Cyberhaven
Fetches DLP incidents from the Cyberhaven data security platform and enables investigation of events and data lineage.
Data Enrichment & Threat Intelligence · Cyberhaven
Details
| ID | Cyberhaven |
|---|---|
| Provider | Cyberhaven |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 6.10.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
| Supported Modules | Agentix XSIAM |
README
Fetches DLP incidents from the Cyberhaven data security platform and enables investigation of events and data lineage.
This integration was integrated and tested with version 2 of Cyberhaven API.
Configure Cyberhaven in Cortex
| Parameter | Description | Required |
|---|---|---|
| Server URL (e.g., https://example.cyberhaven.io) | URL of the Cyberhaven tenant. | True |
| Refresh Token | Provide the Refresh Token for authentication. | True |
| Fetch incidents | Whether to fetch DLP incidents as XSOAR Incidents. | False |
| Incident type | Select Incident type as “Cyberhaven Incident”. | False |
| First fetch time | The date or relative timestamp from which to begin fetching DLP Incidents. Default value is ‘3 days’. The maximum is ‘30 days’. If the value is greater than ‘30 days’, it will be considered as ‘30 days’. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. For example: 01 May 2026, 01 May 2026 04:45:33, 2026-05-17T14:05:44Z. |
False |
| Max Fetch | The maximum number of DLP Incidents to fetch each time. Default value is 100. The maximum is 200. If the value is greater than 200, it will be considered as 200. |
False |
| Status of incidents to fetch | Filter the DLP incidents by Status. Default value is ‘Open’. | False |
| Severity of incidents to fetch | Filter the DLP incidents by Severity. Default value is ‘Informational, Low, Medium, High, Critical’. | False |
| Enable Outgoing Mirroring (from XSOAR to Cyberhaven) | When enabled, updates to the following fields in XSOAR are synchronized to Cyberhaven: Status, Owner, Close Reason, and Close Notes. | False |
| Incidents Fetch Interval | The interval in minutes to fetch incidents. The default is 5 minute. | False |
| Trust any certificate (not secure) | Whether to allow connections without verifying SSL certificates validity. | False |
| Use system proxy settings | Whether to use XSOAR’s system proxy settings to connect to the API. | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
cyberhaven-incident-list
List and search Cyberhaven DLP incidents with optional filters.
Base Command
cyberhaven-incident-list
Input
| Argument Name | Description | Required |
|---|---|---|
| limit | Max incidents to return. Default is 25. | Optional |
| start_time | Filter the incidents by start on or after the provided time. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. | Optional |
| end_time | Filter the incidents by end on or before the provided time. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ. | Optional |
| severity | A comma-separated list of severity by which to filter the incidents. Possible values are: Informational, Low, Medium, High, Critical. | Optional |
| status | A comma-separated list of status by which to filter the incidents. Possible values are: Open, Closed. | Optional |
| assignee | Filter the incidents by assigned analyst email. | Optional |
| user | Filter the incidents by user who triggered the incident. | Optional |
| incident_ids | A comma-separated list of incident IDs to filter the results. | Optional |
| page_id | Page ID to retrieve the next set of the incidents. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Cyberhaven.Incident.id | String | The unique identifier of the incident. |
| Cyberhaven.Incident.user.id | String | The identifier of the user who triggered the incident. |
| Cyberhaven.Incident.user.local_username | String | The local machine username of the user who triggered the incident. |
| Cyberhaven.Incident.user.local_id | String | The local identifier of the user who triggered the incident. |
| Cyberhaven.Incident.event_lineage_id.start_event_id | String | The ID of the first event in the lineage chain. |
| Cyberhaven.Incident.event_lineage_id.end_event_id | String | The ID of the last event in the lineage chain. |
| Cyberhaven.Incident.blocked | Boolean | Whether the action that triggered the incident was blocked. |
| Cyberhaven.Incident.event_time | Date | The timestamp of the event that triggered the incident. |
| Cyberhaven.Incident.trigger_time | Date | The timestamp when the incident was triggered. |
| Cyberhaven.Incident.dataset.id | String | The identifier of the dataset involved in the incident. |
| Cyberhaven.Incident.dataset.name | String | The name of the dataset involved in the incident. |
| Cyberhaven.Incident.dataset.sensitivity | String | The sensitivity classification of the dataset involved. |
| Cyberhaven.Incident.user_risk_groups | String | The list of risk groups the user belongs to. |
| Cyberhaven.Incident.policy.id | String | The identifier of the DLP policy that was triggered. |
| Cyberhaven.Incident.policy.name | String | The name of the DLP policy that was triggered. |
| Cyberhaven.Incident.policy.severity | String | The severity level defined in the triggering DLP policy. |
| Cyberhaven.Incident.risk_score | Number | The numeric risk score assigned to the incident. |
| Cyberhaven.Incident.screenshot_guid | String | The GUID of the screenshot associated with the incident. |
| Cyberhaven.Incident.warning_status | String | The warning acknowledgement status of the incident. |
| Cyberhaven.Incident.user_reactions | String | The list of user reaction codes for the incident. |
| Cyberhaven.Incident.user_reaction_message | String | The message provided by the user when reacting to the warning. |
| Cyberhaven.Incident.reaction_time | Date | The timestamp when the user reacted to the warning. |
| Cyberhaven.Incident.assigned_to | String | The email of the analyst the incident is assigned to. |
| Cyberhaven.Incident.status | String | The current status of the incident (e.g. open, closed). |
| Cyberhaven.Incident.resolution_time | Date | The timestamp when the incident was resolved. |
| Cyberhaven.Incident.close_reason | String | The reason code provided when the incident was closed. |
| Cyberhaven.Incident.close_note | String | The free-text note provided when the incident was closed. |
| Cyberhaven.Incident.created_by | String | Indicates how the incident was created (e.g. created_by_policy). |
| Cyberhaven.Incident.ai_summary | String | The AI-generated summary of the incident. |
| Cyberhaven.Incident.ai_severity | String | The AI-assessed severity level of the incident. |
| Cyberhaven.Incident.last_modified | Date | The timestamp when the incident was last modified. |
| Cyberhaven.Incident.event_details.start_event.id | String | The ID of the start event. |
| Cyberhaven.Incident.event_details.start_event.timestamp | Date | The timestamp of the start event. |
| Cyberhaven.Incident.event_details.start_event.action.kind | String | The action kind performed in the start event (e.g. copy). |
| Cyberhaven.Incident.event_details.start_event.action.blocked | Boolean | Whether the action in the start event was blocked. |
| Cyberhaven.Incident.event_details.start_event.action.data_size | Number | The size of data involved in the start event action (bytes). |
| Cyberhaven.Incident.event_details.start_event.action.content.tags | String | The content classification tags detected in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.attributes | String | The content attributes of the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.upload_filename | String | The filename of the content being uploaded in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.inspected | Boolean | Whether the content was inspected in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.sensor_kind | String | The sensor type that detected the start event (e.g. endpoint). |
| Cyberhaven.Incident.event_details.start_event.action.hostname | String | The hostname of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.machine_serial_number | String | The serial number of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.ip_address | String | The IP address of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.device_type | String | The device management type for the start event (e.g. managed). |
| Cyberhaven.Incident.event_details.start_event.action.temporary_blocked | Boolean | Whether the start event action was temporarily blocked. |
| Cyberhaven.Incident.event_details.start_event.action.fail_close_statuses | String | The list of fail-close status objects for the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.process_id | Number | The process ID of the process that triggered the start event. |
| Cyberhaven.Incident.event_details.start_event.action.parent_process_id | Number | The parent process ID of the process that triggered the start event. |
| Cyberhaven.Incident.event_details.start_event.user.id | String | The identifier of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.user.local_username | String | The local username of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.user.local_id | String | The local ID of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.id | String | The ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.display_name | String | The display name of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.datastore_id | String | The datastore ID associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.dataset_sensitivity | String | The sensitivity classification of the dataset in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.dataset_ids | String | The list of dataset IDs associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.object_type | String | The object type (e.g. file, removable_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.state | String | The state of the object (e.g. active) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.tags | String | The content classification tags in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.attributes | String | The content attributes in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.upload_filename | String | The upload filename of the content in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.inspected | Boolean | Whether the content was inspected in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.data.labels | String | The data classification labels in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.data.label_ids | String | The data classification label IDs in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.name | String | The name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.description | String | The description of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.package_name | String | The package name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.binary_path | String | The binary path of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.command_line | String | The command line of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.main_window_title | String | The main window title of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.name | String | The file name in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.extension | String | The file extension in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.size | Number | The file size (bytes) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.md5_hash | String | The MD5 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.sha256_hash | String | The SHA-256 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.created_at | Date | The creation timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.modified_at | Date | The last modification timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.owner.name | String | The name of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.owner.id | String | The ID of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.local_file.id | String | The local file ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.local_file.path | String | The local file system path in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.network_share.hostname | String | The hostname of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.network_share.path | String | The path of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.id | String | The ID of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.from | String | The sender of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.to | String | The recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.cc | String | The CC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.bcc | String | The BCC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.subject | String | The subject of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email_attachment.id | String | The ID of the email attachment in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.url | String | The URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.domain | String | The domain of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.download_url | String | The download URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.title | String | The page title of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.user_agent | String | The user-agent string of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.provider | String | The cloud provider (e.g. google) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.name | String | The name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_name | String | The username in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_email | String | The user email in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_id | String | The instance ID of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_name | String | The instance name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.id | String | The ID of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.content_uri | String | The content URI of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.path | String | The path of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.scope | String | The sharing scope in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.role | String | The role of the cloud share recipient in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.name | String | The name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.description | String | The description of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.physical_location | String | The physical location of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.server | String | The print server hostname in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.share_name | String | The share name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.port | String | The port of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.driver | String | The driver name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.is_local | Boolean | Whether the printer is local in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.job_id | String | The print job ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.connectivity | String | The connectivity type of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.id | String | The ID of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.name | String | The name of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.product_id | String | The USB product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.sender | String | The sender of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_users | String | The recipient users of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_groups | String | The recipient groups of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.domain | String | The domain of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.workspace | String | The workspace of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.organization | String | The organization of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.name | String | The name of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.branch | String | The branch of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.id | String | The ID of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.labels | String | The labels applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.label_ids | String | The label IDs applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.matched_policies | String | The list of DLP policies matched by the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.issues | String | The list of DLP issues detected on the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.outline | String | The outline description of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.type | String | The endpoint type (e.g. endpoint, removable_media) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.domain | String | The domain of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.discovered_at | Date | The timestamp when the object was first discovered in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.updated_at | Date | The timestamp when the object was last updated in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.id | String | The ID of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.action_kind | String | The action kind of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.timestamp | Date | The timestamp of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.id | String | The user ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_username | String | The local username in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_id | String | The local ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.version_id | String | The version ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.id | String | The ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.type | String | The type of cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.name | String | The name of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.account_id | String | The account ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.id | String | The ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.display_name | String | The display name of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.datastore_id | String | The datastore ID associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.dataset_ids | String | The list of dataset IDs associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.object_type | String | The object type (e.g. file, removable_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.state | String | The state of the object (e.g. active) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.tags | String | The content classification tags in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.attributes | String | The content attributes in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.upload_filename | String | The upload filename of the content in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.inspected | Boolean | Whether the content was inspected in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.data.labels | String | The data classification labels in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.data.label_ids | String | The data classification label IDs in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.name | String | The name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.description | String | The description of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.package_name | String | The package name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.binary_path | String | The binary path of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.command_line | String | The command line of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.main_window_title | String | The main window title of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.name | String | The file name in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.extension | String | The file extension in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.size | Number | The file size (bytes) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.md5_hash | String | The MD5 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.sha256_hash | String | The SHA-256 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.created_at | Date | The creation timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.modified_at | Date | The last modification timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.owner.name | String | The name of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.owner.id | String | The ID of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.local_file.id | String | The local file ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.local_file.path | String | The local file system path in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.network_share.hostname | String | The hostname of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.network_share.path | String | The path of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.id | String | The ID of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.from | String | The sender of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.to | String | The recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.cc | String | The CC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.bcc | String | The BCC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.subject | String | The subject of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email_attachment.id | String | The ID of the email attachment in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.url | String | The URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.domain | String | The domain of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.download_url | String | The download URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.title | String | The page title of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.user_agent | String | The user-agent string of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.provider | String | The cloud provider (e.g. google) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.name | String | The name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_name | String | The username in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_email | String | The user email in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_id | String | The instance ID of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_name | String | The instance name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.id | String | The ID of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.content_uri | String | The content URI of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.path | String | The path of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.scope | String | The sharing scope in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.name | String | The name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.description | String | The description of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.physical_location | String | The physical location of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.server | String | The print server hostname in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.share_name | String | The share name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.port | String | The port of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.driver | String | The driver name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.is_local | Boolean | Whether the printer is local in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.job_id | String | The print job ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.connectivity | String | The connectivity type of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.id | String | The ID of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.name | String | The name of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.product_id | String | The USB product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.sender | String | The sender of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_users | String | The recipient users of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_groups | String | The recipient groups of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.domain | String | The domain of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.workspace | String | The workspace of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.organization | String | The organization of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.name | String | The name of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.branch | String | The branch of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.id | String | The ID of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.labels | String | The labels applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.label_ids | String | The label IDs applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.matched_policies | String | The list of DLP policies matched by the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.issues | String | The list of DLP issues detected on the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.outline | String | The outline description of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.type | String | The endpoint type (e.g. endpoint, removable_media) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.domain | String | The domain of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.discovered_at | Date | The timestamp when the object was first discovered in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.updated_at | Date | The timestamp when the object was last updated in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.id | String | The ID of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.action_kind | String | The action kind of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.timestamp | Date | The timestamp of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.id | String | The user ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_username | String | The local username in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_id | String | The local ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.version_id | String | The version ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.id | String | The ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.type | String | The type of cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.name | String | The name of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.account_id | String | The account ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.end_event.id | String | The ID of the end event. |
| Cyberhaven.Incident.event_details.end_event.timestamp | Date | The timestamp of the end event. |
| Cyberhaven.Incident.event_details.end_event.action.kind | String | The action kind performed in the end event (e.g. copy). |
| Cyberhaven.Incident.event_details.end_event.action.blocked | Boolean | Whether the action in the end event was blocked. |
| Cyberhaven.Incident.event_details.end_event.action.data_size | Number | The size of data involved in the end event action (bytes). |
| Cyberhaven.Incident.event_details.end_event.action.content.tags | String | The content classification tags detected in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.attributes | String | The content attributes of the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.upload_filename | String | The filename of the content being uploaded in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.inspected | Boolean | Whether the content was inspected in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.sensor_kind | String | The sensor type that detected the end event (e.g. endpoint). |
| Cyberhaven.Incident.event_details.end_event.action.hostname | String | The hostname of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.machine_serial_number | String | The serial number of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.ip_address | String | The IP address of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.device_type | String | The device management type for the end event (e.g. managed). |
| Cyberhaven.Incident.event_details.end_event.action.temporary_blocked | Boolean | Whether the end event action was temporarily blocked. |
| Cyberhaven.Incident.event_details.end_event.action.fail_close_statuses | String | The list of fail-close status objects for the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.process_id | Number | The process ID of the process that triggered the end event. |
| Cyberhaven.Incident.event_details.end_event.action.parent_process_id | Number | The parent process ID of the process that triggered the end event. |
| Cyberhaven.Incident.event_details.end_event.user.id | String | The identifier of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.user.local_username | String | The local username of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.user.local_id | String | The local ID of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.id | String | The ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.display_name | String | The display name of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.datastore_id | String | The datastore ID associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.dataset_sensitivity | String | The sensitivity classification of the dataset in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.dataset_ids | String | The list of dataset IDs associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.object_type | String | The object type (e.g. file, removable_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.state | String | The state of the object (e.g. active) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.tags | String | The content classification tags in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.attributes | String | The content attributes in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.upload_filename | String | The upload filename of the content in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.inspected | Boolean | Whether the content was inspected in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.data.labels | String | The data classification labels in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.data.label_ids | String | The data classification label IDs in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.name | String | The name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.description | String | The description of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.package_name | String | The package name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.binary_path | String | The binary path of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.command_line | String | The command line of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.main_window_title | String | The main window title of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.name | String | The file name in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.extension | String | The file extension in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.size | Number | The file size (bytes) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.md5_hash | String | The MD5 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.sha256_hash | String | The SHA-256 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.created_at | Date | The creation timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.modified_at | Date | The last modification timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.owner.name | String | The name of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.owner.id | String | The ID of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.local_file.id | String | The local file ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.local_file.path | String | The local file system path in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.network_share.hostname | String | The hostname of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.network_share.path | String | The path of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.id | String | The ID of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.from | String | The sender of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.to | String | The recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.cc | String | The CC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.bcc | String | The BCC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.subject | String | The subject of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email_attachment.id | String | The ID of the email attachment in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.url | String | The URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.domain | String | The domain of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.download_url | String | The download URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.title | String | The page title of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.user_agent | String | The user-agent string of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.provider | String | The cloud provider (e.g. google) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.name | String | The name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_name | String | The username in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_email | String | The user email in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_id | String | The instance ID of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_name | String | The instance name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.id | String | The ID of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.content_uri | String | The content URI of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.path | String | The path of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.scope | String | The sharing scope in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.role | String | The role of the cloud share recipient in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.name | String | The name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.description | String | The description of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.physical_location | String | The physical location of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.server | String | The print server hostname in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.share_name | String | The share name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.port | String | The port of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.driver | String | The driver name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.is_local | Boolean | Whether the printer is local in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.job_id | String | The print job ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.connectivity | String | The connectivity type of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.id | String | The ID of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.name | String | The name of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.product_id | String | The USB product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.sender | String | The sender of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_users | String | The recipient users of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_groups | String | The recipient groups of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.domain | String | The domain of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.workspace | String | The workspace of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.organization | String | The organization of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.name | String | The name of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.branch | String | The branch of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.id | String | The ID of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.labels | String | The labels applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.label_ids | String | The label IDs applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.matched_policies | String | The list of DLP policies matched by the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.issues | String | The list of DLP issues detected on the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.outline | String | The outline description of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.type | String | The endpoint type (e.g. endpoint, removable_media) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.domain | String | The domain of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.discovered_at | Date | The timestamp when the object was first discovered in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.updated_at | Date | The timestamp when the object was last updated in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.id | String | The ID of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.action_kind | String | The action kind of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.timestamp | Date | The timestamp of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.id | String | The user ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_username | String | The local username in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_id | String | The local ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.version_id | String | The version ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.id | String | The ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.type | String | The type of cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.name | String | The name of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.account_id | String | The account ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.id | String | The ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.display_name | String | The display name of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.datastore_id | String | The datastore ID associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.dataset_ids | String | The list of dataset IDs associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.object_type | String | The object type (e.g. file, removable_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.state | String | The state of the object (e.g. active) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.tags | String | The content classification tags in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.attributes | String | The content attributes in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.upload_filename | String | The upload filename of the content in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.inspected | Boolean | Whether the content was inspected in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.data.labels | String | The data classification labels in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.data.label_ids | String | The data classification label IDs in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.name | String | The name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.description | String | The description of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.package_name | String | The package name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.binary_path | String | The binary path of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.command_line | String | The command line of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.main_window_title | String | The main window title of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.name | String | The file name in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.extension | String | The file extension in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.size | Number | The file size (bytes) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.md5_hash | String | The MD5 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.sha256_hash | String | The SHA-256 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.created_at | Date | The creation timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.modified_at | Date | The last modification timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.owner.name | String | The name of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.owner.id | String | The ID of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.local_file.id | String | The local file ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.local_file.path | String | The local file system path in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.network_share.hostname | String | The hostname of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.network_share.path | String | The path of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.id | String | The ID of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.from | String | The sender of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.to | String | The recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.cc | String | The CC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.bcc | String | The BCC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.subject | String | The subject of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email_attachment.id | String | The ID of the email attachment in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.url | String | The URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.domain | String | The domain of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.download_url | String | The download URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.title | String | The page title of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.user_agent | String | The user-agent string of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.provider | String | The cloud provider (e.g. google) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.name | String | The name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_name | String | The username in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_email | String | The user email in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_id | String | The instance ID of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_name | String | The instance name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.id | String | The ID of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.content_uri | String | The content URI of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.path | String | The path of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.scope | String | The sharing scope in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.name | String | The name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.description | String | The description of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.physical_location | String | The physical location of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.server | String | The print server hostname in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.share_name | String | The share name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.port | String | The port of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.driver | String | The driver name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.is_local | Boolean | Whether the printer is local in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.job_id | String | The print job ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.connectivity | String | The connectivity type of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.id | String | The ID of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.name | String | The name of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.product_id | String | The USB product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.sender | String | The sender of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_users | String | The recipient users of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_groups | String | The recipient groups of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.domain | String | The domain of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.workspace | String | The workspace of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.organization | String | The organization of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.name | String | The name of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.branch | String | The branch of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.id | String | The ID of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.labels | String | The labels applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.label_ids | String | The label IDs applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.matched_policies | String | The list of DLP policies matched by the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.issues | String | The list of DLP issues detected on the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.outline | String | The outline description of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.type | String | The endpoint type (e.g. endpoint, removable_media) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.domain | String | The domain of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.discovered_at | Date | The timestamp when the object was first discovered in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.updated_at | Date | The timestamp when the object was last updated in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.id | String | The ID of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.action_kind | String | The action kind of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.timestamp | Date | The timestamp of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.id | String | The user ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_username | String | The local username in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_id | String | The local ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.version_id | String | The version ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.id | String | The ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.type | String | The type of cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.name | String | The name of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.account_id | String | The account ID of the cloud connector in the end event. |
