commonfields: id: Cyberhaven version: -1 name: Cyberhaven display: Cyberhaven category: Data Enrichment & Threat Intelligence fromversion: 6.10.0 provider: Cyberhaven description: Fetches DLP incidents from the Cyberhaven data security platform and enables investigation of events and data lineage. defaultmapperin: Cyberhaven - Incoming Mapper sectionorder: - Connect - Collect configuration: - section: Connect display: Server URL (e.g., https://example.cyberhaven.io) name: url additionalinfo: URL of the Cyberhaven tenant. type: 0 required: true - section: Connect display: "" displaypassword: Refresh Token name: credentials additionalinfo: Provide the Refresh Token for authentication. type: 9 required: true hiddenusername: true - section: Collect display: Fetch incidents name: isFetch type: 8 required: false - section: Collect display: Incident type name: incidentType defaultvalue: "Cyberhaven Incident" type: 13 required: false - section: Collect display: First fetch time name: first_fetch defaultvalue: '3 days' additionalinfo: "The date or relative timestamp from which to begin fetching DLP Incidents. Default value is '3 days'. The maximum is '30 days'.\n\nIf the value is greater than '30 days', it will be considered as '30 days'.\n\nSupported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ.\n\nFor example: 01 May 2026, 01 May 2026 04:45:33, 2026-05-17T14:05:44Z." type: 0 required: false - section: Collect display: Max Fetch name: max_fetch additionalinfo: "The maximum number of DLP Incidents to fetch each time. Default value is 100. The maximum is 200.\n\nIf the value is greater than 200, it will be considered as 200." defaultvalue: "100" type: 0 required: false - section: Collect display: Status of incidents to fetch name: status_filter additionalinfo: Filter the DLP incidents by Status. type: 16 required: false defaultvalue: "Open" options: - Open - Closed - section: Collect display: Severity of incidents to fetch name: severity_filter additionalinfo: Filter the DLP incidents by Severity. type: 16 required: false defaultvalue: "Informational,Low,Medium,High,Critical" options: - Informational - Low - Medium - High - Critical - section: Collect display: Enable Outgoing Mirroring (from XSOAR to Cyberhaven) name: outgoing_mirroring additionalinfo: "When enabled, updates to the following fields in XSOAR are synchronized to Cyberhaven: Status, Owner, Close Reason, and Close Notes." type: 8 required: false - section: Collect display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: "5" type: 19 required: false - section: Connect advanced: true display: Trust any certificate (not secure) name: insecure type: 8 required: false - section: Connect advanced: true display: Use system proxy settings name: proxy type: 8 required: false script: commands: - name: cyberhaven-incident-list arguments: - name: limit description: Max incidents to return. defaultValue: "25" - name: start_time description: "Filter the incidents by start on or after the provided time. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ." - name: end_time description: "Filter the incidents by end on or before the provided time. Supported formats: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ." - name: severity description: A comma-separated list of severity by which to filter the incidents. isArray: true auto: PREDEFINED predefined: - Informational - Low - Medium - High - Critical - name: status description: A comma-separated list of status by which to filter the incidents. isArray: true auto: PREDEFINED predefined: - Open - Closed - name: assignee description: Filter the incidents by assigned analyst email. - name: user description: Filter the incidents by user who triggered the incident. - name: incident_ids description: A comma-separated list of incident IDs to filter the results. isArray: true - name: page_id description: Page ID to retrieve the next set of the incidents. description: List and search Cyberhaven DLP incidents with optional filters. outputs: - contextPath: Cyberhaven.Incident.id description: The unique identifier of the incident. type: String - contextPath: Cyberhaven.Incident.user.id description: The identifier of the user who triggered the incident. type: String - contextPath: Cyberhaven.Incident.user.local_username description: The local machine username of the user who triggered the incident. type: String - contextPath: Cyberhaven.Incident.user.local_id description: The local identifier of the user who triggered the incident. type: String - contextPath: Cyberhaven.Incident.event_lineage_id.start_event_id description: The ID of the first event in the lineage chain. type: String - contextPath: Cyberhaven.Incident.event_lineage_id.end_event_id description: The ID of the last event in the lineage chain. type: String - contextPath: Cyberhaven.Incident.blocked description: Whether the action that triggered the incident was blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_time description: The timestamp of the event that triggered the incident. type: Date - contextPath: Cyberhaven.Incident.trigger_time description: The timestamp when the incident was triggered. type: Date - contextPath: Cyberhaven.Incident.dataset.id description: The identifier of the dataset involved in the incident. type: String - contextPath: Cyberhaven.Incident.dataset.name description: The name of the dataset involved in the incident. type: String - contextPath: Cyberhaven.Incident.dataset.sensitivity description: The sensitivity classification of the dataset involved. type: String - contextPath: Cyberhaven.Incident.user_risk_groups description: The list of risk groups the user belongs to. type: String - contextPath: Cyberhaven.Incident.policy.id description: The identifier of the DLP policy that was triggered. type: String - contextPath: Cyberhaven.Incident.policy.name description: The name of the DLP policy that was triggered. type: String - contextPath: Cyberhaven.Incident.policy.severity description: The severity level defined in the triggering DLP policy. type: String - contextPath: Cyberhaven.Incident.risk_score description: The numeric risk score assigned to the incident. type: Number - contextPath: Cyberhaven.Incident.screenshot_guid description: The GUID of the screenshot associated with the incident. type: String - contextPath: Cyberhaven.Incident.warning_status description: The warning acknowledgement status of the incident. type: String - contextPath: Cyberhaven.Incident.user_reactions description: The list of user reaction codes for the incident. type: String - contextPath: Cyberhaven.Incident.user_reaction_message description: The message provided by the user when reacting to the warning. type: String - contextPath: Cyberhaven.Incident.reaction_time description: The timestamp when the user reacted to the warning. type: Date - contextPath: Cyberhaven.Incident.assigned_to description: The email of the analyst the incident is assigned to. type: String - contextPath: Cyberhaven.Incident.status description: The current status of the incident (e.g. open, closed). type: String - contextPath: Cyberhaven.Incident.resolution_time description: The timestamp when the incident was resolved. type: Date - contextPath: Cyberhaven.Incident.close_reason description: The reason code provided when the incident was closed. type: String - contextPath: Cyberhaven.Incident.close_note description: The free-text note provided when the incident was closed. type: String - contextPath: Cyberhaven.Incident.created_by description: Indicates how the incident was created (e.g. created_by_policy). type: String - contextPath: Cyberhaven.Incident.ai_summary description: The AI-generated summary of the incident. type: String - contextPath: Cyberhaven.Incident.ai_severity description: The AI-assessed severity level of the incident. type: String - contextPath: Cyberhaven.Incident.last_modified description: The timestamp when the incident was last modified. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.id description: The ID of the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.timestamp description: The timestamp of the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.action.kind description: The action kind performed in the start event (e.g. copy). type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.blocked description: Whether the action in the start event was blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.action.data_size description: The size of data involved in the start event action (bytes). type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.tags description: The content classification tags detected in the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.attributes description: The content attributes of the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.upload_filename description: The filename of the content being uploaded in the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.inspected description: Whether the content was inspected in the start event action. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.action.sensor_kind description: The sensor type that detected the start event (e.g. endpoint). type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.hostname description: The hostname of the machine where the start event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.machine_serial_number description: The serial number of the machine where the start event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.ip_address description: The IP address of the machine where the start event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.device_type description: The device management type for the start event (e.g. managed). type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.temporary_blocked description: Whether the start event action was temporarily blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.action.fail_close_statuses description: The list of fail-close status objects for the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.process_id description: The process ID of the process that triggered the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.action.parent_process_id description: The parent process ID of the process that triggered the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.user.id description: The identifier of the user in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.user.local_username description: The local username of the user in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.user.local_id description: The local ID of the user in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.id description: The ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.display_name description: The display name of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.datastore_id description: The datastore ID associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.dataset_sensitivity description: The sensitivity classification of the dataset in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.dataset_ids description: The list of dataset IDs associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.object_type description: The object type (e.g. file, removable_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.state description: The state of the object (e.g. active) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.tags description: The content classification tags in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.attributes description: The content attributes in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.upload_filename description: The upload filename of the content in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.inspected description: Whether the content was inspected in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.source.data.labels description: The data classification labels in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.data.label_ids description: The data classification label IDs in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.name description: The name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.description description: The description of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.package_name description: The package name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.binary_path description: The binary path of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.command_line description: The command line of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.main_window_title description: The main window title of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.name description: The file name in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.extension description: The file extension in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.size description: The file size (bytes) in the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.md5_hash description: The MD5 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.sha256_hash description: The SHA-256 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.created_at description: The creation timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.modified_at description: The last modification timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.owner.name description: The name of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.owner.id description: The ID of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.local_file.id description: The local file ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.local_file.path description: The local file system path in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.network_share.hostname description: The hostname of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.network_share.path description: The path of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.id description: The ID of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.from description: The sender of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.to description: The recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.cc description: The CC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.bcc description: The BCC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.subject description: The subject of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email_attachment.id description: The ID of the email attachment in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.url description: The URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.domain description: The domain of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.category description: The category of the web endpoint (e.g. cloud_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.download_url description: The download URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.title description: The page title of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.user_agent description: The user-agent string of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.provider description: The cloud provider (e.g. google) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.name description: The name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_name description: The username in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_email description: The user email in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_id description: The instance ID of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_name description: The instance name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_file.id description: The ID of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_file.content_uri description: The content URI of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_file.path description: The path of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.scope description: The sharing scope in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.role description: The role of the cloud share recipient in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.name description: The name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.description