp | Date | The timestamp of the start event. |
| Cyberhaven.Incident.event_details.start_event.action.kind | String | The action kind performed in the start event (e.g. copy). |
| Cyberhaven.Incident.event_details.start_event.action.blocked | Boolean | Whether the action in the start event was blocked. |
| Cyberhaven.Incident.event_details.start_event.action.data_size | Number | The size of data involved in the start event action (bytes). |
| Cyberhaven.Incident.event_details.start_event.action.content.tags | String | The content classification tags detected in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.attributes | String | The content attributes of the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.upload_filename | String | The filename of the content being uploaded in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.inspected | Boolean | Whether the content was inspected in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.sensor_kind | String | The sensor type that detected the start event (e.g. endpoint). |
| Cyberhaven.Incident.event_details.start_event.action.hostname | String | The hostname of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.machine_serial_number | String | The serial number of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.ip_address | String | The IP address of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.device_type | String | The device management type for the start event (e.g. managed). |
| Cyberhaven.Incident.event_details.start_event.action.temporary_blocked | Boolean | Whether the start event action was temporarily blocked. |
| Cyberhaven.Incident.event_details.start_event.action.fail_close_statuses | String | The list of fail-close status objects for the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.process_id | Number | The process ID of the process that triggered the start event. |
| Cyberhaven.Incident.event_details.start_event.action.parent_process_id | Number | The parent process ID of the process that triggered the start event. |
| Cyberhaven.Incident.event_details.start_event.user.id | String | The identifier of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.user.local_username | String | The local username of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.user.local_id | String | The local ID of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.id | String | The ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.display_name | String | The display name of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.datastore_id | String | The datastore ID associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.dataset_sensitivity | String | The sensitivity classification of the dataset in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.dataset_ids | String | The list of dataset IDs associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.object_type | String | The object type (e.g. file, removable_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.state | String | The state of the object (e.g. active) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.tags | String | The content classification tags in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.attributes | String | The content attributes in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.upload_filename | String | The upload filename of the content in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.inspected | Boolean | Whether the content was inspected in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.data.labels | String | The data classification labels in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.data.label_ids | String | The data classification label IDs in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.name | String | The name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.description | String | The description of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.package_name | String | The package name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.binary_path | String | The binary path of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.command_line | String | The command line of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.main_window_title | String | The main window title of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.name | String | The file name in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.extension | String | The file extension in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.size | Number | The file size (bytes) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.md5_hash | String | The MD5 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.sha256_hash | String | The SHA-256 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.created_at | Date | The creation timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.modified_at | Date | The last modification timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.owner.name | String | The name of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.owner.id | String | The ID of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.local_file.id | String | The local file ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.local_file.path | String | The local file system path in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.network_share.hostname | String | The hostname of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.network_share.path | String | The path of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.id | String | The ID of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.from | String | The sender of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.to | String | The recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.cc | String | The CC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.bcc | String | The BCC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.subject | String | The subject of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email_attachment.id | String | The ID of the email attachment in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.url | String | The URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.domain | String | The domain of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.download_url | String | The download URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.title | String | The page title of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.user_agent | String | The user-agent string of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.provider | String | The cloud provider (e.g. google) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.name | String | The name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_name | String | The username in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_email | String | The user email in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_id | String | The instance ID of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_name | String | The instance name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.id | String | The ID of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.content_uri | String | The content URI of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.path | String | The path of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.scope | String | The sharing scope in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.role | String | The role of the cloud share recipient in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.name | String | The name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.description | String | The description of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.physical_location | String | The physical location of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.server | String | The print server hostname in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.share_name | String | The share name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.port | String | The port of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.driver | String | The driver name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.is_local | Boolean | Whether the printer is local in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.job_id | String | The print job ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.connectivity | String | The connectivity type of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.id | String | The ID of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.name | String | The name of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.product_id | String | The USB product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.sender | String | The sender of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_users | String | The recipient users of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_groups | String | The recipient groups of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.domain | String | The domain of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.workspace | String | The workspace of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.organization | String | The organization of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.name | String | The name of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.branch | String | The branch of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.id | String | The ID of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.labels | String | The labels applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.label_ids | String | The label IDs applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.matched_policies | String | The list of DLP policies matched by the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.issues | String | The list of DLP issues detected on the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.outline | String | The outline description of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.type | String | The endpoint type (e.g. endpoint, removable_media) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.domain | String | The domain of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.discovered_at | Date | The timestamp when the object was first discovered in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.updated_at | Date | The timestamp when the object was last updated in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.id | String | The ID of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.action_kind | String | The action kind of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.timestamp | Date | The timestamp of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.id | String | The user ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_username | String | The local username in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_id | String | The local ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.version_id | String | The version ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.id | String | The ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.type | String | The type of cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.name | String | The name of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.account_id | String | The account ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.id | String | The ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.display_name | String | The display name of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.datastore_id | String | The datastore ID associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.dataset_ids | String | The list of dataset IDs associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.object_type | String | The object type (e.g. file, removable_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.state | String | The state of the object (e.g. active) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.tags | String | The content classification tags in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.attributes | String | The content attributes in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.upload_filename | String | The upload filename of the content in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.inspected | Boolean | Whether the content was inspected in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.data.labels | String | The data classification labels in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.data.label_ids | String | The data classification label IDs in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.name | String | The name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.description | String | The description of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.package_name | String | The package name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.binary_path | String | The binary path of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.command_line | String | The command line of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.main_window_title | String | The main window title of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.name | String | The file name in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.extension | String | The file extension in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.size | Number | The file size (bytes) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.md5_hash | String | The MD5 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.sha256_hash | String | The SHA-256 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.created_at | Date | The creation timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.modified_at | Date | The last modification timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.owner.name | String | The name of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.owner.id | String | The ID of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.local_file.id | String | The local file ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.local_file.path | String | The local file system path in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.network_share.hostname | String | The hostname of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.network_share.path | String | The path of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.id | String | The ID of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.from | String | The sender of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.to | String | The recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.cc | String | The CC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.bcc | String | The BCC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.subject | String | The subject of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email_attachment.id | String | The ID of the email attachment in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.url | String | The URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.domain | String | The domain of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.download_url | String | The download URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.title | String | The page title of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.user_agent | String | The user-agent string of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.provider | String | The cloud provider (e.g. google) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.name | String | The name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_name | String | The username in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_email | String | The user email in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_id | String | The instance ID of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_name | String | The instance name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.id | String | The ID of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.content_uri | String | The content URI of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.path | String | The path of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.scope | String | The sharing scope in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.name | String | The name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.description | String | The description of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.physical_location | String | The physical location of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.server | String | The print server hostname in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.share_name | String | The share name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.port | String | The port of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.driver | String | The driver name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.is_local | Boolean | Whether the printer is local in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.job_id | String | The print job ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.connectivity | String | The connectivity type of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.id | String | The ID of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.name | String | The name of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.product_id | String | The USB product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.sender | String | The sender of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_users | String | The recipient users of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_groups | String | The recipient groups of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.domain | String | The domain of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.workspace | String | The workspace of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.organization | String | The organization of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.name | String | The name of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.branch | String | The branch of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.id | String | The ID of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.labels | String | The labels applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.label_ids | String | The label IDs applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.matched_policies | String | The list of DLP policies matched by the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.issues | String | The list of DLP issues detected on the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.outline | String | The outline description of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.type | String | The endpoint type (e.g. endpoint, removable_media) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.domain | String | The domain of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.discovered_at | Date | The timestamp when the object was first discovered in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.updated_at | Date | The timestamp when the object was last updated in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.id | String | The ID of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.action_kind | String | The action kind of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.timestamp | Date | The timestamp of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.id | String | The user ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_username | String | The local username in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_id | String | The local ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.version_id | String | The version ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.id | String | The ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.type | String | The type of cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.name | String | The name of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.account_id | String | The account ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.end_event.id | String | The ID of the end event. |
| Cyberhaven.Incident.event_details.end_event.timestamp | Date | The timestamp of the end event. |
| Cyberhaven.Incident.event_details.end_event.action.kind | String | The action kind performed in the end event (e.g. copy). |
| Cyberhaven.Incident.event_details.end_event.action.blocked | Boolean | Whether the action in the end event was blocked. |
| Cyberhaven.Incident.event_details.end_event.action.data_size | Number | The size of data involved in the end event action (bytes). |
| Cyberhaven.Incident.event_details.end_event.action.content.tags | String | The content classification tags detected in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.attributes | String | The content attributes of the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.upload_filename | String | The filename of the content being uploaded in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.inspected | Boolean | Whether the content was inspected in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.sensor_kind | String | The sensor type that detected the end event (e.g. endpoint). |
| Cyberhaven.Incident.event_details.end_event.action.hostname | String | The hostname of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.machine_serial_number | String | The serial number of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.ip_address | String | The IP address of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.device_type | String | The device management type for the end event (e.g. managed). |
| Cyberhaven.Incident.event_details.end_event.action.temporary_blocked | Boolean | Whether the end event action was temporarily blocked. |
| Cyberhaven.Incident.event_details.end_event.action.fail_close_statuses | String | The list of fail-close status objects for the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.process_id | Number | The process ID of the process that triggered the end event. |
| Cyberhaven.Incident.event_details.end_event.action.parent_process_id | Number | The parent process ID of the process that triggered the end event. |
| Cyberhaven.Incident.event_details.end_event.user.id | String | The identifier of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.user.local_username | String | The local username of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.user.local_id | String | The local ID of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.id | String | The ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.display_name | String | The display name of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.datastore_id | String | The datastore ID associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.dataset_sensitivity | String | The sensitivity classification of the dataset in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.dataset_ids | String | The list of dataset IDs associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.object_type | String | The object type (e.g. file, removable_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.state | String | The state of the object (e.g. active) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.tags | String | The content classification tags in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.attributes | String | The content attributes in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.upload_filename | String | The upload filename of the content in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.inspected | Boolean | Whether the content was inspected in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.data.labels | String | The data classification labels in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.data.label_ids | String | The data classification label IDs in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.name | String | The name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.description | String | The description of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.package_name | String | The package name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.binary_path | String | The binary path of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.command_line | String | The command line of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.main_window_title | String | The main window title of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.name | String | The file name in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.extension | String | The file extension in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.size | Number | The file size (bytes) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.md5_hash | String | The MD5 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.sha256_hash | String | The SHA-256 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.created_at | Date | The creation timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.modified_at | Date | The last modification timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.owner.name | String | The name of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.owner.id | String | The ID of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.local_file.id | String | The local file ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.local_file.path | String | The local file system path in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.network_share.hostname | String | The hostname of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.network_share.path | String | The path of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.id | String | The ID of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.from | String | The sender of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.to | String | The recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.cc | String | The CC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.bcc | String | The BCC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.subject | String | The subject of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email_attachment.id | String | The ID of the email attachment in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.url | String | The URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.domain | String | The domain of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.download_url | String | The download URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.title | String | The page title of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.user_agent | String | The user-agent string of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.provider | String | The cloud provider (e.g. google) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.name | String | The name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_name | String | The username in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_email | String | The user email in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_id | String | The instance ID of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_name | String | The instance name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.id | String | The ID of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.content_uri | String | The content URI of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.path | String | The path of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.scope | String | The sharing scope in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.role | String | The role of the cloud share recipient in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.name | String | The name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.description | String | The description of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.physical_location | String | The physical location of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.server | String | The print server hostname in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.share_name | String | The share name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.port | String | The port of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.driver | String | The driver name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.is_local | Boolean | Whether the printer is local in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.job_id | String | The print job ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.connectivity | String | The connectivity type of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.id | String | The ID of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.name | String | The name of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.product_id | String | The USB product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.sender | String | The sender of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_users | String | The recipient users of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_groups | String | The recipient groups of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.domain | String | The domain of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.workspace | String | The workspace of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.organization | String | The organization of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.name | String | The name of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.branch | String | The branch of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.id | String | The ID of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.labels | String | The labels applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.label_ids | String | The label IDs applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.matched_policies | String | The list of DLP policies matched by the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.issues | String | The list of DLP issues detected on the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.outline | String | The outline description of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.type | String | The endpoint type (e.g. endpoint, removable_media) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.domain | String | The domain of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.discovered_at | Date | The timestamp when the object was first discovered in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.updated_at | Date | The timestamp when the object was last updated in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.id | String | The ID of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.action_kind | String | The action kind of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.timestamp | Date | The timestamp of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.id | String | The user ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_username | String | The local username in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_id | String | The local ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.version_id | String | The version ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.id | String | The ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.type | String | The type of cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.name | String | The name of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.account_id | String | The account ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.id | String | The ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.display_name | String | The display name of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.datastore_id | String | The datastore ID associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.dataset_ids | String | The list of dataset IDs associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.object_type | String | The object type (e.g. file, removable_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.state | String | The state of the object (e.g. active) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.tags | String | The content classification tags in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.attributes | String | The content attributes in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.upload_filename | String | The upload filename of the content in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.inspected | Boolean | Whether the content was inspected in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.data.labels | String | The data classification labels in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.data.label_ids | String | The data classification label IDs in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.name | String | The name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.description | String | The description of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.package_name | String | The package name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.binary_path | String | The binary path of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.command_line | String | The command line of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.main_window_title | String | The main window title of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.name | String | The file name in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.extension | String | The file extension in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.size | Number | The file size (bytes) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.md5_hash | String | The MD5 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.sha256_hash | String | The SHA-256 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.created_at | Date | The creation timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.modified_at | Date | The last modification timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.owner.name | String | The name of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.owner.id | String | The ID of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.local_file.id | String | The local file ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.local_file.path | String | The local file system path in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.network_share.hostname | String | The hostname of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.network_share.path | String | The path of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.id | String | The ID of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.from | String | The sender of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.to | String | The recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.cc | String | The CC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.bcc | String | The BCC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.subject | String | The subject of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email_attachment.id | String | The ID of the email attachment in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.url | String | The URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.domain | String | The domain of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.download_url | String | The download URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.title | String | The page title of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.user_agent | String | The user-agent string of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.provider | String | The cloud provider (e.g. google) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.name | String | The name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_name | String | The username in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_email | String | The user email in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_id | String | The instance ID of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_name | String | The instance name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.id | String | The ID of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.content_uri | String | The content URI of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.path | String | The path of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.scope | String | The sharing scope in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.name | String | The name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.description | String | The description of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.physical_location | String | The physical location of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.server | String | The print server hostname in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.share_name | String | The share name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.port | String | The port of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.driver | String | The driver name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.is_local | Boolean | Whether the printer is local in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.job_id | String | The print job ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.connectivity | String | The connectivity type of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.id | String | The ID of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.name | String | The name of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.product_id | String | The USB product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.sender | String | The sender of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_users | String | The recipient users of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_groups | String | The recipient groups of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.domain | String | The domain of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.workspace | String | The workspace of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.organization | String | The organization of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.name | String | The name of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.branch | String | The branch of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.id | String | The ID of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.labels | String | The labels applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.label_ids | String | The label IDs applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.matched_policies | String | The list of DLP policies matched by the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.issues | String | The list of DLP issues detected on the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.outline | String | The outline description of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.type | String | The endpoint type (e.g. endpoint, removable_media) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.domain | String | The domain of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.discovered_at | Date | The timestamp when the object was first discovered in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.updated_at | Date | The timestamp when the object was last updated in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.id | String | The ID of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.action_kind | String | The action kind of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.timestamp | Date | The timestamp of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.id | String | The user ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_username | String | The local username in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_id | String | The local ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.version_id | String | The version ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.id | String | The ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.type | String | The type of cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.name | String | The name of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.account_id | String | The account ID of the cloud connector in the end event. |