| Cyberhaven.IncidentPage.next_id | String | The opaque cursor for the next page of results. Pass this value as page_id to retrieve the next page. |
| Cyberhaven.IncidentPage.total | Number | The total number of incidents for the provided filters. |
Command example
!cyberhaven-incident-list limit=2 start_time="3 days"
Context Example
{
"Cyberhaven": {
"Incidents": [
{
"id": "inc_a1b2c3d4e5f6",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"department": "Engineering",
"manager_email": "jane.smith@company.com",
"employee_id": "EMP-10042",
"location": "US-NYC",
"role": "Senior Software Engineer"
}
},
"event_lineage_id": {
"start_event_id": "evt_start_001abc",
"end_event_id": "evt_end_002xyz"
},
"blocked": false,
"event_time": "2026-01-15T10:28:45Z",
"trigger_time": "2026-01-15T10:29:02Z",
"dataset": {
"id": "ds_hr_confidential",
"name": "HR Confidential Records",
"sensitivity": "high",
"custom_data": {
"classification_level": "confidential",
"data_owner": "hr@company.com"
}
},
"user_risk_groups": [
{
"id": "rg_high_risk_users",
"name": "High Risk Users",
"risk_multiplier": 1.5,
"custom_data": {
"criteria": "multiple_policy_violations"
}
}
],
"policy": {
"id": "pol_dlp_hr_001",
"name": "HR Data Exfiltration Prevention",
"severity": "high",
"custom_data": {
"policy_owner": "security@company.com",
"enforcement_mode": "block",
"review_cycle": "quarterly",
"compliance_framework": "SOC2"
}
},
"risk_score": 8.5,
"screenshot_guid": "scrn_7f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
"warning_status": "warning_shown",
"user_reactions": [
"reaction_acknowledged"
],
"user_reaction_message": "I was transferring files for an approved project backup.",
"reaction_time": "2026-01-15T10:31:15Z",
"assigned_to": "analyst@company.com",
"status": "open",
"resolution_time": "2026-01-15T14:45:00Z",
"close_reason": "policy_violation",
"close_note": "User violated data exfiltration policy. Escalated to HR.",
"custom_data": {
"ticket_id": "JIRA-4521"
},
"created_by": "created_by_system",
"ai_summary": "User john.doe attempted to copy confidential HR records to a removable USB drive. The action was detected by endpoint DLP and flagged as a high-severity policy violation.",
"ai_severity": "high",
"last_modified": "2026-01-15T11:00:00Z",
"event_details": {
"start_event": {
"id": "evt_start_001abc",
"timestamp": "2026-01-15T10:28:45Z",
"action": {
"kind": "copy",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"encoding": "UTF-8"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"ad_group": "Domain Users",
"upn": "john.doe@company.com",
"last_login": "2026-01-15T08:05:00Z"
}
},
"source": {
"id": "src_local_001abc",
"display_name": "employee_salaries_2026.xlsx",
"datastore_id": "dstore_endpoint_01",
"dataset_sensitivity": "sensitivity_high",
"dataset_ids": [
"ds_hr_confidential"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"classification": "confidential",
"last_scan": "2026-01-10T09:00:00Z",
"scan_result": "contains_pii",
"owner_department": "HR"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential",
"HR Data"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Microsoft Excel",
"description": "Microsoft Office Spreadsheet Application",
"package_name": "com.microsoft.excel",
"binary_path": "C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE",
"command_line": "\"EXCEL.EXE\" /e",
"main_window_title": "employee_salaries_2026.xlsx - Excel",
"custom_data": {
"version": "16.0.17126.20132",
"publisher": "Microsoft Corporation",
"signed": "true",
"install_date": "2023-06-01",
"auto_update": "enabled"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"creator": "john.doe",
"last_modified_by": "jane.smith"
},
"created_at": "2026-01-10T09:00:00Z",
"modified_at": "2026-01-15T08:30:00Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_001abc",
"path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>",
"x_mailer": "Microsoft Outlook 16.0"
}
},
"email_attachment": {
"id": "attach_src_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload",
"custom_data": {
"referrer": "https://drive.google.com/",
"request_method": "POST"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Data/employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"revision_id": "rev_001"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12",
"duplex": "false"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"file_system": "NTFS",
"capacity_gb": "64"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_001abc"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private",
"default_branch": "main",
"last_commit": "a1b2c3d4e5f6",
"language": "Python"
},
"branch": "main",
"id": "repo_001"
},
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection",
"rule_confidential_data"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:28:45Z"
}
],
"issues": [
{
"id": "issue_001abc",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:45Z"
}
],
"custom_data": {
"data_classification": "confidential",
"retention_policy": "7_years",
"gdpr_relevant": "true",
"ccpa_relevant": "true"
},
"outline": "Spreadsheet containing employee salary and compensation data for 250 employees in the Engineering department.",
"type": "removable_media",
"domain": "company.com",
"discovered_at": "2026-01-10T09:00:00Z",
"updated_at": "2026-01-15T10:28:45Z",
"update_event": {
"id": "upd_evt_001",
"action_kind": "copy",
"timestamp": "2026-01-15T10:28:45Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_001abc",
"cloud_connector": {
"id": "cc_box_001",
"type": "box",
"name": "Company Box Integration",
"onboarding_account": "admin@company.com",
"account_id": "box_acct_001"
}
},
"destination": {
"id": "dst_usb_001abc",
"display_name": "SanDisk Ultra 64GB (E:)",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "removable_storage",
"state": "active",
"content": {
"tags": [
"external",
"removable"
],
"attributes": {
"file_count": 1,
"total_size": 2048576
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"destination_path": "E:\\Backup\\HR",
"overwrite": "false"
},
"inspected": true
},
"data": {
"labels": [
"External Storage"
],
"label_ids": [
"lbl_external_storage"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe /select,\"E:\\Backup\\HR\\employee_salaries_2026.xlsx\"",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"destination_created": "true",
"is_copy": "true",
"original_path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_dst_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\Backup\\HR",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>"
}
},
"email_attachment": {
"id": "attach_dst_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"file_size": "2048576",
"sanitized": "false"
}
},
"web": {
"url": "https://drive.google.com/upload/resumable",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload Complete",
"custom_data": {
"upload_session_id": "upload_sess_001"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"upload_complete": "true"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"upload_timestamp": "2026-01-15T10:29:00Z",
"file_id": "1abc123xyz"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true",
"link_type": "restricted"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"drive_letter": "E",
"free_space_gb": "45"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_dst_001",
"channel": "direct",
"platform": "teams",
"thread_id": "thread_001",
"is_external": "true"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_dst_001"
},
"labels": [
"External Storage",
"Removable Media"
],
"label_ids": [
"lbl_external_storage",
"lbl_removable_media"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_removable_001",
"version": 2,
"definition_rule_ids": [
"rule_removable_media_write"
],
"action_rule_id": "action_rule_alert",
"matched_at": "2026-01-15T10:28:50Z"
}
],
"issues": [
{
"id": "issue_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_removable_001",
"policy_action_rule_id": "action_rule_alert",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:50Z"
}
],
"custom_data": {
"endpoint_risk": "high",
"device_approved": "false"
},
"outline": "USB removable storage device used as destination for confidential HR file transfer.",
"type": "share",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:45Z",
"updated_at": "2026-01-15T10:28:50Z",
"update_event": {
"id": "upd_evt_dst_001",
"action_kind": "write",
"timestamp": "2026-01-15T10:28:50Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_dst_001",
"cloud_connector": {
"id": "cc_gcs_001",
"type": "gcs",
"name": "Company GCS Integration",
"onboarding_account": "gcs-service@company.iam.gserviceaccount.com",
"account_id": "gcs_acct_001"
}
}
},
"end_event": {
"id": "evt_end_002xyz",
"timestamp": "2026-01-15T10:29:00Z",
"action": {
"kind": "upload",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500,
"page_count": 3
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"encoding": "UTF-8",
"compressed": "false",
"checksum_verified": "true"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2",
"network_zone": "internal"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
},
"source": {
"id": "src_end_001abc",
"display_name": "E:\\Backup\\HR\\employee_salaries_2026.xlsx",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"drive_letter": "E"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_end_src_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB",
"mount_point": "Z:"
}
},
"email": {
"id": "email_end_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102900.002@company.com>"
}
},
"email_attachment": {
"id": "attach_end_src_001",
"custom_data": {
"attachment_index": "0"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive",
"custom_data": {
"referrer": "https://drive.google.com/",
"request_method": "POST",
"response_code": "200"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1",
"auth_method": "oauth2"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_end_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"file_id": "1abc123xyz",
"revision": "1"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4522",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_end_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"file_system": "NTFS",
"drive_letter": "E"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_end_001",
"platform": "teams",
"thread_id": "thread_001",
"channel_type": "direct_message"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_end_src_001"
},
"labels": [
"External Storage",
"PII"
],
"label_ids": [
"lbl_external_storage",
"lbl_pii"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:29:00Z"
}
],
"issues": [
{
"id": "issue_end_src_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:29:00Z"
}
],
"custom_data": {
"data_classification": "confidential",
"risk_level": "high",
"source_type": "removable_media"
},
"outline": "File read from USB removable storage during end event of the data transfer sequence.",
"type": "endpoint",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:50Z",
"updated_at": "2026-01-15T10:29:00Z",
"update_event": {
"id": "upd_evt_end_src_001",
"action_kind": "read",
"timestamp": "2026-01-15T10:29:00Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_end_src_001",
"cloud_connector": {
"id": "cc_salesforce_001",
"type": "salesforce",
"name": "Company Salesforce Integration",
"onboarding_account": "admin@company.com",
"account_id": "sf_acct_001"
}
},
"destination": {
"id": "dst_end_001abc",
"display_name": "Google Drive - Personal",
"datastore_id": "dstore_gdrive_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_external_cloud"
],
"object_type": "cloud_file",
"state": "active",
"content": {
"tags": [
"external",
"cloud"
],
"attributes": {
"file_count": 1,
"total_size": 2048576,
"upload_chunks": 2,
"retry_count": 0,
"transfer_duration_ms": 1250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"upload_method": "resumable",
"destination_folder": "/My Drive/HR Backup",
"overwrite_existing": "false"
},
"inspected": true
},
"data": {
"labels": [
"External",
"Cloud Storage"
],
"label_ids": [
"lbl_external",
"lbl_cloud_storage"
]
},
"app": {
"name": "Google Chrome",
"description": "Google Chrome Web Browser",
"package_name": "com.google.chrome",
"binary_path": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
"command_line": "chrome.exe --profile-directory=Default",
"main_window_title": "Google Drive - Google Chrome",
"custom_data": {
"version": "120.0.6099.130",
"profile": "Default"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"cloud_file_id": "1abc123xyz",
"upload_session": "upload_sess_001"
},
"created_at": "2026-01-15T10:29:05Z",
"modified_at": "2026-01-15T10:29:05Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_end_dst_001",
"path": "C:\\Users\\john.doe\\Downloads\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "EXTERNAL-SHARE-01",
"path": "\\\\EXTERNAL-SHARE-01\\Public",
"custom_data": {
"share_type": "SMB",
"external_network": "true"
}
},
"email": {
"id": "email_end_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102900.002@company.com>",
"smtp_server": "smtp.gmail.com"
}
},
"email_attachment": {
"id": "attach_end_dst_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"file_size": "2048576",
"sanitized": "false"
}
},
"web": {
"url": "https://drive.google.com/file/d/1abc123xyz/view",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/uc?id=1abc123xyz&export=download",
"title": "employee_salaries_2026.xlsx - Google Drive",
"custom_data": {
"file_id": "1abc123xyz",
"sharing_status": "private"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"account_type": "personal"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_end_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123xyz/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"file_id": "1abc123xyz",
"revision_id": "rev_001",
"upload_complete": "true"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002",
"external_user_003"
],
"role": "role_editor",
"custom_data": {
"expiry_date": "2026-12-31",
"link_type": "restricted",
"notify_on_download": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4523",
"custom_data": {
"pages_printed": "12",
"color": "false"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_end_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_end_dst_001"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private",
"language": "Python",
"size_kb": "1024"
},
"branch": "main",
"id": "repo_end_dst_001"
},
"labels": [
"External",
"Cloud Storage",
"Personal Account"
],
"label_ids": [
"lbl_external",
"lbl_cloud_storage"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_cloud_upload_001",
"version": 1,
"definition_rule_ids": [
"rule_cloud_upload_block"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:29:00Z"
}
],
"issues": [
{
"id": "issue_end_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_cloud_upload_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:29:00Z"
}
],
"custom_data": {
"upload_destination": "personal_cloud",
"risk_level": "critical"
},
"outline": "Personal Google Drive account used as destination for unauthorized data upload containing HR confidential records.",
"type": "removable_media",
"domain": "drive.google.com",
"discovered_at": "2026-01-15T10:29:00Z",
"updated_at": "2026-01-15T10:29:05Z",
"update_event": {
"id": "upd_evt_end_dst_001",
"action_kind": "upload",
"timestamp": "2026-01-15T10:29:05Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_end_dst_001",
"cloud_connector": {
"id": "cc_teams_001",
"type": "teams",
"name": "Company Teams Integration",
"onboarding_account": "teams-admin@company.com",
"account_id": "teams_acct_001"
}
}
}
}
}
]
}
}
Human Readable Output
Cyberhaven Incidents
ID Policy Severity Status Blocked Event Time Start Event ID End Event ID AI Summary inc_a1b2c3d4e5f6 HR Data Exfiltration Prevention high open false 2026-01-15T10:28:45Z evt_start_001abc evt_end_002xyz User john.doe attempted to copy confidential HR records to a removable USB drive. The action was detected by endpoint DLP and flagged as a high-severity policy violation.
cyberhaven-incident-update
Update the status, assignment, or close reason of a Cyberhaven incident.
Base Command
cyberhaven-incident-update
Input
| Argument Name | Description | Required |
|---|---|---|
| incident_id | Specify the Cyberhaven incident ID. Note: Use ‘cyberhaven-incident-list’ to retrieve the incident ID. |
Required |
| status | Specify the status of the incident. Possible values are: Open, Closed. | Optional |
| close_reason | Specify the close reason while closing the incident. Possible values are: Resolved, False Positive, False Positive - Destination Not at Risk, False Positive - User Exempt, Other. | Optional |
| close_note | Provide the meaningful note when closing. | Optional |
| assigned_to | Provide analyst email to whom incident will assign. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| Cyberhaven.Incident.id | String | The unique identifier of the incident. |
| Cyberhaven.Incident.user.id | String | The identifier of the user who triggered the incident. |
| Cyberhaven.Incident.user.local_username | String | The local machine username of the user who triggered the incident. |
| Cyberhaven.Incident.user.local_id | String | The local identifier of the user who triggered the incident. |
| Cyberhaven.Incident.event_lineage_id.start_event_id | String | The ID of the first event in the lineage chain. |
| Cyberhaven.Incident.event_lineage_id.end_event_id | String | The ID of the last event in the lineage chain. |
| Cyberhaven.Incident.blocked | Boolean | Whether the action that triggered the incident was blocked. |
| Cyberhaven.Incident.event_time | Date | The timestamp of the event that triggered the incident. |
| Cyberhaven.Incident.trigger_time | Date | The timestamp when the incident was triggered. |
| Cyberhaven.Incident.dataset.id | String | The identifier of the dataset involved in the incident. |
| Cyberhaven.Incident.dataset.name | String | The name of the dataset involved in the incident. |
| Cyberhaven.Incident.dataset.sensitivity | String | The sensitivity classification of the dataset involved. |
| Cyberhaven.Incident.user_risk_groups | String | The list of risk groups the user belongs to. |
| Cyberhaven.Incident.policy.id | String | The identifier of the DLP policy that was triggered. |
| Cyberhaven.Incident.policy.name | String | The name of the DLP policy that was triggered. |
| Cyberhaven.Incident.policy.severity | String | The severity level defined in the triggering DLP policy. |
| Cyberhaven.Incident.risk_score | Number | The numeric risk score assigned to the incident. |
| Cyberhaven.Incident.screenshot_guid | String | The GUID of the screenshot associated with the incident. |
| Cyberhaven.Incident.warning_status | String | The warning acknowledgement status of the incident. |
| Cyberhaven.Incident.user_reactions | String | The list of user reaction codes for the incident. |
| Cyberhaven.Incident.user_reaction_message | String | The message provided by the user when reacting to the warning. |
| Cyberhaven.Incident.reaction_time | Date | The timestamp when the user reacted to the warning. |
| Cyberhaven.Incident.assigned_to | String | The email of the analyst the incident is assigned to. |
| Cyberhaven.Incident.status | String | The current status of the incident (e.g. open, closed). |
| Cyberhaven.Incident.resolution_time | Date | The timestamp when the incident was resolved. |
| Cyberhaven.Incident.close_reason | String | The reason code provided when the incident was closed. |
| Cyberhaven.Incident.close_note | String | The free-text note provided when the incident was closed. |
| Cyberhaven.Incident.created_by | String | Indicates how the incident was created (e.g. created_by_policy). |
| Cyberhaven.Incident.ai_summary | String | The AI-generated summary of the incident. |
| Cyberhaven.Incident.ai_severity | String | The AI-assessed severity level of the incident. |
| Cyberhaven.Incident.last_modified | Date | The timestamp when the incident was last modified. |
| Cyberhaven.Incident.event_details.start_event.id | String | The ID of the start event. |
| Cyberhaven.Incident.event_details.start_event.timestamp | Date | The timestamp of the start event. |
| Cyberhaven.Incident.event_details.start_event.action.kind | String | The action kind performed in the start event (e.g. copy). |
| Cyberhaven.Incident.event_details.start_event.action.blocked | Boolean | Whether the action in the start event was blocked. |
| Cyberhaven.Incident.event_details.start_event.action.data_size | Number | The size of data involved in the start event action (bytes). |
| Cyberhaven.Incident.event_details.start_event.action.content.tags | String | The content classification tags detected in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.attributes | String | The content attributes of the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.upload_filename | String | The filename of the content being uploaded in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.content.inspected | Boolean | Whether the content was inspected in the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.sensor_kind | String | The sensor type that detected the start event (e.g. endpoint). |
| Cyberhaven.Incident.event_details.start_event.action.hostname | String | The hostname of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.machine_serial_number | String | The serial number of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.ip_address | String | The IP address of the machine where the start event occurred. |
| Cyberhaven.Incident.event_details.start_event.action.device_type | String | The device management type for the start event (e.g. managed). |
| Cyberhaven.Incident.event_details.start_event.action.temporary_blocked | Boolean | Whether the start event action was temporarily blocked. |
| Cyberhaven.Incident.event_details.start_event.action.fail_close_statuses | String | The list of fail-close status objects for the start event action. |
| Cyberhaven.Incident.event_details.start_event.action.process_id | Number | The process ID of the process that triggered the start event. |
| Cyberhaven.Incident.event_details.start_event.action.parent_process_id | Number | The parent process ID of the process that triggered the start event. |
| Cyberhaven.Incident.event_details.start_event.user.id | String | The identifier of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.user.local_username | String | The local username of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.user.local_id | String | The local ID of the user in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.id | String | The ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.display_name | String | The display name of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.datastore_id | String | The datastore ID associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.dataset_sensitivity | String | The sensitivity classification of the dataset in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.dataset_ids | String | The list of dataset IDs associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.object_type | String | The object type (e.g. file, removable_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.state | String | The state of the object (e.g. active) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.tags | String | The content classification tags in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.attributes | String | The content attributes in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.upload_filename | String | The upload filename of the content in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.content.inspected | Boolean | Whether the content was inspected in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.data.labels | String | The data classification labels in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.data.label_ids | String | The data classification label IDs in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.name | String | The name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.description | String | The description of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.package_name | String | The package name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.binary_path | String | The binary path of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.command_line | String | The command line of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.app.main_window_title | String | The main window title of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.name | String | The file name in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.extension | String | The file extension in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.size | Number | The file size (bytes) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.md5_hash | String | The MD5 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.sha256_hash | String | The SHA-256 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.created_at | Date | The creation timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.modified_at | Date | The last modification timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.owner.name | String | The name of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.file.owner.id | String | The ID of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.local_file.id | String | The local file ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.local_file.path | String | The local file system path in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.network_share.hostname | String | The hostname of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.network_share.path | String | The path of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.id | String | The ID of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.from | String | The sender of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.to | String | The recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.cc | String | The CC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.bcc | String | The BCC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email.subject | String | The subject of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.email_attachment.id | String | The ID of the email attachment in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.url | String | The URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.domain | String | The domain of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.download_url | String | The download URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.title | String | The page title of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.web.user_agent | String | The user-agent string of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.provider | String | The cloud provider (e.g. google) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.name | String | The name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_name | String | The username in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_email | String | The user email in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_id | String | The instance ID of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_name | String | The instance name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.id | String | The ID of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.content_uri | String | The content URI of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_file.path | String | The path of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.scope | String | The sharing scope in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.role | String | The role of the cloud share recipient in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.name | String | The name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.description | String | The description of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.physical_location | String | The physical location of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.server | String | The print server hostname in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.share_name | String | The share name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.port | String | The port of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.driver | String | The driver name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.is_local | Boolean | Whether the printer is local in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.job_id | String | The print job ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.printer.connectivity | String | The connectivity type of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.id | String | The ID of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.name | String | The name of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.removable_storage.product_id | String | The USB product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.sender | String | The sender of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_users | String | The recipient users of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_groups | String | The recipient groups of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.domain | String | The domain of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.im_message.workspace | String | The workspace of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.organization | String | The organization of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.name | String | The name of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.branch | String | The branch of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.source_code_repo.id | String | The ID of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.labels | String | The labels applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.label_ids | String | The label IDs applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.matched_policies | String | The list of DLP policies matched by the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.issues | String | The list of DLP issues detected on the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.outline | String | The outline description of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.type | String | The endpoint type (e.g. endpoint, removable_media) in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.domain | String | The domain of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.discovered_at | Date | The timestamp when the object was first discovered in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.updated_at | Date | The timestamp when the object was last updated in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.id | String | The ID of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.action_kind | String | The action kind of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.timestamp | Date | The timestamp of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.id | String | The user ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_username | String | The local username in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_id | String | The local ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.version_id | String | The version ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.id | String | The ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.type | String | The type of cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.name | String | The name of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.source.cloud_connector.account_id | String | The account ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.id | String | The ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.display_name | String | The display name of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.datastore_id | String | The datastore ID associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.dataset_ids | String | The list of dataset IDs associated with the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.object_type | String | The object type (e.g. file, removable_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.state | String | The state of the object (e.g. active) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.tags | String | The content classification tags in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.attributes | String | The content attributes in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.upload_filename | String | The upload filename of the content in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.content.inspected | Boolean | Whether the content was inspected in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.data.labels | String | The data classification labels in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.data.label_ids | String | The data classification label IDs in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.name | String | The name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.description | String | The description of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.package_name | String | The package name of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.binary_path | String | The binary path of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.command_line | String | The command line of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.app.main_window_title | String | The main window title of the associated application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.name | String | The file name in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.extension | String | The file extension in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.size | Number | The file size (bytes) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.md5_hash | String | The MD5 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.sha256_hash | String | The SHA-256 hash of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.created_at | Date | The creation timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.modified_at | Date | The last modification timestamp of the file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.owner.name | String | The name of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.file.owner.id | String | The ID of the file owner in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.local_file.id | String | The local file ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.local_file.path | String | The local file system path in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.network_share.hostname | String | The hostname of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.network_share.path | String | The path of the network share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.id | String | The ID of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.from | String | The sender of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.to | String | The recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.cc | String | The CC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.bcc | String | The BCC recipients of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email.subject | String | The subject of the email in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.email_attachment.id | String | The ID of the email attachment in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.url | String | The URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.domain | String | The domain of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.download_url | String | The download URL of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.title | String | The page title of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.web.user_agent | String | The user-agent string of the web endpoint in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.provider | String | The cloud provider (e.g. google) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.name | String | The name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_name | String | The username in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_email | String | The user email in the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_id | String | The instance ID of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_name | String | The instance name of the cloud application in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.id | String | The ID of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.content_uri | String | The content URI of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_file.path | String | The path of the cloud file in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.scope | String | The sharing scope in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.name | String | The name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.description | String | The description of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.physical_location | String | The physical location of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.server | String | The print server hostname in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.share_name | String | The share name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.port | String | The port of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.driver | String | The driver name of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.is_local | Boolean | Whether the printer is local in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.job_id | String | The print job ID in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.printer.connectivity | String | The connectivity type of the printer in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.id | String | The ID of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.name | String | The name of the removable storage device in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.removable_storage.product_id | String | The USB product ID of the removable storage in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.sender | String | The sender of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_users | String | The recipient users of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_groups | String | The recipient groups of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.domain | String | The domain of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.im_message.workspace | String | The workspace of the IM message in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.organization | String | The organization of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.name | String | The name of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.branch | String | The branch of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.id | String | The ID of the source code repository in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.labels | String | The labels applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.label_ids | String | The label IDs applied to the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.matched_policies | String | The list of DLP policies matched by the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.issues | String | The list of DLP issues detected on the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.outline | String | The outline description of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.type | String | The endpoint type (e.g. endpoint, removable_media) in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.domain | String | The domain of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.discovered_at | Date | The timestamp when the object was first discovered in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.updated_at | Date | The timestamp when the object was last updated in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.id | String | The ID of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.action_kind | String | The action kind of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.timestamp | Date | The timestamp of the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.id | String | The user ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_username | String | The local username in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_id | String | The local ID in the update event in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.version_id | String | The version ID of the object in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.id | String | The ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.type | String | The type of cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.name | String | The name of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.account_id | String | The account ID of the cloud connector in the start event. |