description: The description of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.physical_location description: The physical location of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.server description: The print server hostname in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.share_name description: The share name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.port description: The port of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.driver description: The driver name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.is_local description: Whether the printer is local in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.job_id description: The print job ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.connectivity description: The connectivity type of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.id description: The ID of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.name description: The name of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.product_id description: The USB product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.sender description: The sender of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_users description: The recipient users of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_groups description: The recipient groups of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.domain description: The domain of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.workspace description: The workspace of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.organization description: The organization of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.name description: The name of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.branch description: The branch of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.id description: The ID of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.labels description: The labels applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.label_ids description: The label IDs applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.matched_policies description: The list of DLP policies matched by the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.issues description: The list of DLP issues detected on the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.outline description: The outline description of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.type description: The endpoint type (e.g. endpoint, removable_media) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.domain description: The domain of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.discovered_at description: The timestamp when the object was first discovered in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.updated_at description: The timestamp when the object was last updated in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.id description: The ID of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.action_kind description: The action kind of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.timestamp description: The timestamp of the update event in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.user.id description: The user ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_username description: The local username in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_id description: The local ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.version_id description: The version ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.id description: The ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.type description: The type of cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.name description: The name of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.account_id description: The account ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.id description: The ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.display_name description: The display name of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.datastore_id description: The datastore ID associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.dataset_sensitivity description: The sensitivity classification of the dataset in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.dataset_ids description: The list of dataset IDs associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.object_type description: The object type (e.g. file, removable_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.state description: The state of the object (e.g. active) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.tags description: The content classification tags in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.attributes description: The content attributes in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.upload_filename description: The upload filename of the content in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.inspected description: Whether the content was inspected in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.destination.data.labels description: The data classification labels in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.data.label_ids description: The data classification label IDs in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.name description: The name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.description description: The description of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.package_name description: The package name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.binary_path description: The binary path of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.command_line description: The command line of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.main_window_title description: The main window title of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.name description: The file name in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.extension description: The file extension in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.size description: The file size (bytes) in the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.md5_hash description: The MD5 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.sha256_hash description: The SHA-256 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.created_at description: The creation timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.modified_at description: The last modification timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.owner.name description: The name of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.owner.id description: The ID of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.local_file.id description: The local file ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.local_file.path description: The local file system path in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.network_share.hostname description: The hostname of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.network_share.path description: The path of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.id description: The ID of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.from description: The sender of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.to description: The recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.cc description: The CC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.bcc description: The BCC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.subject description: The subject of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email_attachment.id description: The ID of the email attachment in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.url description: The URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.domain description: The domain of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.category description: The category of the web endpoint (e.g. cloud_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.download_url description: The download URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.title description: The page title of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.user_agent description: The user-agent string of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.provider description: The cloud provider (e.g. google) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.name description: The name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_name description: The username in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_email description: The user email in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_id description: The instance ID of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_name description: The instance name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_file.id description: The ID of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_file.content_uri description: The content URI of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_file.path description: The path of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.scope description: The sharing scope in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.role description: The role of the cloud share recipient in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.name description: The name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.description description: The description of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.physical_location description: The physical location of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.server description: The print server hostname in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.share_name description: The share name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.port description: The port of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.driver description: The driver name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.is_local description: Whether the printer is local in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.job_id description: The print job ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.connectivity description: The connectivity type of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.id description: The ID of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.name description: The name of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.product_id description: The USB product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.sender description: The sender of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_users description: The recipient users of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_groups description: The recipient groups of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.domain description: The domain of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.workspace description: The workspace of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.organization description: The organization of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.name description: The name of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.branch description: The branch of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.id description: The ID of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.labels description: The labels applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.label_ids description: The label IDs applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.matched_policies description: The list of DLP policies matched by the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.issues description: The list of DLP issues detected on the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.outline description: The outline description of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.type description: The endpoint type (e.g. endpoint, removable_media) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.domain description: The domain of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.discovered_at description: The timestamp when the object was first discovered in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.updated_at description: The timestamp when the object was last updated in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.id description: The ID of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.action_kind description: The action kind of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.timestamp description: The timestamp of the update event in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.user.id description: The user ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_username description: The local username in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_id description: The local ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.version_id description: The version ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.id description: The ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.type description: The type of cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.name description: The name of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.account_id description: The account ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.id description: The ID of the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.timestamp description: The timestamp of the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.action.kind description: The action kind performed in the end event (e.g. copy). type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.blocked description: Whether the action in the end event was blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.action.data_size description: The size of data involved in the end event action (bytes). type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.tags description: The content classification tags detected in the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.attributes description: The content attributes of the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.upload_filename description: The filename of the content being uploaded in the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.inspected description: Whether the content was inspected in the end event action. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.action.sensor_kind description: The sensor type that detected the end event (e.g. endpoint). type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.hostname description: The hostname of the machine where the end event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.machine_serial_number description: The serial number of the machine where the end event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.ip_address description: The IP address of the machine where the end event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.device_type description: The device management type for the end event (e.g. managed). type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.temporary_blocked description: Whether the end event action was temporarily blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.action.fail_close_statuses description: The list of fail-close status objects for the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.process_id description: The process ID of the process that triggered the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.action.parent_process_id description: The parent process ID of the process that triggered the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.user.id description: The identifier of the user in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.user.local_username description: The local username of the user in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.user.local_id description: The local ID of the user in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.id description: The ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.display_name description: The display name of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.datastore_id description: The datastore ID associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.dataset_sensitivity description: The sensitivity classification of the dataset in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.dataset_ids description: The list of dataset IDs associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.object_type description: The object type (e.g. file, removable_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.state description: The state of the object (e.g. active) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.tags description: The content classification tags in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.attributes description: The content attributes in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.upload_filename description: The upload filename of the content in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.inspected description: Whether the content was inspected in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.source.data.labels description: The data classification labels in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.data.label_ids description: The data classification label IDs in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.name description: The name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.description description: The description of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.package_name description: The package name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.binary_path description: The binary path of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.command_line description: The command line of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.main_window_title description: The main window title of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.name description: The file name in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.extension description: The file extension in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.size description: The file size (bytes) in the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.md5_hash description: The MD5 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.sha256_hash description: The SHA-256 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.created_at description: The creation timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.modified_at description: The last modification timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.owner.name description: The name of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.owner.id description: The ID of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.local_file.id description: The local file ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.local_file.path description: The local file system path in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.network_share.hostname description: The hostname of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.network_share.path description: The path of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.id description: The ID of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.from description: The sender of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.to description: The recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.cc description: The CC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.bcc description: The BCC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.subject description: The subject of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email_attachment.id description: The ID of the email attachment in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.url description: The URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.domain description: The domain of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.category description: The category of the web endpoint (e.g. cloud_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.download_url description: The download URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.title description: The page title of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.user_agent description: The user-agent string of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.provider description: The cloud provider (e.g. google) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.name description: The name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_name description: The username in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_email description: The user email in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_id description: The instance ID of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_name description: The instance name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_file.id description: The ID of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_file.content_uri description: The content URI of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_file.path description: The path of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.scope description: The sharing scope in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.role description: The role of the cloud share recipient in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.name description: The name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.description description: The description of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.physical_location description: The physical location of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.server description: The print server hostname in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.share_name description: The share name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.port description: The port of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.driver description: The driver name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.is_local description: Whether the printer is local in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.job_id description: The print job ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.connectivity description: The connectivity type of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.id description: The ID of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.name description: The name of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.product_id description: The USB product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.sender description: The sender of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_users description: The recipient users of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_groups description: The recipient groups of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.domain description: The domain of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.workspace description: The workspace of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.organization description: The organization of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.name description: The name of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.branch description: The branch of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.id description: The ID of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.labels description: The labels applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.label_ids description: The label IDs applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.matched_policies description: The list of DLP policies matched by the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.issues description: The list of DLP issues detected on the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.outline description: The outline description of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.type description: The endpoint type (e.g. endpoint, removable_media) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.domain description: The domain of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.discovered_at description: The timestamp when the object was first discovered in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.updated_at description: The timestamp when the object was last updated in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.id description: The ID of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.action_kind description: The action kind of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.timestamp description: The timestamp of the update event in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.user.id description: The user ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_username description: The local username in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_id description: The local ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.version_id description: The version ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.id description: The ID of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.type description: The type of cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.name description: The name of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.account_id description: The account ID of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.id description: The ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.display_name description: The display name of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.datastore_id description: The datastore ID associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.dataset_sensitivity description: The sensitivity classification of the dataset in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.dataset_ids description: The list of dataset IDs associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.object_type description: The object type (e.g. file, removable_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.state description: The state of the object (e.g. active) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.tags description: The content classification tags in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.attributes description: The content attributes in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.upload_filename description: The upload filename of the content in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.inspected description: Whether the content was inspected in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.destination.data.labels description: The data classification labels in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.data.label_ids description: The data classification label IDs in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.name description: The name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.description description: The description of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.package_name description: The package name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.binary_path description: The binary path of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.command_line description: The command line of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.main_window_title description: The main window title of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.name description: The file name in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.extension description: The file extension in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.size description: The file size (bytes) in the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.md5_hash description: The MD5 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.sha256_hash description: The SHA-256 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.created_at description: The creation timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.modified_at description: The last modification timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.owner.name description: The name of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.owner.id description: The ID of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.local_file.id description: The local file ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.local_file.path description: The local file system path in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.network_share.hostname description: The hostname of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.network_share.path description: The path of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.id description: The ID of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.from description: The sender of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.to description: The recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.cc description: The CC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.bcc description: The BCC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.subject description: The subject of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email_attachment.id description: The ID of the email attachment in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.url description: The URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.domain description: The domain of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.category description: The category of the web endpoint (e.g. cloud_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.download_url description: The download URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.title description: The page title of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.user_agent description: The user-agent string of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.provider description: The cloud provider (e.g. google) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.name description: The name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_name description: The username in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_email description: The user email in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_id description: The instance ID of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_name description: The instance name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_file.id description: The ID of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_file.content_uri description: The content URI of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_file.path description: The path of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.scope description: The sharing scope in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.role description: The role of the cloud share recipient in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.name description: The name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.description description: The description of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.physical_location description: The physical location of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.server description: The print server hostname in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.share_name description: The share name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.port description: The port of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.driver description: The driver name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.is_local description: Whether the printer is local in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.job_id description: The print job ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.connectivity description: The connectivity type of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.id description: The ID of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.name description: The name of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.product_id description: The USB product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.sender description: The sender of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_users description: The recipient users of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_groups description: The recipient groups of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.domain