| Cyberhaven.IncidentPage.next_id | String | The opaque cursor for the next page of results. Pass this value as page_id to retrieve the next page. |
| Cyberhaven.IncidentPage.total | Number | The total number of incidents for the provided filters. |
Command example
!cyberhaven-incident-list limit=2 start_time="3 days"
Context Example
{
"Cyberhaven": {
"Incidents": [
{
"id": "inc_a1b2c3d4e5f6",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"department": "Engineering",
"manager_email": "jane.smith@company.com",
"employee_id": "EMP-10042",
"location": "US-NYC",
"role": "Senior Software Engineer"
}
},
"event_lineage_id": {
"start_event_id": "evt_start_001abc",
"end_event_id": "evt_end_002xyz"
},
"blocked": false,
"event_time": "2026-01-15T10:28:45Z",
"trigger_time": "2026-01-15T10:29:02Z",
"dataset": {
"id": "ds_hr_confidential",
"name": "HR Confidential Records",
"sensitivity": "high",
"custom_data": {
"classification_level": "confidential",
"data_owner": "hr@company.com"
}
},
"user_risk_groups": [
{
"id": "rg_high_risk_users",
"name": "High Risk Users",
"risk_multiplier": 1.5,
"custom_data": {
"criteria": "multiple_policy_violations"
}
}
],
"policy": {
"id": "pol_dlp_hr_001",
"name": "HR Data Exfiltration Prevention",
"severity": "high",
"custom_data": {
"policy_owner": "security@company.com",
"enforcement_mode": "block",
"review_cycle": "quarterly",
"compliance_framework": "SOC2"
}
},
"risk_score": 8.5,
"screenshot_guid": "scrn_7f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
"warning_status": "warning_shown",
"user_reactions": [
"reaction_acknowledged"
],
"user_reaction_message": "I was transferring files for an approved project backup.",
"reaction_time": "2026-01-15T10:31:15Z",
"assigned_to": "analyst@company.com",
"status": "open",
"resolution_time": "2026-01-15T14:45:00Z",
"close_reason": "policy_violation",
"close_note": "User violated data exfiltration policy. Escalated to HR.",
"custom_data": {
"ticket_id": "JIRA-4521"
},
"created_by": "created_by_system",
"ai_summary": "User john.doe attempted to copy confidential HR records to a removable USB drive. The action was detected by endpoint DLP and flagged as a high-severity policy violation.",
"ai_severity": "high",
"last_modified": "2026-01-15T11:00:00Z",
"event_details": {
"start_event": {
"id": "evt_start_001abc",
"timestamp": "2026-01-15T10:28:45Z",
"action": {
"kind": "copy",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"encoding": "UTF-8"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"ad_group": "Domain Users",
"upn": "john.doe@company.com",
"last_login": "2026-01-15T08:05:00Z"
}
},
"source": {
"id": "src_local_001abc",
"display_name": "employee_salaries_2026.xlsx",
"datastore_id": "dstore_endpoint_01",
"dataset_sensitivity": "sensitivity_high",
"dataset_ids": [
"ds_hr_confidential"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"classification": "confidential",
"last_scan": "2026-01-10T09:00:00Z",
"scan_result": "contains_pii",
"owner_department": "HR"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential",
"HR Data"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Microsoft Excel",
"description": "Microsoft Office Spreadsheet Application",
"package_name": "com.microsoft.excel",
"binary_path": "C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE",
"command_line": "\"EXCEL.EXE\" /e",
"main_window_title": "employee_salaries_2026.xlsx - Excel",
"custom_data": {
"version": "16.0.17126.20132",
"publisher": "Microsoft Corporation",
"signed": "true",
"install_date": "2023-06-01",
"auto_update": "enabled"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"creator": "john.doe",
"last_modified_by": "jane.smith"
},
"created_at": "2026-01-10T09:00:00Z",
"modified_at": "2026-01-15T08:30:00Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_001abc",
"path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>",
"x_mailer": "Microsoft Outlook 16.0"
}
},
"email_attachment": {
"id": "attach_src_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload",
"custom_data": {
"referrer": "https://drive.google.com/",
"request_method": "POST"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Data/employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"revision_id": "rev_001"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12",
"duplex": "false"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"file_system": "NTFS",
"capacity_gb": "64"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_001abc"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private",
"default_branch": "main",
"last_commit": "a1b2c3d4e5f6",
"language": "Python"
},
"branch": "main",
"id": "repo_001"
},
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection",
"rule_confidential_data"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:28:45Z"
}
],
"issues": [
{
"id": "issue_001abc",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:45Z"
}
],
"custom_data": {
"data_classification": "confidential",
"retention_policy": "7_years",
"gdpr_relevant": "true",
"ccpa_relevant": "true"
},
"outline": "Spreadsheet containing employee salary and compensation data for 250 employees in the Engineering department.",
"type": "removable_media",
"domain": "company.com",
"discovered_at": "2026-01-10T09:00:00Z",
"updated_at": "2026-01-15T10:28:45Z",
"update_event": {
"id": "upd_evt_001",
"action_kind": "copy",
"timestamp": "2026-01-15T10:28:45Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_001abc",
"cloud_connector": {
"id": "cc_box_001",
"type": "box",
"name": "Company Box Integration",
"onboarding_account": "admin@company.com",
"account_id": "box_acct_001"
}
},
"destination": {
"id": "dst_usb_001abc",
"display_name": "SanDisk Ultra 64GB (E:)",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "removable_storage",
"state": "active",
"content": {
"tags": [
"external",
"removable"
],
"attributes": {
"file_count": 1,
"total_size": 2048576
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"destination_path": "E:\\Backup\\HR",
"overwrite": "false"
},
"inspected": true
},
"data": {
"labels": [
"External Storage"
],
"label_ids": [
"lbl_external_storage"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe /select,\"E:\\Backup\\HR\\employee_salaries_2026.xlsx\"",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"destination_created": "true",
"is_copy": "true",
"original_path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_dst_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\Backup\\HR",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>"
}
},
"email_attachment": {
"id": "attach_dst_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"file_size": "2048576",
"sanitized": "false"
}
},
"web": {
"url": "https://drive.google.com/upload/resumable",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload Complete",
"custom_data": {
"upload_session_id": "upload_sess_001"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"upload_complete": "true"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"upload_timestamp": "2026-01-15T10:29:00Z",
"file_id": "1abc123xyz"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true",
"link_type": "restricted"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"drive_letter": "E",
"free_space_gb": "45"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_dst_001",
"channel": "direct",
"platform": "teams",
"thread_id": "thread_001",
"is_external": "true"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_dst_001"
},
"labels": [
"External Storage",
"Removable Media"
],
"label_ids": [
"lbl_external_storage",
"lbl_removable_media"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_removable_001",
"version": 2,
"definition_rule_ids": [
"rule_removable_media_write"
],
"action_rule_id": "action_rule_alert",
"matched_at": "2026-01-15T10:28:50Z"
}
],
"issues": [
{
"id": "issue_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_removable_001",
"policy_action_rule_id": "action_rule_alert",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:50Z"
}
],
"custom_data": {
"endpoint_risk": "high",
"device_approved": "false"
},
"outline": "USB removable storage device used as destination for confidential HR file transfer.",
"type": "share",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:45Z",
"updated_at": "2026-01-15T10:28:50Z",
"update_event": {
"id": "upd_evt_dst_001",
"action_kind": "write",
"timestamp": "2026-01-15T10:28:50Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_dst_001",
"cloud_connector": {
"id": "cc_gcs_001",
"type": "gcs",
"name": "Company GCS Integration",
"onboarding_account": "gcs-service@company.iam.gserviceaccount.com",
"account_id": "gcs_acct_001"
}
}
},
"end_event": {
"id": "evt_end_002xyz",
"timestamp": "2026-01-15T10:29:00Z",
"action": {
"kind": "upload",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500,
"page_count": 3
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"encoding": "UTF-8",
"compressed": "false",
"checksum_verified": "true"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2",
"network_zone": "internal"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
},
"source": {
"id": "src_end_001abc",
"display_name": "E:\\Backup\\HR\\employee_salaries_2026.xlsx",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"drive_letter": "E"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_end_src_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB",
"mount_point": "Z:"
}
},
"email": {
"id": "email_end_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102900.002@company.com>"
}
},
"email_attachment": {
"id": "attach_end_src_001",
"custom_data": {
"attachment_index": "0"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive",
"custom_data": {
"referrer": "https://drive.google.com/",
"request_method": "POST",
"response_code": "200"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1",
"auth_method": "oauth2"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_end_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"file_id": "1abc123xyz",
"revision": "1"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4522",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_end_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"file_system": "NTFS",
"drive_letter": "E"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_end_001",
"platform": "teams",
"thread_id": "thread_001",
"channel_type": "direct_message"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_end_src_001"
},
"labels": [
"External Storage",
"PII"
],
"label_ids": [
"lbl_external_storage",
"lbl_pii"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:29:00Z"
}
],
"issues": [
{
"id": "issue_end_src_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:29:00Z"
}
],
"custom_data": {
"data_classification": "confidential",
"risk_level": "high",
"source_type": "removable_media"
},
"outline": "File read from USB removable storage during end event of the data transfer sequence.",
"type": "endpoint",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:50Z",
"updated_at": "2026-01-15T10:29:00Z",
"update_event": {
"id": "upd_evt_end_src_001",
"action_kind": "read",
"timestamp": "2026-01-15T10:29:00Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_end_src_001",
"cloud_connector": {
"id": "cc_salesforce_001",
"type": "salesforce",
"name": "Company Salesforce Integration",
"onboarding_account": "admin@company.com",
"account_id": "sf_acct_001"
}
},
"destination": {
"id": "dst_end_001abc",
"display_name": "Google Drive - Personal",
"datastore_id": "dstore_gdrive_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_external_cloud"
],
"object_type": "cloud_file",
"state": "active",
"content": {
"tags": [
"external",
"cloud"
],
"attributes": {
"file_count": 1,
"total_size": 2048576,
"upload_chunks": 2,
"retry_count": 0,
"transfer_duration_ms": 1250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"upload_method": "resumable",
"destination_folder": "/My Drive/HR Backup",
"overwrite_existing": "false"
},
"inspected": true
},
"data": {
"labels": [
"External",
"Cloud Storage"
],
"label_ids": [
"lbl_external",
"lbl_cloud_storage"
]
},
"app": {
"name": "Google Chrome",
"description": "Google Chrome Web Browser",
"package_name": "com.google.chrome",
"binary_path": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
"command_line": "chrome.exe --profile-directory=Default",
"main_window_title": "Google Drive - Google Chrome",
"custom_data": {
"version": "120.0.6099.130",
"profile": "Default"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"cloud_file_id": "1abc123xyz",
"upload_session": "upload_sess_001"
},
"created_at": "2026-01-15T10:29:05Z",
"modified_at": "2026-01-15T10:29:05Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_end_dst_001",
"path": "C:\\Users\\john.doe\\Downloads\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "EXTERNAL-SHARE-01",
"path": "\\\\EXTERNAL-SHARE-01\\Public",
"custom_data": {
"share_type": "SMB",
"external_network": "true"
}
},
"email": {
"id": "email_end_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102900.002@company.com>",
"smtp_server": "smtp.gmail.com"
}
},
"email_attachment": {
"id": "attach_end_dst_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"file_size": "2048576",
"sanitized": "false"
}
},
"web": {
"url": "https://drive.google.com/file/d/1abc123xyz/view",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/uc?id=1abc123xyz&export=download",
"title": "employee_salaries_2026.xlsx - Google Drive",
"custom_data": {
"file_id": "1abc123xyz",
"sharing_status": "private"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"account_type": "personal"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_end_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123xyz/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"file_id": "1abc123xyz",
"revision_id": "rev_001",
"upload_complete": "true"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002",
"external_user_003"
],
"role": "role_editor",
"custom_data": {
"expiry_date": "2026-12-31",
"link_type": "restricted",
"notify_on_download": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4523",
"custom_data": {
"pages_printed": "12",
"color": "false"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_end_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_end_dst_001"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private",
"language": "Python",
"size_kb": "1024"
},
"branch": "main",
"id": "repo_end_dst_001"
},
"labels": [
"External",
"Cloud Storage",
"Personal Account"
],
"label_ids": [
"lbl_external",
"lbl_cloud_storage"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_cloud_upload_001",
"version": 1,
"definition_rule_ids": [
"rule_cloud_upload_block"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:29:00Z"
}
],
"issues": [
{
"id": "issue_end_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_cloud_upload_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:29:00Z"
}
],
"custom_data": {
"upload_destination": "personal_cloud",
"risk_level": "critical"
},
"outline": "Personal Google Drive account used as destination for unauthorized data upload containing HR confidential records.",
"type": "removable_media",
"domain": "drive.google.com",
"discovered_at": "2026-01-15T10:29:00Z",
"updated_at": "2026-01-15T10:29:05Z",
"update_event": {
"id": "upd_evt_end_dst_001",
"action_kind": "upload",
"timestamp": "2026-01-15T10:29:05Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_end_dst_001",
"cloud_connector": {
"id": "cc_teams_001",
"type": "teams",
"name": "Company Teams Integration",
"onboarding_account": "teams-admin@company.com",
"account_id": "teams_acct_001"
}
}
}
}
}
]
}
}
Human Readable Output
Cyberhaven Incidents
ID Policy Severity Status Blocked Event Time Start Event ID End Event ID AI Summary inc_a1b2c3d4e5f6 HR Data Exfiltration Prevention high open false 2026-01-15T10:28:45Z evt_start_001abc evt_end_002xyz User john.doe attempted to copy confidential HR records to a removable USB drive. The action was detected by endpoint DLP and flagged as a high-severity policy violation.
cyberhaven-incident-update
Update the status, assignment, or close reason of a Cyberhaven incident.
Base Command
cyberhaven-incident-update
Input
| Argument Name | Description | Required |
|---|---|---|
| incident_id | Specify the Cyberhaven incident ID. Note: Use ‘cyberhaven-incident-list’ to retrieve the incident ID. |
Required |
| status | Specify the status of the incident. Possible values are: Open, Closed. | Optional |
| close_reason | Specify the close reason while closing the incident. Possible values are: Resolved, False Positive, False Positive - Destination Not at Risk, False Positive - User Exempt, Other. | Optional |
| close_note | Provide the meaningful note when closing. | Optional |
| assigned_to | Provide analyst email to whom incident will assign. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Cyberhaven.Incident.id | String | The unique identifier of the incident. |
| Cyberhaven.Incident.user.id | String | The identifier of the user who triggered the incident. |
| Cyberhaven.Incident.user.local_username | String | The local machine username of the user who triggered the incident. |
| Cyberhaven.Incident.user.local_id | String | The local identifier of the user who triggered the incident. |
| Cyberhaven.Incident.event_lineage_id.start_event_id | String | The ID of the first event in the lineage chain. |
| Cyberhaven.Incident.event_lineage_id.end_event_id | String | The ID of the last event in the lineage chain. |
| Cyberhaven.Incident.blocked | Boolean | Whether the action that triggered the incident was blocked. |
| Cyberhaven.Incident.event_time | Date | The timestamp of the event that triggered the incident. |
| Cyberhaven.Incident.trigger_time | Date | The timestamp when the incident was triggered. |
| Cyberhaven.Incident.dataset.id | String | The identifier of the dataset involved in the incident. |
| Cyberhaven.Incident.dataset.name | String | The name of the dataset involved in the incident. |
| Cyberhaven.Incident.dataset.sensitivity | String | The sensitivity classification of the dataset involved. |
| Cyberhaven.Incident.user_risk_groups | String | The list of risk groups the user belongs to. |
| Cyberhaven.Incident.policy.id | String | The identifier of the DLP policy that was triggered. |
| Cyberhaven.Incident.policy.name | String | The name of the DLP policy that was triggered. |
| Cyberhaven.Incident.policy.severity | String | The severity level defined in the triggering DLP policy. |
| Cyberhaven.Incident.risk_score | Number | The numeric risk score assigned to the incident. |
| Cyberhaven.Incident.screenshot_guid | String | The GUID of the screenshot associated with the incident. |
| Cyberhaven.Incident.warning_status | String | The warning acknowledgement status of the incident. |
| Cyberhaven.Incident.user_reactions | String | The list of user reaction codes for the incident. |
| Cyberhaven.Incident.user_reaction_message | String | The message provided by the user when reacting to the warning. |
| Cyberhaven.Incident.reaction_time | Date | The timestamp when the user reacted to the warning. |
| Cyberhaven.Incident.assigned_to | String | The email of the analyst the incident is assigned to. |
| Cyberhaven.Incident.status | String | The current status of the incident (e.g. open, closed). |
| Cyberhaven.Incident.resolution_time | Date | The timestamp when the incident was resolved. |
| Cyberhaven.Incident.close_reason | String | The reason code provided when the incident was closed. |
| Cyberhaven.Incident.close_note | String | The free-text note provided when the incident was closed. |
| Cyberhaven.Incident.created_by | String | Indicates how the incident was created (e.g. created_by_policy). |
| Cyberhaven.Incident.ai_summary | String | The AI-generated summary of the incident. |
| Cyberhaven.Incident.ai_severity | String | The AI-assessed severity level of the incident. |
| Cyberhaven.Incident.last_modified | Date | The timestamp when the incident was last modified. |
| Cyberhaven.Incident.event_details.start_event.id | String | The ID of the start event. |
| Cyberhaven.Incident.event_details.start_event.timestamp | Date | The timestamp of the start event. |
| Cyberhaven.Incident.event_details.start_event.action.kind | String | The action kind performed in the start event (e.g. copy). |
| Cyberhaven.Incident.event_details.start_event.action.blocked | Boolean | Whether the action in the start event was blocked. |
| Cyberhaven.Incident.event_details.start_event.action.data_size | Number | The size of data involved in the start event action (bytes). |
| Cyberhaven.Incident.event_details.start_event.action.content.tags | String | The content classification tags detected in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.attributes | String | The content attributes of the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.upload_filename | String | The filename of the content being uploaded in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.inspected | Boolean | Whether the content was inspected in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.sensor_kind | String | The sensor type that detected the start event (e.g. endpoint). |
| Cyberhaven.Incident.event_details.start_event.action.hostname | String | The hostname of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.machine_serial_number | String | The serial number of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.ip_address | String | The IP address of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.device_type | String | The device management type for the start event (e.g. managed). |
| Cyberhaven.Incident.event_details.start_event.action.temporary_blocked | Boolean | Whether the start event action was temporarily blocked. |
| Cyberhaven.Incident.event_details.start_event.action.fail_close_statuses | String | The list of fail-close status objects for the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.process_id | Number | The process ID of the process that triggered the start event. |
| Cyberhaven.Incident.event_details.start_event.action.parent_process_id | Number | The parent process ID of the process that triggered the start event. |
| Cyberhaven.Incident.event_details.start_event.user.id | String | The identifier of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.user.local_username | String | The local username of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.user.local_id | String | The local ID of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.id | String | The ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.display_name | String | The display name of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.datastore_id | String | The datastore ID associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.dataset_sensitivity | String | The sensitivity classification of the dataset in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.dataset_ids | String | The list of dataset IDs associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.object_type | String | The object type (e.g. file, removable_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.state | String | The state of the object (e.g. active) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.tags | String | The content classification tags in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.attributes | String | The content attributes in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.upload_filename | String | The upload filename of the content in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.inspected | Boolean | Whether the content was inspected in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.data.labels | String | The data classification labels in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.data.label_ids | String | The data classification label IDs in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.name | String | The name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.description | String | The description of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.package_name | String | The package name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.binary_path | String | The binary path of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.command_line | String | The command line of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.main_window_title | String | The main window title of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.name | String | The file name in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.extension | String | The file extension in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.size | Number | The file size (bytes) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.md5_hash | String | The MD5 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.sha256_hash | String | The SHA-256 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.created_at | Date | The creation timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.modified_at | Date | The last modification timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.owner.name | String | The name of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.owner.id | String | The ID of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.local_file.id | String | The local file ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.local_file.path | String | The local file system path in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.network_share.hostname | String | The hostname of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.network_share.path | String | The path of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.id | String | The ID of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.from | String | The sender of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.to | String | The recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.cc | String | The CC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.bcc | String | The BCC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.subject | String | The subject of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email_attachment.id | String | The ID of the email attachment in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.url | String | The URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.domain | String | The domain of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.download_url | String | The download URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.title | String | The page title of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.user_agent | String | The user-agent string of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.provider | String | The cloud provider (e.g. google) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.name | String | The name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_name | String | The username in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_email | String | The user email in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_id | String | The instance ID of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_name | String | The instance name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.id | String | The ID of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.content_uri | String | The content URI of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.path | String | The path of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.scope | String | The sharing scope in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.role | String | The role of the cloud share recipient in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.name | String | The name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.description | String | The description of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.physical_location | String | The physical location of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.server | String | The print server hostname in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.share_name | String | The share name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.port | String | The port of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.driver | String | The driver name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.is_local | Boolean | Whether the printer is local in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.job_id | String | The print job ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.connectivity | String | The connectivity type of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.id | String | The ID of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.name | String | The name of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.product_id | String | The USB product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.sender | String | The sender of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_users | String | The recipient users of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_groups | String | The recipient groups of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.domain | String | The domain of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.workspace | String | The workspace of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.organization | String | The organization of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.name | String | The name of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.branch | String | The branch of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.id | String | The ID of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.labels | String | The labels applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.label_ids | String | The label IDs applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.matched_policies | String | The list of DLP policies matched by the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.issues | String | The list of DLP issues detected on the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.outline | String | The outline description of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.type | String | The endpoint type (e.g. endpoint, removable_media) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.domain | String | The domain of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.discovered_at | Date | The timestamp when the object was first discovered in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.updated_at | Date | The timestamp when the object was last updated in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.id | String | The ID of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.action_kind | String | The action kind of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.timestamp | Date | The timestamp of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.id | String | The user ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_username | String | The local username in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_id | String | The local ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.version_id | String | The version ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.id | String | The ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.type | String | The type of cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.name | String | The name of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.account_id | String | The account ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.id | String | The ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.display_name | String | The display name of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.datastore_id | String | The datastore ID associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.dataset_ids | String | The list of dataset IDs associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.object_type | String | The object type (e.g. file, removable_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.state | String | The state of the object (e.g. active) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.tags | String | The content classification tags in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.attributes | String | The content attributes in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.upload_filename | String | The upload filename of the content in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.inspected | Boolean | Whether the content was inspected in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.data.labels | String | The data classification labels in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.data.label_ids | String | The data classification label IDs in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.name | String | The name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.description | String | The description of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.package_name | String | The package name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.binary_path | String | The binary path of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.command_line | String | The command line of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.main_window_title | String | The main window title of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.name | String | The file name in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.extension | String | The file extension in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.size | Number | The file size (bytes) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.md5_hash | String | The MD5 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.sha256_hash | String | The SHA-256 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.created_at | Date | The creation timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.modified_at | Date | The last modification timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.owner.name | String | The name of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.owner.id | String | The ID of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.local_file.id | String | The local file ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.local_file.path | String | The local file system path in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.network_share.hostname | String | The hostname of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.network_share.path | String | The path of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.id | String | The ID of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.from | String | The sender of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.to | String | The recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.cc | String | The CC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.bcc | String | The BCC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.subject | String | The subject of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email_attachment.id | String | The ID of the email attachment in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.url | String | The URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.domain | String | The domain of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.download_url | String | The download URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.title | String | The page title of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.user_agent | String | The user-agent string of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.provider | String | The cloud provider (e.g. google) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.name | String | The name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_name | String | The username in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_email | String | The user email in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_id | String | The instance ID of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_name | String | The instance name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.id | String | The ID of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.content_uri | String | The content URI of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.path | String | The path of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.scope | String | The sharing scope in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.name | String | The name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.description | String | The description of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.physical_location | String | The physical location of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.server | String | The print server hostname in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.share_name | String | The share name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.port | String | The port of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.driver | String | The driver name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.is_local | Boolean | Whether the printer is local in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.job_id | String | The print job ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.connectivity | String | The connectivity type of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.id | String | The ID of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.name | String | The name of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.product_id | String | The USB product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.sender | String | The sender of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_users | String | The recipient users of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_groups | String | The recipient groups of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.domain | String | The domain of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.workspace | String | The workspace of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.organization | String | The organization of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.name | String | The name of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.branch | String | The branch of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.id | String | The ID of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.labels | String | The labels applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.label_ids | String | The label IDs applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.matched_policies | String | The list of DLP policies matched by the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.issues | String | The list of DLP issues detected on the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.outline | String | The outline description of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.type | String | The endpoint type (e.g. endpoint, removable_media) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.domain | String | The domain of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.discovered_at | Date | The timestamp when the object was first discovered in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.updated_at | Date | The timestamp when the object was last updated in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.id | String | The ID of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.action_kind | String | The action kind of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.timestamp | Date | The timestamp of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.id | String | The user ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_username | String | The local username in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_id | String | The local ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.version_id | String | The version ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.id | String | The ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.type | String | The type of cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.name | String | The name of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.account_id | String | The account ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.end_event.id | String | The ID of the end event. |