| Cyberhaven.Incident.event_details.end_event.id | String | The ID of the end event. |
| Cyberhaven.Incident.event_details.end_event.timestamp | Date | The timestamp of the end event. |
| Cyberhaven.Incident.event_details.end_event.action.kind | String | The action kind performed in the end event (e.g. copy). |
| Cyberhaven.Incident.event_details.end_event.action.blocked | Boolean | Whether the action in the end event was blocked. |
| Cyberhaven.Incident.event_details.end_event.action.data_size | Number | The size of data involved in the end event action (bytes). |
| Cyberhaven.Incident.event_details.end_event.action.content.tags | String | The content classification tags detected in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.attributes | String | The content attributes of the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.upload_filename | String | The filename of the content being uploaded in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.content.inspected | Boolean | Whether the content was inspected in the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.sensor_kind | String | The sensor type that detected the end event (e.g. endpoint). |
| Cyberhaven.Incident.event_details.end_event.action.hostname | String | The hostname of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.machine_serial_number | String | The serial number of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.ip_address | String | The IP address of the machine where the end event occurred. |
| Cyberhaven.Incident.event_details.end_event.action.device_type | String | The device management type for the end event (e.g. managed). |
| Cyberhaven.Incident.event_details.end_event.action.temporary_blocked | Boolean | Whether the end event action was temporarily blocked. |
| Cyberhaven.Incident.event_details.end_event.action.fail_close_statuses | String | The list of fail-close status objects for the end event action. |
| Cyberhaven.Incident.event_details.end_event.action.process_id | Number | The process ID of the process that triggered the end event. |
| Cyberhaven.Incident.event_details.end_event.action.parent_process_id | Number | The parent process ID of the process that triggered the end event. |
| Cyberhaven.Incident.event_details.end_event.user.id | String | The identifier of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.user.local_username | String | The local username of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.user.local_id | String | The local ID of the user in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.id | String | The ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.display_name | String | The display name of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.datastore_id | String | The datastore ID associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.dataset_sensitivity | String | The sensitivity classification of the dataset in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.dataset_ids | String | The list of dataset IDs associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.object_type | String | The object type (e.g. file, removable_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.state | String | The state of the object (e.g. active) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.tags | String | The content classification tags in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.attributes | String | The content attributes in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.upload_filename | String | The upload filename of the content in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.content.inspected | Boolean | Whether the content was inspected in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.data.labels | String | The data classification labels in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.data.label_ids | String | The data classification label IDs in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.name | String | The name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.description | String | The description of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.package_name | String | The package name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.binary_path | String | The binary path of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.command_line | String | The command line of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.app.main_window_title | String | The main window title of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.name | String | The file name in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.extension | String | The file extension in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.size | Number | The file size (bytes) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.md5_hash | String | The MD5 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.sha256_hash | String | The SHA-256 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.created_at | Date | The creation timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.modified_at | Date | The last modification timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.owner.name | String | The name of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.file.owner.id | String | The ID of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.local_file.id | String | The local file ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.local_file.path | String | The local file system path in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.network_share.hostname | String | The hostname of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.network_share.path | String | The path of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.id | String | The ID of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.from | String | The sender of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.to | String | The recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.cc | String | The CC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.bcc | String | The BCC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email.subject | String | The subject of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.email_attachment.id | String | The ID of the email attachment in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.url | String | The URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.domain | String | The domain of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.download_url | String | The download URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.title | String | The page title of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.web.user_agent | String | The user-agent string of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.provider | String | The cloud provider (e.g. google) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.name | String | The name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_name | String | The username in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_email | String | The user email in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_id | String | The instance ID of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_name | String | The instance name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.id | String | The ID of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.content_uri | String | The content URI of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_file.path | String | The path of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.scope | String | The sharing scope in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.role | String | The role of the cloud share recipient in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.name | String | The name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.description | String | The description of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.physical_location | String | The physical location of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.server | String | The print server hostname in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.share_name | String | The share name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.port | String | The port of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.driver | String | The driver name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.is_local | Boolean | Whether the printer is local in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.job_id | String | The print job ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.printer.connectivity | String | The connectivity type of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.id | String | The ID of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.name | String | The name of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.removable_storage.product_id | String | The USB product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.sender | String | The sender of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_users | String | The recipient users of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_groups | String | The recipient groups of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.domain | String | The domain of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.im_message.workspace | String | The workspace of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.organization | String | The organization of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.name | String | The name of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.branch | String | The branch of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.source_code_repo.id | String | The ID of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.labels | String | The labels applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.label_ids | String | The label IDs applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.matched_policies | String | The list of DLP policies matched by the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.issues | String | The list of DLP issues detected on the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.outline | String | The outline description of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.type | String | The endpoint type (e.g. endpoint, removable_media) in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.domain | String | The domain of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.discovered_at | Date | The timestamp when the object was first discovered in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.updated_at | Date | The timestamp when the object was last updated in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.id | String | The ID of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.action_kind | String | The action kind of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.timestamp | Date | The timestamp of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.id | String | The user ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_username | String | The local username in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_id | String | The local ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.version_id | String | The version ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.id | String | The ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.type | String | The type of cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.name | String | The name of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.source.cloud_connector.account_id | String | The account ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.id | String | The ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.display_name | String | The display name of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.datastore_id | String | The datastore ID associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.dataset_ids | String | The list of dataset IDs associated with the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.object_type | String | The object type (e.g. file, removable_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.state | String | The state of the object (e.g. active) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.tags | String | The content classification tags in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.attributes | String | The content attributes in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.upload_filename | String | The upload filename of the content in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.content.inspected | Boolean | Whether the content was inspected in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.data.labels | String | The data classification labels in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.data.label_ids | String | The data classification label IDs in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.name | String | The name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.description | String | The description of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.package_name | String | The package name of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.binary_path | String | The binary path of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.command_line | String | The command line of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.app.main_window_title | String | The main window title of the associated application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.name | String | The file name in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.extension | String | The file extension in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.size | Number | The file size (bytes) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.md5_hash | String | The MD5 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.sha256_hash | String | The SHA-256 hash of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.created_at | Date | The creation timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.modified_at | Date | The last modification timestamp of the file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.owner.name | String | The name of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.file.owner.id | String | The ID of the file owner in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.local_file.id | String | The local file ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.local_file.path | String | The local file system path in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.network_share.hostname | String | The hostname of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.network_share.path | String | The path of the network share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.id | String | The ID of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.from | String | The sender of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.to | String | The recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.cc | String | The CC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.bcc | String | The BCC recipients of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email.subject | String | The subject of the email in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.email_attachment.id | String | The ID of the email attachment in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.url | String | The URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.domain | String | The domain of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.download_url | String | The download URL of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.title | String | The page title of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.web.user_agent | String | The user-agent string of the web endpoint in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.provider | String | The cloud provider (e.g. google) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.name | String | The name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_name | String | The username in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_email | String | The user email in the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_id | String | The instance ID of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_name | String | The instance name of the cloud application in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.id | String | The ID of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.content_uri | String | The content URI of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_file.path | String | The path of the cloud file in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.scope | String | The sharing scope in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.name | String | The name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.description | String | The description of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.physical_location | String | The physical location of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.server | String | The print server hostname in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.share_name | String | The share name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.port | String | The port of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.driver | String | The driver name of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.is_local | Boolean | Whether the printer is local in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.job_id | String | The print job ID in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.printer.connectivity | String | The connectivity type of the printer in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.id | String | The ID of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.name | String | The name of the removable storage device in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.removable_storage.product_id | String | The USB product ID of the removable storage in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.sender | String | The sender of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_users | String | The recipient users of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_groups | String | The recipient groups of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.domain | String | The domain of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.im_message.workspace | String | The workspace of the IM message in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.organization | String | The organization of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.name | String | The name of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.branch | String | The branch of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.id | String | The ID of the source code repository in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.labels | String | The labels applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.label_ids | String | The label IDs applied to the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.matched_policies | String | The list of DLP policies matched by the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.issues | String | The list of DLP issues detected on the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.outline | String | The outline description of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.type | String | The endpoint type (e.g. endpoint, removable_media) in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.domain | String | The domain of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.discovered_at | Date | The timestamp when the object was first discovered in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.updated_at | Date | The timestamp when the object was last updated in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.id | String | The ID of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.action_kind | String | The action kind of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.timestamp | Date | The timestamp of the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.id | String | The user ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_username | String | The local username in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_id | String | The local ID in the update event in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.version_id | String | The version ID of the object in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.id | String | The ID of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.type | String | The type of cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.name | String | The name of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector in the end event. |
| Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.account_id | String | The account ID of the cloud connector in the end event. |
Command example
!cyberhaven-incident-update incident_id="inc_a1b2c3d4e5f6" status="Closed"
Context Example
{
"Cyberhaven": {
"Incidents": [
{
"id": "inc_a1b2c3d4e5f6",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"department": "Engineering",
"manager_email": "jane.smith@company.com",
"employee_id": "EMP-10042",
"location": "US-NYC",
"role": "Senior Software Engineer"
}
},
"event_lineage_id": {
"start_event_id": "evt_start_001abc",
"end_event_id": "evt_end_002xyz"
},
"blocked": false,
"event_time": "2026-01-15T10:28:45Z",
"trigger_time": "2026-01-15T10:29:02Z",
"dataset": {
"id": "ds_hr_confidential",
"name": "HR Confidential Records",
"sensitivity": "high",
"custom_data": {
"classification_level": "confidential",
"data_owner": "hr@company.com"
}
},
"user_risk_groups": [
{
"id": "rg_high_risk_users",
"name": "High Risk Users",
"risk_multiplier": 1.5,
"custom_data": {
"criteria": "multiple_policy_violations"
}
}
],
"policy": {
"id": "pol_dlp_hr_001",
"name": "HR Data Exfiltration Prevention",
"severity": "high",
"custom_data": {
"policy_owner": "security@company.com",
"enforcement_mode": "block",
"review_cycle": "quarterly",
"compliance_framework": "SOC2"
}
},
"risk_score": 8.5,
"screenshot_guid": "scrn_7f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c",
"warning_status": "warning_shown",
"user_reactions": [
"reaction_acknowledged"
],
"user_reaction_message": "I was transferring files for an approved project backup.",
"reaction_time": "2026-01-15T10:31:15Z",
"assigned_to": "analyst@company.com",
"status": "closed",
"resolution_time": "2026-01-15T14:45:00Z",
"close_reason": "policy_violation",
"close_note": "User violated data exfiltration policy. Escalated to HR.",
"custom_data": {
"ticket_id": "JIRA-4521"
},
"created_by": "created_by_system",
"ai_summary": "User john.doe attempted to copy confidential HR records to a removable USB drive. The action was detected by endpoint DLP and flagged as a high-severity policy violation.",
"ai_severity": "high",
"last_modified": "2026-01-15T11:00:00Z",
"event_details": {
"start_event": {
"id": "evt_start_001abc",
"timestamp": "2026-01-15T10:28:45Z",
"action": {
"kind": "copy",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"encoding": "UTF-8"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"ad_group": "Domain Users",
"upn": "john.doe@company.com",
"last_login": "2026-01-15T08:05:00Z"
}
},
"source": {
"id": "src_local_001abc",
"display_name": "employee_salaries_2026.xlsx",
"datastore_id": "dstore_endpoint_01",
"dataset_sensitivity": "sensitivity_high",
"dataset_ids": [
"ds_hr_confidential"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"classification": "confidential",
"last_scan": "2026-01-10T09:00:00Z",
"scan_result": "contains_pii",
"owner_department": "HR"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential",
"HR Data"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Microsoft Excel",
"description": "Microsoft Office Spreadsheet Application",
"package_name": "com.microsoft.excel",
"binary_path": "C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE",
"command_line": "\"EXCEL.EXE\" /e",
"main_window_title": "employee_salaries_2026.xlsx - Excel",
"custom_data": {
"version": "16.0.17126.20132",
"publisher": "Microsoft Corporation",
"signed": "true",
"install_date": "2023-06-01",
"auto_update": "enabled"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"creator": "john.doe",
"last_modified_by": "jane.smith"
},
"created_at": "2026-01-10T09:00:00Z",
"modified_at": "2026-01-15T08:30:00Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_001abc",
"path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>",
"x_mailer": "Microsoft Outlook 16.0"
}
},
"email_attachment": {
"id": "attach_src_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload",
"custom_data": {
"referrer": "https://drive.google.com/",
"request_method": "POST"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Data/employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"revision_id": "rev_001"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12",
"duplex": "false"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"file_system": "NTFS",
"capacity_gb": "64"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_001abc"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private",
"default_branch": "main",
"last_commit": "a1b2c3d4e5f6",
"language": "Python"
},
"branch": "main",
"id": "repo_001"
},
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection",
"rule_confidential_data"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:28:45Z"
}
],
"issues": [
{
"id": "issue_001abc",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:45Z"
}
],
"custom_data": {
"data_classification": "confidential",
"retention_policy": "7_years",
"gdpr_relevant": "true",
"ccpa_relevant": "true"
},
"outline": "Spreadsheet containing employee salary and compensation data for 250 employees in the Engineering department.",
"type": "removable_media",
"domain": "company.com",
"discovered_at": "2026-01-10T09:00:00Z",
"updated_at": "2026-01-15T10:28:45Z",
"update_event": {
"id": "upd_evt_001",
"action_kind": "copy",
"timestamp": "2026-01-15T10:28:45Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_001abc",
"cloud_connector": {
"id": "cc_box_001",
"type": "box",
"name": "Company Box Integration",
"onboarding_account": "admin@company.com",
"account_id": "box_acct_001"
}
},
"destination": {
"id": "dst_usb_001abc",
"display_name": "SanDisk Ultra 64GB (E:)",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "removable_storage",
"state": "active",
"content": {
"tags": [
"external",
"removable"
],
"attributes": {
"file_count": 1,
"total_size": 2048576
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"destination_path": "E:\\Backup\\HR",
"overwrite": "false"
},
"inspected": true
},
"data": {
"labels": [
"External Storage"
],
"label_ids": [
"lbl_external_storage"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe /select,\"E:\\Backup\\HR\\employee_salaries_2026.xlsx\"",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"destination_created": "true",
"is_copy": "true",
"original_path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_dst_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\Backup\\HR",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>"
}
},
"email_attachment": {
"id": "attach_dst_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"file_size": "2048576",
"sanitized": "false"
}
},
"web": {
"url": "https://drive.google.com/upload/resumable",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload Complete",
"custom_data": {
"upload_session_id": "upload_sess_001"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"upload_complete": "true"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"upload_timestamp": "2026-01-15T10:29:00Z",
"file_id": "1abc123xyz"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true",
"link_type": "restricted"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"drive_letter": "E",
"free_space_gb": "45"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_dst_001",
"channel": "direct",
"platform": "teams",
"thread_id": "thread_001",
"is_external": "true"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_dst_001"
},
"labels": [
"External Storage",
"Removable Media"
],
"label_ids": [
"lbl_external_storage",
"lbl_removable_media"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_removable_001",
"version": 2,
"definition_rule_ids": [
"rule_removable_media_write"
],
"action_rule_id": "action_rule_alert",
"matched_at": "2026-01-15T10:28:50Z"
}
],
"issues": [
{
"id": "issue_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_removable_001",
"policy_action_rule_id": "action_rule_alert",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:50Z"
}
],
"custom_data": {
"endpoint_risk": "high",
"device_approved": "false"
},
"outline": "USB removable storage device used as destination for confidential HR file transfer.",
"type": "share",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:45Z",
"updated_at": "2026-01-15T10:28:50Z",
"update_event": {
"id": "upd_evt_dst_001",
"action_kind": "write",
"timestamp": "2026-01-15T10:28:50Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_dst_001",
"cloud_connector": {
"id": "cc_gcs_001",
"type": "gcs",
"name": "Company GCS Integration",
"onboarding_account": "gcs-service@company.iam.gserviceaccount.com",
"account_id": "gcs_acct_001"
}
}
},
"end_event": {
"id": "evt_end_002xyz",
"timestamp": "2026-01-15T10:29:00Z",
"action": {
"kind": "upload",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500,
"page_count": 3
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"encoding": "UTF-8",
"compressed": "false",
"checksum_verified": "true"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2",
"network_zone": "internal"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
},
"source": {
"id": "src_end_001abc",
"display_name": "E:\\Backup\\HR\\employee_salaries_2026.xlsx",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"drive_letter": "E"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_end_src_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB",
"mount_point": "Z:"
}
},
"email": {
"id": "email_end_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102900.002@company.com>"
}
},
"email_attachment": {
"id": "attach_end_src_001",
"custom_data": {
"attachment_index": "0"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive",
"custom_data": {
"referrer": "https://drive.google.com/",
"request_method": "POST",
"response_code": "200"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1",
"auth_method": "oauth2"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_end_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"file_id": "1abc123xyz",
"revision": "1"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4522",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_end_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"file_system": "NTFS",
"drive_letter": "E"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_end_001",
"platform": "teams",
"thread_id": "thread_001",
"channel_type": "direct_message"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_end_src_001"
},
"labels": [
"External Storage",
"PII"
],
"label_ids": [
"lbl_external_storage",
"lbl_pii"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:29:00Z"
}
],
"issues": [
{
"id": "issue_end_src_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:29:00Z"
}
],
"custom_data": {
"data_classification": "confidential",
"risk_level": "high",
"source_type": "removable_media"
},
"outline": "File read from USB removable storage during end event of the data transfer sequence.",
"type": "endpoint",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:50Z",
"updated_at": "2026-01-15T10:29:00Z",
"update_event": {
"id": "upd_evt_end_src_001",
"action_kind": "read",
"timestamp": "2026-01-15T10:29:00Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_end_src_001",
"cloud_connector": {
"id": "cc_salesforce_001",
"type": "salesforce",
"name": "Company Salesforce Integration",
"onboarding_account": "admin@company.com",
"account_id": "sf_acct_001"
}
},
"destination": {
"id": "dst_end_001abc",
"display_name": "Google Drive - Personal",
"datastore_id": "dstore_gdrive_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_external_cloud"
],
"object_type": "cloud_file",
"state": "active",
"content": {
"tags": [
"external",
"cloud"
],
"attributes": {
"file_count": 1,
"total_size": 2048576,
"upload_chunks": 2,
"retry_count": 0,
"transfer_duration_ms": 1250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"upload_method": "resumable",
"destination_folder": "/My Drive/HR Backup",
"overwrite_existing": "false"
},
"inspected": true
},
"data": {
"labels": [
"External",
"Cloud Storage"
],
"label_ids": [
"lbl_external",
"lbl_cloud_storage"
]
},
"app": {
"name": "Google Chrome",
"description": "Google Chrome Web Browser",
"package_name": "com.google.chrome",
"binary_path": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
"command_line": "chrome.exe --profile-directory=Default",
"main_window_title": "Google Drive - Google Chrome",
"custom_data": {
"version": "120.0.6099.130",
"profile": "Default"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"cloud_file_id": "1abc123xyz",
"upload_session": "upload_sess_001"
},
"created_at": "2026-01-15T10:29:05Z",
"modified_at": "2026-01-15T10:29:05Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_end_dst_001",
"path": "C:\\Users\\john.doe\\Downloads\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "EXTERNAL-SHARE-01",
"path": "\\\\EXTERNAL-SHARE-01\\Public",
"custom_data": {
"share_type": "SMB",
"external_network": "true"
}
},
"email": {
"id": "email_end_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102900.002@company.com>",
"smtp_server": "smtp.gmail.com"
}
},
"email_attachment": {
"id": "attach_end_dst_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"file_size": "2048576",
"sanitized": "false"
}
},
"web": {
"url": "https://drive.google.com/file/d/1abc123xyz/view",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/uc?id=1abc123xyz&export=download",
"title": "employee_salaries_2026.xlsx - Google Drive",
"custom_data": {
"file_id": "1abc123xyz",
"sharing_status": "private"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"account_type": "personal"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_end_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123xyz/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"file_id": "1abc123xyz",
"revision_id": "rev_001",
"upload_complete": "true"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002",
"external_user_003"
],
"role": "role_editor",
"custom_data": {
"expiry_date": "2026-12-31",
"link_type": "restricted",
"notify_on_download": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4523",
"custom_data": {
"pages_printed": "12",
"color": "false"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_end_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_end_dst_001"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private",
"language": "Python",
"size_kb": "1024"
},
"branch": "main",
"id": "repo_end_dst_001"
},
"labels": [
"External",
"Cloud Storage",
"Personal Account"
],
"label_ids": [
"lbl_external",
"lbl_cloud_storage"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_cloud_upload_001",
"version": 1,
"definition_rule_ids": [
"rule_cloud_upload_block"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:29:00Z"
}
],
"issues": [
{
"id": "issue_end_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_cloud_upload_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:29:00Z"
}
],
"custom_data": {
"upload_destination": "personal_cloud",
"risk_level": "critical"
},
"outline": "Personal Google Drive account used as destination for unauthorized data upload containing HR confidential records.",
"type": "removable_media",
"domain": "drive.google.com",
"discovered_at": "2026-01-15T10:29:00Z",
"updated_at": "2026-01-15T10:29:05Z",
"update_event": {
"id": "upd_evt_end_dst_001",
"action_kind": "upload",
"timestamp": "2026-01-15T10:29:05Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
}
},
"version_id": "ver_end_dst_001",
"cloud_connector": {
"id": "cc_teams_001",
"type": "teams",
"name": "Company Teams Integration",
"onboarding_account": "teams-admin@company.com",
"account_id": "teams_acct_001"
}
}
}
}
}
]
}
}
Human Readable Output
Incident inc_a1b2c3d4e5f6 updated successfully
ID Policy Severity Status Blocked Event Time Start Event ID End Event ID AI Summary inc_a1b2c3d4e5f6 HR Data Exfiltration Prevention high closed false 2026-01-15T10:28:45Z evt_start_001abc evt_end_002xyz User john.doe attempted to copy confidential HR records to a removable USB drive. The action was detected by endpoint DLP and flagged as a high-severity policy violation.
cyberhaven-event-details-get
Retrieves full details for one or more Cyberhaven events by ID.