description: The domain of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.workspace description: The workspace of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.organization description: The organization of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.name description: The name of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.branch description: The branch of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.id description: The ID of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.labels description: The labels applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.label_ids description: The label IDs applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.matched_policies description: The list of DLP policies matched by the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.issues description: The list of DLP issues detected on the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.outline description: The outline description of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.type description: The endpoint type (e.g. endpoint, removable_media) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.domain description: The domain of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.discovered_at description: The timestamp when the object was first discovered in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.updated_at description: The timestamp when the object was last updated in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.id description: The ID of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.action_kind description: The action kind of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.timestamp description: The timestamp of the update event in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.user.id description: The user ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_username description: The local username in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_id description: The local ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.version_id description: The version ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.id description: The ID of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.type description: The type of cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.name description: The name of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.account_id description: The account ID of the cloud connector in the end event. type: String - contextPath: Cyberhaven.IncidentPage.next_id description: The opaque cursor for the next page of results. Pass this value as page_id to retrieve the next page. type: String - contextPath: Cyberhaven.IncidentPage.total description: The total number of incidents for the provided filters. type: Number - name: cyberhaven-incident-update arguments: - name: incident_id required: true description: "Specify the Cyberhaven incident ID.\n\nNote: Use 'cyberhaven-incident-list' to retrieve the incident ID." - name: status description: Specify the status of the incident. auto: PREDEFINED predefined: - Open - Closed - name: close_reason description: Specify the close reason while closing the incident. auto: PREDEFINED predefined: - Resolved - False Positive - False Positive - Destination Not at Risk - False Positive - User Exempt - Other - name: close_note description: Provide the meaningful note when closing. - name: assigned_to description: Provide analyst email to whom incident will assign. description: Update the status, assignment, or close reason of a Cyberhaven incident. outputs: - contextPath: Cyberhaven.Incident.id description: The unique identifier of the incident. type: String - contextPath: Cyberhaven.Incident.user.id description: The identifier of the user who triggered the incident. type: String - contextPath: Cyberhaven.Incident.user.local_username description: The local machine username of the user who triggered the incident. type: String - contextPath: Cyberhaven.Incident.user.local_id description: The local identifier of the user who triggered the incident. type: String - contextPath: Cyberhaven.Incident.event_lineage_id.start_event_id description: The ID of the first event in the lineage chain. type: String - contextPath: Cyberhaven.Incident.event_lineage_id.end_event_id description: The ID of the last event in the lineage chain. type: String - contextPath: Cyberhaven.Incident.blocked description: Whether the action that triggered the incident was blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_time description: The timestamp of the event that triggered the incident. type: Date - contextPath: Cyberhaven.Incident.trigger_time description: The timestamp when the incident was triggered. type: Date - contextPath: Cyberhaven.Incident.dataset.id description: The identifier of the dataset involved in the incident. type: String - contextPath: Cyberhaven.Incident.dataset.name description: The name of the dataset involved in the incident. type: String - contextPath: Cyberhaven.Incident.dataset.sensitivity description: The sensitivity classification of the dataset involved. type: String - contextPath: Cyberhaven.Incident.user_risk_groups description: The list of risk groups the user belongs to. type: String - contextPath: Cyberhaven.Incident.policy.id description: The identifier of the DLP policy that was triggered. type: String - contextPath: Cyberhaven.Incident.policy.name description: The name of the DLP policy that was triggered. type: String - contextPath: Cyberhaven.Incident.policy.severity description: The severity level defined in the triggering DLP policy. type: String - contextPath: Cyberhaven.Incident.risk_score description: The numeric risk score assigned to the incident. type: Number - contextPath: Cyberhaven.Incident.screenshot_guid description: The GUID of the screenshot associated with the incident. type: String - contextPath: Cyberhaven.Incident.warning_status description: The warning acknowledgement status of the incident. type: String - contextPath: Cyberhaven.Incident.user_reactions description: The list of user reaction codes for the incident. type: String - contextPath: Cyberhaven.Incident.user_reaction_message description: The message provided by the user when reacting to the warning. type: String - contextPath: Cyberhaven.Incident.reaction_time description: The timestamp when the user reacted to the warning. type: Date - contextPath: Cyberhaven.Incident.assigned_to description: The email of the analyst the incident is assigned to. type: String - contextPath: Cyberhaven.Incident.status description: The current status of the incident (e.g. open, closed). type: String - contextPath: Cyberhaven.Incident.resolution_time description: The timestamp when the incident was resolved. type: Date - contextPath: Cyberhaven.Incident.close_reason description: The reason code provided when the incident was closed. type: String - contextPath: Cyberhaven.Incident.close_note description: The free-text note provided when the incident was closed. type: String - contextPath: Cyberhaven.Incident.created_by description: Indicates how the incident was created (e.g. created_by_policy). type: String - contextPath: Cyberhaven.Incident.ai_summary description: The AI-generated summary of the incident. type: String - contextPath: Cyberhaven.Incident.ai_severity description: The AI-assessed severity level of the incident. type: String - contextPath: Cyberhaven.Incident.last_modified description: The timestamp when the incident was last modified. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.id description: The ID of the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.timestamp description: The timestamp of the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.action.kind description: The action kind performed in the start event (e.g. copy). type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.blocked description: Whether the action in the start event was blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.action.data_size description: The size of data involved in the start event action (bytes). type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.tags description: The content classification tags detected in the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.attributes description: The content attributes of the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.upload_filename description: The filename of the content being uploaded in the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.content.inspected description: Whether the content was inspected in the start event action. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.action.sensor_kind description: The sensor type that detected the start event (e.g. endpoint). type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.hostname description: The hostname of the machine where the start event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.machine_serial_number description: The serial number of the machine where the start event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.ip_address description: The IP address of the machine where the start event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.device_type description: The device management type for the start event (e.g. managed). type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.temporary_blocked description: Whether the start event action was temporarily blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.action.fail_close_statuses description: The list of fail-close status objects for the start event action. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.action.process_id description: The process ID of the process that triggered the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.action.parent_process_id description: The parent process ID of the process that triggered the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.user.id description: The identifier of the user in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.user.local_username description: The local username of the user in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.user.local_id description: The local ID of the user in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.id description: The ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.display_name description: The display name of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.datastore_id description: The datastore ID associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.dataset_sensitivity description: The sensitivity classification of the dataset in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.dataset_ids description: The list of dataset IDs associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.object_type description: The object type (e.g. file, removable_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.state description: The state of the object (e.g. active) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.tags description: The content classification tags in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.attributes description: The content attributes in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.upload_filename description: The upload filename of the content in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.content.inspected description: Whether the content was inspected in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.source.data.labels description: The data classification labels in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.data.label_ids description: The data classification label IDs in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.name description: The name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.description description: The description of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.package_name description: The package name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.binary_path description: The binary path of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.command_line description: The command line of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.app.main_window_title description: The main window title of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.name description: The file name in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.extension description: The file extension in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.size description: The file size (bytes) in the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.md5_hash description: The MD5 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.sha256_hash description: The SHA-256 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.created_at description: The creation timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.modified_at description: The last modification timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.owner.name description: The name of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.file.owner.id description: The ID of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.local_file.id description: The local file ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.local_file.path description: The local file system path in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.network_share.hostname description: The hostname of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.network_share.path description: The path of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.id description: The ID of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.from description: The sender of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.to description: The recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.cc description: The CC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.bcc description: The BCC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email.subject description: The subject of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.email_attachment.id description: The ID of the email attachment in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.url description: The URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.domain description: The domain of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.category description: The category of the web endpoint (e.g. cloud_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.download_url description: The download URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.title description: The page title of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.web.user_agent description: The user-agent string of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.provider description: The cloud provider (e.g. google) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.name description: The name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_name description: The username in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.user_email description: The user email in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_id description: The instance ID of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_app.instance_name description: The instance name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_file.id description: The ID of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_file.content_uri description: The content URI of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_file.path description: The path of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.scope description: The sharing scope in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_share_recipient.role description: The role of the cloud share recipient in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.name description: The name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.description description: The description of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.physical_location description: The physical location of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.server description: The print server hostname in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.share_name