| Cyberhaven.Incident.event_details.end_event.timestamp | Date | The timestamp of the end event. |
| Cyberhaven.Incident.event_details.end_event.action.kind | String | The action kind performed in the end event (e.g. copy). |
| Cyberhaven.Incident.event_details.end_event.action.blocked | Boolean | Whether the action in the end event was blocked. |
| Cyberhaven.Incident.event_details.end_event.action.data_size | Number | The size of data involved in the end event action (bytes). |
| Cyberhaven.Incident.event_details.end_event.action.content.tags | String | The content classification tags detected in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.attributes | String | The content attributes of the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.upload_filename | String | The filename of the content being uploaded in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.inspected | Boolean | Whether the content was inspected in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.sensor_kind | String | The sensor type that detected the end event (e.g. endpoint). |
| Cyberhaven.Incident.event_details.end_event.action.hostname | String | The hostname of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.machine_serial_number | String | The serial number of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.ip_address | String | The IP address of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.device_type | String | The device management type for the end event (e.g. managed). |
| Cyberhaven.Incident.event_details.end_event.action.temporary_blocked | Boolean | Whether the end event action was temporarily blocked. |
| Cyberhaven.Incident.event_details.end_event.action.fail_close_statuses | String | The list of fail-close status objects for the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.process_id | Number | The process ID of the process that triggered the end event. |
| Cyberhaven.Incident.event_details.end_event.action.parent_process_id | Number | The parent process ID of the process that triggered the end event. |
| Cyberhaven.Incident.event_details.end_event.user.id | String | The identifier of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.user.local_username | String | The local username of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.user.local_id | String | The local ID of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.id | String | The ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.display_name | String | The display name of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.datastore_id | String | The datastore ID associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.dataset_sensitivity | String | The sensitivity classification of the dataset in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.dataset_ids | String | The list of dataset IDs associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.object_type | String | The object type (e.g. file, removable_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.state | String | The state of the object (e.g. active) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.tags | String | The content classification tags in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.attributes | String | The content attributes in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.upload_filename | String | The upload filename of the content in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.inspected | Boolean | Whether the content was inspected in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.data.labels | String | The data classification labels in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.data.label_ids | String | The data classification label IDs in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.name | String | The name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.description | String | The description of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.package_name | String | The package name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.binary_path | String | The binary path of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.command_line | String | The command line of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.main_window_title | String | The main window title of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.name | String | The file name in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.extension | String | The file extension in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.size | Number | The file size (bytes) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.md5_hash | String | The MD5 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.sha256_hash | String | The SHA-256 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.created_at | Date | The creation timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.modified_at | Date | The last modification timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.owner.name | String | The name of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.owner.id | String | The ID of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.local_file.id | String | The local file ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.local_file.path | String | The local file system path in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.network_share.hostname | String | The hostname of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.network_share.path | String | The path of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.id | String | The ID of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.from | String | The sender of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.to | String | The recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.cc | String | The CC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.bcc | String | The BCC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.subject | String | The subject of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email_attachment.id | String | The ID of the email attachment in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.url | String | The URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.domain | String | The domain of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.download_url | String | The download URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.title | String | The page title of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.user_agent | String | The user-agent string of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.provider | String | The cloud provider (e.g. google) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.name | String | The name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_name | String | The username in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_email | String | The user email in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_id | String | The instance ID of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_name | String | The instance name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.id | String | The ID of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.content_uri | String | The content URI of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.path | String | The path of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.scope | String | The sharing scope in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.role | String | The role of the cloud share recipient in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.name | String | The name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.description | String | The description of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.physical_location | String | The physical location of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.server | String | The print server hostname in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.share_name | String | The share name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.port | String | The port of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.driver | String | The driver name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.is_local | Boolean | Whether the printer is local in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.job_id | String | The print job ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.connectivity | String | The connectivity type of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.id | String | The ID of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.name | String | The name of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.product_id | String | The USB product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.sender | String | The sender of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_users | String | The recipient users of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_groups | String | The recipient groups of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.domain | String | The domain of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.workspace | String | The workspace of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.organization | String | The organization of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.name | String | The name of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.branch | String | The branch of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.id | String | The ID of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.labels | String | The labels applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.label_ids | String | The label IDs applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.matched_policies | String | The list of DLP policies matched by the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.issues | String | The list of DLP issues detected on the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.outline | String | The outline description of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.type | String | The endpoint type (e.g. endpoint, removable_media) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.domain | String | The domain of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.discovered_at | Date | The timestamp when the object was first discovered in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.updated_at | Date | The timestamp when the object was last updated in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.id | String | The ID of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.action_kind | String | The action kind of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.timestamp | Date | The timestamp of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.id | String | The user ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_username | String | The local username in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_id | String | The local ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.version_id | String | The version ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.id | String | The ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.type | String | The type of cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.name | String | The name of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.account_id | String | The account ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.id | String | The ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.display_name | String | The display name of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.datastore_id | String | The datastore ID associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.dataset_ids | String | The list of dataset IDs associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.object_type | String | The object type (e.g. file, removable_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.state | String | The state of the object (e.g. active) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.tags | String | The content classification tags in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.attributes | String | The content attributes in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.upload_filename | String | The upload filename of the content in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.inspected | Boolean | Whether the content was inspected in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.data.labels | String | The data classification labels in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.data.label_ids | String | The data classification label IDs in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.name | String | The name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.description | String | The description of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.package_name | String | The package name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.binary_path | String | The binary path of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.command_line | String | The command line of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.main_window_title | String | The main window title of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.name | String | The file name in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.extension | String | The file extension in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.size | Number | The file size (bytes) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.md5_hash | String | The MD5 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.sha256_hash | String | The SHA-256 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.created_at | Date | The creation timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.modified_at | Date | The last modification timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.owner.name | String | The name of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.owner.id | String | The ID of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.local_file.id | String | The local file ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.local_file.path | String | The local file system path in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.network_share.hostname | String | The hostname of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.network_share.path | String | The path of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.id | String | The ID of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.from | String | The sender of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.to | String | The recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.cc | String | The CC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.bcc | String | The BCC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.subject | String | The subject of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email_attachment.id | String | The ID of the email attachment in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.url | String | The URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.domain | String | The domain of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.download_url | String | The download URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.title | String | The page title of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.user_agent | String | The user-agent string of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.provider | String | The cloud provider (e.g. google) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.name | String | The name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_name | String | The username in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_email | String | The user email in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_id | String | The instance ID of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_name | String | The instance name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.id | String | The ID of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.content_uri | String | The content URI of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.path | String | The path of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.scope | String | The sharing scope in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.name | String | The name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.description | String | The description of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.physical_location | String | The physical location of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.server | String | The print server hostname in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.share_name | String | The share name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.port | String | The port of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.driver | String | The driver name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.is_local | Boolean | Whether the printer is local in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.job_id | String | The print job ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.connectivity | String | The connectivity type of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.id | String | The ID of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.name | String | The name of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.product_id | String | The USB product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.sender | String | The sender of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_users | String | The recipient users of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_groups | String | The recipient groups of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.domain | String | The domain of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.workspace | String | The workspace of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.organization | String | The organization of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.name | String | The name of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.branch | String | The branch of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.id | String | The ID of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.labels | String | The labels applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.label_ids | String | The label IDs applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.matched_policies | String | The list of DLP policies matched by the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.issues | String | The list of DLP issues detected on the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.outline | String | The outline description of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.type | String | The endpoint type (e.g. endpoint, removable_media) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.domain | String | The domain of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.discovered_at | Date | The timestamp when the object was first discovered in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.updated_at | Date | The timestamp when the object was last updated in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.id | String | The ID of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.action_kind | String | The action kind of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.timestamp | Date | The timestamp of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.id | String | The user ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_username | String | The local username in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_id | String | The local ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.version_id | String | The version ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.id | String | The ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.type | String | The type of cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.name | String | The name of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.account_id | String | The account ID of the cloud connector in the end event. |
Command example
!cyberhaven-incident-update incident_id="inc_a1b2c3d4e5f6" status="Closed"
Context Example
{
"Cyberhaven": {
"Incidents": [
{
"id": "inc_a1b2c3d4e5f6",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"department": "Engineering",
"manager_email": "jane.smith@company.com",
"employee_id": "EMP-10042",
"location": "US-NYC",
"role": "Senior Software Engineer"
}
},
"event_lineage_id": {
"start_event_id": "evt_start_001abc",
"end_event_id": "evt_end_002xyz"
},
"blocked": false,
"event_time": "2026-01-15T10:28:45Z",
"trigger_time": "2026-01-15T10:29:02Z",
"dataset": {
"id": "ds_hr_confidential",
"name": "HR Confidential Records",
"sensitivity": "high",
"custom_data": {
"classification_level": "confidential",
"data_owner": "hr@company.com"
}
},
"user_risk_groups": [
{
"id": "rg_high_risk_users",
"name": "High Risk Users",
"risk_multiplier": 1.5,
"custom_data": {
"criteria": "multiple_policy_violations"
}
}
],
"policy": {
"id": "pol_dlp_hr_001",
"name": "HR Data Exfiltration Prevention",
"severity": "high",
"custom_data": {
"policy_owner": "security@company.com",
"enforcement_mode": "block",
"review_cycle": "quarterly",
"compliance_framework": "SOC2"
}
},
"risk_score": 8.5,
"screenshot_guid": "scrn_7f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
"warning_status": "warning_shown",
"user_reactions": [
"reaction_acknowledged"
],
"user_reaction_message": "I was transferring files for an approved project backup.",
"reaction_time": "2026-01-15T10:31:15Z",
"assigned_to": "analyst@company.com",
"status": "closed",
"resolution_time": "2026-01-15T14:45:00Z",
"close_reason": "policy_violation",
"close_note": "User violated data exfiltration policy. Escalated to HR.",
"custom_data": {
"ticket_id": "JIRA-4521"
},
"created_by": "created_by_system",
"ai_summary": "User john.doe attempted to copy confidential HR records to a removable USB drive. The action was detected by endpoint DLP and flagged as a high-severity policy violation.",
"ai_severity": "high",
"last_modified": "2026-01-15T11:00:00Z",
"event_details": {
"start_event": {
"id": "evt_start_001abc",
"timestamp": "2026-01-15T10:28:45Z",
"action": {
"kind": "copy",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"encoding": "UTF-8"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"ad_group": "Domain Users",
"upn": "john.doe@company.com",
"last_login": "2026-01-15T08:05:00Z"
}
},
"source": {
"id": "src_local_001abc",
"display_name": "employee_salaries_2026.xlsx",
"datastore_id": "dstore_endpoint_01",
"dataset_sensitivity": "sensitivity_high",
"dataset_ids": [
"ds_hr_confidential"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"classification": "confidential",
"last_scan": "2026-01-10T09:00:00Z",
"scan_result": "contains_pii",
"owner_department": "HR"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential",
"HR Data"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Microsoft Excel",
"description": "Microsoft Office Spreadsheet Application",
"package_name": "com.microsoft.excel",
"binary_path": "C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE",
"command_line": "\"EXCEL.EXE\" /e",
"main_window_title": "employee_salaries_2026.xlsx - Excel",
"custom_data": {
"version": "16.0.17126.20132",
"publisher": "Microsoft Corporation",
"signed": "true",
"install_date": "2023-06-01",
"auto_update": "enabled"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"creator": "john.doe",
"last_modified_by": "jane.smith"
},
"created_at": "2026-01-10T09:00:00Z",
"modified_at": "2026-01-15T08:30:00Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_001abc",
"path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>",
"x_mailer": "Microsoft Outlook 16.0"
}
},
"email_attachment": {
"id": "attach_src_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload",
"custom_data": {
"referrer": "https://drive.google.com/",
"request_method": "POST"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Data/employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"revision_id": "rev_001"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12",
"duplex": "false"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"file_system": "NTFS",
"capacity_gb": "64"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_001abc"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private",
"default_branch": "main",
"last_commit": "a1b2c3d4e5f6",
"language": "Python"
},
"branch": "main",
"id": "repo_001"
},
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection",
"rule_confidential_data"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:28:45Z"
}
],
"issues": [
{
"id": "issue_001abc",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:45Z"
}
],
"custom_data": {
"data_classification": "confidential",
"retention_policy": "7_years",
"gdpr_relevant": "true",
"ccpa_relevant": "true"
},
"outline": "Spreadsheet containing employee salary and compensation data for 250 employees in the Engineering department.",
"type": "removable_media",
"domain": "company.com",
"discovered_at": "2026-01-10T09:00:00Z",
"updated_at": "2026-01-15T10:28:45Z",
"update_event": {
"id": "upd_evt_001",
"action_kind": "copy",
"timestamp": "2026-01-15T10:28:45Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_001abc",
"cloud_connector": {
"id": "cc_box_001",
"type": "box",
"name": "Company Box Integration",
"onboarding_account": "admin@company.com",
"account_id": "box_acct_001"
}
},
"destination": {
"id": "dst_usb_001abc",
"display_name": "SanDisk Ultra 64GB (E:)",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "removable_storage",
"state": "active",
"content": {
"tags": [
"external",
"removable"
],
"attributes": {
"file_count": 1,
"total_size": 2048576
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"destination_path": "E:\\Backup\\HR",
"overwrite": "false"
},
"inspected": true
},
"data": {
"labels": [
"External Storage"
],
"label_ids": [
"lbl_external_storage"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe /select,\"E:\\Backup\\HR\\employee_salaries_2026.xlsx\"",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"destination_created": "true",
"is_copy": "true",
"original_path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_dst_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\Backup\\HR",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>"
}
},
"email_attachment": {
"id": "attach_dst_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"file_size": "2048576",
"sanitized": "false"
}
},
"web": {
"url": "https://drive.google.com/upload/resumable",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload Complete",
"custom_data": {
"upload_session_id": "upload_sess_001"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"upload_complete": "true"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"upload_timestamp": "2026-01-15T10:29:00Z",
"file_id": "1abc123xyz"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true",
"link_type": "restricted"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"drive_letter": "E",
"free_space_gb": "45"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_dst_001",
"channel": "direct",
"platform": "teams",
"thread_id": "thread_001",
"is_external": "true"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_dst_001"
},
"labels": [
"External Storage",
"Removable Media"
],
"label_ids": [
"lbl_external_storage",
"lbl_removable_media"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_removable_001",
"version": 2,
"definition_rule_ids": [
"rule_removable_media_write"
],
"action_rule_id": "action_rule_alert",
"matched_at": "2026-01-15T10:28:50Z"
}
],
"issues": [
{
"id": "issue_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_removable_001",
"policy_action_rule_id": "action_rule_alert",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:50Z"
}
],
"custom_data": {
"endpoint_risk": "high",
"device_approved": "false"
},
"outline": "USB removable storage device used as destination for confidential HR file transfer.",
"type": "share",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:45Z",
"updated_at": "2026-01-15T10:28:50Z",
"update_event": {
"id": "upd_evt_dst_001",
"action_kind": "write",
"timestamp": "2026-01-15T10:28:50Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_dst_001",
"cloud_connector": {
"id": "cc_gcs_001",
"type": "gcs",
"name": "Company GCS Integration",
"onboarding_account": "gcs-service@company.iam.gserviceaccount.com",
"account_id": "gcs_acct_001"
}
}
},
"end_event": {
"id": "evt_end_002xyz",
"timestamp": "2026-01-15T10:29:00Z",
"action": {
"kind": "upload",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500,
"page_count": 3
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"encoding": "UTF-8",
"compressed": "false",
"checksum_verified": "true"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2",
"network_zone": "internal"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
},
"source": {
"id": "src_end_001abc",
"display_name": "E:\\Backup\\HR\\employee_salaries_2026.xlsx",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"drive_letter": "E"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_end_src_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB",
"mount_point": "Z:"
}
},
"email": {
"id": "email_end_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102900.002@company.com>"
}
},
"email_attachment": {
"id": "attach_end_src_001",
"custom_data": {
"attachment_index": "0"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive",
"custom_data": {
"referrer": "https://drive.google.com/",
"request_method": "POST",
"response_code": "200"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1",
"auth_method": "oauth2"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_end_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"file_id": "1abc123xyz",
"revision": "1"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4522",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_end_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"file_system": "NTFS",
"drive_letter": "E"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_end_001",
"platform": "teams",
"thread_id": "thread_001",
"channel_type": "direct_message"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_end_src_001"
},
"labels": [
"External Storage",
"PII"
],
"label_ids": [
"lbl_external_storage",
"lbl_pii"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:29:00Z"
}
],
"issues": [
{
"id": "issue_end_src_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:29:00Z"
}
],
"custom_data": {
"data_classification": "confidential",
"risk_level": "high",
"source_type": "removable_media"
},
"outline": "File read from USB removable storage during end event of the data transfer sequence.",
"type": "endpoint",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:50Z",
"updated_at": "2026-01-15T10:29:00Z",
"update_event": {
"id": "upd_evt_end_src_001",
"action_kind": "read",
"timestamp": "2026-01-15T10:29:00Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_end_src_001",
"cloud_connector": {
"id": "cc_salesforce_001",
"type": "salesforce",
"name": "Company Salesforce Integration",
"onboarding_account": "admin@company.com",
"account_id": "sf_acct_001"
}
},
"destination": {
"id": "dst_end_001abc",
"display_name": "Google Drive - Personal",
"datastore_id": "dstore_gdrive_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_external_cloud"
],
"object_type": "cloud_file",
"state": "active",
"content": {
"tags": [
"external",
"cloud"
],
"attributes": {
"file_count": 1,
"total_size": 2048576,
"upload_chunks": 2,
"retry_count": 0,
"transfer_duration_ms": 1250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"upload_method": "resumable",
"destination_folder": "/My Drive/HR Backup",
"overwrite_existing": "false"
},
"inspected": true
},
"data": {
"labels": [
"External",
"Cloud Storage"
],
"label_ids": [
"lbl_external",
"lbl_cloud_storage"
]
},
"app": {
"name": "Google Chrome",
"description": "Google Chrome Web Browser",
"package_name": "com.google.chrome",
"binary_path": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
"command_line": "chrome.exe --profile-directory=Default",
"main_window_title": "Google Drive - Google Chrome",
"custom_data": {
"version": "120.0.6099.130",
"profile": "Default"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"cloud_file_id": "1abc123xyz",
"upload_session": "upload_sess_001"
},
"created_at": "2026-01-15T10:29:05Z",
"modified_at": "2026-01-15T10:29:05Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_end_dst_001",
"path": "C:\\Users\\john.doe\\Downloads\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "EXTERNAL-SHARE-01",
"path": "\\\\EXTERNAL-SHARE-01\\Public",
"custom_data": {
"share_type": "SMB",
"external_network": "true"
}
},
"email": {
"id": "email_end_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102900.002@company.com>",
"smtp_server": "smtp.gmail.com"
}
},
"email_attachment": {
"id": "attach_end_dst_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"file_size": "2048576",
"sanitized": "false"
}
},
"web": {
"url": "https://drive.google.com/file/d/1abc123xyz/view",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/uc?id=1abc123xyz&export=download",
"title": "employee_salaries_2026.xlsx - Google Drive",
"custom_data": {
"file_id": "1abc123xyz",
"sharing_status": "private"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"account_type": "personal"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_end_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123xyz/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"file_id": "1abc123xyz",
"revision_id": "rev_001",
"upload_complete": "true"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002",
"external_user_003"
],
"role": "role_editor",
"custom_data": {
"expiry_date": "2026-12-31",
"link_type": "restricted",
"notify_on_download": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4523",
"custom_data": {
"pages_printed": "12",
"color": "false"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_end_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_end_dst_001"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private",
"language": "Python",
"size_kb": "1024"
},
"branch": "main",
"id": "repo_end_dst_001"
},
"labels": [
"External",
"Cloud Storage",
"Personal Account"
],
"label_ids": [
"lbl_external",
"lbl_cloud_storage"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_cloud_upload_001",
"version": 1,
"definition_rule_ids": [
"rule_cloud_upload_block"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:29:00Z"
}
],
"issues": [
{
"id": "issue_end_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_cloud_upload_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:29:00Z"
}
],
"custom_data": {
"upload_destination": "personal_cloud",
"risk_level": "critical"
},
"outline": "Personal Google Drive account used as destination for unauthorized data upload containing HR confidential records.",
"type": "removable_media",
"domain": "drive.google.com",
"discovered_at": "2026-01-15T10:29:00Z",
"updated_at": "2026-01-15T10:29:05Z",
"update_event": {
"id": "upd_evt_end_dst_001",
"action_kind": "upload",
"timestamp": "2026-01-15T10:29:05Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_end_dst_001",
"cloud_connector": {
"id": "cc_teams_001",
"type": "teams",
"name": "Company Teams Integration",
"onboarding_account": "teams-admin@company.com",
"account_id": "teams_acct_001"
}
}
}
}
}
]
}
}
Human Readable Output
Incident inc_a1b2c3d4e5f6 updated successfully
ID Policy Severity Status Blocked Event Time Start Event ID End Event ID AI Summary inc_a1b2c3d4e5f6 HR Data Exfiltration Prevention high closed false 2026-01-15T10:28:45Z evt_start_001abc evt_end_002xyz User john.doe attempted to copy confidential HR records to a removable USB drive. The action was detected by endpoint DLP and flagged as a high-severity policy violation.
cyberhaven-event-details-get
Retrieves full details for one or more Cyberhaven events by ID.