Base Command
cyberhaven-event-details-get
Input
| Argument Name | Description | Required |
|---|---|---|
| event_ids | A comma-separated list of event UUIDs to get the events. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Cyberhaven.Event.id | String | The unique identifier of the event. |
| Cyberhaven.Event.timestamp | Date | The timestamp when the event occurred. |
| Cyberhaven.Event.action.kind | String | The kind of action performed (e.g. copy, upload). |
| Cyberhaven.Event.action.blocked | Boolean | Whether the action was blocked by policy. |
| Cyberhaven.Event.action.data_size | Number | The size of data involved in the action (bytes). |
| Cyberhaven.Event.action.content.tags | String | The content classification tags detected in the action. |
| Cyberhaven.Event.action.content.attributes | String | The content attributes of the action. |
| Cyberhaven.Event.action.content.upload_filename | String | The filename of the content being uploaded in the action. |
| Cyberhaven.Event.action.content.inspected | Boolean | Whether the content was inspected in the action. |
| Cyberhaven.Event.action.sensor_kind | String | The sensor type that detected the action (e.g. endpoint). |
| Cyberhaven.Event.action.hostname | String | The hostname of the machine where the action occurred. |
| Cyberhaven.Event.action.machine_serial_number | String | The serial number of the machine where the action occurred. |
| Cyberhaven.Event.action.ip_address | String | The IP address of the machine where the action occurred. |
| Cyberhaven.Event.action.device_type | String | The device management type (e.g. managed). |
| Cyberhaven.Event.action.temporary_blocked | Boolean | Whether the action was temporarily blocked. |
| Cyberhaven.Event.action.fail_close_statuses | String | The list of fail-close status objects for the action. |
| Cyberhaven.Event.action.process_id | Number | The process ID of the process that triggered the action. |
| Cyberhaven.Event.action.parent_process_id | Number | The parent process ID of the process that triggered the action. |
| Cyberhaven.Event.user.id | String | The identifier of the user who triggered the event. |
| Cyberhaven.Event.user.local_username | String | The local machine username of the user who triggered the event. |
| Cyberhaven.Event.user.local_id | String | The local identifier of the user who triggered the event. |
| Cyberhaven.Event.source.id | String | The ID of the object. |
| Cyberhaven.Event.source.display_name | String | The display name of the object. |
| Cyberhaven.Event.source.datastore_id | String | The datastore ID associated with the object. |
| Cyberhaven.Event.source.dataset_sensitivity | String | The sensitivity classification of the dataset. |
| Cyberhaven.Event.source.dataset_ids | String | The list of dataset IDs associated with the object. |
| Cyberhaven.Event.source.object_type | String | The object type (e.g. file, removable_storage). |
| Cyberhaven.Event.source.state | String | The state of the object (e.g. active). |
| Cyberhaven.Event.source.content.tags | String | The content classification tags. |
| Cyberhaven.Event.source.content.attributes | String | The content attributes. |
| Cyberhaven.Event.source.content.upload_filename | String | The upload filename of the content. |
| Cyberhaven.Event.source.content.inspected | Boolean | Whether the content was inspected. |
| Cyberhaven.Event.source.data.labels | String | The data classification labels. |
| Cyberhaven.Event.source.data.label_ids | String | The data classification label IDs. |
| Cyberhaven.Event.source.app.name | String | The name of the associated application. |
| Cyberhaven.Event.source.app.description | String | The description of the associated application. |
| Cyberhaven.Event.source.app.package_name | String | The package name of the associated application. |
| Cyberhaven.Event.source.app.binary_path | String | The binary path of the associated application. |
| Cyberhaven.Event.source.app.command_line | String | The command line of the associated application. |
| Cyberhaven.Event.source.app.main_window_title | String | The main window title of the associated application. |
| Cyberhaven.Event.source.file.name | String | The file name. |
| Cyberhaven.Event.source.file.extension | String | The file extension. |
| Cyberhaven.Event.source.file.size | Number | The file size (bytes). |
| Cyberhaven.Event.source.file.md5_hash | String | The MD5 hash of the file. |
| Cyberhaven.Event.source.file.sha256_hash | String | The SHA-256 hash of the file. |
| Cyberhaven.Event.source.file.created_at | Date | The creation timestamp of the file. |
| Cyberhaven.Event.source.file.modified_at | Date | The last modification timestamp of the file. |
| Cyberhaven.Event.source.file.owner.name | String | The name of the file owner. |
| Cyberhaven.Event.source.file.owner.id | String | The ID of the file owner. |
| Cyberhaven.Event.source.local_file.id | String | The local file ID. |
| Cyberhaven.Event.source.local_file.path | String | The local file system path. |
| Cyberhaven.Event.source.network_share.hostname | String | The hostname of the network share. |
| Cyberhaven.Event.source.network_share.path | String | The path of the network share. |
| Cyberhaven.Event.source.email.id | String | The ID of the email. |
| Cyberhaven.Event.source.email.from | String | The sender of the email. |
| Cyberhaven.Event.source.email.to | String | The recipients of the email. |
| Cyberhaven.Event.source.email.cc | String | The CC recipients of the email. |
| Cyberhaven.Event.source.email.bcc | String | The BCC recipients of the email. |
| Cyberhaven.Event.source.email.subject | String | The subject of the email. |
| Cyberhaven.Event.source.email_attachment.id | String | The ID of the email attachment. |
| Cyberhaven.Event.source.web.url | String | The URL of the web endpoint. |
| Cyberhaven.Event.source.web.domain | String | The domain of the web endpoint. |
| Cyberhaven.Event.source.web.category | String | The category of the web endpoint (e.g. cloud_storage). |
| Cyberhaven.Event.source.web.download_url | String | The download URL of the web endpoint. |
| Cyberhaven.Event.source.web.title | String | The page title of the web endpoint. |
| Cyberhaven.Event.source.web.user_agent | String | The user-agent string of the web endpoint. |
| Cyberhaven.Event.source.cloud_app.provider | String | The cloud provider (e.g. google). |
| Cyberhaven.Event.source.cloud_app.name | String | The name of the cloud application. |
| Cyberhaven.Event.source.cloud_app.user_name | String | The username in the cloud application. |
| Cyberhaven.Event.source.cloud_app.user_email | String | The user email in the cloud application. |
| Cyberhaven.Event.source.cloud_app.instance_id | String | The instance ID of the cloud application. |
| Cyberhaven.Event.source.cloud_app.instance_name | String | The instance name of the cloud application. |
| Cyberhaven.Event.source.cloud_file.id | String | The ID of the cloud file. |
| Cyberhaven.Event.source.cloud_file.content_uri | String | The content URI of the cloud file. |
| Cyberhaven.Event.source.cloud_file.path | String | The path of the cloud file. |
| Cyberhaven.Event.source.cloud_share_recipient.scope | String | The sharing scope. |
| Cyberhaven.Event.source.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share. |
| Cyberhaven.Event.source.cloud_share_recipient.role | String | The role of the cloud share recipient. |
| Cyberhaven.Event.source.printer.name | String | The name of the printer. |
| Cyberhaven.Event.source.printer.description | String | The description of the printer. |
| Cyberhaven.Event.source.printer.physical_location | String | The physical location of the printer. |
| Cyberhaven.Event.source.printer.server | String | The print server hostname. |
| Cyberhaven.Event.source.printer.share_name | String | The share name of the printer. |
| Cyberhaven.Event.source.printer.port | String | The port of the printer. |
| Cyberhaven.Event.source.printer.driver | String | The driver name of the printer. |
| Cyberhaven.Event.source.printer.is_local | Boolean | Whether the printer is local. |
| Cyberhaven.Event.source.printer.job_id | String | The print job ID. |
| Cyberhaven.Event.source.printer.connectivity | String | The connectivity type of the printer. |
| Cyberhaven.Event.source.removable_storage.id | String | The ID of the removable storage device. |
| Cyberhaven.Event.source.removable_storage.name | String | The name of the removable storage device. |
| Cyberhaven.Event.source.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage. |
| Cyberhaven.Event.source.removable_storage.vendor_id | String | The USB vendor ID of the removable storage. |
| Cyberhaven.Event.source.removable_storage.product_id | String | The USB product ID of the removable storage. |
| Cyberhaven.Event.source.im_message.sender | String | The sender of the IM message. |
| Cyberhaven.Event.source.im_message.recipient_users | String | The recipient users of the IM message. |
| Cyberhaven.Event.source.im_message.recipient_groups | String | The recipient groups of the IM message. |
| Cyberhaven.Event.source.im_message.domain | String | The domain of the IM message. |
| Cyberhaven.Event.source.im_message.workspace | String | The workspace of the IM message. |
| Cyberhaven.Event.source.source_code_repo.organization | String | The organization of the source code repository. |
| Cyberhaven.Event.source.source_code_repo.name | String | The name of the source code repository. |
| Cyberhaven.Event.source.source_code_repo.branch | String | The branch of the source code repository. |
| Cyberhaven.Event.source.source_code_repo.id | String | The ID of the source code repository. |
| Cyberhaven.Event.source.labels | String | The labels applied to the object. |
| Cyberhaven.Event.source.label_ids | String | The label IDs applied to the object. |
| Cyberhaven.Event.source.matched_policies | String | The list of DLP policies matched by the object. |
| Cyberhaven.Event.source.issues | String | The list of DLP issues detected on the object. |
| Cyberhaven.Event.source.outline | String | The outline description of the object. |
| Cyberhaven.Event.source.type | String | The endpoint type (e.g. endpoint, removable_media). |
| Cyberhaven.Event.source.domain | String | The domain of the object. |
| Cyberhaven.Event.source.discovered_at | Date | The timestamp when the object was first discovered. |
| Cyberhaven.Event.source.updated_at | Date | The timestamp when the object was last updated. |
| Cyberhaven.Event.source.update_event.id | String | The ID of the update event. |
| Cyberhaven.Event.source.update_event.action_kind | String | The action kind of the update event. |
| Cyberhaven.Event.source.update_event.timestamp | Date | The timestamp of the update event. |
| Cyberhaven.Event.source.update_event.user.id | String | The user ID in the update event. |
| Cyberhaven.Event.source.update_event.user.local_username | String | The local username in the update event. |
| Cyberhaven.Event.source.update_event.user.local_id | String | The local ID in the update event. |
| Cyberhaven.Event.source.version_id | String | The version ID of the object. |
| Cyberhaven.Event.source.cloud_connector.id | String | The ID of the cloud connector. |
| Cyberhaven.Event.source.cloud_connector.type | String | The type of cloud connector. |
| Cyberhaven.Event.source.cloud_connector.name | String | The name of the cloud connector. |
| Cyberhaven.Event.source.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector. |
| Cyberhaven.Event.source.cloud_connector.account_id | String | The account ID of the cloud connector. |
| Cyberhaven.Event.destination.id | String | The ID of the object. |
| Cyberhaven.Event.destination.display_name | String | The display name of the object. |
| Cyberhaven.Event.destination.datastore_id | String | The datastore ID associated with the object. |
| Cyberhaven.Event.destination.dataset_sensitivity | String | The sensitivity classification of the dataset. |
| Cyberhaven.Event.destination.dataset_ids | String | The list of dataset IDs associated with the object. |
| Cyberhaven.Event.destination.object_type | String | The object type (e.g. file, removable_storage). |
| Cyberhaven.Event.destination.state | String | The state of the object (e.g. active). |
| Cyberhaven.Event.destination.content.tags | String | The content classification tags. |
| Cyberhaven.Event.destination.content.attributes | String | The content attributes. |
| Cyberhaven.Event.destination.content.upload_filename | String | The upload filename of the content. |
| Cyberhaven.Event.destination.content.inspected | Boolean | Whether the content was inspected. |
| Cyberhaven.Event.destination.data.labels | String | The data classification labels. |
| Cyberhaven.Event.destination.data.label_ids | String | The data classification label IDs. |
| Cyberhaven.Event.destination.app.name | String | The name of the associated application. |
| Cyberhaven.Event.destination.app.description | String | The description of the associated application. |
| Cyberhaven.Event.destination.app.package_name | String | The package name of the associated application. |
| Cyberhaven.Event.destination.app.binary_path | String | The binary path of the associated application. |
| Cyberhaven.Event.destination.app.command_line | String | The command line of the associated application. |
| Cyberhaven.Event.destination.app.main_window_title | String | The main window title of the associated application. |
| Cyberhaven.Event.destination.file.name | String | The file name. |
| Cyberhaven.Event.destination.file.extension | String | The file extension. |
| Cyberhaven.Event.destination.file.size | Number | The file size (bytes). |
| Cyberhaven.Event.destination.file.md5_hash | String | The MD5 hash of the file. |
| Cyberhaven.Event.destination.file.sha256_hash | String | The SHA-256 hash of the file. |
| Cyberhaven.Event.destination.file.created_at | Date | The creation timestamp of the file. |
| Cyberhaven.Event.destination.file.modified_at | Date | The last modification timestamp of the file. |
| Cyberhaven.Event.destination.file.owner.name | String | The name of the file owner. |
| Cyberhaven.Event.destination.file.owner.id | String | The ID of the file owner. |
| Cyberhaven.Event.destination.local_file.id | String | The local file ID. |
| Cyberhaven.Event.destination.local_file.path | String | The local file system path. |
| Cyberhaven.Event.destination.network_share.hostname | String | The hostname of the network share. |
| Cyberhaven.Event.destination.network_share.path | String | The path of the network share. |
| Cyberhaven.Event.destination.email.id | String | The ID of the email. |
| Cyberhaven.Event.destination.email.from | String | The sender of the email. |
| Cyberhaven.Event.destination.email.to | String | The recipients of the email. |
| Cyberhaven.Event.destination.email.cc | String | The CC recipients of the email. |
| Cyberhaven.Event.destination.email.bcc | String | The BCC recipients of the email. |
| Cyberhaven.Event.destination.email.subject | String | The subject of the email. |
| Cyberhaven.Event.destination.email_attachment.id | String | The ID of the email attachment. |
| Cyberhaven.Event.destination.web.url | String | The URL of the web endpoint. |
| Cyberhaven.Event.destination.web.domain | String | The domain of the web endpoint. |
| Cyberhaven.Event.destination.web.category | String | The category of the web endpoint (e.g. cloud_storage). |
| Cyberhaven.Event.destination.web.download_url | String | The download URL of the web endpoint. |
| Cyberhaven.Event.destination.web.title | String | The page title of the web endpoint. |
| Cyberhaven.Event.destination.web.user_agent | String | The user-agent string of the web endpoint. |
| Cyberhaven.Event.destination.cloud_app.provider | String | The cloud provider (e.g. google). |
| Cyberhaven.Event.destination.cloud_app.name | String | The name of the cloud application. |
| Cyberhaven.Event.destination.cloud_app.user_name | String | The username in the cloud application. |
| Cyberhaven.Event.destination.cloud_app.user_email | String | The user email in the cloud application. |
| Cyberhaven.Event.destination.cloud_app.instance_id | String | The instance ID of the cloud application. |
| Cyberhaven.Event.destination.cloud_app.instance_name | String | The instance name of the cloud application. |
| Cyberhaven.Event.destination.cloud_file.id | String | The ID of the cloud file. |
| Cyberhaven.Event.destination.cloud_file.content_uri | String | The content URI of the cloud file. |
| Cyberhaven.Event.destination.cloud_file.path | String | The path of the cloud file. |
| Cyberhaven.Event.destination.cloud_share_recipient.scope | String | The sharing scope. |
| Cyberhaven.Event.destination.cloud_share_recipient.user_ids | String | The recipient user IDs of the cloud share. |
| Cyberhaven.Event.destination.cloud_share_recipient.role | String | The role of the cloud share recipient. |
| Cyberhaven.Event.destination.printer.name | String | The name of the printer. |
| Cyberhaven.Event.destination.printer.description | String | The description of the printer. |
| Cyberhaven.Event.destination.printer.physical_location | String | The physical location of the printer. |
| Cyberhaven.Event.destination.printer.server | String | The print server hostname. |
| Cyberhaven.Event.destination.printer.share_name | String | The share name of the printer. |
| Cyberhaven.Event.destination.printer.port | String | The port of the printer. |
| Cyberhaven.Event.destination.printer.driver | String | The driver name of the printer. |
| Cyberhaven.Event.destination.printer.is_local | Boolean | Whether the printer is local. |
| Cyberhaven.Event.destination.printer.job_id | String | The print job ID. |
| Cyberhaven.Event.destination.printer.connectivity | String | The connectivity type of the printer. |
| Cyberhaven.Event.destination.removable_storage.id | String | The ID of the removable storage device. |
| Cyberhaven.Event.destination.removable_storage.name | String | The name of the removable storage device. |
| Cyberhaven.Event.destination.removable_storage.usb_id | String | The USB vendor:product ID of the removable storage. |
| Cyberhaven.Event.destination.removable_storage.vendor_id | String | The USB vendor ID of the removable storage. |
| Cyberhaven.Event.destination.removable_storage.product_id | String | The USB product ID of the removable storage. |
| Cyberhaven.Event.destination.im_message.sender | String | The sender of the IM message. |
| Cyberhaven.Event.destination.im_message.recipient_users | String | The recipient users of the IM message. |
| Cyberhaven.Event.destination.im_message.recipient_groups | String | The recipient groups of the IM message. |
| Cyberhaven.Event.destination.im_message.domain | String | The domain of the IM message. |
| Cyberhaven.Event.destination.im_message.workspace | String | The workspace of the IM message. |
| Cyberhaven.Event.destination.source_code_repo.organization | String | The organization of the source code repository. |
| Cyberhaven.Event.destination.source_code_repo.name | String | The name of the source code repository. |
| Cyberhaven.Event.destination.source_code_repo.branch | String | The branch of the source code repository. |
| Cyberhaven.Event.destination.source_code_repo.id | String | The ID of the source code repository. |
| Cyberhaven.Event.destination.labels | String | The labels applied to the object. |
| Cyberhaven.Event.destination.label_ids | String | The label IDs applied to the object. |
| Cyberhaven.Event.destination.matched_policies | String | The list of DLP policies matched by the object. |
| Cyberhaven.Event.destination.issues | String | The list of DLP issues detected on the object. |
| Cyberhaven.Event.destination.outline | String | The outline description of the object. |
| Cyberhaven.Event.destination.type | String | The endpoint type (e.g. endpoint, removable_media). |
| Cyberhaven.Event.destination.domain | String | The domain of the object. |
| Cyberhaven.Event.destination.discovered_at | Date | The timestamp when the object was first discovered. |
| Cyberhaven.Event.destination.updated_at | Date | The timestamp when the object was last updated. |
| Cyberhaven.Event.destination.update_event.id | String | The ID of the update event. |
| Cyberhaven.Event.destination.update_event.action_kind | String | The action kind of the update event. |
| Cyberhaven.Event.destination.update_event.timestamp | Date | The timestamp of the update event. |
| Cyberhaven.Event.destination.update_event.user.id | String | The user ID in the update event. |
| Cyberhaven.Event.destination.update_event.user.local_username | String | The local username in the update event. |
| Cyberhaven.Event.destination.update_event.user.local_id | String | The local ID in the update event. |
| Cyberhaven.Event.destination.version_id | String | The version ID of the object. |
| Cyberhaven.Event.destination.cloud_connector.id | String | The ID of the cloud connector. |
| Cyberhaven.Event.destination.cloud_connector.type | String | The type of cloud connector. |
| Cyberhaven.Event.destination.cloud_connector.name | String | The name of the cloud connector. |
| Cyberhaven.Event.destination.cloud_connector.onboarding_account | String | The onboarding account of the cloud connector. |
| Cyberhaven.Event.destination.cloud_connector.account_id | String | The account ID of the cloud connector. |
Command example
!cyberhaven-event-details-get event_ids="evt_start_001abc"
Context Example
{
"Cyberhaven": {
"Event": [
{
"id": "evt_start_001abc",
"timestamp": "2026-01-15T10:28:45Z",
"action": {
"kind": "copy",
"blocked": false,
"data_size": 2048576,
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"word_count": 1500,
"page_count": 3,
"record_count": 250,
"sensitivity_score": 95
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
},
"inspected": true
},
"sensor_kind": "endpoint",
"hostname": "WORKSTATION-NYC-042",
"machine_serial_number": "C02XK1JFHV2R",
"custom_data": {
"os_version": "Windows 11 22H2"
},
"ip_address": "192.168.1.100",
"device_type": "managed",
"temporary_blocked": false,
"fail_close_statuses": [
{
"temporary_blocked": false,
"dlp_api_status": "SUCCESS",
"dlp_precondition": "DLP_PRECONDITION_MET",
"action_status": "ACTION_STATUS_COMPLETED"
}
],
"process_id": 4821,
"parent_process_id": 1024
},
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001"
}
},
"source": {
"id": "src_local_001abc",
"display_name": "employee_salaries_2026.xlsx",
"datastore_id": "dstore_endpoint_01",
"dataset_sensitivity": "sensitivity_high",
"dataset_ids": [
"ds_hr_confidential"
],
"object_type": "file",
"state": "active",
"content": {
"tags": [
"pii",
"confidential"
],
"attributes": {
"record_count": 250
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"classification": "confidential",
"last_scan": "2026-01-10T09:00:00Z",
"scan_result": "contains_pii",
"owner_department": "HR"
},
"inspected": true
},
"data": {
"labels": [
"PII",
"Confidential",
"HR Data"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
]
},
"app": {
"name": "Microsoft Excel",
"description": "Microsoft Office Spreadsheet Application",
"package_name": "com.microsoft.excel",
"binary_path": "C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE",