description: The share name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.port description: The port of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.driver description: The driver name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.is_local description: Whether the printer is local in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.job_id description: The print job ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.printer.connectivity description: The connectivity type of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.id description: The ID of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.name description: The name of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.removable_storage.product_id description: The USB product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.sender description: The sender of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_users description: The recipient users of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.recipient_groups description: The recipient groups of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.domain description: The domain of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.im_message.workspace description: The workspace of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.organization description: The organization of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.name description: The name of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.branch description: The branch of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.source_code_repo.id description: The ID of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.labels description: The labels applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.label_ids description: The label IDs applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.matched_policies description: The list of DLP policies matched by the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.issues description: The list of DLP issues detected on the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.outline description: The outline description of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.type description: The endpoint type (e.g. endpoint, removable_media) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.domain description: The domain of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.discovered_at description: The timestamp when the object was first discovered in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.updated_at description: The timestamp when the object was last updated in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.id description: The ID of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.action_kind description: The action kind of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.timestamp description: The timestamp of the update event in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.user.id description: The user ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_username description: The local username in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.update_event.user.local_id description: The local ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.version_id description: The version ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.id description: The ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.type description: The type of cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.name description: The name of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.source.cloud_connector.account_id description: The account ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.id description: The ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.display_name description: The display name of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.datastore_id description: The datastore ID associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.dataset_sensitivity description: The sensitivity classification of the dataset in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.dataset_ids description: The list of dataset IDs associated with the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.object_type description: The object type (e.g. file, removable_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.state description: The state of the object (e.g. active) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.tags description: The content classification tags in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.attributes description: The content attributes in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.upload_filename description: The upload filename of the content in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.content.inspected description: Whether the content was inspected in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.destination.data.labels description: The data classification labels in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.data.label_ids description: The data classification label IDs in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.name description: The name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.description description: The description of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.package_name description: The package name of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.binary_path description: The binary path of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.command_line description: The command line of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.app.main_window_title description: The main window title of the associated application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.name description: The file name in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.extension description: The file extension in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.size description: The file size (bytes) in the start event. type: Number - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.md5_hash description: The MD5 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.sha256_hash description: The SHA-256 hash of the file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.created_at description: The creation timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.modified_at description: The last modification timestamp of the file in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.owner.name description: The name of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.file.owner.id description: The ID of the file owner in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.local_file.id description: The local file ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.local_file.path description: The local file system path in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.network_share.hostname description: The hostname of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.network_share.path description: The path of the network share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.id description: The ID of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.from description: The sender of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.to description: The recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.cc description: The CC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.bcc description: The BCC recipients of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email.subject description: The subject of the email in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.email_attachment.id description: The ID of the email attachment in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.url description: The URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.domain description: The domain of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.category description: The category of the web endpoint (e.g. cloud_storage) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.download_url description: The download URL of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.title description: The page title of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.web.user_agent description: The user-agent string of the web endpoint in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.provider description: The cloud provider (e.g. google) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.name description: The name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_name description: The username in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.user_email description: The user email in the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_id description: The instance ID of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_app.instance_name description: The instance name of the cloud application in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_file.id description: The ID of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_file.content_uri description: The content URI of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_file.path description: The path of the cloud file in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.scope description: The sharing scope in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_share_recipient.role description: The role of the cloud share recipient in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.name description: The name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.description description: The description of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.physical_location description: The physical location of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.server description: The print server hostname in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.share_name description: The share name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.port description: The port of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.driver description: The driver name of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.is_local description: Whether the printer is local in the start event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.job_id description: The print job ID in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.printer.connectivity description: The connectivity type of the printer in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.id description: The ID of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.name description: The name of the removable storage device in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.removable_storage.product_id description: The USB product ID of the removable storage in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.sender description: The sender of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_users description: The recipient users of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.recipient_groups description: The recipient groups of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.domain description: The domain of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.im_message.workspace description: The workspace of the IM message in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.organization description: The organization of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.name description: The name of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.branch description: The branch of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.source_code_repo.id description: The ID of the source code repository in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.labels description: The labels applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.label_ids description: The label IDs applied to the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.matched_policies description: The list of DLP policies matched by the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.issues description: The list of DLP issues detected on the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.outline description: The outline description of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.type description: The endpoint type (e.g. endpoint, removable_media) in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.domain description: The domain of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.discovered_at description: The timestamp when the object was first discovered in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.updated_at description: The timestamp when the object was last updated in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.id description: The ID of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.action_kind description: The action kind of the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.timestamp description: The timestamp of the update event in the start event. type: Date - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.user.id description: The user ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_username description: The local username in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.update_event.user.local_id description: The local ID in the update event in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.version_id description: The version ID of the object in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.id description: The ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.type description: The type of cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.name description: The name of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.start_event.destination.cloud_connector.account_id description: The account ID of the cloud connector in the start event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.id description: The ID of the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.timestamp description: The timestamp of the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.action.kind description: The action kind performed in the end event (e.g. copy). type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.blocked description: Whether the action in the end event was blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.action.data_size description: The size of data involved in the end event action (bytes). type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.tags description: The content classification tags detected in the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.attributes description: The content attributes of the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.upload_filename description: The filename of the content being uploaded in the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.content.inspected description: Whether the content was inspected in the end event action. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.action.sensor_kind description: The sensor type that detected the end event (e.g. endpoint). type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.hostname description: The hostname of the machine where the end event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.machine_serial_number description: The serial number of the machine where the end event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.ip_address description: The IP address of the machine where the end event occurred. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.device_type description: The device management type for the end event (e.g. managed). type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.temporary_blocked description: Whether the end event action was temporarily blocked. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.action.fail_close_statuses description: The list of fail-close status objects for the end event action. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.action.process_id description: The process ID of the process that triggered the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.action.parent_process_id description: The parent process ID of the process that triggered the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.user.id description: The identifier of the user in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.user.local_username description: The local username of the user in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.user.local_id description: The local ID of the user in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.id description: The ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.display_name description: The display name of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.datastore_id description: The datastore ID associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.dataset_sensitivity description: The sensitivity classification of the dataset in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.dataset_ids description: The list of dataset IDs associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.object_type description: The object type (e.g. file, removable_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.state description: The state of the object (e.g. active) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.tags description: The content classification tags in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.attributes description: The content attributes in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.upload_filename description: The upload filename of the content in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.content.inspected description: Whether the content was inspected in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.source.data.labels description: The data classification labels in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.data.label_ids description: The data classification label IDs in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.name description: The name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.description description: The description of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.package_name description: The package name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.binary_path description: The binary path of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.command_line description: The command line of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.app.main_window_title description: The main window title of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.name description: The file name in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.extension description: The file extension in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.size description: The file size (bytes) in the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.md5_hash description: The MD5 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.sha256_hash description: The SHA-256 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.created_at description: The creation timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.modified_at description: The last modification timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.owner.name description: The name of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.file.owner.id description: The ID of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.local_file.id description: The local file ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.local_file.path description: The local file system path in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.network_share.hostname description: The hostname of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.network_share.path description: The path of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.id description: The ID of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.from description: The sender of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.to description: The recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.cc description: The CC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.bcc description: The BCC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email.subject description: The subject of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.email_attachment.id description: The ID of the email attachment in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.url description: The URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.domain description: The domain of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.category description: The category of the web endpoint (e.g. cloud_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.download_url description: The download URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.title description: The page title of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.web.user_agent description: The user-agent string of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.provider description: The cloud provider (e.g. google) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.name description: The name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_name description: The username in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.user_email description: The user email in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_id description: The instance ID of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_app.instance_name description: The instance name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_file.id description: The ID of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_file.content_uri description: The content URI of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_file.path description: The path of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.scope description: The sharing scope in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_share_recipient.role description: The role of the cloud share recipient in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.name description: The name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.description description: The description of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.physical_location description: The physical location of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.server description: The print server hostname in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.share_name description: The share name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.port description: The port of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.driver description: The driver name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.is_local description: Whether the printer is local in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.job_id description: The print job ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.printer.connectivity description: The connectivity type of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.id description: The ID of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.name description: The name of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.removable_storage.product_id description: The USB product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.sender description: The sender of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_users description: The recipient users of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.recipient_groups description: The recipient groups of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.domain description: The domain of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.im_message.workspace description: The workspace of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.organization description: The organization of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.name description: The name of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.branch description: The branch of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.source_code_repo.id description: The ID of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.labels description: The labels applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.label_ids description: The label IDs applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.matched_policies description: The list of DLP policies matched by the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.issues description: The list of DLP issues detected on the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.outline description: The outline description of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.type description: The endpoint type (e.g. endpoint, removable_media) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.domain description: The domain of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.discovered_at description: The timestamp when the object was first discovered in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.updated_at description: The timestamp when the object was last updated in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.id description: The ID of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.action_kind description: The action kind of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.timestamp description: The timestamp of the update event in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.user.id description: The user ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_username description: The local username in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.update_event.user.local_id description: The local ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.version_id description: The version ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.id description: The ID of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.type description: The type of cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.name description: The name of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.source.cloud_connector.account_id description: The account ID of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.id description: The ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.display_name description: The display name of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.datastore_id description: The datastore ID associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.dataset_sensitivity description: The sensitivity classification of the dataset in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.dataset_ids description: The list of dataset IDs associated with the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.object_type description: The object type (e.g. file, removable_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.state description: The state of the object (e.g. active) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.tags description: The content classification tags in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.attributes description: The content attributes in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.upload_filename description: The upload filename of the content in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.content.inspected description: Whether the content was inspected in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.destination.data.labels description: The data classification labels in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.data.label_ids description: The data classification label IDs in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.name description: The name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.description description: The description of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.package_name description: The package name of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.binary_path description: The binary path of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.command_line description: The command line of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.app.main_window_title description: The main window title of the associated application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.name description: The file name in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.extension description: The file extension in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.size description: The file size (bytes) in the end event. type: Number - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.md5_hash description: The MD5 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.sha256_hash description: The SHA-256 hash of the file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.created_at description: The creation timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.modified_at description: The last modification timestamp of the file in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.owner.name description: The name of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.file.owner.id description: The ID of the file owner in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.local_file.id description: The local file ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.local_file.path description: The local file system path in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.network_share.hostname description: The hostname of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.network_share.path description: The path of the network share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.id description: The ID of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.from description: The sender of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.to description: The recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.cc description: The CC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.bcc description: The BCC recipients of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email.subject description: The subject of the email in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.email_attachment.id description: The ID of the email attachment in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.url description: The URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.domain description: The domain of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.category description: The category of the web endpoint (e.g. cloud_storage) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.download_url description: The download URL of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.title description: The page title of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.web.user_agent description: The user-agent string of the web endpoint in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.provider description: The cloud provider (e.g. google) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.name description: The name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_name description: The username in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.user_email description: The user email in the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_id description: The instance ID of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_app.instance_name description: The instance name of the cloud application in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_file.id description: The ID of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_file.content_uri description: The content URI of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_file.path description: The path of the cloud file in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.scope description: The sharing scope in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_share_recipient.role description: The role of the cloud share recipient in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.name description: The name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.description description: The description of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.physical_location description: The physical location of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.server description: The print server hostname in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.share_name description: The share