Base Command
cyberhaven-event-details-get
Input
| Argument Name | Description | Required |
|---|---|---|
| event_ids | A comma-separated list of event UUIDs to get the events. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Cyberhaven.Event.id | String | The unique identifier of the event. |
| Cyberhaven.Event.timestamp | Date | The timestamp when the event occurred. |
| Cyberhaven.Event.action.kind | String | The kind of action performed (e.g. copy, upload). |
| Cyberhaven.Event.action.blocked | Boolean | Whether the action was blocked by policy. |
| Cyberhaven.Event.action.data_size | Number | The size of data involved in the action (bytes). |
| Cyberhaven.Event.action.content.tags | String | The content classification tags detected in the action. |
| Cyberhaven.Event.action.content.attributes | String | The content attributes of the action. |
| Cyberhaven.Event.action.content.upload_filename | String | The filename of the content being uploaded in the action. |
| Cyberhaven.Event.action.content.inspected | Boolean | Whether the content was inspected in the action. |
| Cyberhaven.Event.action.sensor_kind | String | The sensor type that detected the action (e.g. endpoint). |
| Cyberhaven.Event.action.hostname | String | The hostname of the machine where the action occurred. |
| Cyberhaven.Event.action.machine_serial_number | String | The serial number of the machine where the action occurred. |
| Cyberhaven.Event.action.ip_address | String | The IP address of the machine where the action occurred. |
| Cyberhaven.Event.action.device_type | String | The device management type (e.g. managed). |
| Cyberhaven.Event.action.temporary_blocked | Boolean | Whether the action was temporarily blocked. |
| Cyberhaven.Event.action.fail_close_statuses | String | The list of fail-close status objects for the action. |
| Cyberhaven.Event.action.process_id | Number | The process ID of the process that triggered the action. |
| Cyberhaven.Event.action.parent_process_id | Number | The parent process ID of the process that triggered the action. |
| Cyberhaven.Event.user.id | String | The identifier of the user who triggered the event. |
| Cyberhaven.Event.user.local_username | String | The local machine username of the user who triggered the event. |
| Cyberhaven.Event.user.local_id | String | The local identifier of the user who triggered the event. |
| Cyberhaven.Event.source.id | String | The ID of the object. |
| Cyberhaven.Event.source.display_name | String | The display name of the object. |
| Cyberhaven.Event.source.datastore_id | String | The datastore ID associated with the object. |
| Cyberhaven.Event.source.dataset_sensitivity | String | The sensitivity classification of the dataset. |
| Cyberhaven.Event.source.dataset_ids | String | The list of dataset IDs associated with the object. |
| Cyberhaven.Event.source.object_type | String | The object type (e.g. file, removable_storage). |
| Cyberhaven.Event.source.state | String | The state of the object (e.g. active). |
| Cyberhaven.Event.source.content.tags | String | The content classification tags. |
| Cyberhaven.Event.source.content.attributes | String | The content attributes. |
| Cyberhaven.Event.source.content.upload_filename | String | The upload filename of the content. |
| Cyberhaven.Event.source.content.inspected | Boolean | Whether the content was inspected. |
| Cyberhaven.Event.source.data.labels | String | The data classification labels. |
| Cyberhaven.Event.source.data.label_ids | String | The data classification label IDs. |
| Cyberhaven.Event.source.app.name | String | The name of the associated application. |
| Cyberhaven.Event.source.app.description | String | The description of the associated application. |
| Cyberhaven.Event.source.app.package_name | String | The package name of the associated application. |
| Cyberhaven.Event.source.app.binary_path | String | The binary path of the associated application. |
| Cyberhaven.Event.source.app.command_line | String | The command line of the associated application. |
| Cyberhaven.Event.source.app.main_window_title | String | The main window title of the associated application. |
| Cyberhaven.Event.source.file.name | String | The file name. |
| Cyberhaven.Event.source.file.extension | String | The file extension. |
| Cyberhaven.Event.source.file.size | Number | The file size (bytes). |
| Cyberhaven.Event.source.file.md5_hash | String | The MD5 hash of the file. |
| Cyberhaven.Event.source.file.sha256_hash | String | The SHA-256 hash of the file. |
| Cyberhaven.Event.source.file.created_at | Date | The creation timestamp of the file. |
| Cyberhaven.Event.source.file.modified_at | Date | The last modification timestamp of the file. |
| Cyberhaven.Event.source.file.owner.name | String | The name of the file owner. |
| Cyberhaven.Event.source.file.owner.id | String | The ID of the file owner. |
| Cyberhaven.Event.source.local_file.id | String | The local file ID. |
| Cyberhaven.Event.source.local_file.path | String | The local file system path. |
| Cyberhaven.Event.source.network_share.hostname | String | The hostname of the network share. |
| Cyberhaven.Event.source.network_share.path | String | The path of the network share. |
| Cyberhaven.Event.source.email.id | String | The ID of the email. |
| Cyberhaven.Event.source.email.from | String | The sender of the email. |
| Cyberhaven.Event.source.email.to | String | The recipients of the email. |
| Cyberhaven.Event.source.email.cc | String | The CC recipients of the email. |
| Cyberhaven.Event.source.email.bcc | String | The BCC recipients of the email. |
| Cyberhaven.Event.source.email.subject | String | The subject of the email. |
| Cyberhaven.Event.source.email_attachment.id | String | The ID of the email attachment. |
| Cyberhaven.Event.source.web.url | String | The URL of the web endpoint. |
| Cyberhaven.Event.source.web.domain | String | The domain of the web endpoint. |
| Cyberhaven.Event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage). |
| Cyberhaven.Event.source.web.download_url | String | The download URL of the web endpoint. |
| Cyberhaven.Event.source.web.title | String | The page title of the web endpoint. |
| Cyberhaven.Event.source.web.user_agent | String | The user-agent string of the web endpoint. |
| Cyberhaven.Event.source.cloud_app.provider | String | The cloud provider (e.g. google). |
| Cyberhaven.Event.source.cloud_app.name | String | The name of the cloud application. |
| Cyberhaven.Event.source.cloud_app.user_name | String | The username in the cloud application. |
| Cyberhaven.Event.source.cloud_app.user_email | String | The user email in the cloud application. |
| Cyberhaven.Event.source.cloud_app.instance_id | String | The instance ID of the cloud application. |
| Cyberhaven.Event.source.cloud_app.instance_name | String | The instance name of the cloud application. |
| Cyberhaven.Event.source.cloud_file.id | String | The ID of the cloud file. |
| Cyberhaven.Event.source.cloud_file.content_uri | String | The content URI of the cloud file. |
| Cyberhaven.Event.source.cloud_file.path | String | The path of the cloud file. |
| Cyberhaven.Event.source.cloud_share_recipient.scope | String | The sharing scope. |
| Cyberhaven.Event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share. |
| Cyberhaven.Event.source.cloud_share_recipient.role | String | The role of the cloud share recipient. |
| Cyberhaven.Event.source.printer.name | String | The name of the printer. |
| Cyberhaven.Event.source.printer.description | String | The description of the printer. |
| Cyberhaven.Event.source.printer.physical_location | String | The physical location of the printer. |
| Cyberhaven.Event.source.printer.server | String | The print server hostname. |
| Cyberhaven.Event.source.printer.share_name | String | The share name of the printer. |
| Cyberhaven.Event.source.printer.port | String | The port of the printer. |
| Cyberhaven.Event.source.printer.driver | String | The driver name of the printer. |
| Cyberhaven.Event.source.printer.is_local | Boolean | Whether the printer is local. |
| Cyberhaven.Event.source.printer.job_id | String | The print job ID. |
| Cyberhaven.Event.source.printer.connectivity | String | The connectivity type of the printer. |
| Cyberhaven.Event.source.removable_storage.id | String | The ID of the removable storage device. |
| Cyberhaven.Event.source.removable_storage.name | String | The name of the removable storage device. |
| Cyberhaven.Event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage. |
| Cyberhaven.Event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage. |
| Cyberhaven.Event.source.removable_storage.product_id | String | The USB product ID of the removable storage. |
| Cyberhaven.Event.source.im_message.sender | String | The sender of the IM message. |
| Cyberhaven.Event.source.im_message.recipient_users | String | The recipient users of the IM message. |
| Cyberhaven.Event.source.im_message.recipient_groups | String | The recipient groups of the IM message. |
| Cyberhaven.Event.source.im_message.domain | String | The domain of the IM message. |
| Cyberhaven.Event.source.im_message.workspace | String | The workspace of the IM message. |
| Cyberhaven.Event.source.source_code_repo.organization | String | The organization of the source code repository. |
| Cyberhaven.Event.source.source_code_repo.name | String | The name of the source code repository. |
| Cyberhaven.Event.source.source_code_repo.branch | String | The branch of the source code repository. |
| Cyberhaven.Event.source.source_code_repo.id | String | The ID of the source code repository. |
| Cyberhaven.Event.source.labels | String | The labels applied to the object. |
| Cyberhaven.Event.source.label_ids | String | The label IDs applied to the object. |
| Cyberhaven.Event.source.matched_policies | String | The list of DLP policies matched by the object. |
| Cyberhaven.Event.source.issues | String | The list of DLP issues detected on the object. |
| Cyberhaven.Event.source.outline | String | The outline description of the object. |
| Cyberhaven.Event.source.type | String | The endpoint type (e.g. endpoint, removable_media). |
| Cyberhaven.Event.source.domain | String | The domain of the object. |
| Cyberhaven.Event.source.discovered_at | Date | The timestamp when the object was first discovered. |
| Cyberhaven.Event.source.updated_at | Date | The timestamp when the object was last updated. |
| Cyberhaven.Event.source.update_event.id | String | The ID of the update event. |
| Cyberhaven.Event.source.update_event.action_kind | String | The action kind of the update event. |
| Cyberhaven.Event.source.update_event.timestamp | Date | The timestamp of the update event. |
| Cyberhaven.Event.source.update_event.user.id | String | The user ID in the update event. |
| Cyberhaven.Event.source.update_event.user.local_username | String | The local username in the update event. |
| Cyberhaven.Event.source.update_event.user.local_id | String | The local ID in the update event. |
| Cyberhaven.Event.source.version_id | String | The version ID of the object. |
| Cyberhaven.Event.source.cloud_connector.id | String | The ID of the cloud connector. |
| Cyberhaven.Event.source.cloud_connector.type | String | The type of cloud connector. |
| Cyberhaven.Event.source.cloud_connector.name | String | The name of the cloud connector. |
| Cyberhaven.Event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector. |
| Cyberhaven.Event.source.cloud_connector.account_id | String | The account ID of the cloud connector. |
| Cyberhaven.Event.destination.id | String | The ID of the object. |
| Cyberhaven.Event.destination.display_name | String | The display name of the object. |
| Cyberhaven.Event.destination.datastore_id | String | The datastore ID associated with the object. |
| Cyberhaven.Event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset. |
| Cyberhaven.Event.destination.dataset_ids | String | The list of dataset IDs associated with the object. |
| Cyberhaven.Event.destination.object_type | String | The object type (e.g. file, removable_storage). |
| Cyberhaven.Event.destination.state | String | The state of the object (e.g. active). |
| Cyberhaven.Event.destination.content.tags | String | The content classification tags. |
| Cyberhaven.Event.destination.content.attributes | String | The content attributes. |
| Cyberhaven.Event.destination.content.upload_filename | String | The upload filename of the content. |
| Cyberhaven.Event.destination.content.inspected | Boolean | Whether the content was inspected. |
| Cyberhaven.Event.destination.data.labels | String | The data classification labels. |
| Cyberhaven.Event.destination.data.label_ids | String | The data classification label IDs. |
| Cyberhaven.Event.destination.app.name | String | The name of the associated application. |
| Cyberhaven.Event.destination.app.description | String | The description of the associated application. |
| Cyberhaven.Event.destination.app.package_name | String | The package name of the associated application. |
| Cyberhaven.Event.destination.app.binary_path | String | The binary path of the associated application. |
| Cyberhaven.Event.destination.app.command_line | String | The command line of the associated application. |
| Cyberhaven.Event.destination.app.main_window_title | String | The main window title of the associated application. |
| Cyberhaven.Event.destination.file.name | String | The file name. |
| Cyberhaven.Event.destination.file.extension | String | The file extension. |
| Cyberhaven.Event.destination.file.size | Number | The file size (bytes). |
| Cyberhaven.Event.destination.file.md5_hash | String | The MD5 hash of the file. |
| Cyberhaven.Event.destination.file.sha256_hash | String | The SHA-256 hash of the file. |
| Cyberhaven.Event.destination.file.created_at | Date | The creation timestamp of the file. |
| Cyberhaven.Event.destination.file.modified_at | Date | The last modification timestamp of the file. |
| Cyberhaven.Event.destination.file.owner.name | String | The name of the file owner. |
| Cyberhaven.Event.destination.file.owner.id | String | The ID of the file owner. |
| Cyberhaven.Event.destination.local_file.id | String | The local file ID. |
| Cyberhaven.Event.destination.local_file.path | String | The local file system path. |
| Cyberhaven.Event.destination.network_share.hostname | String | The hostname of the network share. |
| Cyberhaven.Event.destination.network_share.path | String | The path of the network share. |
| Cyberhaven.Event.destination.email.id | String | The ID of the email. |
| Cyberhaven.Event.destination.email.from | String | The sender of the email. |
| Cyberhaven.Event.destination.email.to | String | The recipients of the email. |
| Cyberhaven.Event.destination.email.cc | String | The CC recipients of the email. |
| Cyberhaven.Event.destination.email.bcc | String | The BCC recipients of the email. |
| Cyberhaven.Event.destination.email.subject | String | The subject of the email. |
| Cyberhaven.Event.destination.email_attachment.id | String | The ID of the email attachment. |
| Cyberhaven.Event.destination.web.url | String | The URL of the web endpoint. |
| Cyberhaven.Event.destination.web.domain | String | The domain of the web endpoint. |
| Cyberhaven.Event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage). |
| Cyberhaven.Event.destination.web.download_url | String | The download URL of the web endpoint. |
| Cyberhaven.Event.destination.web.title | String | The page title of the web endpoint. |
| Cyberhaven.Event.destination.web.user_agent | String | The user-agent string of the web endpoint. |
| Cyberhaven.Event.destination.cloud_app.provider | String | The cloud provider (e.g. google). |
| Cyberhaven.Event.destination.cloud_app.name | String | The name of the cloud application. |
| Cyberhaven.Event.destination.cloud_app.user_name | String | The username in the cloud application. |
| Cyberhaven.Event.destination.cloud_app.user_email | String | The user email in the cloud application. |
| Cyberhaven.Event.destination.cloud_app.instance_id | String | The instance ID of the cloud application. |
| Cyberhaven.Event.destination.cloud_app.instance_name | String | The instance name of the cloud application. |
| Cyberhaven.Event.destination.cloud_file.id | String | The ID of the cloud file. |
| Cyberhaven.Event.destination.cloud_file.content_uri | String | The content URI of the cloud file. |
| Cyberhaven.Event.destination.cloud_file.path | String | The path of the cloud file. |
| Cyberhaven.Event.destination.cloud_share_recipient.scope | String | The sharing scope. |
| Cyberhaven.Event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share. |
| Cyberhaven.Event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient. |
| Cyberhaven.Event.destination.printer.name | String | The name of the printer. |
| Cyberhaven.Event.destination.printer.description | String | The description of the printer. |
| Cyberhaven.Event.destination.printer.physical_location | String | The physical location of the printer. |
| Cyberhaven.Event.destination.printer.server | String | The print server hostname. |
| Cyberhaven.Event.destination.printer.share_name | String | The share name of the printer. |
| Cyberhaven.Event.destination.printer.port | String | The port of the printer. |
| Cyberhaven.Event.destination.printer.driver | String | The driver name of the printer. |
| Cyberhaven.Event.destination.printer.is_local | Boolean | Whether the printer is local. |
| Cyberhaven.Event.destination.printer.job_id | String | The print job ID. |
| Cyberhaven.Event.destination.printer.connectivity | String | The connectivity type of the printer. |
| Cyberhaven.Event.destination.removable_storage.id | String | The ID of the removable storage device. |
| Cyberhaven.Event.destination.removable_storage.name | String | The name of the removable storage device. |
| Cyberhaven.Event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage. |
| Cyberhaven.Event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage. |
| Cyberhaven.Event.destination.removable_storage.product_id | String | The USB product ID of the removable storage. |
| Cyberhaven.Event.destination.im_message.sender | String | The sender of the IM message. |
| Cyberhaven.Event.destination.im_message.recipient_users | String | The recipient users of the IM message. |
| Cyberhaven.Event.destination.im_message.recipient_groups | String | The recipient groups of the IM message. |
| Cyberhaven.Event.destination.im_message.domain | String | The domain of the IM message. |
| Cyberhaven.Event.destination.im_message.workspace | String | The workspace of the IM message. |
| Cyberhaven.Event.destination.source_code_repo.organization | String | The organization of the source code repository. |
| Cyberhaven.Event.destination.source_code_repo.name | String | The name of the source code repository. |
| Cyberhaven.Event.destination.source_code_repo.branch | String | The branch of the source code repository. |
| Cyberhaven.Event.destination.source_code_repo.id | String | The ID of the source code repository. |
| Cyberhaven.Event.destination.labels | String | The labels applied to the object. |
| Cyberhaven.Event.destination.label_ids | String | The label IDs applied to the object. |
| Cyberhaven.Event.destination.matched_policies | String | The list of DLP policies matched by the object. |
| Cyberhaven.Event.destination.issues | String | The list of DLP issues detected on the object. |
| Cyberhaven.Event.destination.outline | String | The outline description of the object. |
| Cyberhaven.Event.destination.type | String | The endpoint type (e.g. endpoint, removable_media). |
| Cyberhaven.Event.destination.domain | String | The domain of the object. |
| Cyberhaven.Event.destination.discovered_at | Date | The timestamp when the object was first discovered. |
| Cyberhaven.Event.destination.updated_at | Date | The timestamp when the object was last updated. |
| Cyberhaven.Event.destination.update_event.id | String | The ID of the update event. |
| Cyberhaven.Event.destination.update_event.action_kind | String | The action kind of the update event. |
| Cyberhaven.Event.destination.update_event.timestamp | Date | The timestamp of the update event. |
| Cyberhaven.Event.destination.update_event.user.id | String | The user ID in the update event. |
| Cyberhaven.Event.destination.update_event.user.local_username | String | The local username in the update event. |
| Cyberhaven.Event.destination.update_event.user.local_id | String | The local ID in the update event. |
| Cyberhaven.Event.destination.version_id | String | The version ID of the object. |
| Cyberhaven.Event.destination.cloud_connector.id | String | The ID of the cloud connector. |
| Cyberhaven.Event.destination.cloud_connector.type | String | The type of cloud connector. |
| Cyberhaven.Event.destination.cloud_connector.name | String | The name of the cloud connector. |
| Cyberhaven.Event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector. |
| Cyberhaven.Event.destination.cloud_connector.account_id | String | The account ID of the cloud connector. |
Command example
!cyberhaven-event-details-get event_ids="evt_start_001abc"
Context Example
{
"Cyberhaven": {
"Event": [
{
"id": "evt_start_001abc",
"timestamp": "2026-01-15T10:28:45Z",
"action": {
"kind": "copy",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500,