"command_line": "\"EXCEL.EXE\" /e",
"main_window_title": "employee_salaries_2026.xlsx - Excel",
"custom_data": {
"version": "16.0.17126.20132",
"publisher": "Microsoft Corporation",
"signed": "true",
"install_date": "2023-06-01"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"creator": "john.doe",
"last_modified_by": "jane.smith",
"revision": "3"
},
"created_at": "2026-01-10T09:00:00Z",
"modified_at": "2026-01-15T08:30:00Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_001abc",
"path": "C:\\Users\\john.doe\\Documents\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\HR\\Compensation",
"custom_data": {
"share_type": "SMB",
"mount_point": "Z:"
}
},
"email": {
"id": "email_src_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>"
}
},
"email_attachment": {
"id": "attach_src_001",
"custom_data": {
"attachment_index": "0",
"content_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
}
},
"web": {
"url": "https://drive.google.com/upload",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload",
"custom_data": {
"referrer": "https://drive.google.com/"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"tenant_id": "tenant_google_001",
"app_version": "2026.1"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_src_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Data/employee_salaries_2026.xlsx",
"custom_data": {
"mime_type": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"revision_id": "rev_001"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_src_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_001abc",
"platform": "teams"
}
},
"source_code_repo": {
"organization": "company-org",
"name": "hr-data-scripts",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_001"
},
"labels": [
"PII",
"Confidential"
],
"label_ids": [
"lbl_pii",
"lbl_confidential"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_hr_001",
"version": 3,
"definition_rule_ids": [
"rule_pii_detection",
"rule_confidential_data"
],
"action_rule_id": "action_rule_block",
"matched_at": "2026-01-15T10:28:45Z"
}
],
"issues": [
{
"id": "issue_001abc",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_hr_001",
"policy_action_rule_id": "action_rule_block",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:45Z"
}
],
"custom_data": {
"data_classification": "confidential"
},
"outline": "Spreadsheet containing employee salary and compensation data for 250 employees in the Engineering department.",
"type": "website",
"domain": "company.com",
"discovered_at": "2026-01-10T09:00:00Z",
"updated_at": "2026-01-15T10:28:45Z",
"update_event": {
"id": "upd_evt_001",
"action_kind": "read",
"timestamp": "2026-01-15T10:28:45Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001",
"ad_group": "Domain Users"
}
}
},
"version_id": "ver_001abc",
"cloud_connector": {
"id": "cc_snowflake_001",
"type": "snowflake",
"name": "Company Snowflake Integration",
"onboarding_account": "snowflake-admin@company.com",
"account_id": "sf_snowflake_001"
}
},
"destination": {
"id": "dst_usb_001abc",
"display_name": "SanDisk Ultra 64GB (E:)",
"datastore_id": "dstore_usb_01",
"dataset_sensitivity": "sensitivity_unspecified",
"dataset_ids": [
"ds_removable_default"
],
"object_type": "removable_storage",
"state": "active",
"content": {
"tags": [
"external",
"removable"
],
"attributes": {
"file_count": 1
},
"upload_filename": "employee_salaries_2026.xlsx",
"custom_data": {
"destination_path": "E:\\Backup\\HR",
"overwrite": "false"
},
"inspected": true
},
"data": {
"labels": [
"External Storage",
"Removable Media"
],
"label_ids": [
"lbl_external_storage",
"lbl_removable_media"
]
},
"app": {
"name": "Windows Explorer",
"description": "Windows File Explorer",
"package_name": "com.microsoft.explorer",
"binary_path": "C:\\Windows\\explorer.exe",
"command_line": "explorer.exe /select,\"E:\\Backup\\HR\\employee_salaries_2026.xlsx\"",
"main_window_title": "E:\\Backup\\HR",
"custom_data": {
"version": "10.0.22621.1",
"elevated": "false"
}
},
"file": {
"name": "employee_salaries_2026.xlsx",
"extension": "xlsx",
"size": 2048576,
"md5_hash": "d41d8cd98f00b204e9800998ecf8427e",
"sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"custom_data": {
"destination_created": "true",
"is_copy": "true"
},
"created_at": "2026-01-15T10:28:50Z",
"modified_at": "2026-01-15T10:28:50Z",
"owner": {
"name": "john.doe",
"id": "usr_john_doe_001"
}
},
"local_file": {
"id": "lf_dst_001",
"path": "E:\\Backup\\HR\\employee_salaries_2026.xlsx"
},
"network_share": {
"hostname": "FILESERVER-01",
"path": "\\\\FILESERVER-01\\Backup\\HR",
"custom_data": {
"share_type": "SMB"
}
},
"email": {
"id": "email_dst_001",
"from": "john.doe@company.com",
"to": [
"personal@gmail.com"
],
"cc": [
"backup@gmail.com"
],
"bcc": [
"archive@gmail.com"
],
"subject": "Salary Data Backup",
"custom_data": {
"message_id": "<20260115102845.001@company.com>"
}
},
"email_attachment": {
"id": "attach_dst_001",
"custom_data": {
"attachment_index": "0"
}
},
"web": {
"url": "https://drive.google.com/upload/resumable",
"domain": "drive.google.com",
"category": "cloud_storage",
"download_url": "https://drive.google.com/file/d/1abc123/view",
"title": "Google Drive - Upload Complete",
"custom_data": {
"upload_session_id": "upload_sess_001"
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
},
"cloud_app": {
"provider": "google",
"name": "google_drive",
"user_name": "john.doe",
"user_email": "john.doe@personal.com",
"custom_data": {
"upload_complete": "true"
},
"instance_id": "gdrive_inst_001",
"instance_name": "Personal Google Drive"
},
"cloud_file": {
"id": "cf_dst_001",
"content_uri": "https://drive.google.com/file/d/1abc123/content",
"path": "/My Drive/HR Backup/employee_salaries_2026.xlsx",
"custom_data": {
"upload_timestamp": "2026-01-15T10:29:00Z",
"file_id": "1abc123xyz",
"revision_id": "rev_001"
}
},
"cloud_share_recipient": {
"scope": "share_external",
"user_ids": [
"external_user_001",
"external_user_002"
],
"role": "role_viewer",
"custom_data": {
"expiry_date": "2026-12-31",
"notify_on_access": "true"
}
},
"printer": {
"name": "HP LaserJet Pro M404n",
"description": "Office Laser Printer - Floor 3",
"physical_location": "3rd Floor Copy Room",
"server": "PRINTSERVER-01",
"share_name": "HP-LaserJet-3F",
"port": "IP_192.168.1.200",
"driver": "HP LaserJet Pro M404n PCL 6",
"is_local": false,
"job_id": "print_job_4521",
"custom_data": {
"pages_printed": "12"
},
"connectivity": "network"
},
"removable_storage": {
"id": "usb_dst_001",
"name": "SanDisk Ultra 64GB",
"usb_id": "usb_0781_5581",
"vendor_id": "0781",
"product_id": "5581",
"custom_data": {
"serial_number": "4C530001041120115283",
"drive_letter": "E"
}
},
"im_message": {
"sender": "john.doe@company.com",
"recipient_users": [
"personal.contact@gmail.com"
],
"recipient_groups": [
"external-group-001"
],
"domain": "teams.microsoft.com",
"workspace": "Personal Chat",
"custom_data": {
"message_id": "msg_dst_001"
}
},
"source_code_repo": {
"organization": "personal-org",
"name": "personal-backup-repo",
"custom_data": {
"visibility": "private"
},
"branch": "main",
"id": "repo_dst_001"
},
"labels": [
"External Storage",
"Removable Media"
],
"label_ids": [
"lbl_external_storage",
"lbl_removable_media"
],
"matched_policies": [
{
"policy_type": "dlp",
"id": "pol_dlp_removable_001",
"version": 2,
"definition_rule_ids": [
"rule_removable_media_write"
],
"action_rule_id": "action_rule_alert",
"matched_at": "2026-01-15T10:28:50Z"
}
],
"issues": [
{
"id": "issue_dst_001",
"policy_type": "dlp",
"matched_policy_id": "pol_dlp_removable_001",
"policy_action_rule_id": "action_rule_alert",
"severity": "issue_severity_high",
"detected_at": "2026-01-15T10:28:50Z"
}
],
"custom_data": {
"endpoint_risk": "high",
"device_approved": "false",
"destination_type": "removable_media",
"risk_assessment": "critical",
"flagged_by": "dlp_engine"
},
"outline": "SanDisk USB removable storage device used as unauthorized destination for confidential HR data transfer.",
"type": "cloud_apps",
"domain": "company.com",
"discovered_at": "2026-01-15T10:28:45Z",
"updated_at": "2026-01-15T10:28:50Z",
"update_event": {
"id": "upd_evt_dst_001",
"action_kind": "write",
"timestamp": "2026-01-15T10:28:50Z",
"user": {
"id": "usr_john_doe_001",
"local_username": "john.doe",
"local_id": "S-1-5-21-3623811015-3361044348-030300820-1013",
"custom_data": {
"session_id": "sess_20260115_001",
"ad_group": "Domain Users"
}
}
},
"version_id": "ver_dst_001",
"cloud_connector": {
"id": "cc_salesforce_001",
"type": "salesforce",
"name": "Company Salesforce Integration",
"onboarding_account": "admin@company.com",
"account_id": "sf_acct_001"
}
}
}
]
}
}
Human Readable Output
Cyberhaven Event Details
ID Time User Action Source Destination evt_start_001abc 2026-01-15T10:28:45Z id: usr_john_doe_001
local_username: john.doe
local_id: S-1-5-21-3623811015-3361044348-030300820-1013
custom_data:
session_id: sess_20260115_001kind: copy
blocked: false
data_size: 2048576
content:
tags:
values: pii, confidential
attributes:
word_count: 1500
page_count: 3
record_count: 250
sensitivity_score: 95
upload_filename: employee_salaries_2026.xlsx
custom_data:
mime_type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
inspected: true
sensor_kind: endpoint
hostname: WORKSTATION-NYC-042
machine_serial_number: C02XK1JFHV2R
custom_data:
os_version: Windows 11 22H2
ip_address: 192.168.1.100
device_type: managed
temporary_blocked: false
fail_close_statuses:
- temporary_blocked: false
dlp_api_status: SUCCESS
dlp_precondition: DLP_PRECONDITION_MET
action_status: ACTION_STATUS_COMPLETED
process_id: 4821
parent_process_id: 1024id: src_local_001abc
display_name: employee_salaries_2026.xlsx
datastore_id: dstore_endpoint_01
dataset_sensitivity: sensitivity_high
dataset_ids:
values: ds_hr_confidential
object_type: file
state: active
content:
tags:
values: pii, confidential
attributes:
record_count: 250
upload_filename: employee_salaries_2026.xlsx
custom_data:
classification: confidential
last_scan: 2026-01-10T09:00:00Z
scan_result: contains_pii
owner_department: HR
inspected: true
data:
labels:
values: PII, Confidential, HR Data
label_ids:
values: lbl_pii, lbl_confidential
app:
name: Microsoft Excel
description: Microsoft Office Spreadsheet Application
package_name: com.microsoft.excel
binary_path: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
command_line: “EXCEL.EXE” /e
main_window_title: employee_salaries_2026.xlsx - Excel
custom_data:
version: 16.0.17126.20132
publisher: Microsoft Corporation
signed: true
install_date: 2023-06-01
file:
name: employee_salaries_2026.xlsx
extension: xlsx
size: 2048576
md5_hash: d41d8cd98f00b204e9800998ecf8427e
sha256_hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
custom_data:
creator: john.doe
last_modified_by: jane.smith
revision: 3
created_at: 2026-01-10T09:00:00Z
modified_at: 2026-01-15T08:30:00Z
owner:
name: john.doe
id: usr_john_doe_001
local_file:
id: lf_001abc
path: C:\Users\john.doe\Documents\HR\employee_salaries_2026.xlsx
network_share:
hostname: FILESERVER-01
path: \FILESERVER-01\HR\Compensation
custom_data:
share_type: SMB
mount_point: Z:
email:
id: email_src_001
from: john.doe@company.com
to:
values: personal@gmail.com
cc:
values: backup@gmail.com
bcc:
values: archive@gmail.com
subject: Salary Data Backup
custom_data:
message_id: 20260115102845.001@company.com
email_attachment:
id: attach_src_001
custom_data:
attachment_index: 0
content_type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
web:
url: https://drive.google.com/upload
domain: drive.google.com
category: cloud_storage
download_url: https://drive.google.com/file/d/1abc123/view
title: Google Drive - Upload
custom_data:
referrer: https://drive.google.com/
user_agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
cloud_app:
provider: google
name: google_drive
user_name: john.doe
user_email: john.doe@personal.com
custom_data:
tenant_id: tenant_google_001
app_version: 2026.1
instance_id: gdrive_inst_001
instance_name: Personal Google Drive
cloud_file:
id: cf_src_001
content_uri: https://drive.google.com/file/d/1abc123/content
path: /My Drive/HR Data/employee_salaries_2026.xlsx
custom_data:
mime_type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
revision_id: rev_001
cloud_share_recipient:
scope: share_external
user_ids:
values: external_user_001
role: role_viewer
custom_data:
expiry_date: 2026-12-31
printer:
name: HP LaserJet Pro M404n
description: Office Laser Printer - Floor 3
physical_location: 3rd Floor Copy Room
server: PRINTSERVER-01
share_name: HP-LaserJet-3F
port: IP_192.168.1.200
driver: HP LaserJet Pro M404n PCL 6
is_local: false
job_id: print_job_4521
custom_data:
pages_printed: 12
connectivity: network
removable_storage:
id: usb_src_001
name: SanDisk Ultra 64GB
usb_id: usb_0781_5581
vendor_id: 0781
product_id: 5581
custom_data:
serial_number: 4C530001041120115283
im_message:
sender: john.doe@company.com
recipient_users:
values: personal.contact@gmail.com
recipient_groups:
values: external-group-001
domain: teams.microsoft.com
workspace: Personal Chat
custom_data:
message_id: msg_001abc
platform: teams
source_code_repo:
organization: company-org
name: hr-data-scripts
custom_data:
visibility: private
branch: main
id: repo_001
labels:
values: PII, Confidential
label_ids:
values: lbl_pii, lbl_confidential
matched_policies:
- policy_type: dlp
id: pol_dlp_hr_001
version: 3
definition_rule_ids:
values: rule_pii_detection, rule_confidential_data
action_rule_id: action_rule_block
matched_at: 2026-01-15T10:28:45Z
issues:
- id: issue_001abc
policy_type: dlp
matched_policy_id: pol_dlp_hr_001
policy_action_rule_id: action_rule_block
severity: issue_severity_high
detected_at: 2026-01-15T10:28:45Z
custom_data:
data_classification: confidential
outline: Spreadsheet containing employee salary and compensation data for 250 employees in the Engineering department.
type: website
domain: company.com
discovered_at: 2026-01-10T09:00:00Z
updated_at: 2026-01-15T10:28:45Z
update_event:
id: upd_evt_001
action_kind: read
timestamp: 2026-01-15T10:28:45Z
user:
id: usr_john_doe_001
local_username: john.doe
local_id: S-1-5-21-3623811015-3361044348-030300820-1013
custom_data:
session_id: sess_20260115_001
ad_group: Domain Users
version_id: ver_001abc
cloud_connector:
id: cc_snowflake_001
type: snowflake
name: Company Snowflake Integration
onboarding_account: snowflake-admin@company.com
account_id: sf_snowflake_001id: dst_usb_001abc
display_name: SanDisk Ultra 64GB (E:)
datastore_id: dstore_usb_01
dataset_sensitivity: sensitivity_unspecified
dataset_ids:
values: ds_removable_default
object_type: removable_storage
state: active
content:
tags:
values: external, removable
attributes:
file_count: 1
upload_filename: employee_salaries_2026.xlsx
custom_data:
destination_path: E:\Backup\HR
overwrite: false
inspected: true
data:
labels:
values: External Storage, Removable Media
label_ids:
values: lbl_external_storage, lbl_removable_media
app:
name: Windows Explorer
description: Windows File Explorer
package_name: com.microsoft.explorer
binary_path: C:\Windows\explorer.exe
command_line: explorer.exe /select,”E:\Backup\HR\employee_salaries_2026.xlsx”
main_window_title: E:\Backup\HR
custom_data:
version: 10.0.22621.1
elevated: false
file:
name: employee_salaries_2026.xlsx
extension: xlsx
size: 2048576
md5_hash: d41d8cd98f00b204e9800998ecf8427e
sha256_hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
custom_data:
destination_created: true
is_copy: true
created_at: 2026-01-15T10:28:50Z
modified_at: 2026-01-15T10:28:50Z
owner:
name: john.doe
id: usr_john_doe_001
local_file:
id: lf_dst_001
path: E:\Backup\HR\employee_salaries_2026.xlsx
network_share:
hostname: FILESERVER-01
path: \FILESERVER-01\Backup\HR
custom_data:
share_type: SMB
email:
id: email_dst_001
from: john.doe@company.com
to:
values: personal@gmail.com
cc:
values: backup@gmail.com
bcc:
values: archive@gmail.com
subject: Salary Data Backup
custom_data:
message_id: 20260115102845.001@company.com
email_attachment:
id: attach_dst_001
custom_data:
attachment_index: 0
web:
url: https://drive.google.com/upload/resumable
domain: drive.google.com
category: cloud_storage
download_url: https://drive.google.com/file/d/1abc123/view
title: Google Drive - Upload Complete
custom_data:
upload_session_id: upload_sess_001
user_agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
cloud_app:
provider: google
name: google_drive
user_name: john.doe
user_email: john.doe@personal.com
custom_data:
upload_complete: true
instance_id: gdrive_inst_001
instance_name: Personal Google Drive
cloud_file:
id: cf_dst_001
content_uri: https://drive.google.com/file/d/1abc123/content
path: /My Drive/HR Backup/employee_salaries_2026.xlsx
custom_data:
upload_timestamp: 2026-01-15T10:29:00Z
file_id: 1abc123xyz
revision_id: rev_001
cloud_share_recipient:
scope: share_external
user_ids:
values: external_user_001, external_user_002
role: role_viewer
custom_data:
expiry_date: 2026-12-31
notify_on_access: true
printer:
name: HP LaserJet Pro M404n
description: Office Laser Printer - Floor 3
physical_location: 3rd Floor Copy Room
server: PRINTSERVER-01
share_name: HP-LaserJet-3F
port: IP_192.168.1.200
driver: HP LaserJet Pro M404n PCL 6
is_local: false
job_id: print_job_4521
custom_data:
pages_printed: 12
connectivity: network
removable_storage:
id: usb_dst_001
name: SanDisk Ultra 64GB
usb_id: usb_0781_5581
vendor_id: 0781
product_id: 5581
custom_data:
serial_number: 4C530001041120115283
drive_letter: E
im_message:
sender: john.doe@company.com
recipient_users:
values: personal.contact@gmail.com
recipient_groups:
values: external-group-001
domain: teams.microsoft.com
workspace: Personal Chat
custom_data:
message_id: msg_dst_001
source_code_repo:
organization: personal-org
name: personal-backup-repo
custom_data:
visibility: private
branch: main
id: repo_dst_001
labels:
values: External Storage, Removable Media
label_ids:
values: lbl_external_storage, lbl_removable_media
matched_policies:
- policy_type: dlp
id: pol_dlp_removable_001
version: 2
definition_rule_ids:
values: rule_removable_media_write
action_rule_id: action_rule_alert
matched_at: 2026-01-15T10:28:50Z
issues:
- id: issue_dst_001
policy_type: dlp
matched_policy_id: pol_dlp_removable_001
policy_action_rule_id: action_rule_alert
severity: issue_severity_high
detected_at: 2026-01-15T10:28:50Z
custom_data:
endpoint_risk: high
device_approved: false
destination_type: removable_media
risk_assessment: critical
flagged_by: dlp_engine
outline: SanDisk USB removable storage device used as unauthorized destination for confidential HR data transfer.
type: cloud_apps
domain: company.com
discovered_at: 2026-01-15T10:28:45Z
updated_at: 2026-01-15T10:28:50Z
update_event:
id: upd_evt_dst_001
action_kind: write
timestamp: 2026-01-15T10:28:50Z
user:
id: usr_john_doe_001
local_username: john.doe
local_id: S-1-5-21-3623811015-3361044348-030300820-1013
custom_data:
session_id: sess_20260115_001
ad_group: Domain Users
version_id: ver_dst_001
cloud_connector:
id: cc_salesforce_001
type: salesforce
name: Company Salesforce Integration
onboarding_account: admin@company.com
account_id: sf_acct_001
cyberhaven-event-lineage-get
Retrieves the data lineage chain between two Cyberhaven event IDs.
Base Command
cyberhaven-event-lineage-get
Input
| Argument Name | Description | Required |
|---|---|---|
| start_event_id | Provide the UUID of the first event in the chain. | Required |
| end_event_id | Provide the UUID of the last event in the chain. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| Cyberhaven.EventLineage.resources | String | The list of events ID in order. |
Command example
!cyberhaven-event-lineage-get start_event_id="evt-001" end_event_id="evt-003"
Context Example
{
"Cyberhaven": {
"EventLineage": [
{
"resources": [
"evt-001",
"evt-002",
"evt-003"
]
}
]
}
}
Human Readable Output
Event Lineage: evt-001 to evt-003
Number ID 1 evt-001 2 evt-002 3 evt-003
Troubleshoot
Getting a Connection Error
Summary:
While running Test Connectivity, it fails with an error message similar to:
Failed to execute test-module command. Error: Verify that the server URL parameter is correct and that you have access to the server from your host.
Troubleshooting:
- Verify the Server URL field is correctly formatted (e.g.,
https://example.cyberhaven.io) with no trailing slash. - Confirm XSOAR can reach the Cyberhaven tenant host from your network.
- If a proxy is in use, verify the proxy is configured correctly and enable the Use system proxy settings option in the integration configuration.
Invalid or Expired Refresh Token (401 Unauthorized)
Summary:
While running Test Connectivity or executing a command, the following error appears:
Error: Status code: 401. Unauthorized request.
Troubleshooting:
- Verify the Refresh Token in the integration configuration is correct and has not expired.
- Generate a new Refresh Token from the Cyberhaven platform and update the integration configuration.
- Confirm the token has the necessary permissions to access the Cyberhaven API.
No Incidents Fetched
Summary:
The integration is configured to fetch incidents, but no incidents appear in XSOAR.
Troubleshooting:
- Confirm Fetch incidents is enabled in the integration configuration.
- Verify the Incident type is set to
Cyberhaven Incident. - Check the First fetch time value. It cannot exceed 30 days; values greater than 30 days are automatically capped to 30 days.
- Check the Status of incidents to fetch and Severity of incidents to fetch filters. If the filters are too restrictive, no matching incidents may exist in Cyberhaven during the fetch window.
- Confirm the Cyberhaven tenant has DLP incidents within the configured fetch window.
Max Fetch Limit Exceeded
Summary:
The Max Fetch parameter is set to a value greater than 200, but only 200 incidents are fetched per cycle.
Troubleshooting:
- The maximum allowed value for Max Fetch is 200. Any value greater than 200 is automatically treated as 200. Adjust your expectations or the fetch interval accordingly.
Outgoing Mirroring Not Syncing to Cyberhaven
Summary:
Changes made in XSOAR (Status, Owner, Close Reason, Close Notes) are not reflected in Cyberhaven.
Troubleshooting:
- Confirm Enable Outgoing Mirroring (from XSOAR to Cyberhaven) is enabled in the integration configuration.
- Verify the Refresh Token has write permissions on the Cyberhaven platform.
- Only the following fields are mirrored from XSOAR to Cyberhaven: Status, Owner, Close Reason, and Close Notes. Changes to other fields are not synced.
- Check that the incident in XSOAR was created by this integration instance. Mirroring applies only to incidents fetched by Cyberhaven integration.
Execution Timeout
Summary:
A command fails due to a timeout error.
Troubleshooting:
- Use the
execution-timeoutargument to extend the command timeout (value in seconds):
| !cyberhaven-incident-list execution-timeout=120 |
| :—- |
For Any Other Errors
- Run the failing command with the
debug-mode=trueargument to generate a detailed log file:
| !<command_name> debug-mode=true Example: !cyberhaven-incident-list debug-mode=true |
| :—- |
- For fetch incident errors, run:
| !<integration_instance_name>-fetch debug-mode=true Example: !Cyberhaven_Instance_1-fetch debug-mode=true |
| :—- |
- Enable integration-level debug logging from the configuration page by setting the Log Level to
debug. Logs are written to/var/log/demisto/Integration-Instance.log.