name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.port description: The port of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.driver description: The driver name of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.is_local description: Whether the printer is local in the end event. type: Boolean - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.job_id description: The print job ID in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.printer.connectivity description: The connectivity type of the printer in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.id description: The ID of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.name description: The name of the removable storage device in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.usb_id description: The USB vendor:product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.vendor_id description: The USB vendor ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.removable_storage.product_id description: The USB product ID of the removable storage in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.sender description: The sender of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_users description: The recipient users of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.recipient_groups description: The recipient groups of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.domain description: The domain of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.im_message.workspace description: The workspace of the IM message in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.organization description: The organization of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.name description: The name of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.branch description: The branch of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.source_code_repo.id description: The ID of the source code repository in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.labels description: The labels applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.label_ids description: The label IDs applied to the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.matched_policies description: The list of DLP policies matched by the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.issues description: The list of DLP issues detected on the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.outline description: The outline description of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.type description: The endpoint type (e.g. endpoint, removable_media) in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.domain description: The domain of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.discovered_at description: The timestamp when the object was first discovered in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.updated_at description: The timestamp when the object was last updated in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.id description: The ID of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.action_kind description: The action kind of the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.timestamp description: The timestamp of the update event in the end event. type: Date - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.user.id description: The user ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_username description: The local username in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.update_event.user.local_id description: The local ID in the update event in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.version_id description: The version ID of the object in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.id description: The ID of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.type description: The type of cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.name description: The name of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.onboarding_account description: The onboarding account of the cloud connector in the end event. type: String - contextPath: Cyberhaven.Incident.event_details.end_event.destination.cloud_connector.account_id description: The account ID of the cloud connector in the end event. type: String - name: cyberhaven-event-details-get arguments: - name: event_ids required: true isArray: true description: A comma-separated list of event UUIDs to get the events. description: Retrieves full details for one or more Cyberhaven events by ID. outputs: - contextPath: Cyberhaven.Event.id description: The unique identifier of the event. type: String - contextPath: Cyberhaven.Event.timestamp description: The timestamp when the event occurred. type: Date - contextPath: Cyberhaven.Event.action.kind description: The kind of action performed (e.g. copy, upload). type: String - contextPath: Cyberhaven.Event.action.blocked description: Whether the action was blocked by policy. type: Boolean - contextPath: Cyberhaven.Event.action.data_size description: The size of data involved in the action (bytes). type: Number - contextPath: Cyberhaven.Event.action.content.tags description: The content classification tags detected in the action. type: String - contextPath: Cyberhaven.Event.action.content.attributes description: The content attributes of the action. type: String - contextPath: Cyberhaven.Event.action.content.upload_filename description: The filename of the content being uploaded in the action. type: String - contextPath: Cyberhaven.Event.action.content.inspected description: Whether the content was inspected in the action. type: Boolean - contextPath: Cyberhaven.Event.action.sensor_kind description: The sensor type that detected the action (e.g. endpoint). type: String - contextPath: Cyberhaven.Event.action.hostname description: The hostname of the machine where the action occurred. type: String - contextPath: Cyberhaven.Event.action.machine_serial_number description: The serial number of the machine where the action occurred. type: String - contextPath: Cyberhaven.Event.action.ip_address description: The IP address of the machine where the action occurred. type: String - contextPath: Cyberhaven.Event.action.device_type description: The device management type (e.g. managed). type: String - contextPath: Cyberhaven.Event.action.temporary_blocked description: Whether the action was temporarily blocked. type: Boolean - contextPath: Cyberhaven.Event.action.fail_close_statuses description: The list of fail-close status objects for the action. type: String - contextPath: Cyberhaven.Event.action.process_id description: The process ID of the process that triggered the action. type: Number - contextPath: Cyberhaven.Event.action.parent_process_id description: The parent process ID of the process that triggered the action. type: Number - contextPath: Cyberhaven.Event.user.id description: The identifier of the user who triggered the event. type: String - contextPath: Cyberhaven.Event.user.local_username description: The local machine username of the user who triggered the event. type: String - contextPath: Cyberhaven.Event.user.local_id description: The local identifier of the user who triggered the event. type: String - contextPath: Cyberhaven.Event.source.id description: The ID of the object. type: String - contextPath: Cyberhaven.Event.source.display_name description: The display name of the object. type: String - contextPath: Cyberhaven.Event.source.datastore_id description: The datastore ID associated with the object. type: String - contextPath: Cyberhaven.Event.source.dataset_sensitivity description: The sensitivity classification of the dataset. type: String - contextPath: Cyberhaven.Event.source.dataset_ids description: The list of dataset IDs associated with the object. type: String - contextPath: Cyberhaven.Event.source.object_type description: The object type (e.g. file, removable_storage). type: String - contextPath: Cyberhaven.Event.source.state description: The state of the object (e.g. active). type: String - contextPath: Cyberhaven.Event.source.content.tags description: The content classification tags. type: String - contextPath: Cyberhaven.Event.source.content.attributes description: The content attributes. type: String - contextPath: Cyberhaven.Event.source.content.upload_filename description: The upload filename of the content. type: String - contextPath: Cyberhaven.Event.source.content.inspected description: Whether the content was inspected. type: Boolean - contextPath: Cyberhaven.Event.source.data.labels description: The data classification labels. type: String - contextPath: Cyberhaven.Event.source.data.label_ids description: The data classification label IDs. type: String - contextPath: Cyberhaven.Event.source.app.name description: The name of the associated application. type: String - contextPath: Cyberhaven.Event.source.app.description description: The description of the associated application. type: String - contextPath: Cyberhaven.Event.source.app.package_name description: The package name of the associated application. type: String - contextPath: Cyberhaven.Event.source.app.binary_path description: The binary path of the associated application. type: String - contextPath: Cyberhaven.Event.source.app.command_line description: The command line of the associated application. type: String - contextPath: Cyberhaven.Event.source.app.main_window_title description: The main window title of the associated application. type: String - contextPath: Cyberhaven.Event.source.file.name description: The file name. type: String - contextPath: Cyberhaven.Event.source.file.extension description: The file extension. type: String - contextPath: Cyberhaven.Event.source.file.size description: The file size (bytes). type: Number - contextPath: Cyberhaven.Event.source.file.md5_hash description: The MD5 hash of the file. type: String - contextPath: Cyberhaven.Event.source.file.sha256_hash description: The SHA-256 hash of the file. type: String - contextPath: Cyberhaven.Event.source.file.created_at description: The creation timestamp of the file. type: Date - contextPath: Cyberhaven.Event.source.file.modified_at description: The last modification timestamp of the file. type: Date - contextPath: Cyberhaven.Event.source.file.owner.name description: The name of the file owner. type: String - contextPath: Cyberhaven.Event.source.file.owner.id description: The ID of the file owner. type: String - contextPath: Cyberhaven.Event.source.local_file.id description: The local file ID. type: String - contextPath: Cyberhaven.Event.source.local_file.path description: The local file system path. type: String - contextPath: Cyberhaven.Event.source.network_share.hostname description: The hostname of the network share. type: String - contextPath: Cyberhaven.Event.source.network_share.path description: The path of the network share. type: String - contextPath: Cyberhaven.Event.source.email.id description: The ID of the email. type: String - contextPath: Cyberhaven.Event.source.email.from description: The sender of the email. type: String - contextPath: Cyberhaven.Event.source.email.to description: The recipients of the email. type: String - contextPath: Cyberhaven.Event.source.email.cc description: The CC recipients of the email. type: String - contextPath: Cyberhaven.Event.source.email.bcc description: The BCC recipients of the email. type: String - contextPath: Cyberhaven.Event.source.email.subject description: The subject of the email. type: String - contextPath: Cyberhaven.Event.source.email_attachment.id description: The ID of the email attachment. type: String - contextPath: Cyberhaven.Event.source.web.url description: The URL of the web endpoint. type: String - contextPath: Cyberhaven.Event.source.web.domain description: The domain of the web endpoint. type: String - contextPath: Cyberhaven.Event.source.web.category description: The category of the web endpoint (e.g. cloud_storage). type: String - contextPath: Cyberhaven.Event.source.web.download_url description: The download URL of the web endpoint. type: String - contextPath: Cyberhaven.Event.source.web.title description: The page title of the web endpoint. type: String - contextPath: Cyberhaven.Event.source.web.user_agent description: The user-agent string of the web endpoint. type: String - contextPath: Cyberhaven.Event.source.cloud_app.provider description: The cloud provider (e.g. google). type: String - contextPath: Cyberhaven.Event.source.cloud_app.name description: The name of the cloud application. type: String - contextPath: Cyberhaven.Event.source.cloud_app.user_name description: The username in the cloud application. type: String - contextPath: Cyberhaven.Event.source.cloud_app.user_email description: The user email in the cloud application. type: String - contextPath: Cyberhaven.Event.source.cloud_app.instance_id description: The instance ID of the cloud application. type: String - contextPath: Cyberhaven.Event.source.cloud_app.instance_name description: The instance name of the cloud application. type: String - contextPath: Cyberhaven.Event.source.cloud_file.id description: The ID of the cloud file. type: String - contextPath: Cyberhaven.Event.source.cloud_file.content_uri description: The content URI of the cloud file. type: String - contextPath: Cyberhaven.Event.source.cloud_file.path description: The path of the cloud file. type: String - contextPath: Cyberhaven.Event.source.cloud_share_recipient.scope description: The sharing scope. type: String - contextPath: Cyberhaven.Event.source.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share. type: String - contextPath: Cyberhaven.Event.source.cloud_share_recipient.role description: The role of the cloud share recipient. type: String - contextPath: Cyberhaven.Event.source.printer.name description: The name of the printer. type: String - contextPath: Cyberhaven.Event.source.printer.description description: The description of the printer. type: String - contextPath: Cyberhaven.Event.source.printer.physical_location description: The physical location of the printer. type: String - contextPath: Cyberhaven.Event.source.printer.server description: The print server hostname. type: String - contextPath: Cyberhaven.Event.source.printer.share_name description: The share name of the printer. type: String - contextPath: Cyberhaven.Event.source.printer.port description: The port of the printer. type: String - contextPath: Cyberhaven.Event.source.printer.driver description: The driver name of the printer. type: String - contextPath: Cyberhaven.Event.source.printer.is_local description: Whether the printer is local. type: Boolean - contextPath: Cyberhaven.Event.source.printer.job_id description: The print job ID. type: String - contextPath: Cyberhaven.Event.source.printer.connectivity description: The connectivity type of the printer. type: String - contextPath: Cyberhaven.Event.source.removable_storage.id description: The ID of the removable storage device. type: String - contextPath: Cyberhaven.Event.source.removable_storage.name description: The name of the removable storage device. type: String - contextPath: Cyberhaven.Event.source.removable_storage.usb_id description: The USB vendor:product ID of the removable storage. type: String - contextPath: Cyberhaven.Event.source.removable_storage.vendor_id description: The USB vendor ID of the removable storage. type: String - contextPath: Cyberhaven.Event.source.removable_storage.product_id description: The USB product ID of the removable storage. type: String - contextPath: Cyberhaven.Event.source.im_message.sender description: The sender of the IM message. type: String - contextPath: Cyberhaven.Event.source.im_message.recipient_users description: The recipient users of the IM message. type: String - contextPath: Cyberhaven.Event.source.im_message.recipient_groups description: The recipient groups of the IM message. type: String - contextPath: Cyberhaven.Event.source.im_message.domain description: The domain of the IM message. type: String - contextPath: Cyberhaven.Event.source.im_message.workspace description: The workspace of the IM message. type: String - contextPath: Cyberhaven.Event.source.source_code_repo.organization description: The organization of the source code repository. type: String - contextPath: Cyberhaven.Event.source.source_code_repo.name description: The name of the source code repository. type: String - contextPath: Cyberhaven.Event.source.source_code_repo.branch description: The branch of the source code repository. type: String - contextPath: Cyberhaven.Event.source.source_code_repo.id description: The ID of the source code repository. type: String - contextPath: Cyberhaven.Event.source.labels description: The labels applied to the object. type: String - contextPath: Cyberhaven.Event.source.label_ids description: The label IDs applied to the object. type: String - contextPath: Cyberhaven.Event.source.matched_policies description: The list of DLP policies matched by the object. type: String - contextPath: Cyberhaven.Event.source.issues description: The list of DLP issues detected on the object. type: String - contextPath: Cyberhaven.Event.source.outline description: The outline description of the object. type: String - contextPath: Cyberhaven.Event.source.type description: The endpoint type (e.g. endpoint, removable_media). type: String - contextPath: Cyberhaven.Event.source.domain description: The domain of the object. type: String - contextPath: Cyberhaven.Event.source.discovered_at description: The timestamp when the object was first discovered. type: Date - contextPath: Cyberhaven.Event.source.updated_at description: The timestamp when the object was last updated. type: Date - contextPath: Cyberhaven.Event.source.update_event.id description: The ID of the update event. type: String - contextPath: Cyberhaven.Event.source.update_event.action_kind description: The action kind of the update event. type: String - contextPath: Cyberhaven.Event.source.update_event.timestamp description: The timestamp of the update event. type: Date - contextPath: Cyberhaven.Event.source.update_event.user.id description: The user ID in the update event. type: String - contextPath: Cyberhaven.Event.source.update_event.user.local_username description: The local username in the update event. type: String - contextPath: Cyberhaven.Event.source.update_event.user.local_id description: The local ID in the update event. type: String - contextPath: Cyberhaven.Event.source.version_id description: The version ID of the object. type: String - contextPath: Cyberhaven.Event.source.cloud_connector.id description: The ID of the cloud connector. type: String - contextPath: Cyberhaven.Event.source.cloud_connector.type description: The type of cloud connector. type: String - contextPath: Cyberhaven.Event.source.cloud_connector.name description: The name of the cloud connector. type: String - contextPath: Cyberhaven.Event.source.cloud_connector.onboarding_account description: The onboarding account of the cloud connector. type: String - contextPath: Cyberhaven.Event.source.cloud_connector.account_id description: The account ID of the cloud connector. type: String - contextPath: Cyberhaven.Event.destination.id description: The ID of the object. type: String - contextPath: Cyberhaven.Event.destination.display_name description: The display name of the object. type: String - contextPath: Cyberhaven.Event.destination.datastore_id description: The datastore ID associated with the object. type: String - contextPath: Cyberhaven.Event.destination.dataset_sensitivity description: The sensitivity classification of the dataset. type: String - contextPath: Cyberhaven.Event.destination.dataset_ids description: The list of dataset IDs associated with the object. type: String - contextPath: Cyberhaven.Event.destination.object_type description: The object type (e.g. file, removable_storage). type: String - contextPath: Cyberhaven.Event.destination.state description: The state of the object (e.g. active). type: String - contextPath: Cyberhaven.Event.destination.content.tags description: The content classification tags. type: String - contextPath: Cyberhaven.Event.destination.content.attributes description: The content attributes. type: String - contextPath: Cyberhaven.Event.destination.content.upload_filename description: The upload filename of the content. type: String - contextPath: Cyberhaven.Event.destination.content.inspected description: Whether the content was inspected. type: Boolean - contextPath: Cyberhaven.Event.destination.data.labels description: The data classification labels. type: String - contextPath: Cyberhaven.Event.destination.data.label_ids description: The data classification label IDs. type: String - contextPath: Cyberhaven.Event.destination.app.name description: The name of the associated application. type: String - contextPath: Cyberhaven.Event.destination.app.description description: The description of the associated application. type: String - contextPath: Cyberhaven.Event.destination.app.package_name description: The package name of the associated application. type: String - contextPath: Cyberhaven.Event.destination.app.binary_path description: The binary path of the associated application. type: String - contextPath: Cyberhaven.Event.destination.app.command_line description: The command line of the associated application. type: String - contextPath: Cyberhaven.Event.destination.app.main_window_title description: The main window title of the associated application. type: String - contextPath: Cyberhaven.Event.destination.file.name description: The file name. type: String - contextPath: Cyberhaven.Event.destination.file.extension description: The file extension. type: String - contextPath: Cyberhaven.Event.destination.file.size description: The file size (bytes). type: Number - contextPath: Cyberhaven.Event.destination.file.md5_hash description: The MD5 hash of the file. type: String - contextPath: Cyberhaven.Event.destination.file.sha256_hash description: The SHA-256 hash of the file. type: String - contextPath: Cyberhaven.Event.destination.file.created_at description: The creation timestamp of the file. type: Date - contextPath: Cyberhaven.Event.destination.file.modified_at description: The last modification timestamp of the file. type: Date - contextPath: Cyberhaven.Event.destination.file.owner.name description: The name of the file owner. type: String - contextPath: Cyberhaven.Event.destination.file.owner.id description: The ID of the file owner. type: String - contextPath: Cyberhaven.Event.destination.local_file.id description: The local file ID. type: String - contextPath: Cyberhaven.Event.destination.local_file.path description: The local file system path. type: String - contextPath: Cyberhaven.Event.destination.network_share.hostname description: The hostname of the network share. type: String - contextPath: Cyberhaven.Event.destination.network_share.path description: The path of the network share. type: String - contextPath: Cyberhaven.Event.destination.email.id description: The ID of the email. type: String - contextPath: Cyberhaven.Event.destination.email.from description: The sender of the email. type: String - contextPath: Cyberhaven.Event.destination.email.to description: The recipients of the email. type: String - contextPath: Cyberhaven.Event.destination.email.cc description: The CC recipients of the email. type: String - contextPath: Cyberhaven.Event.destination.email.bcc description: The BCC recipients of the email. type: String - contextPath: Cyberhaven.Event.destination.email.subject description: The subject of the email. type: String - contextPath: Cyberhaven.Event.destination.email_attachment.id description: The ID of the email attachment. type: String - contextPath: Cyberhaven.Event.destination.web.url description: The URL of the web endpoint. type: String - contextPath: Cyberhaven.Event.destination.web.domain description: The domain of the web endpoint. type: String - contextPath: Cyberhaven.Event.destination.web.category description: The category of the web endpoint (e.g. cloud_storage). type: String - contextPath: Cyberhaven.Event.destination.web.download_url description: The download URL of the web endpoint. type: String - contextPath: Cyberhaven.Event.destination.web.title description: The page title of the web endpoint. type: String - contextPath: Cyberhaven.Event.destination.web.user_agent description: The user-agent string of the web endpoint. type: String - contextPath: Cyberhaven.Event.destination.cloud_app.provider description: The cloud provider (e.g. google). type: String - contextPath: Cyberhaven.Event.destination.cloud_app.name description: The name of the cloud application. type: String - contextPath: Cyberhaven.Event.destination.cloud_app.user_name description: The username in the cloud application. type: String - contextPath: Cyberhaven.Event.destination.cloud_app.user_email description: The user email in the cloud application. type: String - contextPath: Cyberhaven.Event.destination.cloud_app.instance_id description: The instance ID of the cloud application. type: String - contextPath: Cyberhaven.Event.destination.cloud_app.instance_name description: The instance name of the cloud application. type: String - contextPath: Cyberhaven.Event.destination.cloud_file.id description: The ID of the cloud file. type: String - contextPath: Cyberhaven.Event.destination.cloud_file.content_uri description: The content URI of the cloud file. type: String - contextPath: Cyberhaven.Event.destination.cloud_file.path description: The path of the cloud file. type: String - contextPath: Cyberhaven.Event.destination.cloud_share_recipient.scope description: The sharing scope. type: String - contextPath: Cyberhaven.Event.destination.cloud_share_recipient.user_ids description: The recipient user IDs of the cloud share. type: String - contextPath: Cyberhaven.Event.destination.cloud_share_recipient.role description: The role of the cloud share recipient. type: String - contextPath: Cyberhaven.Event.destination.printer.name description: The name of the printer. type: String - contextPath: Cyberhaven.Event.destination.printer.description description: The description of the printer. type: String - contextPath: Cyberhaven.Event.destination.printer.physical_location description: The physical location of the printer. type: String - contextPath: Cyberhaven.Event.destination.printer.server description: The print server hostname. type: String - contextPath: Cyberhaven.Event.destination.printer.share_name description: The share name of the printer. type: String - contextPath: Cyberhaven.Event.destination.printer.port description: The port of the printer. type: String - contextPath: Cyberhaven.Event.destination.printer.driver description: The driver name of the printer. type: String - contextPath: Cyberhaven.Event.destination.printer.is_local description: Whether the printer is local. type: Boolean - contextPath: Cyberhaven.Event.destination.printer.job_id description: The print job ID. type: String - contextPath: Cyberhaven.Event.destination.printer.connectivity description: The connectivity type of the printer. type: String - contextPath: Cyberhaven.Event.destination.removable_storage.id description: The ID of the removable storage device. type: String - contextPath: Cyberhaven.Event.destination.removable_storage.name description: The name of the removable storage device. type: String - contextPath: Cyberhaven.Event.destination.removable_storage.usb_id description: The USB vendor:product ID of the removable storage. type: String - contextPath: Cyberhaven.Event.destination.removable_storage.vendor_id description: The USB vendor ID of the removable storage. type: String - contextPath: Cyberhaven.Event.destination.removable_storage.product_id description: The USB product ID of the removable storage. type: String - contextPath: Cyberhaven.Event.destination.im_message.sender description: The sender of the IM message. type: String - contextPath: Cyberhaven.Event.destination.im_message.recipient_users description: The recipient users of the IM message. type: String - contextPath: Cyberhaven.Event.destination.im_message.recipient_groups description: The recipient groups of the IM message. type: String - contextPath: Cyberhaven.Event.destination.im_message.domain description: The domain of the IM message. type: String - contextPath: Cyberhaven.Event.destination.im_message.workspace description: The workspace of the IM message. type: String - contextPath: Cyberhaven.Event.destination.source_code_repo.organization description: The organization of the source code repository. type: String - contextPath: Cyberhaven.Event.destination.source_code_repo.name description: The name of the source code repository. type: String - contextPath: Cyberhaven.Event.destination.source_code_repo.branch description: The branch of the source code repository. type: String - contextPath: Cyberhaven.Event.destination.source_code_repo.id description: The ID of the source code repository. type: String - contextPath: Cyberhaven.Event.destination.labels description: The labels applied to the object. type: String - contextPath: Cyberhaven.Event.destination.label_ids description: The label IDs applied to the object. type: String - contextPath: Cyberhaven.Event.destination.matched_policies description: The list of DLP policies matched by the object. type: String - contextPath: Cyberhaven.Event.destination.issues description: The list of DLP issues detected on the object. type: String - contextPath: Cyberhaven.Event.destination.outline description: The outline description of the object. type: String - contextPath: Cyberhaven.Event.destination.type description: The endpoint type (e.g. endpoint, removable_media). type: String - contextPath: Cyberhaven.Event.destination.domain description: The domain of the object. type: String - contextPath: Cyberhaven.Event.destination.discovered_at description: The timestamp when the object was first discovered. type: Date - contextPath: Cyberhaven.Event.destination.updated_at description: The timestamp when the object was last updated. type: Date - contextPath: Cyberhaven.Event.destination.update_event.id description: The ID of the update event. type: String - contextPath: Cyberhaven.Event.destination.update_event.action_kind description: The action kind of the update event. type: String - contextPath: Cyberhaven.Event.destination.update_event.timestamp description: The timestamp of the update event. type: Date - contextPath: Cyberhaven.Event.destination.update_event.user.id description: The user ID in the update event. type: String - contextPath: Cyberhaven.Event.destination.update_event.user.local_username description: The local username in the update event. type: String - contextPath: Cyberhaven.Event.destination.update_event.user.local_id description: The local ID in the update event. type: String - contextPath: Cyberhaven.Event.destination.version_id description: The version ID of the object. type: String - contextPath: Cyberhaven.Event.destination.cloud_connector.id description: The ID of the cloud connector. type: String - contextPath: Cyberhaven.Event.destination.cloud_connector.type description: The type of cloud connector. type: String - contextPath: Cyberhaven.Event.destination.cloud_connector.name description: The name of the cloud connector. type: String - contextPath: Cyberhaven.Event.destination.cloud_connector.onboarding_account description: The onboarding account of the cloud connector. type: String - contextPath: Cyberhaven.Event.destination.cloud_connector.account_id description: The account ID of the cloud connector. type: String - name: cyberhaven-event-lineage-get arguments: - name: start_event_id required: true description: Provide the UUID of the first event in the chain. - name: end_event_id required: true description: Provide the UUID of the last event in the chain. description: Retrieves the data lineage chain between two Cyberhaven event IDs. outputs: - contextPath: Cyberhaven.EventLineage.resources description: The list of events ID in order. type: String script: '' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10404775 isfetch: true isremotesyncout: true tests: - No tests (auto formatted)