"page_count": 3,
"record_count": 250,
"sensitivity_score": 95
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
},
"source": {
"id": "src_local_001abc",
"display_name": "employee_salaries_2026.xlsx",
"datastore_id": "dstore_endpoint_01",
"dataset_sensitivity": "sensitivity_high",
"dataset_ids": [
"ds_hr_confidential"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"classification": "confidential",
"last_scan": "2026-01-10T09:00:00Z",
"scan_result": "contains_pii",
"owner_department": "HR"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential",
"HR Data"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Microsoft Excel",
"description": "Microsoft Office Spreadsheet Application",
"package_name": "com.microsoft.excel",
"binary_path": "C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE",
"command_line": "\"EXCEL.EXE\" /e",
"main_window_title": "employee_salaries_2026.xlsx - Excel",
"custom_data": {
"version": "16.0.17126.20132",
"publisher": "Microsoft Corporation",
"signed": "true",
"install_date": "2023-06-01"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"creator": "john.doe",
"last_modified_by": "jane.smith",
"revision": "3"
},
"created_at": "2026-01-10T09:00:00Z",
"modified_at": "2026-01-15T08:30:00Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_001abc",
"path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB",
"mount_point": "Z:"
}
},
"email": {
"id": "email_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>"
}
},
"email_attachment": {
"id": "attach_src_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload",
"custom_data": {
"referrer": "https://drive.google.com/"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Data/employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"revision_id": "rev_001"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_001abc",
"platform": "teams"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_001"
},
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection",
"rule_confidential_data"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:28:45Z"
}
],
"issues": [
{
"id": "issue_001abc",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:45Z"
}
],
"custom_data": {
"data_classification": "confidential"
},
"outline": "Spreadsheet containing employee salary and compensation data for 250 employees in the Engineering department.",
"type": "website",
"domain": "company.com",
"discovered_at": "2026-01-10T09:00:00Z",
"updated_at": "2026-01-15T10:28:45Z",
"update_event": {
"id": "upd_evt_001",
"action_kind": "read",
"timestamp": "2026-01-15T10:28:45Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001",
"ad_group": "Domain Users"
}
}
},
"version_id": "ver_001abc",
"cloud_connector": {
"id": "cc_snowflake_001",
"type": "snowflake",
"name": "Company Snowflake Integration",
"onboarding_account": "snowflake-admin@company.com",
"account_id": "sf_snowflake_001"
}
},
"destination": {
"id": "dst_usb_001abc",
"display_name": "SanDisk Ultra 64GB (E:)",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "removable_storage",
"state": "active",
"content": {
"tags": [
"external",
"removable"
],
"attributes": {
"file_count": 1
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"destination_path": "E:\\Backup\\HR",
"overwrite": "false"
},
"inspected": true
},
"data": {
"labels": [
"External Storage",
"Removable Media"
],
"label_ids": [
"lbl_external_storage",
"lbl_removable_media"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe /select,\"E:\\Backup\\HR\\employee_salaries_2026.xlsx\"",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1",
"elevated": "false"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"destination_created": "true",
"is_copy": "true"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_dst_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\Backup\\HR",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>"
}
},
"email_attachment": {
"id": "attach_dst_001",
"custom_data": {
"attachment_index": "0"
}
},
"web": {
"url": "https://drive.google.com/upload/resumable",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload Complete",
"custom_data": {
"upload_session_id": "upload_sess_001"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"upload_complete": "true"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"upload_timestamp": "2026-01-15T10:29:00Z",
"file_id": "1abc123xyz",
"revision_id": "rev_001"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"drive_letter": "E"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_dst_001"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_dst_001"
},
"labels": [
"External Storage",
"Removable Media"
],
"label_ids": [
"lbl_external_storage",
"lbl_removable_media"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_removable_001",
"version": 2,
"definition_rule_ids": [
"rule_removable_media_write"
],
"action_rule_id": "action_rule_alert",
"matched_at": "2026-01-15T10:28:50Z"
}
],
"issues": [
{
"id": "issue_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_removable_001",
"policy_action_rule_id": "action_rule_alert",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:50Z"
}
],
"custom_data": {
"endpoint_risk": "high",
"device_approved": "false",
"destination_type": "removable_media",
"risk_assessment": "critical",
"flagged_by": "dlp_engine"
},
"outline": "SanDisk USB removable storage device used as unauthorized destination for confidential HR data transfer.",
"type": "cloud_apps",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:45Z",
"updated_at": "2026-01-15T10:28:50Z",
"update_event": {
"id": "upd_evt_dst_001",
"action_kind": "write",
"timestamp": "2026-01-15T10:28:50Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001",
"ad_group": "Domain Users"
}
}
},
"version_id": "ver_dst_001",
"cloud_connector": {
"id": "cc_salesforce_001",
"type": "salesforce",
"name": "Company Salesforce Integration",
"onboarding_account": "admin@company.com",
"account_id": "sf_acct_001"
}
}
}
]
}
}
Human Readable Output
Cyberhaven Event Details
ID Time User Action Source Destination evt_start_001abc 2026-01-15T10:28:45Z id: usr_john_doe_001
local_username: john.doe
local_id: S-1-5-21-3623811015-3361044348-030300820-1013
custom_data:
session_id: sess_20260115_001kind: copy
blocked: false
data_size: 2048576
content:
tags:
values: pii, confidential
attributes:
word_count: 1500
page_count: 3
record_count: 250
sensitivity_score: 95
upload_filename: employee_salaries_2026.xlsx
custom_data:
mime_type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
inspected: true
sensor_kind: endpoint
hostname: WORKSTATION-NYC-042
machine_serial_number: C02XK1JFHV2R
custom_data:
os_version: Windows 11 22H2
ip_address: 192.168.1.100
device_type: managed
temporary_blocked: false
fail_close_statuses:
- temporary_blocked: false
dlp_api_status: SUCCESS
dlp_precondition: DLP_PRECONDITION_MET
action_status: ACTION_STATUS_COMPLETED
process_id: 4821
parent_process_id: 1024id: src_local_001abc
display_name: employee_salaries_2026.xlsx
datastore_id: dstore_endpoint_01
dataset_sensitivity: sensitivity_high
dataset_ids:
values: ds_hr_confidential
object_type: file
state: active
content:
tags:
values: pii, confidential
attributes:
record_count: 250
upload_filename: employee_salaries_2026.xlsx
custom_data:
classification: confidential
last_scan: 2026-01-10T09:00:00Z
scan_result: contains_pii
owner_department: HR
inspected: true
data:
labels:
values: PII, Confidential, HR Data
label_ids:
values: lbl_pii, lbl_confidential
app:
name: Microsoft Excel
description: Microsoft Office Spreadsheet Application
package_name: com.microsoft.excel
binary_path: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
command_line: “EXCEL.EXE” /e
main_window_title: employee_salaries_2026.xlsx - Excel
custom_data:
version: 16.0.17126.20132
publisher: Microsoft Corporation
signed: true
install_date: 2023-06-01
file:
name: employee_salaries_2026.xlsx
extension: xlsx
size: 2048576
md5_hash: d41d8cd98f00b204e9800998ecf8427e
sha256_hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
custom_data:
creator: john.doe
last_modified_by: jane.smith
revision: 3
created_at: 2026-01-10T09:00:00Z
modified_at: 2026-01-15T08:30:00Z
owner:
name: john.doe
id: usr_john_doe_001
local_file:
id: lf_001abc
path: C:\Users\john.doe\Documents\HR\employee_salaries_2026.xlsx
network_share:
hostname: FILESERVER-01
path: \FILESERVER-01\HR\Compensation
custom_data:
share_type: SMB
mount_point: Z:
email:
id: email_src_001
from: john.doe@company.com
to:
values: personal@gmail.com
cc:
values: backup@gmail.com
bcc:
values: archive@gmail.com
subject: Salary Data Backup
custom_data:
message_id: 20260115102845.001@company.com
email_attachment:
id: attach_src_001
custom_data:
attachment_index: 0
content_type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
web:
url: https://drive.google.com/upload
domain: drive.google.com
category: cloud_storage
download_url: https://drive.google.com/file/d/1abc123/view
title: Google Drive - Upload
custom_data:
referrer: https://drive.google.com/
user_agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
cloud_app:
provider: google
name: google_drive
user_name: john.doe
user_email: john.doe@personal.com
custom_data:
tenant_id: tenant_google_001
app_version: 2026.1
instance_id: gdrive_inst_001
instance_name: Personal Google Drive
cloud_file:
id: cf_src_001
content_uri: https://drive.google.com/file/d/1abc123/content
path: /My Drive/HR Data/employee_salaries_2026.xlsx
custom_data:
mime_type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
revision_id: rev_001
cloud_share_recipient:
scope: share_external
user_ids:
values: external_user_001
role: role_viewer
custom_data:
expiry_date: 2026-12-31
printer:
name: HP LaserJet Pro M404n
description: Office Laser Printer - Floor 3
physical_location: 3rd Floor Copy Room
server: PRINTSERVER-01
share_name: HP-LaserJet-3F
port: IP_192.168.1.200
driver: HP LaserJet Pro M404n PCL 6
is_local: false
job_id: print_job_4521
custom_data:
pages_printed: 12
connectivity: network
removable_storage:
id: usb_src_001
name: SanDisk Ultra 64GB
usb_id: usb_0781_5581
vendor_id: 0781
product_id: 5581
custom_data:
serial_number: 4C530001041120115283
im_message:
sender: john.doe@company.com
recipient_users:
values: personal.contact@gmail.com
recipient_groups:
values: external-group-001
domain: teams.microsoft.com
workspace: Personal Chat
custom_data:
message_id: msg_001abc
platform: teams
source_code_repo:
organization: company-org
name: hr-data-scripts
custom_data:
visibility: private
branch: main
id: repo_001
labels:
values: PII, Confidential
label_ids:
values: lbl_pii, lbl_confidential
matched_policies:
- policy_type: dlp
id: pol_dlp_hr_001
version: 3
definition_rule_ids:
values: rule_pii_detection, rule_confidential_data
action_rule_id: action_rule_block
matched_at: 2026-01-15T10:28:45Z
issues:
- id: issue_001abc
policy_type: dlp
matched_policy_id: pol_dlp_hr_001
policy_action_rule_id: action_rule_block
severity: issue_severity_high
detected_at: 2026-01-15T10:28:45Z
custom_data:
data_classification: confidential
outline: Spreadsheet containing employee salary and compensation data for 250 employees in the Engineering department.
type: website
domain: company.com
discovered_at: 2026-01-10T09:00:00Z
updated_at: 2026-01-15T10:28:45Z
update_event:
id: upd_evt_001
action_kind: read
timestamp: 2026-01-15T10:28:45Z
user:
id: usr_john_doe_001
local_username: john.doe
local_id: S-1-5-21-3623811015-3361044348-030300820-1013
custom_data:
session_id: sess_20260115_001
ad_group: Domain Users
version_id: ver_001abc
cloud_connector:
id: cc_snowflake_001
type: snowflake
name: Company Snowflake Integration
onboarding_account: snowflake-admin@company.com
account_id: sf_snowflake_001id: dst_usb_001abc
display_name: SanDisk Ultra 64GB (E:)
datastore_id: dstore_usb_01
dataset_sensitivity: sensitivity_unspecified
dataset_ids:
values: ds_removable_default
object_type: removable_storage
state: active
content:
tags:
values: external, removable
attributes:
file_count: 1
upload_filename: employee_salaries_2026.xlsx
custom_data:
destination_path: E:\Backup\HR
overwrite: false
inspected: true
data:
labels:
values: External Storage, Removable Media
label_ids:
values: lbl_external_storage, lbl_removable_media
app:
name: Windows Explorer
description: Windows File Explorer
package_name: com.microsoft.explorer
binary_path: C:\Windows\explorer.exe
command_line: explorer.exe /select,”E:\Backup\HR\employee_salaries_2026.xlsx”
main_window_title: E:\Backup\HR
custom_data:
version: 10.0.22621.1
elevated: false
file:
name: employee_salaries_2026.xlsx
extension: xlsx
size: 2048576
md5_hash: d41d8cd98f00b204e9800998ecf8427e
sha256_hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
custom_data:
destination_created: true
is_copy: true
created_at: 2026-01-15T10:28:50Z
modified_at: 2026-01-15T10:28:50Z
owner:
name: john.doe
id: usr_john_doe_001
local_file:
id: lf_dst_001
path: E:\Backup\HR\employee_salaries_2026.xlsx
network_share:
hostname: FILESERVER-01
path: \FILESERVER-01\Backup\HR
custom_data:
share_type: SMB
email:
id: email_dst_001
from: john.doe@company.com
to:
values: personal@gmail.com
cc:
values: backup@gmail.com
bcc:
values: archive@gmail.com
subject: Salary Data Backup
custom_data:
message_id: 20260115102845.001@company.com
email_attachment:
id: attach_dst_001
custom_data:
attachment_index: 0
web:
url: https://drive.google.com/upload/resumable
domain: drive.google.com
category: cloud_storage
download_url: https://drive.google.com/file/d/1abc123/view
title: Google Drive - Upload Complete
custom_data:
upload_session_id: upload_sess_001
user_agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
cloud_app:
provider: google
name: google_drive
user_name: john.doe
user_email: john.doe@personal.com
custom_data:
upload_complete: true
instance_id: gdrive_inst_001
instance_name: Personal Google Drive
cloud_file:
id: cf_dst_001
content_uri: https://drive.google.com/file/d/1abc123/content
path: /My Drive/HR Backup/employee_salaries_2026.xlsx
custom_data:
upload_timestamp: 2026-01-15T10:29:00Z
file_id: 1abc123xyz
revision_id: rev_001
cloud_share_recipient:
scope: share_external
user_ids:
values: external_user_001, external_user_002
role: role_viewer
custom_data:
expiry_date: 2026-12-31
notify_on_access: true
printer:
name: HP LaserJet Pro M404n
description: Office Laser Printer - Floor 3
physical_location: 3rd Floor Copy Room
server: PRINTSERVER-01
share_name: HP-LaserJet-3F
port: IP_192.168.1.200
driver: HP LaserJet Pro M404n PCL 6
is_local: false
job_id: print_job_4521
custom_data:
pages_printed: 12
connectivity: network
removable_storage:
id: usb_dst_001
name: SanDisk Ultra 64GB
usb_id: usb_0781_5581
vendor_id: 0781
product_id: 5581
custom_data:
serial_number: 4C530001041120115283
drive_letter: E
im_message:
sender: john.doe@company.com
recipient_users:
values: personal.contact@gmail.com
recipient_groups:
values: external-group-001
domain: teams.microsoft.com
workspace: Personal Chat
custom_data:
message_id: msg_dst_001
source_code_repo:
organization: personal-org
name: personal-backup-repo
custom_data:
visibility: private
branch: main
id: repo_dst_001
labels:
values: External Storage, Removable Media
label_ids:
values: lbl_external_storage, lbl_removable_media
matched_policies:
- policy_type: dlp
id: pol_dlp_removable_001
version: 2
definition_rule_ids:
values: rule_removable_media_write
action_rule_id: action_rule_alert
matched_at: 2026-01-15T10:28:50Z
issues:
- id: issue_dst_001
policy_type: dlp
matched_policy_id: pol_dlp_removable_001
policy_action_rule_id: action_rule_alert
severity: issue_severity_high
detected_at: 2026-01-15T10:28:50Z
custom_data:
endpoint_risk: high
device_approved: false
destination_type: removable_media
risk_assessment: critical
flagged_by: dlp_engine
outline: SanDisk USB removable storage device used as unauthorized destination for confidential HR data transfer.
type: cloud_apps
domain: company.com
discovered_at: 2026-01-15T10:28:45Z
updated_at: 2026-01-15T10:28:50Z
update_event:
id: upd_evt_dst_001
action_kind: write
timestamp: 2026-01-15T10:28:50Z
user:
id: usr_john_doe_001
local_username: john.doe
local_id: S-1-5-21-3623811015-3361044348-030300820-1013
custom_data:
session_id: sess_20260115_001
ad_group: Domain Users
version_id: ver_dst_001
cloud_connector:
id: cc_salesforce_001
type: salesforce
name: Company Salesforce Integration
onboarding_account: admin@company.com
account_id: sf_acct_001
cyberhaven-event-lineage-get
Retrieves the data lineage chain between two Cyberhaven event IDs.
Base Command
cyberhaven-event-lineage-get
Input
| Argument Name | Description | Required |
|---|---|---|
| start_event_id | Provide the UUID of the first event in the chain. | Required |
| end_event_id | Provide the UUID of the last event in the chain. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Cyberhaven.EventLineage.resources | String | The list of events ID in order. |
Command example
!cyberhaven-event-lineage-get start_event_id="evt-001" end_event_id="evt-003"
Context Example
{
"Cyberhaven": {
"EventLineage": [
{
"resources": [
"evt-001",
"evt-002",
"evt-003"
]
}
]
}
}
Human Readable Output
Event Lineage: evt-001 to evt-003
Number ID 1 evt-001 2 evt-002 3 evt-003
Troubleshoot
Getting a Connection Error
Summary:
While running Test Connectivity, it fails with an error message similar to:
Failed to execute test-module command. Error: Verify that the server URL parameter is correct and that you have access to the server from your host.
Troubleshooting:
- Verify the Server URL field is correctly formatted (e.g.,
https://example.cyberhaven.io) with no trailing slash. - Confirm XSOAR can reach the Cyberhaven tenant host from your network.
- If a proxy is in use, verify the proxy is configured correctly and enable the Use system proxy settings option in the integration configuration.
Invalid or Expired Refresh Token (401 Unauthorized)
Summary:
While running Test Connectivity or executing a command, the following error appears:
Error: Status code: 401. Unauthorized request.
Troubleshooting:
- Verify the Refresh Token in the integration configuration is correct and has not expired.
- Generate a new Refresh Token from the Cyberhaven platform and update the integration configuration.
- Confirm the token has the necessary permissions to access the Cyberhaven API.
No Incidents Fetched
Summary:
The integration is configured to fetch incidents, but no incidents appear in XSOAR.
Troubleshooting:
- Confirm Fetch incidents is enabled in the integration configuration.
- Verify the Incident type is set to
Cyberhaven Incident. - Check the First fetch time value. It cannot exceed 30 days; values greater than 30 days are automatically capped to 30 days.
- Check the Status of incidents to fetch and Severity of incidents to fetch filters. If the filters are too restrictive, no matching incidents may exist in Cyberhaven during the fetch window.
- Confirm the Cyberhaven tenant has DLP incidents within the configured fetch window.
Max Fetch Limit Exceeded
Summary:
The Max Fetch parameter is set to a value greater than 200, but only 200 incidents are fetched per cycle.
Troubleshooting:
- The maximum allowed value for Max Fetch is 200. Any value greater than 200 is automatically treated as 200. Adjust your expectations or the fetch interval accordingly.
Outgoing Mirroring Not Syncing to Cyberhaven
Summary:
Changes made in XSOAR (Status, Owner, Close Reason, Close Notes) are not reflected in Cyberhaven.
Troubleshooting:
- Confirm Enable Outgoing Mirroring (from XSOAR to Cyberhaven) is enabled in the integration configuration.
- Verify the Refresh Token has write permissions on the Cyberhaven platform.
- Only the following fields are mirrored from XSOAR to Cyberhaven: Status, Owner, Close Reason, and Close Notes. Changes to other fields are not synced.
- Check that the incident in XSOAR was created by this integration instance. Mirroring applies only to incidents fetched by Cyberhaven integration.
Execution Timeout
Summary:
A command fails due to a timeout error.
Troubleshooting:
- Use the
execution-timeoutargument to extend the command timeout (value in seconds):
| !cyberhaven-incident-list execution-timeout=120 |
| :—- |
For Any Other Errors
- Run the failing command with the
debug-mode=trueargument to generate a detailed log file:
| !<command_name> debug-mode=true Example: !cyberhaven-incident-list debug-mode=true |
| :—- |
- For fetch incident errors, run:
| !<integration_instance_name>-fetch debug-mode=true Example: !Cyberhaven_Instance_1-fetch debug-mode=true |
| :—- |
- Enable integration-level debug logging from the configuration page by setting the Log Level to
debug. Logs are written to/var/log/demisto/Integration-Instance.log.
Reference links:
Configuration parameters
url— Server URL (e.g., https://example.cyberhaven.io) (required)credentials— (required)isFetch— Fetch incidentsincidentType— Incident typefirst_fetch— First fetch timemax_fetch— Max Fetchstatus_filter— Status of incidents to fetchseverity_filter— Severity of incidents to fetchoutgoing_mirroring— Enable Outgoing Mirroring (from XSOAR to Cyberhaven)incidentFetchInterval— Incidents Fetch Intervalinsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (4)
-
cyberhaven-event-details-getRetrieves full details for one or more Cyberhaven events by ID.
-
cyberhaven-event-lineage-getRetrieves the data lineage chain between two Cyberhaven event IDs.
-
cyberhaven-incident-listList and search Cyberhaven DLP incidents with optional filters.