Reference links:
Configuration parameters
url— Server URL (e.g., https://example.cyberhaven.io) (required)credentials— (required)isFetch— Fetch incidentsincidentType— Incident typefirst_fetch— First fetch timemax_fetch— Max Fetchstatus_filter— Status of incidents to fetchseverity_filter— Severity of incidents to fetchoutgoing_mirroring— Enable Outgoing Mirroring (from XSOAR to Cyberhaven)incidentFetchInterval— Incidents Fetch Intervalinsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (4)
-
cyberhaven-event-details-getRetrieves full details for one or more Cyberhaven events by ID.
-
cyberhaven-event-lineage-getRetrieves the data lineage chain between two Cyberhaven event IDs.
-
cyberhaven-incident-listList and search Cyberhaven DLP incidents with optional filters.
-
cyberhaven-incident-updateUpdate the status, assignment, or close reason of a Cyberhaven incident.
import json import time from datetime import datetime, timedelta import pytest from CommonServerPython import CommandResults, DemistoException, IncidentStatus from Cyberhaven import ( CLOSE_REASON_VALUES, ERROR_MESSAGES, EVENT_DETAILS_ENDPOINT, EVENT_LINEAGE_ENDPOINT, INCIDENT_PATCH_ENDPOINT, INCIDENTS_ENDPOINT, MAX_INCIDENTS_TO_FETCH, SEVERITY_MAP, TOKEN_ENDPOINT, Client, apply_api_labels, convert_severity, cyberhaven_event_details_get_command, cyberhaven_event_lineage_get_command, cyberhaven_incident_list_command, cyberhaven_incident_update_command, fetch_incidents, get_mirroring, main, nullify_sentinels, test_module as cyberhaven_test_module, trim_spaces_from_args, update_remote_system_command, validate_cyberhaven_url, validate_incident_list_args, validate_incident_update_args, ) BASE_URL = "https://your-tenant.cyberhaven.io" TOKEN_URL = f"{BASE_URL}{TOKEN_ENDPOINT}" INCIDENTS_URL = f"{BASE_URL}{INCIDENTS_ENDPOINT}" def util_load_json(path): with open(path, encoding="utf-8") as f: return json.loads(f.read()) @pytest.fixture def mock_client(mocker, requests_mock): """Fixture: client with empty integration context, token endpoint stubbed to return a valid token.""" mocker.patch("Cyberhaven.get_integration_context", return_value={}) mocker.patch("Cyberhaven.set_integration_context") auth_response = util_load_json("test_data/auth_token.json") requests_mock.post(TOKEN_URL, json=auth_response, status_code=200) return Client( base_url=BASE_URL, refresh_token="test-refresh-token", verify=False, proxy=False, ) def test_client_uses_cached_access_token(mocker): """ Given: - A non-expired access_token already stored in integration context. When: - Constructing the Client. Then: - The cached token is reused and set_integration_context is never called. """ future_expiry = time.time() + 900 mocker.patch( "Cyberhaven.get_integration_context", return_value={"access_token": "cached-token", "token_expiry": future_expiry}, ) set_ctx = mocker.patch("Cyberhaven.set_integration_context") client = Client(base_url=BASE_URL, refresh_token="tok", verify=False, proxy=False) assert client._access_token == "cached-token" set_ctx.assert_not_called() def test_client_generates_new_token_when_cache_empty(mocker, requests_mock): """ Given: - An empty integration context (no cached token). When: - Constructing the Client. Then: - The token endpoint is called, the returned token is stored, and cached in the client. """ mocker.patch("Cyberhaven.get_integration_context", return_value={}) set_ctx = mocker.patch("Cyberhaven.set_integration_context") auth_response = util_load_json("test_data/auth_token.json") requests_mock.post(TOKEN_URL, json=auth_response, status_code=200) client = Client(base_url=BASE_URL, refresh_token="test-tok", verify=False, proxy=False) assert client._access_token == auth_response["access_token"] set_ctx.assert_called_once() stored = set_ctx.call_args[0][0] assert stored["access_token"] == auth_response["access_token"] assert "token_expiry" in stored def test_client_generates_new_token_when_token_expired(mocker, requests_mock): """ Given: - An integration context with an expired token (expiry in the past). When: - Constructing the Client. Then: - A new token is fetched and replaces the expired one. """ mocker.patch( "Cyberhaven.get_integration_context", return_value={"access_token": "old-token", "token_expiry": time.time() - 10}, ) set_ctx = mocker.patch("Cyberhaven.set_integration_context") auth_response = util_load_json("test_data/auth_token.json") requests_mock.post(TOKEN_URL, json=auth_response, status_code=200) client = Client(base_url=BASE_URL, refresh_token="tok", verify=False, proxy=False) assert client._access_token == auth_response["access_token"] set_ctx.assert_called_once() def test_generate_token_invalid_refresh_token_401_json(mocker, requests_mock): """ Given: - Token endpoint returns 401 with a JSON error body. When: - Constructing the Client. Then: - DemistoException is raised containing the UNAUTHORIZED_REQUEST message. """ mocker.patch("Cyberhaven.get_integration_context", return_value={}) mocker.patch("Cyberhaven.set_integration_context") requests_mock.post( TOKEN_URL, json={"error": "invalid_token", "message": "Bad refresh token"}, status_code=401, ) with pytest.raises(DemistoException) as exc: Client(base_url=BASE_URL, refresh_token="bad-token", verify=False, proxy=False) assert ERROR_MESSAGES["UNAUTHORIZED_REQUEST"].format(401, "").rstrip(" .") in str(exc.value) def test_generate_token_invalid_refresh_token_401_non_json(mocker, requests_mock): """ Given: - Token endpoint returns 401 with a plain-text body (not JSON). When: - Constructing the Client. Then: - DemistoException is raised via the ValueError fallback path; still contains UNAUTHORIZED_REQUEST. """ mocker.patch("Cyberhaven.get_integration_context", return_value={}) mocker.patch("Cyberhaven.set_integration_context") requests_mock.post(TOKEN_URL, text="Unauthorized", status_code=401) with pytest.raises(DemistoException) as exc: Client(base_url=BASE_URL, refresh_token="bad-token", verify=False, proxy=False) assert ERROR_MESSAGES["UNAUTHORIZED_REQUEST"].format(401, "").rstrip(" .") in str(exc.value) def test_generate_token_non_json_success_response(mocker, requests_mock): """ Given: - Token endpoint returns 200 with a plain-text (non-JSON) body. When: - Constructing the Client. Then: - DemistoException is raised because the token response cannot be parsed as JSON. """ mocker.patch("Cyberhaven.get_integration_context", return_value={}) mocker.patch("Cyberhaven.set_integration_context") requests_mock.post(TOKEN_URL, text="not-json", status_code=200) with pytest.raises(DemistoException) as exc: Client(base_url=BASE_URL, refresh_token="tok", verify=False, proxy=False) assert ERROR_MESSAGES["INVALID_OBJECT"].format("json", "") in str(exc.value) def test_generate_token_missing_access_token_field(mocker, requests_mock): """ Given: - Token endpoint returns 200 JSON but without an access_token field. When: - Constructing the Client. Then: - DemistoException is raised with the TOKEN_GENERATION_FAILED message. """ mocker.patch("Cyberhaven.get_integration_context", return_value={}) mocker.patch("Cyberhaven.set_integration_context") requests_mock.post(TOKEN_URL, json={"token_type": "Bearer"}, status_code=200) with pytest.raises(DemistoException) as exc: Client(base_url=BASE_URL, refresh_token="tok", verify=False, proxy=False) assert ERROR_MESSAGES["TOKEN_GENERATION_FAILED"] in str(exc.value) def test_http_request_refreshes_token_on_401(mocker, requests_mock): """ Given: - Client with a stale (cached, not-yet-expired) token. First API call returns 401; auth endpoint returns a new token; second API call succeeds. When: - list_incidents is called. Then: - A new access token is fetched and the retried call returns the successful response. """ mocker.patch( "Cyberhaven.get_integration_context", return_value={"access_token": "stale-token", "token_expiry": time.time() + 900}, ) mocker.patch("Cyberhaven.set_integration_context") auth_response = util_load_json("test_data/auth_token.json") requests_mock.post(TOKEN_URL, json=auth_response, status_code=200) incident_list = util_load_json("test_data/incident_list.json") requests_mock.post( INCIDENTS_URL, [ {"json": {"error": "unauthorized"}, "status_code": 401}, {"json": incident_list, "status_code": 200}, ], ) client = Client(base_url=BASE_URL, refresh_token="tok", verify=False, proxy=False) result = client.list_incidents(page_size=1) assert result == incident_list assert client._access_token == auth_response["access_token"] def test_http_request_persistent_401_json_body(mocker, requests_mock): """ Given: - Client whose retried request (after token refresh) also returns 401 with JSON body. When: - list_incidents is called. Then: - DemistoException is raised with the UNAUTHORIZED_REQUEST message. """ mocker.patch( "Cyberhaven.get_integration_context", return_value={"access_token": "stale-token", "token_expiry": time.time() + 900}, ) mocker.patch("Cyberhaven.set_integration_context") auth_response = util_load_json("test_data/auth_token.json") requests_mock.post(TOKEN_URL, json=auth_response, status_code=200) requests_mock.post(INCIDENTS_URL, json={"error": "unauthorized"}, status_code=401) client = Client(base_url=BASE_URL, refresh_token="tok", verify=False, proxy=False) with pytest.raises(DemistoException) as exc: client.list_incidents(page_size=1) assert ERROR_MESSAGES["UNAUTHORIZED_REQUEST"].format(401, "").rstrip(" .") in str(exc.value) def test_http_request_persistent_401_non_json_body(mocker, requests_mock): """ Given: - Client whose retried request (after token refresh) returns 401 with plain-text body. When: - list_incidents is called. Then: - DemistoException is raised via the ValueError fallback; still contains UNAUTHORIZED_REQUEST. """ mocker.patch( "Cyberhaven.get_integration_context", return_value={"access_token": "stale-token", "token_expiry": time.time() + 900}, ) mocker.patch("Cyberhaven.set_integration_context") auth_response = util_load_json("test_data/auth_token.json") requests_mock.post(TOKEN_URL, json=auth_response, status_code=200) requests_mock.post(INCIDENTS_URL, text="Unauthorized", status_code=401) client = Client(base_url=BASE_URL, refresh_token="tok", verify=False, proxy=False) with pytest.raises(DemistoException) as exc: client.list_incidents(page_size=1) assert ERROR_MESSAGES["UNAUTHORIZED_REQUEST"].format(401, "").rstrip(" .") in str(exc.value) def test_http_request_response_type_json_returns_parsed(mock_client, requests_mock): """ Given: - A valid client and a successful JSON response. When: - http_request is called with response_type='json'. Then: - The parsed JSON dict is returned. """ incident_list = util_load_json("test_data/incident_list.json") requests_mock.post(INCIDENTS_URL, json=incident_list, status_code=200) result = mock_client.http_request(method="POST", url_suffix=INCIDENTS_ENDPOINT, response_type="json") assert result == incident_list def test_http_request_response_type_response_returns_raw(mock_client, requests_mock): """ Given: - A valid client and a successful response. When: - http_request is called with response_type='response'. Then: - The raw response object is returned with status_code 200. """ incident_list = util_load_json("test_data/incident_list.json") requests_mock.post(INCIDENTS_URL, json=incident_list, status_code=200) result = mock_client.http_request(method="POST", url_suffix=INCIDENTS_ENDPOINT, response_type="response") assert result.status_code == 200 assert result.json() == incident_list def test_http_request_json_parse_error_raises(mock_client, requests_mock): """ Given: - A valid client and a 200 response with non-JSON body. When: - http_request is called with response_type='json'. Then: - DemistoException is raised with the INVALID_OBJECT message. """ requests_mock.post(INCIDENTS_URL, text="not-valid-json", status_code=200) with pytest.raises(DemistoException) as exc: mock_client.http_request(method="POST", url_suffix=INCIDENTS_ENDPOINT, response_type="json") assert ERROR_MESSAGES["INVALID_OBJECT"].format("json", "") in str(exc.value) def test_test_module_success_no_fetch(mock_client, mocker, requests_mock): """ Given: - Integration params with isFetch=False. - Incidents endpoint returns valid data. When: - test_module is called. Then: - list_incidents is called (not fetch_incidents) and "ok" is returned. """ mocker.patch("Cyberhaven.demisto.params", return_value={"isFetch": False}) requests_mock.post(INCIDENTS_URL, json=util_load_json("test_data/incident_list.json"), status_code=200) result = cyberhaven_test_module(mock_client) assert result == "ok" def test_test_module_with_is_fetch_calls_fetch_incidents(mock_client, mocker): """ Given: - Integration params with isFetch=True. When: - test_module is called. Then: - fetch_incidents is called with is_test=True and "ok" is returned. """ params = {"isFetch": True, "first_fetch": "3 days", "max_fetch": "10"} mocker.patch("Cyberhaven.demisto.params", return_value=params) mock_fetch = mocker.patch("Cyberhaven.fetch_incidents", return_value=([], {})) result = cyberhaven_test_module(mock_client) assert result == "ok" mock_fetch.assert_called_once_with(mock_client, {}, params, is_test=True) def test_test_module_401_returns_auth_error_string(mock_client, mocker): """ Given: - Integration params with isFetch=False. - list_incidents raises DemistoException containing '401'. When: - test_module is called. Then: - The string 'Authorization Error' is returned instead of raising. """ mocker.patch("Cyberhaven.demisto.params", return_value={"isFetch": False}) mocker.patch.object(mock_client, "list_incidents", side_effect=DemistoException("401 Unauthorized")) result = cyberhaven_test_module(mock_client) assert "Authorization Error" in result def test_test_module_403_returns_auth_error_string(mock_client, mocker): """ Given: - list_incidents raises DemistoException containing '403'. When: - test_module is called. Then: - 'Authorization Error' string is returned. """ mocker.patch("Cyberhaven.demisto.params", return_value={"isFetch": False}) mocker.patch.object(mock_client, "list_incidents", side_effect=DemistoException("403 Forbidden")) result = cyberhaven_test_module(mock_client) assert "Authorization Error" in result def test_test_module_non_auth_error_reraises(mock_client, mocker): """ Given: - list_incidents raises DemistoException NOT containing 401 or 403. When: - test_module is called. Then: - The DemistoException propagates (is re-raised). """ mocker.patch("Cyberhaven.demisto.params", return_value={"isFetch": False}) mocker.patch.object(mock_client, "list_incidents", side_effect=DemistoException("Connection timed out")) with pytest.raises(DemistoException): cyberhaven_test_module(mock_client) def _make_incident( inc_id: str = "inc-001", event_time: str = "2026-06-10T08:00:00Z", policy_name: str = "Test Policy", severity: str = "high", user_email: str = "alice@example.com", ) -> dict: return { "id": inc_id, "status": "open", "blocked": True, "event_time": event_time, "trigger_time": event_time, "policy": {"name": policy_name, "severity": severity}, "user": {"email": user_email}, "dataset": {"name": "DS", "sensitivity": "confidential"}, "ai_summary": "Summary text.", } def test_fetch_incidents_first_run_creates_incident(mock_client, mocker): """ Given: - Empty last_run (first fetch). - API returns one incident from test_data/incident_list.json. When: - fetch_incidents is called. Then: - One incident dict is returned with correct name, occurred, severity, rawJSON, and details. - next_run contains next_fetch_time and already_fetch_ids. """ incident_list = util_load_json("test_data/incident_list.json") mocker.patch.object(mock_client, "list_incidents", return_value=incident_list) incidents, next_run = fetch_incidents(mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10"}) assert len(incidents) == 1 inc = incidents[0] assert inc["name"] == "Cyberhaven: HR Data Exfiltration Prevention - usr_john_doe_001" assert inc["occurred"] == "2026-01-15T10:29:02Z" assert inc["severity"] == SEVERITY_MAP["high"] expected_raw = util_load_json("test_data/fetch_incidents_raw.json") assert json.loads(inc["rawJSON"]) == expected_raw assert inc["details"] == incident_list["resources"][0]["ai_summary"] assert "next_fetch_time" in next_run assert "already_fetch_ids" in next_run assert "inc_a1b2c3d4e5f6" in next_run["already_fetch_ids"] def test_fetch_incidents_uses_stored_next_fetch_time(mock_client, mocker): """ Given: - last_run has a next_fetch_time of '2026-06-09T00:00:00Z'. - API returns one new incident. When: - fetch_incidents is called. Then: - client.list_incidents is called with start_time equal to the stored next_fetch_time. """ mock_list = mocker.patch.object( mock_client, "list_incidents", return_value={"resources": [_make_incident("inc-002")], "page_response": {"next_id": ""}}, ) last_run = { "next_fetch_time": "2026-06-09T00:00:00Z", "already_fetch_ids": [], "next_page_id": "", "filter_string": '{"severity": [], "status": []}', } fetch_incidents(mock_client, last_run, {"first_fetch": "3 days", "max_fetch": "10"}) call_kwargs = mock_list.call_args[1] assert call_kwargs.get("start_time") == "2026-06-09T00:00:00Z" def test_fetch_incidents_deduplication_skips_known_ids(mock_client, mocker): """ Given: - last_run already_fetch_ids contains 'inc-001'. - API returns inc-001 (duplicate) and inc-002 (new). When: - fetch_incidents is called. Then: - Only inc-002 becomes an incident. - next_run.already_fetch_ids contains both inc-001 and inc-002. """ mocker.patch.object( mock_client, "list_incidents", return_value={ "resources": [ _make_incident("inc-001"), _make_incident("inc-002", event_time="2026-06-11T00:00:00Z"), ], "page_response": {"next_id": ""}, }, ) last_run = {"next_fetch_time": "2026-06-09T00:00:00Z", "already_fetch_ids": ["inc-001"], "next_page_id": ""} incidents, next_run = fetch_incidents(mock_client, last_run, {"first_fetch": "3 days", "max_fetch": "10"}) assert len(incidents) == 1 assert json.loads(incidents[0]["rawJSON"])["id"] == "inc-002" assert set(next_run["already_fetch_ids"]) == {"inc-001", "inc-002"} def test_fetch_incidents_all_duplicates_returns_empty(mock_client, mocker): """ Given: - All incidents returned by API are already in already_fetch_ids. When: - fetch_incidents is called. Then: - No incidents are created. """ mocker.patch.object( mock_client, "list_incidents", return_value={"resources": [_make_incident("inc-001")], "page_response": {"next_id": ""}}, ) last_run = {"next_fetch_time": "2026-06-09T00:00:00Z", "already_fetch_ids": ["inc-001"], "next_page_id": ""} incidents, _ = fetch_incidents(mock_client, last_run, {"first_fetch": "3 days", "max_fetch": "10"}) assert incidents == [] def test_fetch_incidents_is_test_returns_empty_after_api_call(mock_client, mocker): """ Given: - is_test=True and API returns one incident. When: - fetch_incidents is called. Then: - Returns ([], {}) without creating any incidents. - The API was still called once (to verify connectivity). """ mock_list = mocker.patch.object( mock_client, "list_incidents", return_value={"resources": [_make_incident()], "page_response": {"next_id": ""}}, ) incidents, next_run = fetch_incidents(mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10"}, is_test=True) assert incidents == [] assert next_run == {} mock_list.assert_called_once() def test_fetch_incidents_empty_api_response_preserves_next_fetch_time(mock_client, mocker): """ Given: - API returns no incidents. - last_run has a stored next_fetch_time. When: - fetch_incidents is called. Then: - No incidents are created. - next_run.next_fetch_time equals the stored value. """ mocker.patch.object(mock_client, "list_incidents", return_value={"resources": [], "page_response": {"next_id": ""}}) stored_time = "2026-06-09T00:00:00Z" last_run = { "next_fetch_time": stored_time, "already_fetch_ids": [], "next_page_id": "", "filter_string": '{"severity": [], "status": []}', } incidents, next_run = fetch_incidents(mock_client, last_run, {"first_fetch": "3 days", "max_fetch": "10"}) assert incidents == [] assert next_run["next_fetch_time"] == stored_time def test_fetch_incidents_next_fetch_time_updated_from_last_incident(mock_client, mocker): """ Given: - API returns two incidents, the second has a later event_time. When: - fetch_incidents is called. Then: - next_run.next_fetch_time equals the last incident's event_time. """ mocker.patch.object( mock_client, "list_incidents", return_value={ "resources": [ _make_incident("inc-001", event_time="2026-06-10T08:00:00Z"), _make_incident("inc-002", event_time="2026-06-11T10:00:00Z"), ], "page_response": {"next_id": ""}, }, ) _, next_run = fetch_incidents(mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10"}) assert next_run["next_fetch_time"] == "2026-06-11T10:00:00Z" def test_fetch_incidents_next_page_id_stored_in_next_run(mock_client, mocker): """ Given: - API returns a page_response with a non-empty next_id (cursor). When: - fetch_incidents is called. Then: - next_run contains next_fetch_time and already_fetch_ids (pagination cursor not stored). """ incident_list = util_load_json("test_data/incident_list_response.json") mocker.patch.object(mock_client, "list_incidents", return_value=incident_list) _, next_run = fetch_incidents(mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10"}) assert "next_fetch_time" in next_run assert "already_fetch_ids" in next_run def test_fetch_incidents_page_id_passed_to_client_and_clears_start_time(mock_client, mocker): """ Given: - last_run contains a next_page_id cursor and a next_fetch_time. When: - fetch_incidents is called. Then: - client.list_incidents is called with the stored start_time (cursor is ignored). """ mock_list = mocker.patch.object( mock_client, "list_incidents", return_value={"resources": [], "page_response": {"next_id": ""}}, ) last_run = { "next_fetch_time": "2026-06-09T00:00:00Z", "already_fetch_ids": [], "next_page_id": "cursor-xyz", "filter_string": '{"severity": [], "status": []}', } fetch_incidents(mock_client, last_run, {"first_fetch": "3 days", "max_fetch": "10"}) call_kwargs = mock_list.call_args[1] assert call_kwargs.get("start_time") == "2026-06-09T00:00:00Z" def test_fetch_incidents_invalid_max_fetch_raises(mock_client): """ Given: - max_fetch param is 0 (below minimum of 1). When: - fetch_incidents is called. Then: - ValueError is raised with the INVALID_MAX_FETCH message. """ with pytest.raises(ValueError) as exc: fetch_incidents(mock_client, {}, {"first_fetch": "3 days", "max_fetch": "0"}) assert ERROR_MESSAGES["INVALID_MAX_FETCH"].format(0, MAX_INCIDENTS_TO_FETCH) in str(exc.value) def test_fetch_incidents_negative_max_fetch_raises(mock_client): """ Given: - max_fetch param is -1. When: - fetch_incidents is called. Then: - ValueError is raised with the INVALID_MAX_FETCH message. """ with pytest.raises(ValueError) as exc: fetch_incidents(mock_client, {}, {"first_fetch": "3 days", "max_fetch": "-1"}) assert ERROR_MESSAGES["INVALID_MAX_FETCH"].format(-1, MAX_INCIDENTS_TO_FETCH) in str(exc.value) def test_fetch_incidents_first_fetch_older_than_30_days_is_test_raises(mock_client): """ Given: - first_fetch is set to 31 days ago (older than the 30-day limit). - is_test=True (called from test-module). When: - fetch_incidents is called. Then: - ValueError is raised with the FIRST_FETCH_TOO_OLD message. """ with pytest.raises(ValueError) as exc: fetch_incidents(mock_client, {}, {"first_fetch": "31 days", "max_fetch": "10"}, is_test=True) assert ERROR_MESSAGES["FIRST_FETCH_TOO_OLD"] in str(exc.value) def test_fetch_incidents_first_fetch_older_than_30_days_caps_to_30_days(mock_client, mocker): """ Given: - first_fetch is set to 45 days ago (older than the 30-day limit). - is_test=False (normal fetch). When: - fetch_incidents is called. Then: - client.list_incidents is called with start_time not older than 30 days ago. - No error is raised. """ mock_list = mocker.patch.object( mock_client, "list_incidents", return_value={"resources": [], "page_response": {"next_id": ""}} ) fetch_incidents(mock_client, {}, {"first_fetch": "45 days", "max_fetch": "10"}) call_kwargs = mock_list.call_args[1] start_time_str = call_kwargs.get("start_time") assert start_time_str is not None start_time_dt = datetime.strptime(start_time_str, "%Y-%m-%dT%H:%M:%SZ") thirty_days_ago = datetime.utcnow() - timedelta(days=30) assert start_time_dt >= thirty_days_ago - timedelta(seconds=5) assert start_time_dt <= thirty_days_ago + timedelta(seconds=5) def test_fetch_incidents_first_fetch_absolute_timestamp_older_than_30_days_is_test_raises(mock_client): """ Given: - first_fetch is an absolute ISO timestamp more than 30 days in the past. - is_test=True (called from test-module). When: - fetch_incidents is called. Then: - ValueError is raised with the FIRST_FETCH_TOO_OLD message (no TypeError from tz mismatch). """ old_timestamp = (datetime.utcnow() - timedelta(days=40)).strftime("%Y-%m-%dT%H:%M:%SZ") with pytest.raises(ValueError) as exc: fetch_incidents(mock_client, {}, {"first_fetch": old_timestamp, "max_fetch": "10"}, is_test=True) assert ERROR_MESSAGES["FIRST_FETCH_TOO_OLD"] in str(exc.value) def test_fetch_incidents_max_fetch_exceeding_cap_is_capped(mock_client, mocker): """ Given: - max_fetch param is greater than MAX_INCIDENTS_TO_FETCH (200). When: - fetch_incidents is called. Then: - client.list_incidents is called with page_size capped at MAX_INCIDENTS_TO_FETCH. """ mock_list = mocker.patch.object( mock_client, "list_incidents", return_value={"resources": [], "page_response": {"next_id": ""}} ) fetch_incidents(mock_client, {}, {"first_fetch": "3 days", "max_fetch": "500"}) call_kwargs = mock_list.call_args[1] assert call_kwargs.get("page_size") == MAX_INCIDENTS_TO_FETCH def test_fetch_incidents_invalid_severity_filter_raises(mock_client): """ Given: - severity_filter contains an invalid value 'extreme'. When: - fetch_incidents is called. Then: - ValueError is raised mentioning the invalid value. """ with pytest.raises(ValueError) as exc: fetch_incidents( mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10", "severity_filter": "extreme"}, is_test=True, ) assert "extreme" in str(exc.value) def test_fetch_incidents_valid_severity_filter_passes_to_client(mock_client, mocker): """ Given: - severity_filter contains valid values 'high,critical'. When: - fetch_incidents is called. Then: - client.list_incidents is called with policy_severities=['high', 'critical']. """ mock_list = mocker.patch.object( mock_client, "list_incidents", return_value={"resources": [], "page_response": {"next_id": ""}} ) fetch_incidents( mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10", "severity_filter": "high,critical"}, ) call_kwargs = mock_list.call_args[1] assert call_kwargs.get("policy_severities") == ["high", "critical"] @pytest.mark.parametrize( "severity, expected_xsoar_severity", [ ("low", 1), ("medium", 2), ("high", 3), ("critical", 4), ("informational", 0.5), ("unspecified", 0), ("unknown_xyz", 0), ], ) def test_fetch_incidents_severity_mapped_to_xsoar(mock_client, mocker, severity, expected_xsoar_severity): """ Given: - An incident with a specific Cyberhaven severity string. When: - fetch_incidents is called. Then: - The incident severity matches the expected XSOAR numeric value. """ mocker.patch.object( mock_client, "list_incidents", return_value={ "resources": [_make_incident("inc-sev", severity=severity)], "page_response": {"next_id": ""}, }, ) incidents, _ = fetch_incidents(mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10"}) assert incidents[0]["severity"] == expected_xsoar_severity def test_fetch_incidents_name_falls_back_to_inc_id_when_no_user_email(mock_client, mocker): """ Given: - An incident with no user.id or user.local_id. When: - fetch_incidents is called. Then: - The incident name has an empty user identifier (name ends with " - "). """ raw = { "id": "inc-noemail", "status": "open", "event_time": "2026-06-10T08:00:00Z", "policy": {"name": "Policy X", "severity": "low"}, "user": {}, } mocker.patch.object(mock_client, "list_incidents", return_value={"resources": [raw], "page_response": {"next_id": ""}}) incidents, _ = fetch_incidents(mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10"}) assert incidents[0]["name"] == "Cyberhaven: Policy X" def test_fetch_incidents_name_uses_alias_when_no_email(mock_client, mocker): """ Given: - An incident whose user has no user.id but has a local_id. When: - fetch_incidents is called. Then: - The incident name uses the local_id as the user identifier. """ raw = { "id": "inc-alias", "status": "open", "event_time": "2026-06-10T08:00:00Z", "policy": {"name": "Policy Y", "severity": "medium"}, "user": {"local_id": "bob_alias"}, } mocker.patch.object(mock_client, "list_incidents", return_value={"resources": [raw], "page_response": {"next_id": ""}}) incidents, _ = fetch_incidents(mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10"}) assert "bob_alias" in incidents[0]["name"] def test_fetch_incidents_occurred_falls_back_to_trigger_time(mock_client, mocker): """ Given: - An incident with no event_time but with trigger_time. When: - fetch_incidents is called. Then: - The incident 'occurred' field uses trigger_time. """ raw = { "id": "inc-trigger", "status": "open", "trigger_time": "2026-06-10T09:00:00Z", "policy": {"name": "Policy Z", "severity": "high"}, "user": {"email": "carol@example.com"}, } mocker.patch.object(mock_client, "list_incidents", return_value={"resources": [raw], "page_response": {"next_id": ""}}) incidents, _ = fetch_incidents(mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10"}) assert incidents[0]["occurred"] == "2026-06-10T09:00:00Z" def test_fetch_incidents_already_fetch_ids_accumulated_across_runs(mock_client, mocker): """ Given: - last_run.already_fetch_ids has ['inc-001']. - API returns inc-002 and inc-003 (both new). When: - fetch_incidents is called. Then: - next_run.already_fetch_ids contains all three IDs. """ mocker.patch.object( mock_client, "list_incidents", return_value={ "resources": [ _make_incident("inc-002", event_time="2026-06-11T00:00:00Z"), _make_incident("inc-003", event_time="2026-06-12T00:00:00Z"), ], "page_response": {"next_id": ""}, }, ) last_run = {"next_fetch_time": "2026-06-10T00:00:00Z", "already_fetch_ids": ["inc-001"], "next_page_id": ""} _, next_run = fetch_incidents(mock_client, last_run, {"first_fetch": "3 days", "max_fetch": "10"}) assert set(next_run["already_fetch_ids"]) == {"inc-001", "inc-002", "inc-003"} @pytest.mark.parametrize( "label, expected", [ ("high", SEVERITY_MAP["high"]), ("HIGH", SEVERITY_MAP["high"]), ("critical", SEVERITY_MAP["critical"]), ("low", SEVERITY_MAP["low"]), ("medium", SEVERITY_MAP["medium"]), ("informational", SEVERITY_MAP["informational"]), ("unspecified", SEVERITY_MAP["unspecified"]), ("bogus", SEVERITY_MAP["unspecified"]), ], ) def test_convert_severity(label, expected): """ Given: - A Cyberhaven severity string (various cases and unknown values). When: - convert_severity is called. Then: - The correct XSOAR IncidentSeverity float is returned. """ assert convert_severity(label) == expected """ ── update_remote_system_command ─────────────────────────────────────────── """ REMOTE_ID = "ch-incident-42" INCIDENTS_PATCH_URL = f"{BASE_URL}/v2/incidents/{REMOTE_ID}" def _urs_args( remote_id=REMOTE_ID, incident_changed="true", status=None, delta=None, ): """Build args dict for UpdateRemoteSystemArgs.""" args: dict = {} if remote_id is not None: args["remoteId"] = remote_id if incident_changed is not None: args["incidentChanged"] = incident_changed if status is not None: args["status"] = status if delta is not None: args["delta"] = delta return args def test_update_remote_no_remote_id(mock_client): """ Given: - args with no remoteId. When: - update_remote_system_command is called. Then: - Returns empty string without calling API. """ result = update_remote_system_command(mock_client, {}) assert result == "" def test_update_remote_incident_not_changed(mock_client, mocker): """ Given: - remoteId present but incidentChanged is False. When: - update_remote_system_command is called. Then: - Returns remoteId without calling update_incident. """ mock_update = mocker.patch.object(mock_client, "update_incident") result = update_remote_system_command(mock_client, _urs_args(incident_changed="false")) assert result == REMOTE_ID mock_update.assert_not_called() def test_update_remote_no_watched_fields_in_delta(mock_client, mocker): """ Given: - incidentChanged=True but delta contains no watched fields (owner/closeReason/closeNotes). When: - update_remote_system_command is called. Then: - Returns remoteId without calling update_incident. """ mock_update = mocker.patch.object(mock_client, "update_incident") result = update_remote_system_command(mock_client, _urs_args(delta={"unrelatedField": "foo"})) assert result == REMOTE_ID mock_update.assert_not_called() def test_update_remote_delta_as_json_string(mock_client, mocker): """ Given: - delta is a JSON-encoded string containing a watched field (closeNotes). - inc_status=DONE and remote incident still open in CH, so close fields are processed. When: - update_remote_system_command is called. Then: - JSON is parsed and update_incident is called with close_note. """ mocker.patch.object(mock_client, "list_incidents", return_value={"resources": [{"status": "open"}]}) mock_update = mocker.patch.object(mock_client, "update_incident", return_value={}) delta_str = json.dumps({"closeNotes": "parsed from string"}) update_remote_system_command(mock_client, _urs_args(status=IncidentStatus.DONE, delta=delta_str)) mock_update.assert_called_once_with( incident_id=REMOTE_ID, status="closed", close_reason=None, close_note="parsed from string", assigned_to=None, ) def test_update_remote_delta_invalid_json_string(mock_client, mocker): """ Given: - delta is a non-JSON string (malformed). When: - update_remote_system_command is called. Then: - delta treated as empty; no PATCH issued. """ mock_update = mocker.patch.object(mock_client, "update_incident") result = update_remote_system_command(mock_client, _urs_args(delta="not-json{{{")) assert result == REMOTE_ID mock_update.assert_not_called() def test_update_remote_owner_changed(mock_client, mocker): """ Given: - delta contains owner with a non-blank value. When: - update_remote_system_command is called. Then: - update_incident called with assigned_to set to owner value. """ mock_update = mocker.patch.object(mock_client, "update_incident", return_value={}) update_remote_system_command(mock_client, _urs_args(delta={"owner": "analyst@corp.com"})) mock_update.assert_called_once_with( incident_id=REMOTE_ID, status=None, close_reason=None, close_note=None, assigned_to="analyst@corp.com", ) def test_update_remote_owner_blank_skips_patch(mock_client, mocker): """ Given: - delta contains owner with blank/empty string. When: - update_remote_system_command is called. Then: - assigned_to omitted; no other watched fields → no PATCH. """ mock_update = mocker.patch.object(mock_client, "update_incident") result = update_remote_system_command(mock_client, _urs_args(delta={"owner": " "})) assert result == REMOTE_ID mock_update.assert_not_called() @pytest.mark.parametrize( "xsoar_reason, expected_ch_reason", [ ("Resolved", "valid"), ("False Positive", "invalid_data_mislabled"), ("Other", "invalid_other"), ], ) def test_update_remote_close_reason_mapped(mock_client, mocker, xsoar_reason, expected_ch_reason): """ Given: - delta contains closeReason with a value that maps to a CH close reason. - inc_status=DONE and remote incident still open in CH, so close fields are processed. When: - update_remote_system_command is called. Then: - update_incident called with correct close_reason. """ mocker.patch.object(mock_client, "list_incidents", return_value={"resources": [{"status": "open"}]}) mock_update = mocker.patch.object(mock_client, "update_incident", return_value={}) update_remote_system_command(mock_client, _urs_args(status=IncidentStatus.DONE, delta={"closeReason": xsoar_reason})) mock_update.assert_called_once_with( incident_id=REMOTE_ID, status="closed", close_reason=expected_ch_reason, close_note=None, assigned_to=None, ) def test_update_remote_close_reason_unmapped_skips_patch(mock_client, mocker): """ Given: - delta contains closeReason with a value not in XSOAR_CLOSE_REASON_TO_CH. - inc_status=DONE and remote incident still open in CH. When: - update_remote_system_command is called. Then: - update_incident still called for the status change, but without close_reason (no mapping found for the unknown reason). """ mocker.patch.object(mock_client, "list_incidents", return_value={"resources": [{"status": "open"}]}) mock_update = mocker.patch.object(mock_client, "update_incident", return_value={}) update_remote_system_command(mock_client, _urs_args(status=IncidentStatus.DONE, delta={"closeReason": "Unknown Reason"})) mock_update.assert_called_once_with( incident_id=REMOTE_ID, status="closed", close_reason=None, close_note=None, assigned_to=None, ) def test_update_remote_close_notes(mock_client, mocker): """ Given: - delta contains closeNotes. - inc_status=DONE and remote incident still open in CH, so close fields are processed. When: - update_remote_system_command is called. Then: - update_incident called with close_note set. """ mocker.patch.object(mock_client, "list_incidents", return_value={"resources": [{"status": "open"}]}) mock_update = mocker.patch.object(mock_client, "update_incident", return_value={}) update_remote_system_command( mock_client, _urs_args(status=IncidentStatus.DONE, delta={"closeNotes": "Ticket resolved via helpdesk."}) ) mock_update.assert_called_once_with( incident_id=REMOTE_ID, status="closed", close_reason=None, close_note="Ticket resolved via helpdesk.", assigned_to=None, ) def test_update_remote_status_open_in_ch_patches_status(mock_client, mocker): """ Given: - inc_status=DONE and the remote incident is still open in Cyberhaven. When: - update_remote_system_command is called. Then: - list_incidents is queried, status differs, so update_incident called with status="closed". """ mocker.patch.object(mock_client, "list_incidents", return_value={"resources": [{"status": "open"}]}) mock_update = mocker.patch.object(mock_client, "update_incident", return_value={}) update_remote_system_command(mock_client, _urs_args(status=IncidentStatus.DONE, delta=None)) mock_update.assert_called_once_with( incident_id=REMOTE_ID, status="closed", close_reason=None, close_note=None, assigned_to=None, ) def test_update_remote_status_already_closed_skips_close_fields_but_owner_still_patched(mock_client, mocker): """ Given: - inc_status=DONE but the remote incident is already closed in Cyberhaven. - delta also contains an owner change. When: - update_remote_system_command is called. Then: - close_reason/close_note are NOT re-sent (close workflow not re-run), but the unrelated owner change still triggers a PATCH with assigned_to set. Note: `status` is still forwarded to the PATCH since it mirrors the (unchanged) external state - it is only excluded from the internal patch_fields skip/log check, not from the API call itself (same pre-existing quirk as when other watched fields are patched without a status diff). """ mocker.patch.object(mock_client, "list_incidents", return_value={"resources": [{"status": "closed"}]}) mock_update = mocker.patch.object(mock_client, "update_incident", return_value={}) update_remote_system_command( mock_client, _urs_args(status=IncidentStatus.DONE, delta={"owner": "lead@corp.com"}), ) mock_update.assert_called_once_with( incident_id=REMOTE_ID, status="closed", close_reason=None, close_note=None, assigned_to="lead@corp.com", ) def test_update_remote_status_not_found_in_ch_discards_update(mock_client, mocker): """ Given: - inc_status=DONE but the remote incident no longer exists in Cyberhaven (empty resources). - delta also contains an owner change. When: - update_remote_system_command is called. Then: - Update is discarded entirely, including the owner change; no PATCH issued. """ mocker.patch.object(mock_client, "list_incidents", return_value={"resources": []}) mock_update = mocker.patch.object(mock_client, "update_incident") result = update_remote_system_command( mock_client, _urs_args(status=IncidentStatus.DONE, delta={"owner": "lead@corp.com"}), ) assert result == REMOTE_ID mock_update.assert_not_called() def test_update_remote_list_incidents_error_discards_update(mock_client, mocker): """ Given: - inc_status=DONE but list_incidents raises a DemistoException (e.g. 500 error). - delta also contains an owner change. When: - update_remote_system_command is called. Then: - The lookup failure is logged and the whole update is discarded (including owner), same as the not-found case; no PATCH issued, no unhandled exception. """ mocker.patch.object(mock_client, "list_incidents", side_effect=DemistoException("500 Internal Server Error")) mock_error = mocker.patch("Cyberhaven.demisto.error") mock_update = mocker.patch.object(mock_client, "update_incident") result = update_remote_system_command( mock_client, _urs_args(status=IncidentStatus.DONE, delta={"owner": "lead@corp.com"}), ) assert result == REMOTE_ID mock_update.assert_not_called() mock_error.assert_called_once() def test_update_remote_status_active_no_other_fields_skips_patch(mock_client, mocker): """ Given: - inc_status=ACTIVE (not DONE) and no other watched fields in delta. When: - update_remote_system_command is called. Then: - No CH lookup needed (only DONE triggers it); no PATCH issued. """ mock_list = mocker.patch.object(mock_client, "list_incidents") mock_update = mocker.patch.object(mock_client, "update_incident") result = update_remote_system_command(mock_client, _urs_args(status=IncidentStatus.ACTIVE, delta={})) assert result == REMOTE_ID mock_list.assert_not_called() mock_update.assert_not_called() def test_update_remote_multiple_fields(mock_client, mocker): """ Given: - delta contains owner, closeReason, closeNotes with DONE status, remote still open in CH. When: - update_remote_system_command is called. Then: - update_incident called with all mapped fields. """ mocker.patch.object(mock_client, "list_incidents", return_value={"resources": [{"status": "open"}]}) mock_update = mocker.patch.object(mock_client, "update_incident", return_value={}) update_remote_system_command( mock_client, _urs_args( status=IncidentStatus.DONE, delta={ "owner": "lead@corp.com", "closeReason": "Resolved", "closeNotes": "All clear.", }, ), ) mock_update.assert_called_once_with( incident_id=REMOTE_ID, status="closed", close_reason="valid", close_note="All clear.", assigned_to="lead@corp.com", ) def test_update_remote_404_error_no_warning(mock_client, mocker): """ Given: - update_incident raises DemistoException with '404' in message. - inc_status=DONE and remote incident still open in CH, so the PATCH is actually attempted. When: - update_remote_system_command is called. Then: - Returns remoteId; return_warning is NOT called. """ mocker.patch.object(mock_client, "list_incidents", return_value={"resources": [{"status": "open"}]}) mocker.patch.object(mock_client, "update_incident", side_effect=DemistoException("404 Not Found")) mock_warn = mocker.patch("Cyberhaven.return_warning") result = update_remote_system_command(mock_client, _urs_args(status=IncidentStatus.DONE, delta={"closeNotes": "note"})) assert result == REMOTE_ID mock_warn.assert_not_called() def test_update_remote_non_404_error_calls_return_warning(mock_client, mocker): """ Given: - update_incident raises DemistoException with a non-404 error (e.g. 500). - inc_status=DONE and remote incident still open in CH, so the PATCH is actually attempted. When: - update_remote_system_command is called. Then: - Returns remoteId; return_warning is called with details about the failure. """ mocker.patch.object(mock_client, "list_incidents", return_value={"resources": [{"status": "open"}]}) mocker.patch.object(mock_client, "update_incident", side_effect=DemistoException("500 Internal Server Error")) mocker.patch("Cyberhaven.demisto.error") mock_warn = mocker.patch("Cyberhaven.return_warning") result = update_remote_system_command(mock_client, _urs_args(status=IncidentStatus.DONE, delta={"closeNotes": "note"})) assert result == REMOTE_ID mock_warn.assert_called_once() call_msg = mock_warn.call_args[0][0] assert REMOTE_ID in call_msg assert "close_note" in call_msg def test_incident_list_command_success(mock_client, mocker): """ Given: - list_incidents returns one incident from test_data/incident_list_command_response.json. When: - cyberhaven_incident_list_command is called with default args. Then: - Returns a list of two CommandResults (incidents + page info). - First result outputs_prefix, outputs_key_field, outputs, raw_response, and readable_output match the expected context and HR files. - Second result outputs_prefix and outputs match the expected page context file. """ incident_list_response = util_load_json("test_data/incident_list_response.json") mocker.patch.object(mock_client, "list_incidents", return_value=incident_list_response) result = cyberhaven_incident_list_command(mock_client, {}) expected_context = util_load_json("test_data/incident_list_context.json") expected_page_context = util_load_json("test_data/incident_list_page_context.json") with open("test_data/incident_list_hr.md", encoding="utf-8") as f: expected_hr = f.read() assert isinstance(result, list) assert len(result) == 2 assert result[0].outputs_prefix == "Cyberhaven.Incident" assert result[0].outputs_key_field == "id" assert result[0].outputs == expected_context assert result[0].raw_response == incident_list_response assert result[0].readable_output == expected_hr assert result[1].outputs_prefix == "Cyberhaven.IncidentPage" assert result[1].outputs == expected_page_context def test_incident_list_command_no_results(mock_client, mocker): """ Given: - list_incidents returns no incidents. When: - cyberhaven_incident_list_command is called. Then: - Returns a single CommandResults with 'No incidents found' message. """ empty_response = util_load_json("test_data/incident_list_empty.json") mocker.patch.object(mock_client, "list_incidents", return_value=empty_response) result = cyberhaven_incident_list_command(mock_client, {}) assert isinstance(result, CommandResults) assert "No incidents found" in (result.readable_output or "") def test_incident_list_command_invalid_severity_raises(mock_client): """ Given: - severity arg contains an invalid value. When: - cyberhaven_incident_list_command is called. Then: - ValueError raised mentioning the invalid value. """ with pytest.raises(ValueError) as exc: cyberhaven_incident_list_command(mock_client, {"severity": "extreme"}) assert "extreme" in str(exc.value) def test_incident_list_command_invalid_status_raises(mock_client): """ Given: - status arg contains an invalid value. When: - cyberhaven_incident_list_command is called. Then: - ValueError raised mentioning the invalid value. """ with pytest.raises(ValueError) as exc: cyberhaven_incident_list_command(mock_client, {"status": "pending"}) assert "pending" in str(exc.value) def