Search Events Tokens

action

actor.imagePath

actor.process

actor.userID

actor.userName

asset.agentId

asset.agentVersion

asset.assetType

asset.created

asset.lastCheckedIn

asset.name

asset.netbiosName

asset.system.lastBoot

asset.tags

asset.updated

asset.interfaces.address

asset.interfaces.hostname

asset.interfaces.interfaceName

asset.interfaces.macAddress

asset.lastLoggedOnUser

asset.operatingSystem

class

file.fullPath

file.name

id

platform

profile.category

profile.name

profile.rule.description

profile.rule.id

profile.rule.name

severity

type

and

not

or

reputationStatus

trustStatus

registryKey.name

registryKey.path