-
cyberhaven-incident-updateUpdate the status, assignment, or close reason of a Cyberhaven incident.
commonfields: id: Cyberhaven version: -1 name: Cyberhaven display: Cyberhaven category: Data Enrichment & Threat Intelligence fromversion: 6.10.0 provider: Cyberhaven description: Fetches DLP incidents from the Cyberhaven data security platform and enables investigation of events and data lineage. defaultmapperin: Cyberhaven - Incoming Mapper sectionorder: - Connect - Collect configuration: - section: Connect display: Server URL (e.g., https://example.cyberhaven.io) name: url additionalinfo: URL of the Cyberhaven tenant. type: 0 required: true - section: Connect display: "" displaypassword: Refresh Token name: credentials additionalinfo: Provide the Refresh Token for authentication. type: 9 required: true hiddenusername: true - section: Collect display: Fetch incidents name: isFetch type: 8 required: false - section: Collect display: Incident type name: incidentType defaultvalue: "Cyberhaven Incident" type: 13 required: false - section: Collect display: First fetch time name: first_fetch defaultvalue: '3 days' additionalinfo: "The date or relative timestamp from which to begin fetching DLP Incidents. Default value is '3 days'. The maximum is '30 days'.\n\nIf the value is greater than '30 days', it will be considered as '30 days'.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2026, 01 May 2026 04:45:33, 2026-05-17T14:05:44Z." type: 0 required: false - section: Collect display: Max Fetch name: max_fetch additionalinfo: "The maximum number of DLP Incidents to fetch each time. Default value is 100. The maximum is 200.\n\nIf the value is greater than 200, it will be considered as 200." defaultvalue: "100" type: 0 required: false - section: Collect display: Status of incidents to fetch name: status_filter additionalinfo: Filter the DLP incidents by Status. type: 16 required: false defaultvalue: "Open" options: - Open - Closed - section: Collect display: Severity of incidents to fetch name: severity_filter additionalinfo: Filter the DLP incidents by Severity. type: 16 required: false defaultvalue: "Informational,Low,Medium,High,Critical" options: - Informational - Low - Medium - High - Critical - section: Collect display: Enable Outgoing Mirroring (from XSOAR to Cyberhaven) name: outgoing_mirroring additionalinfo: "When enabled, updates to the following fields in XSOAR are synchronized to Cyberhaven: Status, Owner, Close Reason, and Close Notes." type: 8 required: false - section: Collect display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: "5" type: 19 required: false - section: Connect advanced: true display: Trust any certificate (not secure) name: insecure type: 8 required: false - section: Connect advanced: true display: Use system proxy settings name: proxy type: 8 required: false script: commands: - name: cyberhaven-incident-list arguments: - name: limit description: Max incidents to return. defaultValue: "25" - name: start_time description: "Filter the incidents by start on or after the provided time. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ." - name: end_time description: "Filter the incidents by end on or before the provided time. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ." - name: severity description: A comma-separated list of severity by which to filter the incidents. isArray: true auto: PREDEFINED predefined: - Informational - Low - Medium - High - Critical - name: status description: A comma-separated list of status by which to filter the incidents. isArray: true auto: PREDEFINED predefined: - Open - Closed - name: assignee description: Filter the incidents by assigned analyst email. - name: user description: Filter the incidents by user who triggered the incident. - name: incident_ids description: A comma-separated list of incident IDs to filter the results. isArray: true - name: page_id description: Page ID to retrieve the next set of the incidents. description: List and search Cyberhaven DLP incidents with optional filters. outputs: - contextPath: Cyberhaven.Incident.id description: The unique identifier of the incident. type: String - contextPath: Cyberhaven.Incident.user.id description: The identifier of the user who triggered the incident. type: String - contextPath: Cyberhaven.Incident.user.local_username description: The local machine username of the user who triggered the incident. type: String - contextPath: Cyberhaven.Incident.user.local_id description: The local identifier of the user who triggered the incident. type: String - contextPath: Cyberhaven.Incident.event_lineage_id.start_event_id description: The ID of the first event in the lineage chain. type: String - contextPath: Cyberhaven.Incident.event_lineage_id.end_event_id description: The ID of the last event in the lineage chain. type: String - contextPath: Cyberhaven.Incident.blocked description: Whether the action that triggered the incident was blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_time description: The timestamp of the event that triggered the incident. type: Date - contextPath: Cyberhaven.Incident.trigger_time description: The timestamp when the incident was triggered. type: Date - contextPath: Cyberhaven.Incident.dataset.id description: The identifier of the dataset involved in the incident. type: String - contextPath: Cyberhaven.Incident.dataset.name description: The name of the dataset involved in the incident. type: String - contextPath: Cyberhaven.Incident.dataset.sensitivity description: The sensitivity classification of the dataset involved. type: String - contextPath: Cyberhaven.Incident.user_risk_groups description: The list of risk groups the user belongs to. type: String - contextPath: Cyberhaven.Incident.policy.id description: The identifier of the DLP policy that was triggered. type: String - contextPath: Cyberhaven.Incident.policy.name description: The name of the DLP policy that was triggered. type: String - contextPath: Cyberhaven.Incident.policy.severity description: The severity level defined in the triggering DLP policy. type: String - contextPath: Cyberhaven.Incident.risk_score description: The numeric risk score assigned to the incident. type: Number - contextPath: Cyberhaven.Incident.screenshot_guid description: The GUID of the screenshot associated with the incident. type: String - contextPath: Cyberhaven.Incident.warning_status description: The warning acknowledgement status of the incident. type: String - contextPath: Cyberhaven.Incident.user_reactions description: The list of user reaction codes for the incident. type: String - contextPath: Cyberhaven.Incident.user_reaction_message description: The message provided by the user when reacting to the warning. type: String - contextPath: Cyberhaven.Incident.reaction_time description: The timestamp when the user reacted to the warning. type: Date - contextPath: Cyberhaven.Incident.assigned_to description: The email of the analyst the incident is assigned to. type: String - contextPath: Cyberhaven.Incident.status description: The current status of the incident (e.g. open, closed). type: String - contextPath: Cyberhaven.Incident.resolution_time description: The timestamp when the incident was resolved. type: Date - contextPath: Cyberhaven.Incident.close_reason description: The reason code provided when the incident was closed. type: String - contextPath: Cyberhaven.Incident.close_note description: The free-text note provided when the incident was closed. type: String - contextPath: Cyberhaven.Incident.created_by description: Indicates how the incident was created (e.g. created_by_policy). type: String - contextPath: Cyberhaven.Incident.ai_summary description: The AI-generated summary of the incident. type: String - contextPath: Cyberhaven.Incident.ai_severity description: The AI-assessed severity level of the incident. type: String - contextPath: Cyberhaven.Incident.last_modified description: The timestamp when the incident was last modified. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.id description: The ID of the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.timestamp description: The timestamp of the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.action.kind description: The action kind performed in the start event (e.g. copy). type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.blocked description: Whether the action in the start event was blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.action.data_size description: The size of data involved in the start event action (bytes). type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.tags description: The content classification tags detected in the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.attributes description: The content attributes of the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.upload_filename description: The filename of the content being uploaded in the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.inspected description: Whether the content was inspected in the start event action. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.action.sensor_kind description: The sensor type that detected the start event (e.g. endpoint). type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.hostname description: The hostname of the machine where the start event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.machine_serial_number description: The serial number of the machine where the start event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.ip_address description: The IP address of the machine where the start event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.device_type description: The device management type for the start event (e.g. managed). type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.temporary_blocked description: Whether the start event action was temporarily blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.action.fail_close_statuses description: The list of fail-close status objects for the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.process_id description: The process ID of the process that triggered the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.action.parent_process_id description: The parent process ID of the process that triggered the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.user.id description: The identifier of the user in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.user.local_username description: The local username of the user in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.user.local_id description: The local ID of the user in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.id description: The ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.display_name description: The display name of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.datastore_id description: The datastore ID associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.dataset_sensitivity description: The sensitivity classification of the dataset in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.dataset_ids description: The list of dataset IDs associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.object_type description: The object type (e.g. file, removable_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.state description: The state of the object (e.g. active) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.tags description: The content classification tags in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.attributes description: The content attributes in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.upload_filename description: The upload filename of the content in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.inspected description: Whether the content was inspected in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.source.data.labels description: The data classification labels in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.data.label_ids description: The data classification label IDs in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.name description: The name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.description description: The description of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.package_name description: The package name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.binary_path description: The binary path of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.command_line description: The command line of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.main_window_title description: The main window title of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.name description: The file name in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.extension description: The file extension in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.size description: The file size (bytes) in the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.md5_hash description: The MD5 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.sha256_hash description: The SHA-256 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.created_at description: The creation timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.modified_at description: The last modification timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.owner.name description: The name of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.owner.id description: The ID of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.local_file.id description: The local file ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.local_file.path description: The local file system path in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.network_share.hostname description: The hostname of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.network_share.path description: The path of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.id description: The ID of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.from description: The sender of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.to description: The recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.cc description: The CC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.bcc description: The BCC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.subject description: The subject of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email_attachment.id description: The ID of the email attachment in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.url description: The URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.domain description: The domain of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.category description: The category of the web endpoint (e.g. cloud_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.download_url description: The download URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.title description: The page title of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.user_agent description: The user-agent string of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.provider description: The cloud provider (e.g. google) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.name description: The name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_name description: The username in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_email description: The user email in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_id description: The instance ID of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_name description: The instance name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_file.id description: The ID of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_file.content_uri description: The content URI of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_file.path description: The path of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.scope description: The sharing scope in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.role description: The role of the cloud share recipient in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.name description: The name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.description description: The description of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.physical_location description: The physical location of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.server description: The print server hostname in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.share_name description: The share name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.port description: The port of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.driver description: The driver name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.is_local description: Whether the printer is local in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.job_id description: The print job ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.connectivity description: The connectivity type of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.id description: The ID of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.name description: The name of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.product_id description: The USB product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.sender description: The sender of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_users description: The recipient users of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_groups description: The recipient groups of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.domain description: The domain of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.workspace description: The workspace of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.organization description: The organization of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.name description: The name of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.branch description: The branch of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.id description: The ID of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.labels description: The labels applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.label_ids description: The label IDs applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.matched_policies description: The list of DLP policies matched by the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.issues description: The list of DLP issues detected on the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.outline description: The outline description of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.type description: The endpoint type (e.g. endpoint, removable_media) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.domain description: The domain of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.discovered_at description: The timestamp when the object was first discovered in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.updated_at description: The timestamp when the object was last updated in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.id description: The ID of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.action_kind description: The action kind of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.timestamp description: The timestamp of the update event in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.user.id description: The user ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_username description: The local username in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_id description: The local ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.version_id description: The version ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.id description: The ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.type description: The type of cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.name description: The name of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.account_id description: The account ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.id description: The ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.display_name description: The display name of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.datastore_id description: The datastore ID associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.dataset_sensitivity description: The sensitivity classification of the dataset in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.dataset_ids description: The list of dataset IDs associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.object_type description: The object type (e.g. file, removable_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.state description: The state of the object (e.g. active) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.tags description: The content classification tags in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.attributes description: The content attributes in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.upload_filename description: The upload filename of the content in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.inspected description: Whether the content was inspected in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.destination.data.labels description: The data classification labels in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.data.label_ids description: The data classification label IDs in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.name description: The name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.description description: The description of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.package_name description: The package name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.binary_path description: The binary path of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.command_line description: The command line of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.main_window_title description: The main window title of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.name description: The file name in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.extension description: The file extension in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.size description: The file size (bytes) in the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.md5_hash description: The MD5 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.sha256_hash description: The SHA-256 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.created_at description: The creation timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.modified_at description: The last modification timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.owner.name description: The name of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.owner.id description: The ID of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.local_file.id description: The local file ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.local_file.path description: The local file system path in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.network_share.hostname description: The hostname of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.network_share.path description: The path of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.id description: The ID of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.from description: The sender of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.to description: The recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.cc description: The CC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.bcc description: The BCC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.subject description: The subject of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email_attachment.id description: The ID of the email attachment in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.url description: The URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.domain description: The domain of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.category description: The category of the web endpoint (e.g. cloud_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.download_url description: The download URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.title description: The page title of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.user_agent description: The user-agent string of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.provider description: The cloud provider (e.g. google) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.name description: The name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_name description: The username in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_email description: The user email in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_id description: The instance ID of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_name description: The instance name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_file.id description: The ID of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_file.content_uri description: The content URI of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_file.path description: The path of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.scope description: The sharing scope in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.role description: The role of the cloud share recipient in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.name description: The name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.description description: The description of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.physical_location description: The physical location of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.server description: The print server hostname in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.share_name description: The share name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.port description: The port of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.driver description: The driver name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.is_local description: Whether the printer is local in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.job_id description: The print job ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.connectivity description: The connectivity type of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.id description: The ID of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.name description: The name of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.product_id description: The USB product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.sender description: The sender of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_users description: The recipient users of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_groups description: The recipient groups of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.domain description: The domain of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.workspace description: The workspace of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.organization description: The organization of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.name description: The name of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.branch description: The branch of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.id description: The ID of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.labels description: The labels applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.label_ids description: The label IDs applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.matched_policies description: The list of DLP policies matched by the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.issues description: The list of DLP issues detected on the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.outline description: The outline description of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.type description: The endpoint type (e.g. endpoint, removable_media) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.domain description: The domain of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.discovered_at description: The timestamp when the object was first discovered in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.updated_at description: The timestamp when the object was last updated in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.id description: The ID of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.action_kind description: The action kind of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.timestamp description: The timestamp of the update event in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.user.id description: The user ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_username description: The local username in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_id description: The local ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.version_id description: The version ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.id description: The ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.type description: The type of cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.name description: The name of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.account_id description: The account ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.id description: The ID of the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.timestamp description: The timestamp of the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.action.kind description: The action kind performed in the end event (e.g. copy). type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.blocked description: Whether the action in the end event was blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.action.data_size description: The size of data involved in the end event action (bytes). type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.tags description: The content classification tags detected in the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.attributes description: The content attributes of the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.upload_filename description: The filename of the content being uploaded in the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.inspected description: Whether the content was inspected in the end event action. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.action.sensor_kind description: The sensor type that detected the end event (e.g. endpoint). type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.hostname description: The hostname of the machine where the end event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.machine_serial_number description: The serial number of the machine where the end event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.ip_address description: The IP address of the machine where the end event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.device_type description: The device management type for the end event (e.g. managed). type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.temporary_blocked description: Whether the end event action was temporarily blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.action.fail_close_statuses description: The list of fail-close status objects for the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.process_id description: The process ID of the process that triggered the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.action.parent_process_id description: The parent process ID of the process that triggered the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.user.id description: The identifier of the user in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.user.local_username description: The local username of the user in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.user.local_id description: The local ID of the user in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.id description: The ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.display_name description: The display name of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.datastore_id description: The datastore ID associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.dataset_sensitivity description: The sensitivity classification of the dataset in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.dataset_ids description: The list of dataset IDs associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.object_type description: The object type (e.g. file, removable_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.state description: The state of the object (e.g. active) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.tags description: The content classification tags in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.attributes description: The content attributes in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.upload_filename description: The upload filename of the content in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.inspected description: Whether the content was inspected in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.source.data.labels description: The data classification labels in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.data.label_ids description: The data classification label IDs in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.name description: The name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.description description: The description of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.package_name description: The package name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.binary_path description: The binary path of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.command_line description: The command line of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.main_window_title description: The main window title of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.name description: The file name in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.extension description: The file extension in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.size description: The file size (bytes) in the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.md5_hash description: The MD5 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.sha256_hash description: The SHA-256 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.created_at description: The creation timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.modified_at description: The last modification timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.owner.name description: The name of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.owner.id description: The ID of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.local_file.id description: The local file ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.local_file.path description: The local file system path in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.network_share.hostname description: The hostname of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.network_share.path description: The path of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.id description: The ID of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.from description: The sender of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.to description: The recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.cc description: The CC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.bcc description: The BCC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.subject description: The subject of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email_attachment.id description: The ID of the email attachment in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.url description: The URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.domain description: The domain of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.category description: The category of the web endpoint (e.g. cloud_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.download_url description: The download URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.title description: The page title of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.user_agent description: The user-agent string of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.provider description: The cloud provider (e.g. google) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.name description: The name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_name description: The username in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_email description: The user email in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_id description: The instance ID of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_name description: The instance name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_file.id description: The ID of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_file.content_uri description: The content URI of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_file.path description: The path of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.scope description: The sharing scope in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.role description: The role of the cloud share recipient in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.name description: The name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.description description: The description of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.physical_location description: The physical location of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.server description: The print server hostname in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.share_name description: The share name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.port description: The port of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.driver description: The driver name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.is_local description: Whether the printer is local in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.job_id description: The print job ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.connectivity description: The connectivity type of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.id description: The ID of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.name description: The name of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.product_id description: The USB product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.sender description: The sender of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_users description: The recipient users of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_groups description: The recipient groups of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.domain description: The domain of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.workspace description: The workspace of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.organization description: The organization of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.name description: The name of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.branch description: The branch of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.id description: The ID of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.labels description: The labels applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.label_ids description: The label IDs applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.matched_policies description: The list of DLP policies matched by the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.issues description: The list of DLP issues detected on the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.outline description: The outline description of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.type description: The endpoint type (e.g. endpoint, removable_media) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.domain description: The domain of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.discovered_at description: The timestamp when the object was first discovered in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.updated_at description: The timestamp when the object was last updated in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.id description: The ID of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.action_kind description: The action kind of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.timestamp description: The timestamp of the update event in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.user.id description: The user ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_username description: The local username in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_id description: The local ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.version_id description: The version ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.id description: The ID of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.type description: The type of cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.name description: The name of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.account_id description: The account ID of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.id description: The ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.display_name description: The display name of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.datastore_id description: The datastore ID associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.dataset_sensitivity description: The sensitivity classification of the dataset in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.dataset_ids description: The list of dataset IDs associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.object_type description: The object type (e.g. file, removable_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.state description: The state of the object (e.g. active) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.tags description: The content