test_incident_list_command_invalid_limit_raises(mock_client): """ Given: - limit arg is 0. When: - cyberhaven_incident_list_command is called. Then: - ValueError raised. """ with pytest.raises(ValueError): cyberhaven_incident_list_command(mock_client, {"limit": "0"}) def test_incident_update_command_success(mock_client, mocker): """ Given: - Valid incident_id and status=closed. - update_incident returns test_data/incident_update_response.json. When: - cyberhaven_incident_update_command is called. Then: - update_incident called once; CommandResults outputs_prefix, outputs_key_field, outputs, raw_response, and readable_output match the expected context and HR files. """ incident_update_response = util_load_json("test_data/incident_update_response.json") mock_update = mocker.patch.object(mock_client, "update_incident", return_value=incident_update_response) result = cyberhaven_incident_update_command(mock_client, {"incident_id": "inc-001", "status": "closed"}) expected_context = util_load_json("test_data/incident_update_context.json") with open("test_data/incident_update_hr.md", encoding="utf-8") as f: expected_hr = f.read() mock_update.assert_called_once() assert result.outputs_prefix == "Cyberhaven.Incident" assert result.outputs_key_field == "id" assert result.outputs == expected_context assert result.raw_response == incident_update_response assert result.readable_output == expected_hr def test_incident_update_command_missing_incident_id_raises(mock_client): """ Given: - No incident_id in args. When: - cyberhaven_incident_update_command is called. Then: - ValueError raised. """ with pytest.raises(ValueError) as exc: cyberhaven_incident_update_command(mock_client, {"status": "closed"}) assert "incident_id" in str(exc.value) def test_incident_update_command_no_update_fields_raises(mock_client): """ Given: - incident_id present but no updatable fields. When: - cyberhaven_incident_update_command is called. Then: - ValueError raised with AT_LEAST_ONE_REQUIRED message. """ with pytest.raises(ValueError) as exc: cyberhaven_incident_update_command(mock_client, {"incident_id": "inc-001"}) assert "required" in str(exc.value).lower() def test_incident_update_command_close_reason_mapped(mock_client, mocker): """ Given: - close_reason='false positive'. When: - cyberhaven_incident_update_command is called. Then: - update_incident called with close_reason='invalid_data_mislabled'. """ mock_update = mocker.patch.object(mock_client, "update_incident", return_value={"resources": []}) cyberhaven_incident_update_command(mock_client, {"incident_id": "inc-001", "close_reason": "false positive"}) _, call_kwargs = mock_update.call_args assert call_kwargs.get("close_reason") == "invalid_data_mislabled" def test_event_details_get_command_success(mock_client, mocker): """ Given: - event_ids arg has one ID. - get_event_details returns test_data/event_details.json. When: - cyberhaven_event_details_get_command is called. Then: - get_event_details called with ['evt-001']; CommandResults outputs_prefix, outputs_key_field, outputs, raw_response, and readable_output match the expected context and HR files. """ event_details_response = util_load_json("test_data/event_details_response.json") mock_get = mocker.patch.object(mock_client, "get_event_details", return_value=event_details_response) result = cyberhaven_event_details_get_command(mock_client, {"event_ids": "evt-001"}) expected_context = util_load_json("test_data/event_details_context.json") with open("test_data/event_details_hr.md", encoding="utf-8") as f: expected_hr = f.read() mock_get.assert_called_once_with(["evt-001"]) assert result.outputs_prefix == "Cyberhaven.Event" assert result.outputs_key_field == "id" assert result.outputs == expected_context assert result.raw_response == event_details_response assert result.readable_output == expected_hr def test_event_details_get_command_missing_ids_raises(mock_client): """ Given: - event_ids arg is empty. When: - cyberhaven_event_details_get_command is called. Then: - ValueError raised with 'event_ids' in message. """ with pytest.raises(ValueError) as exc: cyberhaven_event_details_get_command(mock_client, {}) assert "event_ids" in str(exc.value) _EVENT_LINEAGE_RESPONSE = { "resources": ["evt-001", "evt-002", "evt-003"], } def test_event_lineage_get_command_success(mock_client, mocker): """ Given: - start_event_id and end_event_id provided. When: - cyberhaven_event_lineage_get_command is called. Then: - get_event_lineage called with correct IDs; CommandResults has Cyberhaven.EventLineage outputs. """ mock_get = mocker.patch.object(mock_client, "get_event_lineage", return_value=_EVENT_LINEAGE_RESPONSE) result = cyberhaven_event_lineage_get_command(mock_client, {"start_event_id": "evt-001", "end_event_id": "evt-003"}) mock_get.assert_called_once_with("evt-001", "evt-003") assert result.outputs_prefix == "Cyberhaven.EventLineage" def test_event_lineage_get_command_missing_args_raises(mock_client): """ Given: - start_event_id or end_event_id missing. When: - cyberhaven_event_lineage_get_command is called. Then: - ValueError raised. """ with pytest.raises(ValueError): cyberhaven_event_lineage_get_command(mock_client, {"start_event_id": "evt-001"}) def test_client_update_incident_omits_none_fields(mock_client, requests_mock): """ Given: - update_incident called with status and close_note; close_reason and assigned_to are None. When: - update_incident is called on the client. Then: - PATCH body contains only status and close_note (assign_params strips None values). """ patch_url = f"{BASE_URL}{INCIDENT_PATCH_ENDPOINT.format(id='inc-42')}" requests_mock.patch(patch_url, json={"id": "inc-42", "status": "closed"}, status_code=200) mock_client.update_incident( incident_id="inc-42", status="closed", close_note="resolved note", close_reason=None, assigned_to=None, ) sent_body = requests_mock.last_request.json() assert sent_body == {"status": "closed", "close_note": "resolved note"} assert "close_reason" not in sent_body assert "assigned_to" not in sent_body def test_client_get_event_details_sends_ids(mock_client, requests_mock): """ Given: - get_event_details called with a list of event IDs. When: - The method is called. Then: - POST to EVENT_DETAILS_ENDPOINT with {"ids": [...]} body; returns parsed response. """ event_url = f"{BASE_URL}{EVENT_DETAILS_ENDPOINT}" expected_response = {"resources": [{"id": "evt-001"}]} requests_mock.post(event_url, json=expected_response, status_code=200) result = mock_client.get_event_details(["evt-001", "evt-002"]) sent_body = requests_mock.last_request.json() assert sent_body == {"ids": ["evt-001", "evt-002"]} assert result == expected_response def test_client_get_event_lineage_sends_correct_payload(mock_client, requests_mock): """ Given: - get_event_lineage called with start and end event IDs. When: - The method is called. Then: - POST to EVENT_LINEAGE_ENDPOINT with correct body; returns parsed response. """ lineage_url = f"{BASE_URL}{EVENT_LINEAGE_ENDPOINT}" expected_response = {"resources": ["evt-001", "evt-002", "evt-003"]} requests_mock.post(lineage_url, json=expected_response, status_code=200) result = mock_client.get_event_lineage("evt-001", "evt-003") sent_body = requests_mock.last_request.json() assert sent_body == {"start_event_id": "evt-001", "end_event_id": "evt-003"} assert result == expected_response def test_trim_spaces_from_args_strips_string_values(): """ Given: - Dict with string values containing leading/trailing spaces and a non-string value. When: - trim_spaces_from_args is called. Then: - String values are stripped; non-string values are unchanged; dict is returned. """ args = {"name": " alice ", "count": 42, "tag": " test "} result = trim_spaces_from_args(args) assert result["name"] == "alice" assert result["count"] == 42 assert result["tag"] == "test" def test_get_mirroring_returns_direction_and_instance(mocker): """ Given: - demisto.integrationInstance() returns 'test-instance'. When: - get_mirroring is called. Then: - Returns dict with mirror_direction='Out' and mirror_instance='test-instance'. """ mocker.patch("Cyberhaven.demisto.integrationInstance", return_value="test-instance") result = get_mirroring() assert result["mirror_direction"] == "Out" assert result["mirror_instance"] == "test-instance" @pytest.mark.parametrize( "url", [ "https://tenant.cyberhaven.io", "https://sub.tenant.cyberhaven.io", "https://tenant.cyberhaven.io/", "http://tenant.cyberhaven.io", ], ) def test_validate_cyberhaven_url_valid(url): """ Given: - A URL whose hostname ends with cyberhaven.io. When: - validate_cyberhaven_url is called. Then: - No exception is raised. """ validate_cyberhaven_url(url) # must not raise @pytest.mark.parametrize( "url", [ "https://tenant.example.com", "https://cyberhaven.io.evil.com", "https://notcyberhaven.io.com", "https://evilcyberhaven.io", "https://tenant.cyberhaven.io.fake", "", ], ) def test_validate_cyberhaven_url_invalid(url): """ Given: - A URL whose hostname does not end with cyberhaven.io. When: - validate_cyberhaven_url is called. Then: - ValueError is raised. """ with pytest.raises(ValueError, match="cyberhaven.io"): validate_cyberhaven_url(url) def test_validate_incident_list_args_parses_start_time(): """ Given: - start_time provided as an ISO timestamp string. When: - validate_incident_list_args is called. Then: - start_time in the result is formatted as an ISO timestamp. """ result = validate_incident_list_args({"start_time": "2026-06-10T00:00:00Z"}) assert result["start_time"] == "2026-06-10T00:00:00Z" def test_validate_incident_list_args_parses_end_time(): """ Given: - end_time provided as an ISO timestamp string. When: - validate_incident_list_args is called. Then: - end_time in the result is formatted as an ISO timestamp. """ result = validate_incident_list_args({"end_time": "2026-06-11T00:00:00Z"}) assert result["end_time"] == "2026-06-11T00:00:00Z" def test_validate_incident_list_args_empty_times_return_empty_strings(): """ Given: - No start_time or end_time in args. When: - validate_incident_list_args is called. Then: - start_time and end_time in result are empty strings. """ result = validate_incident_list_args({}) assert result["start_time"] == "" assert result["end_time"] == "" def test_validate_incident_update_args_invalid_status_raises(): """ Given: - status arg is 'pending' (not in STATUS_FILTER_VALUES). When: - validate_incident_update_args is called. Then: - ValueError raised mentioning the invalid value. """ with pytest.raises(ValueError) as exc: validate_incident_update_args({"incident_id": "inc-001", "status": "pending"}) assert "pending" in str(exc.value) def test_validate_incident_update_args_invalid_close_reason_raises(): """ Given: - close_reason arg is 'unknown_reason' (not in CLOSE_REASON_VALUES). When: - validate_incident_update_args is called. Then: - ValueError raised mentioning the invalid value and valid choices. """ with pytest.raises(ValueError) as exc: validate_incident_update_args({"incident_id": "inc-001", "close_reason": "unknown_reason"}) assert "unknown_reason" in str(exc.value) def test_validate_incident_update_args_valid_close_reason_passes(): """ Given: - close_reason is a valid value from CLOSE_REASON_VALUES. When: - validate_incident_update_args is called. Then: - No exception raised; close_reason appears in returned dict. """ for reason in CLOSE_REASON_VALUES: result = validate_incident_update_args({"incident_id": "inc-001", "close_reason": reason}) assert result["close_reason"] == reason.lower() def test_fetch_incidents_outgoing_mirroring_adds_mirror_fields(mock_client, mocker): """ Given: - outgoing_mirroring=True in params. - API returns one incident. When: - fetch_incidents is called. Then: - The incident rawJSON contains mirror_direction, mirror_instance, and mirror_id. """ mocker.patch("Cyberhaven.demisto.integrationInstance", return_value="my-instance") mocker.patch.object( mock_client, "list_incidents", return_value={"resources": [_make_incident("inc-001")], "page_response": {"next_id": ""}}, ) incidents, _ = fetch_incidents( mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10", "outgoing_mirroring": "true"}, ) raw = json.loads(incidents[0]["rawJSON"]) assert raw["mirror_direction"] == "Out" assert raw["mirror_instance"] == "my-instance" assert raw["mirror_id"] == "inc-001" def test_fetch_incidents_no_mirroring_when_disabled(mock_client, mocker): """ Given: - outgoing_mirroring=False in params. - API returns one incident. When: - fetch_incidents is called. Then: - The incident rawJSON does NOT contain mirror_direction or mirror_id. """ mocker.patch.object( mock_client, "list_incidents", return_value={"resources": [_make_incident("inc-001")], "page_response": {"next_id": ""}}, ) incidents, _ = fetch_incidents( mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10", "outgoing_mirroring": "false"}, ) raw = json.loads(incidents[0]["rawJSON"]) assert "mirror_direction" not in raw assert "mirror_id" not in raw def test_nullify_sentinels_replaces_unspecified_string(): """ Given: a string ending with _unspecified. When: nullify_sentinels is called. Then: returns None. """ assert nullify_sentinels("status_unspecified") is None assert nullify_sentinels("reason_unspecified") is None assert nullify_sentinels("action_unspecified") is None assert nullify_sentinels("SEVERITY_UNSPECIFIED") is None def test_nullify_sentinels_preserves_valid_strings(): """ Given: strings that do NOT end with unspecified. When: nullify_sentinels is called. Then: returns string unchanged. """ assert nullify_sentinels("open") == "open" assert nullify_sentinels("closed") == "closed" assert nullify_sentinels("valid") == "valid" assert nullify_sentinels("unspecified_reason") == "unspecified_reason" def test_nullify_sentinels_bare_unspecified_is_nullified(): """ Given: bare 'unspecified' string (protobuf zero-value sentinel per CH spec). When: nullify_sentinels is called. Then: returns None. """ assert nullify_sentinels("unspecified") is None def test_nullify_sentinels_recurses_into_dict(): """ Given: dict with a sentinel string value. When: nullify_sentinels is called. Then: sentinel value replaced with None; other values untouched. """ result = nullify_sentinels({"status": "status_unspecified", "id": "abc-123"}) assert result == {"status": None, "id": "abc-123"} def test_nullify_sentinels_recurses_into_list(): """ Given: list containing a sentinel string. When: nullify_sentinels is called. Then: sentinel element replaced with None. """ result = nullify_sentinels(["action_unspecified", "upload", "reason_unspecified"]) assert result == [None, "upload", None] def test_nullify_sentinels_nested_structure(): """ Given: nested dict/list with sentinel values at multiple depths. When: nullify_sentinels is called. Then: all sentinels replaced with None; non-sentinels intact. """ data = { "status": "status_unspecified", "policy": {"severity": "severity_unspecified", "name": "HR Policy"}, "events": [{"action": "action_unspecified"}, {"action": "upload"}], } result = nullify_sentinels(data) assert result["status"] is None assert result["policy"]["severity"] is None assert result["policy"]["name"] == "HR Policy" assert result["events"][0]["action"] is None assert result["events"][1]["action"] == "upload" def test_nullify_sentinels_non_string_passthrough(): """ Given: non-string scalars (int, bool, None). When: nullify_sentinels is called. Then: values returned unchanged. """ assert nullify_sentinels(42) == 42 assert nullify_sentinels(True) is True assert nullify_sentinels(None) is None def test_fetch_incidents_sentinel_stripped_from_rawjson(mock_client, mocker): """ Given: - API returns an incident where close_reason is 'reason_unspecified' and status is 'status_unspecified'. When: - fetch_incidents is called. Then: - rawJSON does NOT contain any '_unspecified' sentinel strings. - The sentinel fields are absent (stripped by remove_empty_elements_for_fetch). """ raw_incident = _make_incident("inc-sentinel") raw_incident["close_reason"] = "reason_unspecified" raw_incident["status"] = "status_unspecified" mocker.patch.object( mock_client, "list_incidents", return_value={"resources": [raw_incident], "page_response": {"next_id": ""}}, ) incidents, _ = fetch_incidents(mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10"}) assert len(incidents) == 1 raw = json.loads(incidents[0]["rawJSON"]) assert "close_reason" not in raw assert "status" not in raw def test_fetch_incidents_close_reason_sentinel_not_stored_in_xsoar_field(mock_client, mocker): """ Given: - API returns a closed incident with close_reason = 'reason_unspecified'. When: - fetch_incidents is called. Then: - The XSOAR 'closeReason' field is empty string, not the sentinel. """ raw_incident = _make_incident("inc-cr-sentinel") raw_incident["status"] = "closed" raw_incident["close_reason"] = "reason_unspecified" mocker.patch.object( mock_client, "list_incidents", return_value={"resources": [raw_incident], "page_response": {"next_id": ""}}, ) incidents, _ = fetch_incidents(mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10"}) assert len(incidents) == 1 assert incidents[0].get("closeReason", "") == "" def test_fetch_incidents_severity_sentinel_maps_to_unknown(mock_client, mocker): """ Given: - API returns an incident with policy.severity = 'severity_unspecified'. When: - fetch_incidents is called. Then: - XSOAR severity is UNKNOWN (0), not an error. - rawJSON does not contain the sentinel string. """ raw_incident = _make_incident("inc-sev-sentinel") raw_incident["policy"]["severity"] = "severity_unspecified" mocker.patch.object( mock_client, "list_incidents", return_value={"resources": [raw_incident], "page_response": {"next_id": ""}}, ) incidents, _ = fetch_incidents(mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10"}) assert len(incidents) == 1 assert incidents[0]["severity"] == SEVERITY_MAP["unspecified"] raw = json.loads(incidents[0]["rawJSON"]) assert raw.get("policy", {}).get("severity") is None or "severity_unspecified" not in json.dumps(raw) def test_main_dispatches_test_module(mocker, requests_mock): """ Given: - demisto.command() returns 'test-module'. - Integration params with valid credentials. When: - main() is called directly. Then: - test_module is invoked and return_results receives 'ok'. """ auth_response = util_load_json("test_data/auth_token.json") requests_mock.post(TOKEN_URL, json=auth_response) requests_mock.post(INCIDENTS_URL, json=util_load_json("test_data/incident_list_response.json")) mocker.patch("Cyberhaven.get_integration_context", return_value={}) mocker.patch("Cyberhaven.set_integration_context") mocker.patch( "Cyberhaven.demisto.params", return_value={"credentials": {"password": "tok"}, "url": BASE_URL, "insecure": "false", "proxy": "false"}, ) mocker.patch("Cyberhaven.demisto.command", return_value="test-module") mocker.patch("Cyberhaven.demisto.args", return_value={}) mock_return_results = mocker.patch("Cyberhaven.return_results") main() mock_return_results.assert_called_once_with("ok") def test_main_missing_refresh_token_calls_return_error(mocker): """ Given: - Integration params with no 'password' set under 'credentials'. When: - main() is called directly. Then: - return_error is called with the ERROR_MESSAGES['REFRESH_TOKEN_REQUIRED'] message. """ mocker.patch( "Cyberhaven.demisto.params", return_value={"credentials": {}, "url": BASE_URL, "insecure": "false", "proxy": "false"}, ) mocker.patch("Cyberhaven.demisto.command", return_value="test-module") mock_return_error = mocker.patch("Cyberhaven.return_error") main() mock_return_error.assert_called_once() assert ERROR_MESSAGES["REFRESH_TOKEN_REQUIRED"] in mock_return_error.call_args[0][0] def test_main_unknown_command_calls_return_error(mocker, requests_mock): """ Given: - demisto.command() returns an unrecognised command name. When: - main() is called directly. Then: - return_error is called with a message containing the command name. """ auth_response = util_load_json("test_data/auth_token.json") requests_mock.post(TOKEN_URL, json=auth_response) mocker.patch("Cyberhaven.get_integration_context", return_value={}) mocker.patch("Cyberhaven.set_integration_context") mocker.patch( "Cyberhaven.demisto.params", return_value={"credentials": {"password": "tok"}, "url": BASE_URL, "insecure": "false", "proxy": "false"}, ) mocker.patch("Cyberhaven.demisto.command", return_value="unknown-command-xyz") mocker.patch("Cyberhaven.demisto.args", return_value={}) mock_return_error = mocker.patch("Cyberhaven.return_error") main() mock_return_error.assert_called_once() assert "unknown-command-xyz" in mock_return_error.call_args[0][0] def test_fetch_incidents_filter_change_resets_fetch_time(mock_client, mocker): """ Given: - last_run has next_fetch_time='2026-06-20T00:00:00Z' and a filter_string built with severity=['high']. - params now request severity=['low'] — a different filter. When: - fetch_incidents is called. Then: - client.list_incidents is called with start_time equal to first_fetch_time (not next_fetch_time). - next_run contains the new filter_string reflecting the updated severity. """ import json as _json old_filter = _json.dumps({"severity": ["high"], "status": ["open"]}, sort_keys=True) last_run = { "next_fetch_time": "2026-06-20T00:00:00Z", "first_fetch_time": "2026-06-01T00:00:00Z", "already_fetch_ids": [], "next_page_id": "", "filter_string": old_filter, } mock_list = mocker.patch.object( mock_client, "list_incidents", return_value={"resources": [_make_incident("inc-reset")], "page_response": {"next_id": ""}}, ) params = {"first_fetch": "3 days", "max_fetch": "10", "severity": "low", "status": "open"} fetch_incidents(mock_client, last_run, params) call_kwargs = mock_list.call_args[1] # Must NOT use the stale next_fetch_time; must fall back to first_fetch_time stored in last_run assert call_kwargs.get("start_time") == "2026-06-01T00:00:00Z" def test_apply_api_labels_start_action_none_does_not_raise(): """ Given: - Resource where event_details.start_event.action is None. When: - apply_api_labels is called. Then: - No exception is raised (TypeError caught by except block). """ resource = { "event_details": { "start_event": {"action": None}, "end_event": {"action": {"kind": "write"}}, } } result = apply_api_labels(resource) assert result["event_details"]["start_event"]["action"] is None def test_apply_api_labels_end_action_none_does_not_raise(): """ Given: - Resource where event_details.end_event.action is None. When: - apply_api_labels is called. Then: - No exception is raised (TypeError caught by except block). """ resource = { "event_details": { "start_event": {"action": {"kind": "read"}}, "end_event": {"action": None}, } } result = apply_api_labels(resource) assert result["event_details"]["end_event"]["action"] is None def test_fetch_incidents_invalid_status_filter_raises(mock_client): """ Given: - status_filter contains an invalid value 'unknown_status'. When: - fetch_incidents is called with is_test=True. Then: - ValueError is raised mentioning the invalid value. """ with pytest.raises(ValueError) as exc: fetch_incidents( mock_client, {}, {"first_fetch": "3 days", "max_fetch": "10", "status_filter": "unknown_status"}, is_test=True, ) assert "unknown_status" in str(exc.value) def test_main_entry_point(): """ Given: - Module is run as __main__. When: - The entry point guard executes main(). Then: - main() is invoked (SystemExit raised by return_error when demisto is not configured). """ import runpy with pytest.raises(SystemExit): runpy.run_module("Cyberhaven", run_name="__main__")