classification tags in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.attributes description: The content attributes in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.upload_filename description: The upload filename of the content in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.inspected description: Whether the content was inspected in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.destination.data.labels description: The data classification labels in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.data.label_ids description: The data classification label IDs in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.name description: The name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.description description: The description of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.package_name description: The package name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.binary_path description: The binary path of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.command_line description: The command line of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.main_window_title description: The main window title of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.name description: The file name in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.extension description: The file extension in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.size description: The file size (bytes) in the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.md5_hash description: The MD5 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.sha256_hash description: The SHA-256 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.created_at description: The creation timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.modified_at description: The last modification timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.owner.name description: The name of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.owner.id description: The ID of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.local_file.id description: The local file ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.local_file.path description: The local file system path in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.network_share.hostname description: The hostname of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.network_share.path description: The path of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.id description: The ID of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.from description: The sender of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.to description: The recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.cc description: The CC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.bcc description: The BCC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.subject description: The subject of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email_attachment.id description: The ID of the email attachment in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.url description: The URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.domain description: The domain of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.category description: The category of the web endpoint (e.g. cloud_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.download_url description: The download URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.title description: The page title of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.user_agent description: The user-agent string of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.provider description: The cloud provider (e.g. google) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.name description: The name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_name description: The username in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_email description: The user email in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_id description: The instance ID of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_name description: The instance name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_file.id description: The ID of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_file.content_uri description: The content URI of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_file.path description: The path of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.scope description: The sharing scope in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.role description: The role of the cloud share recipient in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.name description: The name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.description description: The description of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.physical_location description: The physical location of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.server description: The print server hostname in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.share_name description: The share name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.port description: The port of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.driver description: The driver name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.is_local description: Whether the printer is local in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.job_id description: The print job ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.connectivity description: The connectivity type of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.id description: The ID of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.name description: The name of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.product_id description: The USB product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.sender description: The sender of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_users description: The recipient users of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_groups description: The recipient groups of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.domain description: The domain of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.workspace description: The workspace of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.organization description: The organization of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.name description: The name of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.branch description: The branch of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.id description: The ID of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.labels description: The labels applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.label_ids description: The label IDs applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.matched_policies description: The list of DLP policies matched by the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.issues description: The list of DLP issues detected on the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.outline description: The outline description of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.type description: The endpoint type (e.g. endpoint, removable_media) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.domain description: The domain of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.discovered_at description: The timestamp when the object was first discovered in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.updated_at description: The timestamp when the object was last updated in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.id description: The ID of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.action_kind description: The action kind of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.timestamp description: The timestamp of the update event in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.user.id description: The user ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_username description: The local username in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_id description: The local ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.version_id description: The version ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.id description: The ID of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.type description: The type of cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.name description: The name of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.account_id description: The account ID of the cloud connector in the end event. type: String - contextPath: Cyberhaven.IncidentPage.next_id description: The opaque cursor for the next page of results. Pass this value as page_id to retrieve the next page. type: String - contextPath: Cyberhaven.IncidentPage.total description: The total number of incidents for the provided filters. type: Number - name: cyberhaven-incident-update arguments: - name: incident_id required: true description: "Specify the Cyberhaven incident ID.\n\nNote: Use 'cyberhaven-incident-list' to retrieve the incident ID." - name: status description: Specify the status of the incident. auto: PREDEFINED predefined: - Open - Closed - name: close_reason description: Specify the close reason while closing the incident. auto: PREDEFINED predefined: - Resolved - False Positive - False Positive - Destination Not at Risk - False Positive - User Exempt - Other - name: close_note description: Provide the meaningful note when closing. - name: assigned_to description: Provide analyst email to whom incident will assign. description: Update the status, assignment, or close reason of a Cyberhaven incident. outputs: - contextPath: Cyberhaven.Incident.id description: The unique identifier of the incident. type: String - contextPath: Cyberhaven.Incident.user.id description: The identifier of the user who triggered the incident. type: String - contextPath: Cyberhaven.Incident.user.local_username description: The local machine username of the user who triggered the incident. type: String - contextPath: Cyberhaven.Incident.user.local_id description: The local identifier of the user who triggered the incident. type: String - contextPath: Cyberhaven.Incident.event_lineage_id.start_event_id description: The ID of the first event in the lineage chain. type: String - contextPath: Cyberhaven.Incident.event_lineage_id.end_event_id description: The ID of the last event in the lineage chain. type: String - contextPath: Cyberhaven.Incident.blocked description: Whether the action that triggered the incident was blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_time description: The timestamp of the event that triggered the incident. type: Date - contextPath: Cyberhaven.Incident.trigger_time description: The timestamp when the incident was triggered. type: Date - contextPath: Cyberhaven.Incident.dataset.id description: The identifier of the dataset involved in the incident. type: String - contextPath: Cyberhaven.Incident.dataset.name description: The name of the dataset involved in the incident. type: String - contextPath: Cyberhaven.Incident.dataset.sensitivity description: The sensitivity classification of the dataset involved. type: String - contextPath: Cyberhaven.Incident.user_risk_groups description: The list of risk groups the user belongs to. type: String - contextPath: Cyberhaven.Incident.policy.id description: The identifier of the DLP policy that was triggered. type: String - contextPath: Cyberhaven.Incident.policy.name description: The name of the DLP policy that was triggered. type: String - contextPath: Cyberhaven.Incident.policy.severity description: The severity level defined in the triggering DLP policy. type: String - contextPath: Cyberhaven.Incident.risk_score description: The numeric risk score assigned to the incident. type: Number - contextPath: Cyberhaven.Incident.screenshot_guid description: The GUID of the screenshot associated with the incident. type: String - contextPath: Cyberhaven.Incident.warning_status description: The warning acknowledgement status of the incident. type: String - contextPath: Cyberhaven.Incident.user_reactions description: The list of user reaction codes for the incident. type: String - contextPath: Cyberhaven.Incident.user_reaction_message description: The message provided by the user when reacting to the warning. type: String - contextPath: Cyberhaven.Incident.reaction_time description: The timestamp when the user reacted to the warning. type: Date - contextPath: Cyberhaven.Incident.assigned_to description: The email of the analyst the incident is assigned to. type: String - contextPath: Cyberhaven.Incident.status description: The current status of the incident (e.g. open, closed). type: String - contextPath: Cyberhaven.Incident.resolution_time description: The timestamp when the incident was resolved. type: Date - contextPath: Cyberhaven.Incident.close_reason description: The reason code provided when the incident was closed. type: String - contextPath: Cyberhaven.Incident.close_note description: The free-text note provided when the incident was closed. type: String - contextPath: Cyberhaven.Incident.created_by description: Indicates how the incident was created (e.g. created_by_policy). type: String - contextPath: Cyberhaven.Incident.ai_summary description: The AI-generated summary of the incident. type: String - contextPath: Cyberhaven.Incident.ai_severity description: The AI-assessed severity level of the incident. type: String - contextPath: Cyberhaven.Incident.last_modified description: The timestamp when the incident was last modified. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.id description: The ID of the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.timestamp description: The timestamp of the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.action.kind description: The action kind performed in the start event (e.g. copy). type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.blocked description: Whether the action in the start event was blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.action.data_size description: The size of data involved in the start event action (bytes). type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.tags description: The content classification tags detected in the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.attributes description: The content attributes of the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.upload_filename description: The filename of the content being uploaded in the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.inspected description: Whether the content was inspected in the start event action. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.action.sensor_kind description: The sensor type that detected the start event (e.g. endpoint). type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.hostname description: The hostname of the machine where the start event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.machine_serial_number description: The serial number of the machine where the start event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.ip_address description: The IP address of the machine where the start event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.device_type description: The device management type for the start event (e.g. managed). type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.temporary_blocked description: Whether the start event action was temporarily blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.action.fail_close_statuses description: The list of fail-close status objects for the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.process_id description: The process ID of the process that triggered the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.action.parent_process_id description: The parent process ID of the process that triggered the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.user.id description: The identifier of the user in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.user.local_username description: The local username of the user in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.user.local_id description: The local ID of the user in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.id description: The ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.display_name description: The display name of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.datastore_id description: The datastore ID associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.dataset_sensitivity description: The sensitivity classification of the dataset in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.dataset_ids description: The list of dataset IDs associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.object_type description: The object type (e.g. file, removable_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.state description: The state of the object (e.g. active) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.tags description: The content classification tags in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.attributes description: The content attributes in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.upload_filename description: The upload filename of the content in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.inspected description: Whether the content was inspected in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.source.data.labels description: The data classification labels in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.data.label_ids description: The data classification label IDs in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.name description: The name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.description description: The description of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.package_name description: The package name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.binary_path description: The binary path of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.command_line description: The command line of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.main_window_title description: The main window title of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.name description: The file name in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.extension description: The file extension in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.size description: The file size (bytes) in the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.md5_hash description: The MD5 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.sha256_hash description: The SHA-256 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.created_at description: The creation timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.modified_at description: The last modification timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.owner.name description: The name of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.owner.id description: The ID of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.local_file.id description: The local file ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.local_file.path description: The local file system path in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.network_share.hostname description: The hostname of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.network_share.path description: The path of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.id description: The ID of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.from description: The sender of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.to description: The recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.cc description: The CC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.bcc description: The BCC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.subject description: The subject of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email_attachment.id description: The ID of the email attachment in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.url description: The URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.domain description: The domain of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.category description: The category of the web endpoint (e.g. cloud_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.download_url description: The download URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.title description: The page title of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.user_agent description: The user-agent string of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.provider description: The cloud provider (e.g. google) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.name description: The name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_name description: The username in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_email description: The user email in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_id description: The instance ID of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_name description: The instance name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_file.id description: The ID of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_file.content_uri description: The content URI of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_file.path description: The path of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.scope description: The sharing scope in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.role description: The role of the cloud share recipient in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.name description: The name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.description description: The description of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.physical_location description: The physical location of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.server description: The print server hostname in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.share_name description: The share name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.port description: The port of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.driver description: The driver name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.is_local description: Whether the printer is local in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.job_id description: The print job ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.connectivity description: The connectivity type of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.id description: The ID of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.name description: The name of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.product_id description: The USB product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.sender description: The sender of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_users description: The recipient users of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_groups description: The recipient groups of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.domain description: The domain of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.workspace description: The workspace of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.organization description: The organization of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.name description: The name of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.branch description: The branch of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.id description: The ID of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.labels description: The labels applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.label_ids description: The label IDs applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.matched_policies description: The list of DLP policies matched by the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.issues description: The list of DLP issues detected on the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.outline description: The outline description of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.type description: The endpoint type (e.g. endpoint, removable_media) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.domain description: The domain of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.discovered_at description: The timestamp when the object was first discovered in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.updated_at description: The timestamp when the object was last updated in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.id description: The ID of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.action_kind description: The action kind of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.timestamp description: The timestamp of the update event in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.user.id description: The user ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_username description: The local username in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_id description: The local ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.version_id description: The version ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.id description: The ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.type description: The type of cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.name description: The name of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.account_id description: The account ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.id description: The ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.display_name description: The display name of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.datastore_id description: The datastore ID associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.dataset_sensitivity description: The sensitivity classification of the dataset in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.dataset_ids description: The list of dataset IDs associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.object_type description: The object type (e.g. file, removable_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.state description: The state of the object (e.g. active) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.tags description: The content classification tags in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.attributes description: The content attributes in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.upload_filename description: The upload filename of the content in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.inspected description: Whether the content was inspected in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.destination.data.labels description: The data classification labels in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.data.label_ids description: The data classification label IDs in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.name description: The name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.description description: The description of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.package_name description: The package name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.binary_path description: The binary path of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.command_line description: The command line of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.main_window_title description: The main window title of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.name description: The file name in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.extension description: The file extension in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.size description: The file size (bytes) in the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.md5_hash description: The MD5 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.sha256_hash description: The SHA-256 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.created_at description: The creation timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.modified_at description: The last modification timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.owner.name description: The name of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.owner.id description: The ID of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.local_file.id description: The local file ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.local_file.path description: The local file system path in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.network_share.hostname description: The hostname of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.network_share.path description: The path of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.id description: The ID of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.from description: The sender of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.to description: The recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.cc description: The CC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.bcc description: The BCC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.subject description: The subject of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email_attachment.id description: The ID of the email attachment in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.url description: The URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.domain description: The domain of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.category description: The category of the web endpoint (e.g. cloud_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.download_url description: The download URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.title description: The page title of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.user_agent description: The user-agent string of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.provider description: The cloud provider (e.g. google) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.name description: The name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_name description: The username in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_email description: The user email in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_id description: The instance ID of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_name description: The instance name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_file.id description: The ID of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_file.content_uri description: The content URI of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_file.path description: The path of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.scope description: The sharing scope in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.role description: The role of the cloud share recipient in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.name description: The name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.description description: The description of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.physical_location description: The physical location of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.server description: The print server hostname in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.share_name description: The share name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.port description: The port of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.driver description: The driver name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.is_local description: Whether the printer is local in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.job_id description: The print job ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.connectivity description: The connectivity type of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.id description: The ID of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.name description: The name of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.product_id description: The USB product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.sender description: The sender of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_users description: The recipient users of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_groups description: The recipient groups of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.domain description: The domain of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.workspace description: The workspace of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.organization description: The organization of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.name description: The name of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.branch description: The branch of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.id description: The ID of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.labels description: The labels applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.label_ids description: The label IDs applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.matched_policies description: The list of DLP policies matched by the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.issues description: The list of DLP issues detected on the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.outline description: The outline description of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.type description: The endpoint type (e.g. endpoint, removable_media) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.domain description: The domain of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.discovered_at description: The timestamp when the object was first discovered in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.updated_at description: The timestamp when the object was last updated in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.id description: The ID of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.action_kind description: The action kind of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.timestamp description: The timestamp of the update event in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.user.id description: The user ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_username description: The local username in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_id description: The local ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.version_id description: The version ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.id description: The ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.type description: The type of cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.name description: The name of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.account_id description: The account ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.id description: The ID of the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.timestamp description: The timestamp of the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.action.kind description: The action kind performed in the end event (e.g. copy). type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.blocked description: Whether the action in the end event was blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.action.data_size description: The size of data involved in the end event action (bytes). type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.tags description: The content classification tags detected in the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.attributes description: The content attributes of the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.upload_filename description: The filename of the content being uploaded in the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.inspected description: Whether the content was inspected in the end event action. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.action.sensor_kind description: The sensor type that detected the end event (e.g. endpoint). type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.hostname description: The hostname of the machine where the end event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.machine_serial_number description: The serial number of the machine where the end event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.ip_address description: The IP address of the machine where the end event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.device_type description: The device management type for the end event (e.g. managed). type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.temporary_blocked description: Whether the end event action was temporarily blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.action.fail_close_statuses description: The list of fail-close status objects for the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.process_id description: The process ID of the process that triggered the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.action.parent_process_id description: The parent process ID of the process that triggered the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.user.id description: The identifier of the user in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.user.local_username description: The local username of the user in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.user.local_id description: The local ID of the user in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.id description: The ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.display_name description: The display name of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.datastore_id description: The datastore ID associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.dataset_sensitivity description: The sensitivity classification of the dataset in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.dataset_ids description: The list of dataset IDs associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.object_type description: The object type (e.g. file, removable_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.state description: The state of the object (e.g. active) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.tags description: The content classification tags in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.attributes description: The content attributes in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.upload_filename description: The upload filename of the content in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.inspected description: Whether the content was inspected in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.source.data.labels description: The data classification labels in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.data.label_ids description: The data classification label IDs in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.name description: The name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.description description: The description of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.package_name description: The package name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.binary_path description: The binary path of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.command_line description: The command line of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.main_window_title description: The main window title of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.name description: The file name in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.extension description: The file extension in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.size description: The file size (bytes) in the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.md5_hash description: The MD5 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.sha256_hash description: The SHA-256 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.created_at description: The creation timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.modified_at description: The last modification timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.owner.name description: The name of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.owner.id description: The ID of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.local_file.id description: The local file ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.local_file.path description: The local file system path in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.network_share.hostname description: The hostname of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.network_share.path description: The path of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.id description: The ID of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.from description: The sender of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.to description: The recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.cc description: The CC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.bcc description: The BCC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.subject description: The subject of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email_attachment.id description: The ID of the email attachment in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.url description: The URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.domain description: The domain of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.category description: The category of the web endpoint (e.g. cloud_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.download_url description: The download URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.title description: The page title of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.user_agent description: The user-agent string of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.provider description: The cloud provider (e.g. google) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.name description: The name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_name description: The username in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_email description: The user email in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_id description: The instance ID of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_name description: The instance name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_file.id description: The ID of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_file.content_uri description: The content URI of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_file.path description: The path of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.scope description: The sharing scope in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.role description: The role of the cloud share recipient in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.name description: The name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.description description: The description of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.physical_location description: The physical location of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.server description: The print server hostname in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.share_name description: The share name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.port description: The port of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.driver description: The driver name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.is_local description: Whether the printer is local in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.job_id description: The print job ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.connectivity description: The connectivity type of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.id description: The ID of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.name description: The name of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.product_id description: The USB product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.sender description: The sender of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_users description: The recipient users of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_groups description: The recipient groups of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.domain description: The domain of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.workspace description: The workspace of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.organization description: The organization of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.name description: The name of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.branch description: The branch of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.id description: The ID of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.labels description: The labels applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.label_ids description: The label IDs applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.matched_policies description: The list of DLP policies matched by the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.issues description: The list of DLP issues detected on the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.outline description: The outline description of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.type description: The endpoint type (e.g. endpoint, removable_media) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.domain description: The domain of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.discovered_at description: The timestamp when the object was first discovered in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.updated_at description: The timestamp when the object was last updated in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.id description: The ID of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.action_kind description: The action kind of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.timestamp description: The timestamp of the update event in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.user.id description: The user ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_username description: The local username in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_id description: The local ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.version_id description: The version ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.id description: The ID of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.type description: The type of cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.name description: The name of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.account_id description: The account ID of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.id description: The ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.display_name description: The display name of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.datastore_id description: The datastore ID associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.dataset_sensitivity description: The sensitivity classification of the dataset in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.dataset_ids description: The list of dataset IDs associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.object_type description: The object type (e.g. file, removable_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.state description: The state of the object (e.g. active) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.tags description: The content classification tags in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.attributes description: The content attributes in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.upload_filename description: The upload filename of the content in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.inspected description: Whether the content was inspected in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.destination.data.labels description: The data classification labels in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.data.label_ids description: The data classification label IDs in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.name description: The name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.description description: The description of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.package_name description: The package name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.binary_path description: The binary path of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.command_line description: The command line of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.main_window_title description: The main window title of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.name description: The file name in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.extension description: The file extension in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.size description: The file size (bytes) in the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.md5_hash description: The MD5 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.sha256_hash description: The SHA-256 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.created_at description: The creation timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.modified_at description: The last modification timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.owner.name description: The name of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.owner.id description: The ID of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.local_file.id description: The local file ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.local_file.path description: The local file system path in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.network_share.hostname description: The hostname of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.network_share.path description: The path of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.id description: The ID of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.from description: The sender of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.to description: The recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.cc description: The CC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.bcc description: The BCC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.subject description: The subject of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email_attachment.id description: The ID of the email attachment in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.url description: The URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.domain description: The domain of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.category description: The category of the web endpoint (e.g. cloud_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.download_url description: The download URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.title description: The page title of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.user_agent description: The user-agent string of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.provider description: The cloud provider (e.g. google) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.name description: The name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_name description: The username in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_email description: The user email in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_id description: The instance ID of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_name description: The instance name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_file.id description: The ID of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_file.content_uri description: The content URI of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_file.path description: The path of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.scope description: The sharing scope in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.role description: The role of the cloud share recipient in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.name description: The name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.description description: The description of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.physical_location description: The physical location of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.server description: The print server hostname in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.share_name description: The share name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.port description: The port of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.driver description: The driver name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.is_local description: Whether the printer is local in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.job_id description: The print job ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.connectivity description: The connectivity type of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.id description: The ID of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.name description: The name of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.product_id description: The USB product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.sender description: The sender of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_users description: The recipient users of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_groups description: The recipient groups of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.domain description: The domain of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.workspace description: The workspace of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.organization description: The organization of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.name description: The name of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.branch description: The branch of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.id description: The ID of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.labels description: The labels applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.label_ids description: The label IDs applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.matched_policies description: The list of DLP policies matched by the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.issues description: The list of DLP issues detected on the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.outline description: The outline description of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.type description: The endpoint type (e.g. endpoint, removable_media) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.domain description: The domain of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.discovered_at description: The timestamp when the object was first discovered in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.updated_at description: The timestamp when the object was last updated in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.id description: The ID of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.action_kind description: The action kind of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.timestamp description: The timestamp of the update event in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.user.id description: The user ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_username description: The local username in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_id description: The local ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.version_id description: The version ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.id description: The ID of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.type description: The type of cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.name description: The name of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.account_id description: The account ID of the cloud connector in the end event. type: String - name: cyberhaven-event-details-get arguments: - name: event_ids required: true isArray: true description: A comma-separated list of event UUIDs to get the events. description: Retrieves full details for one or more Cyberhaven events by ID. outputs: - contextPath: Cyberhaven.Event.id description: The unique identifier of the event. type: String - contextPath: Cyberhaven.Event.timestamp description: The timestamp when the event occurred. type: Date - contextPath: Cyberhaven.Event.action.kind description: The kind of action performed (e.g. copy, upload). type: String - contextPath: Cyberhaven.Event.action.blocked description: Whether the action was blocked by policy. type: Boolean - contextPath: Cyberhaven.Event.action.data_size description: The size of data involved in the action (bytes). type: Number - contextPath: Cyberhaven.Event.action.content.tags description: The content classification tags detected in the action. type: String - contextPath: Cyberhaven.Event.action.content.attributes description: The content attributes of the action. type: String - contextPath: Cyberhaven.Event.action.content.upload_filename description: The filename of the content being uploaded in the action. type: String - contextPath: Cyberhaven.Event.action.content.inspected description: Whether the content was inspected in the action. type: Boolean - contextPath: Cyberhaven.Event.action.sensor_kind description: The sensor type that detected the action (e.g. endpoint). type: String - contextPath: Cyberhaven.Event.action.hostname description: The hostname of the machine where the action occurred. type: String - contextPath: Cyberhaven.Event.action.machine_serial_number description: The serial number of the machine where the action occurred. type: String - contextPath: Cyberhaven.Event.action.ip_address description: The IP address of the machine where the action occurred. type: String - contextPath: Cyberhaven.Event.action.device_type description: The device management type (e.g. managed). type: String - contextPath: Cyberhaven.Event.action.temporary_blocked description: Whether the action was temporarily blocked. type: Boolean - contextPath: Cyberhaven.Event.action.fail_close_statuses description: The list of fail-close status objects for the action. type: String - contextPath: Cyberhaven.Event.action.process_id description: The process ID of the process that triggered the action. type: Number - contextPath: Cyberhaven.Event.action.parent_process_id description: The parent process ID of the process that triggered the action. type: Number - contextPath: Cyberhaven.Event.user.id description: The identifier of the user who triggered the event. type: String - contextPath: Cyberhaven.Event.user.local_username description: The local machine username of the user who triggered the event. type: String - contextPath: Cyberhaven.Event.user.local_id description: The local identifier of the user who triggered the event. type: String - contextPath: Cyberhaven.Event.source.id description: The ID of the object. type: String - contextPath: Cyberhaven.Event.source.display_name description: The display name of the object. type: String - contextPath: Cyberhaven.Event.source.datastore_id description: The datastore ID associated with the object. type: String - contextPath: Cyberhaven.Event.source.dataset_sensitivity description: The sensitivity classification of the dataset. type: String - contextPath: Cyberhaven.Event.source.dataset_ids description: The list of dataset IDs associated with the object. type: String - contextPath: Cyberhaven.Event.source.object_type description: The object type (e.g. file, removable_storage). type: String - contextPath: Cyberhaven.Event.source.state description: The state of the object (e.g. active). type: String - contextPath: Cyberhaven.Event.source.content.tags description: The content classification tags. type: String - contextPath: Cyberhaven.Event.source.content.attributes description: The content attributes. type: String - contextPath: Cyberhaven.Event.source.content.upload_filename description: The upload filename of the content. type: String - contextPath: Cyberhaven.Event.source.content.inspected description: Whether the content was inspected. type: Boolean - contextPath: Cyberhaven.Event.source.data.labels description: The data classification labels. type: String - contextPath: Cyberhaven.Event.source.data.label_ids description: The data classification label IDs. type: String - contextPath: Cyberhaven.Event.source.app.name description: The name of the associated application. type: String - contextPath: Cyberhaven.Event.source.app.description description: The description of the associated application. type: String - contextPath: Cyberhaven.Event.source.app.package_name description: The package name of the associated application. type: String - contextPath: Cyberhaven.Event.source.app.binary_path description: The binary path of the associated application. type: String - contextPath: Cyberhaven.Event.source.app.command_line description: The command line of the associated application. type: String - contextPath: Cyberhaven.Event.source.app.main_window_title description: The main window title of the associated application. type: String - contextPath: Cyberhaven.Event.source.file.name description: The file name. type: String - contextPath: Cyberhaven.Event.source.file.extension description: The file extension. type: String - contextPath: Cyberhaven.Event.source.file.size description: The file size (bytes). type: Number - contextPath: Cyberhaven.Event.source.file.md5_hash description: The MD5 hash of the file. type: String - contextPath: Cyberhaven.Event.source.file.sha256_hash description: The SHA-256 hash of the file. type: String - contextPath: Cyberhaven.Event.source.file.created_at description: The creation timestamp of the file. type: Date - contextPath: Cyberhaven.Event.source.file.modified_at description: The last modification timestamp of the file. type: Date - contextPath: Cyberhaven.Event.source.file.owner.name description: The name of the file owner. type: String - contextPath: Cyberhaven.Event.source.file.owner.id description: The ID of the file owner. type: String - contextPath: Cyberhaven.Event.source.local_file.id description: The local file ID. type: String - contextPath: Cyberhaven.Event.source.local_file.path description: The local file system path. type: String - contextPath: Cyberhaven.Event.source.network_share.hostname description: The hostname of the network share. type: String - contextPath: Cyberhaven.Event.source.network_share.path description: The path of the network share. type: String - contextPath: Cyberhaven.Event.source.email.id description: The ID of the email. type: String - contextPath: Cyberhaven.Event.source.email.from description: The sender of the email. type: String - contextPath: Cyberhaven.Event.source.email.to description: The recipients of the email. type: String - contextPath: Cyberhaven.Event.source.email.cc description: The CC recipients of the email. type: String - contextPath: Cyberhaven.Event.source.email.bcc description: The BCC recipients of the email. type: String - contextPath: Cyberhaven.Event.source.email.subject description: The subject of the email. type: String - contextPath: Cyberhaven.Event.source.email_attachment.id description: The ID of the email attachment. type: String - contextPath: Cyberhaven.Event.source.web.url description: The URL of the web endpoint. type: String - contextPath: Cyberhaven.Event.source.web.domain description: The domain of the web endpoint. type: String - contextPath: Cyberhaven.Event.source.web.category description: The category of the web endpoint (e.g. cloud_storage). type: String - contextPath: Cyberhaven.Event.source.web.download_url description: The download URL of the web endpoint. type: String - contextPath: Cyberhaven.Event.source.web.title description: The page title of the web endpoint. type: String - contextPath: Cyberhaven.Event.source.web.user_agent description: The user-agent string of the web endpoint. type: String - contextPath: Cyberhaven.Event.source.cloud_app.provider description: The cloud provider (e.g. google). type: String - contextPath: Cyberhaven.Event.source.cloud_app.name description: The name of the cloud application. type: String - contextPath: Cyberhaven.Event.source.cloud_app.user_name description: The username in the cloud application. type: String - contextPath: Cyberhaven.Event.source.cloud_app.user_email description: The user email in the cloud application. type: String - contextPath: Cyberhaven.Event.source.cloud_app.instance_id description: The instance ID of the cloud application. type: String - contextPath: Cyberhaven.Event.source.cloud_app.instance_name description: The instance name of the cloud application. type: String - contextPath: Cyberhaven.Event.source.cloud_file.id description: The ID of the cloud file. type: String - contextPath: Cyberhaven.Event.source.cloud_file.content_uri description: The content URI of the cloud file. type: String - contextPath: Cyberhaven.Event.source.cloud_file.path description: The path of the cloud file. type: String - contextPath: Cyberhaven.Event.source.cloud_share_recipient.scope description: The sharing scope. type: String - contextPath: Cyberhaven.Event.source.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share. type: String - contextPath: Cyberhaven.Event.source.cloud_share_recipient.role description: The role of the cloud share recipient. type: String - contextPath: Cyberhaven.Event.source.printer.name description: The name of the printer. type: String - contextPath: Cyberhaven.Event.source.printer.description description: The description of the printer. type: String - contextPath: Cyberhaven.Event.source.printer.physical_location description: The physical location of the printer. type: String - contextPath: Cyberhaven.Event.source.printer.server description: The print server hostname. type: String - contextPath: Cyberhaven.Event.source.printer.share_name description: The share name of the printer. type: String - contextPath: Cyberhaven.Event.source.printer.port description: The port of the printer. type: String - contextPath: Cyberhaven.Event.source.printer.driver description: The driver name of the printer. type: String - contextPath: Cyberhaven.Event.source.printer.is_local description: Whether the printer is local. type: Boolean - contextPath: Cyberhaven.Event.source.printer.job_id description: The print job ID. type: String - contextPath: Cyberhaven.Event.source.printer.connectivity description: The connectivity type of the printer. type: String - contextPath: Cyberhaven.Event.source.removable_storage.id description: The ID of the removable storage device. type: String - contextPath: Cyberhaven.Event.source.removable_storage.name description: The name of the removable storage device. type: String - contextPath: Cyberhaven.Event.source.removable_storage.usb_id description: The USB vendor:product ID of the removable storage. type: String - contextPath: Cyberhaven.Event.source.removable_storage.vendor_id description: The USB vendor ID of the removable storage. type: String - contextPath: Cyberhaven.Event.source.removable_storage.product_id description: The USB product ID of the removable storage. type: String - contextPath: Cyberhaven.Event.source.im_message.sender description: The sender of the IM message. type: String - contextPath: Cyberhaven.Event.source.im_message.recipient_users description: The recipient users of the IM message. type: String - contextPath: Cyberhaven.Event.source.im_message.recipient_groups description: The recipient groups of the IM message. type: String - contextPath: Cyberhaven.Event.source.im_message.domain description: The domain of the IM message. type: String - contextPath: Cyberhaven.Event.source.im_message.workspace description: The workspace of the IM message. type: String - contextPath: Cyberhaven.Event.source.source_code_repo.organization description: The organization of the source code repository. type: String - contextPath: Cyberhaven.Event.source.source_code_repo.name description: The name of the source code repository. type: String - contextPath: Cyberhaven.Event.source.source_code_repo.branch description: The branch of the source code repository. type: String - contextPath: Cyberhaven.Event.source.source_code_repo.id description: The ID of the source code repository. type: String - contextPath: Cyberhaven.Event.source.labels description: The labels applied to the object. type: String - contextPath: Cyberhaven.Event.source.label_ids description: The label IDs applied to the object. type: String - contextPath: Cyberhaven.Event.source.matched_policies description: The list of DLP policies matched by the object. type: String - contextPath: Cyberhaven.Event.source.issues description: The list of DLP issues detected on the object. type: String - contextPath: Cyberhaven.Event.source.outline description: The outline description of the object. type: String - contextPath: Cyberhaven.Event.source.type description: The endpoint type (e.g. endpoint, removable_media). type: String - contextPath: Cyberhaven.Event.source.domain description: The domain of the object. type: String - contextPath: Cyberhaven.Event.source.discovered_at description: The timestamp when the object was first discovered. type: Date - contextPath: Cyberhaven.Event.source.updated_at description: The timestamp when the object was last updated. type: Date - contextPath: Cyberhaven.Event.source.update_event.id description: The ID of the update event. type: String - contextPath: Cyberhaven.Event.source.update_event.action_kind description: The action kind of the update event. type: String - contextPath: Cyberhaven.Event.source.update_event.timestamp description: The timestamp of the update event. type: Date - contextPath: Cyberhaven.Event.source.update_event.user.id description: The user ID in the update event. type: String - contextPath: Cyberhaven.Event.source.update_event.user.local_username description: The local username in the update event. type: String - contextPath: Cyberhaven.Event.source.update_event.user.local_id description: The local ID in the update event. type: String - contextPath: Cyberhaven.Event.source.version_id description: The version ID of the object. type: String - contextPath: Cyberhaven.Event.source.cloud_connector.id description: The ID of the cloud connector. type: String - contextPath: Cyberhaven.Event.source.cloud_connector.type description: The type of cloud connector. type: String - contextPath: Cyberhaven.Event.source.cloud_connector.name description: The name of the cloud connector. type: String - contextPath: Cyberhaven.Event.source.cloud_connector.onboarding_account description: The onboarding account of the cloud connector. type: String - contextPath: Cyberhaven.Event.source.cloud_connector.account_id description: The account ID of the cloud connector. type: String - contextPath: Cyberhaven.Event.destination.id description: The ID of the object. type: String - contextPath: Cyberhaven.Event.destination.display_name description: The display name of the object. type: String - contextPath: Cyberhaven.Event.destination.datastore_id description: The datastore ID associated with the object. type: String - contextPath: Cyberhaven.Event.destination.dataset_sensitivity description: The sensitivity classification of the dataset. type: String - contextPath: Cyberhaven.Event.destination.dataset_ids description: The list of dataset IDs associated with the object. type: String - contextPath: Cyberhaven.Event.destination.object_type description: The object type (e.g. file, removable_storage). type: String - contextPath: Cyberhaven.Event.destination.state description: The state of the object (e.g. active). type: String - contextPath: Cyberhaven.Event.destination.content.tags description: The content classification tags. type: String - contextPath: Cyberhaven.Event.destination.content.attributes description: The content attributes. type: String - contextPath: Cyberhaven.Event.destination.content.upload_filename description: The upload filename of the content. type: String - contextPath: Cyberhaven.Event.destination.content.inspected description: Whether the content was inspected. type: Boolean - contextPath: Cyberhaven.Event.destination.data.labels description: The data classification labels. type: String - contextPath: Cyberhaven.Event.destination.data.label_ids description: The data classification label IDs. type: String - contextPath: Cyberhaven.Event.destination.app.name description: The name of the associated application. type: String - contextPath: Cyberhaven.Event.destination.app.description description: The description of the associated application. type: String - contextPath: Cyberhaven.Event.destination.app.package_name description: The package name of the associated application. type: String - contextPath: Cyberhaven.Event.destination.app.binary_path description: The binary path of the associated application. type: String - contextPath: Cyberhaven.Event.destination.app.command_line description: The command line of the associated application. type: String - contextPath: Cyberhaven.Event.destination.app.main_window_title description: The main window title of the associated application. type: String - contextPath: Cyberhaven.Event.destination.file.name description: The file name. type: String - contextPath: Cyberhaven.Event.destination.file.extension description: The file extension. type: String - contextPath: Cyberhaven.Event.destination.file.size description: The file size (bytes). type: Number - contextPath: Cyberhaven.Event.destination.file.md5_hash description: The MD5 hash of the file. type: String - contextPath: Cyberhaven.Event.destination.file.sha256_hash description: The SHA-256 hash of the file. type: String - contextPath: Cyberhaven.Event.destination.file.created_at description: The creation timestamp of the file. type: Date - contextPath: Cyberhaven.Event.destination.file.modified_at description: The last modification timestamp of the file. type: Date - contextPath: Cyberhaven.Event.destination.file.owner.name description: The name of the file owner. type: String - contextPath: Cyberhaven.Event.destination.file.owner.id description: The ID of the file owner. type: String - contextPath: Cyberhaven.Event.destination.local_file.id description: The local file ID. type: String - contextPath: Cyberhaven.Event.destination.local_file.path description: The local file system path. type: String - contextPath: Cyberhaven.Event.destination.network_share.hostname description: The hostname of the network share. type: String - contextPath: Cyberhaven.Event.destination.network_share.path description: The path of the network share. type: String - contextPath: Cyberhaven.Event.destination.email.id description: The ID of the email. type: String - contextPath: Cyberhaven.Event.destination.email.from description: The sender of the email. type: String - contextPath: Cyberhaven.Event.destination.email.to description: The recipients of the email. type: String - contextPath: Cyberhaven.Event.destination.email.cc description: The CC recipients of the email. type: String - contextPath: Cyberhaven.Event.destination.email.bcc description: The BCC recipients of the email. type: String - contextPath: Cyberhaven.Event.destination.email.subject description: The subject of the email. type: String - contextPath: Cyberhaven.Event.destination.email_attachment.id description: The ID of the email attachment. type: String - contextPath: Cyberhaven.Event.destination.web.url description: The URL of the web endpoint. type: String - contextPath: Cyberhaven.Event.destination.web.domain description: The domain of the web endpoint. type: String - contextPath: Cyberhaven.Event.destination.web.category description: The category of the web endpoint (e.g. cloud_storage). type: String - contextPath: Cyberhaven.Event.destination.web.download_url description: The download URL of the web endpoint. type: String - contextPath: Cyberhaven.Event.destination.web.title description: The page title of the web endpoint. type: String - contextPath: Cyberhaven.Event.destination.web.user_agent description: The user-agent string of the web endpoint. type: String - contextPath: Cyberhaven.Event.destination.cloud_app.provider description: The cloud provider (e.g. google). type: String - contextPath: Cyberhaven.Event.destination.cloud_app.name description: The name of the cloud application. type: String - contextPath: Cyberhaven.Event.destination.cloud_app.user_name description: The username in the cloud application. type: String - contextPath: Cyberhaven.Event.destination.cloud_app.user_email description: The user email in the cloud application. type: String - contextPath: Cyberhaven.Event.destination.cloud_app.instance_id description: The instance ID of the cloud application. type: String - contextPath: Cyberhaven.Event.destination.cloud_app.instance_name description: The instance name of the cloud application. type: String - contextPath: Cyberhaven.Event.destination.cloud_file.id description: The ID of the cloud file. type: String - contextPath: Cyberhaven.Event.destination.cloud_file.content_uri description: The content URI of the cloud file. type: String - contextPath: Cyberhaven.Event.destination.cloud_file.path description: The path of the cloud file. type: String - contextPath: Cyberhaven.Event.destination.cloud_share_recipient.scope description: The sharing scope. type: String - contextPath: Cyberhaven.Event.destination.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share. type: String - contextPath: Cyberhaven.Event.destination.cloud_share_recipient.role description: The role of the cloud share recipient. type: String - contextPath: Cyberhaven.Event.destination.printer.name description: The name of the printer. type: String - contextPath: Cyberhaven.Event.destination.printer.description description: The description of the printer. type: String - contextPath: Cyberhaven.Event.destination.printer.physical_location description: The physical location of the printer. type: String - contextPath: Cyberhaven.Event.destination.printer.server description: The print server hostname. type: String - contextPath: Cyberhaven.Event.destination.printer.share_name description: The share name of the printer. type: String - contextPath: Cyberhaven.Event.destination.printer.port description: The port of the printer. type: String - contextPath: Cyberhaven.Event.destination.printer.driver description: The driver name of the printer. type: String - contextPath: Cyberhaven.Event.destination.printer.is_local description: Whether the printer is local. type: Boolean - contextPath: Cyberhaven.Event.destination.printer.job_id description: The print job ID. type: String - contextPath: Cyberhaven.Event.destination.printer.connectivity description: The connectivity type of the printer. type: String - contextPath: Cyberhaven.Event.destination.removable_storage.id description: The ID of the removable storage device. type: String - contextPath: Cyberhaven.Event.destination.removable_storage.name description: The name of the removable storage device. type: String - contextPath: Cyberhaven.Event.destination.removable_storage.usb_id description: The USB vendor:product ID of the removable storage. type: String - contextPath: Cyberhaven.Event.destination.removable_storage.vendor_id description: The USB vendor ID of the removable storage. type: String - contextPath: Cyberhaven.Event.destination.removable_storage.product_id description: The USB product ID of the removable storage. type: String - contextPath: Cyberhaven.Event.destination.im_message.sender description: The sender of the IM message. type: String - contextPath: Cyberhaven.Event.destination.im_message.recipient_users description: The recipient users of the IM message. type: String - contextPath: Cyberhaven.Event.destination.im_message.recipient_groups description: The recipient groups of the IM message. type: String - contextPath: Cyberhaven.Event.destination.im_message.domain description: The domain of the IM message. type: String - contextPath: Cyberhaven.Event.destination.im_message.workspace description: The workspace of the IM message. type: String - contextPath: Cyberhaven.Event.destination.source_code_repo.organization description: The organization of the source code repository. type: String - contextPath: Cyberhaven.Event.destination.source_code_repo.name description: The name of the source code repository. type: String - contextPath: Cyberhaven.Event.destination.source_code_repo.branch description: The branch of the source code repository. type: String - contextPath: Cyberhaven.Event.destination.source_code_repo.id description: The ID of the source code repository. type: String - contextPath: Cyberhaven.Event.destination.labels description: The labels applied to the object. type: String - contextPath: Cyberhaven.Event.destination.label_ids description: The label IDs applied to the object. type: String - contextPath: Cyberhaven.Event.destination.matched_policies description: The list of DLP policies matched by the object. type: String - contextPath: Cyberhaven.Event.destination.issues description: The list of DLP issues detected on the object. type: String - contextPath: Cyberhaven.Event.destination.outline description: The outline description of the object. type: String - contextPath: Cyberhaven.Event.destination.type description: The endpoint type (e.g. endpoint, removable_media). type: String - contextPath: Cyberhaven.Event.destination.domain description: The domain of the object. type: String - contextPath: Cyberhaven.Event.destination.discovered_at description: The timestamp when the object was first discovered. type: Date - contextPath: Cyberhaven.Event.destination.updated_at description: The timestamp when the object was last updated. type: Date - contextPath: Cyberhaven.Event.destination.update_event.id description: The ID of the update event. type: String - contextPath: Cyberhaven.Event.destination.update_event.action_kind description: The action kind of the update event. type: String - contextPath: Cyberhaven.Event.destination.update_event.timestamp description: The timestamp of the update event. type: Date - contextPath: Cyberhaven.Event.destination.update_event.user.id description: The user ID in the update event. type: String - contextPath: Cyberhaven.Event.destination.update_event.user.local_username description: The local username in the update event. type: String - contextPath: Cyberhaven.Event.destination.update_event.user.local_id description: The local ID in the update event. type: String - contextPath: Cyberhaven.Event.destination.version_id description: The version ID of the object. type: String - contextPath: Cyberhaven.Event.destination.cloud_connector.id description: The ID of the cloud connector. type: String - contextPath: Cyberhaven.Event.destination.cloud_connector.type description: The type of cloud connector. type: String - contextPath: Cyberhaven.Event.destination.cloud_connector.name description: The name of the cloud connector. type: String - contextPath: Cyberhaven.Event.destination.cloud_connector.onboarding_account description: The onboarding account of the cloud connector. type: String - contextPath: Cyberhaven.Event.destination.cloud_connector.account_id description: The account ID of the cloud connector. type: String - name: cyberhaven-event-lineage-get arguments: - name: start_event_id required: true description: Provide the UUID of the first event in the chain. - name: end_event_id required: true description: Provide the UUID of the last event in the chain. description: Retrieves the data lineage chain between two Cyberhaven event IDs. outputs: - contextPath: Cyberhaven.EventLineage.resources description: The list of events ID in order. type: String script: '' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10404775 isfetch: true isremotesyncout: true tests: - No tests (auto formatted)