Data Security

The name of the data classification category that data matched into, e.g. Financial, Personal, Governmental, etc.

The normalized identifier of the data classification category.

• 0: Unknown (UNKNOWN)
• 1: Personal (PERSONAL)
• 2: Governmental (GOVERNMENTAL)
• 3: Financial (FINANCIAL)
• 4: Business (BUSINESS)
• 5: Military and Law Enforcement (MILITARY_AND_LAW_ENFORCEMENT)
• 6: Security (SECURITY)
• 99: Other (OTHER)

Describes details about the classifier used for data classification.

The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source.

The normalized identifier of the file content confidentiality indicator.

• 0: Unknown (UNKNOWN)
• 1: Not Confidential (NOT_CONFIDENTIAL)
• 2: Confidential (CONFIDENTIAL)
• 3: Secret (SECRET)
• 4: Top Secret (TOP_SECRET)
• 5: Private (PRIVATE)
• 6: Restricted (RESTRICTED)
• 99: Other (OTHER)

The name of the stage or state that the data was in. E.g., Data-at-Rest, Data-in-Transit, etc.

The stage or state that the data was in when it was assessed or scanned by a data security tool.

• 0: Unknown (UNKNOWN)
• 1: Data at-Rest (DATA_AT_REST)
• 2: Data in-Transit (DATA_IN_TRANSIT)
• 3: Data in-Use (DATA_IN_USE)
• 99: Other (OTHER)

Specific pattern, algorithm, fingerprint, or model used for detection.

The name of the type of data security tool or system that the finding, detection, or alert originated from. E.g., Endpoint, Secure Email Gateway, etc.

The type of data security tool or system that the finding, detection, or alert originated from.

• 0: Unknown (UNKNOWN)
• 1: Endpoint (ENDPOINT)
• 10: Application-Level DLP (APPLICATION_LEVEL_DLP)
• 11: Developer Security (DEVELOPER_SECURITY)
• 12: Data Security Posture Management (DATA_SECURITY_POSTURE_MANAGEMENT)
• 2: DLP Gateway (DLP_GATEWAY)
• 3: Mobile Device Management (MOBILE_DEVICE_MANAGEMENT)
• 4: Data Discovery & Classification (DATA_DISCOVERY_&_CLASSIFICATION)
• 5: Secure Web Gateway (SECURE_WEB_GATEWAY)
• 6: Secure Email Gateway (SECURE_EMAIL_GATEWAY)
• 7: Digital Rights Management (DIGITAL_RIGHTS_MANAGEMENT)
• 8: Cloud Access Security Broker (CLOUD_ACCESS_SECURITY_BROKER)
• 9: Database Activity Monitoring (DATABASE_ACTIVITY_MONITORING)
• 99: Other (OTHER)

Details about the data discovered by classification job.

A text, binary, file name, or datastore that matched against a detection rule.

Details about the policy that triggered the finding.

Group:context
The event data as received from the event source.

Group:primary
Unique identifier for the object

Size of the data classified.

Entity:URL_STRING
The source URL pointing towards the full classifcation job details.

The resultant status of the classification job normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.

The contextual description of the status, status_id value.

The normalized status identifier of the classification job.

• 0: Unknown (UNKNOWN)
• 1: Complete (COMPLETE)
• 2: Partial (PARTIAL)
• 3: Fail (FAIL)
• 99: Other (OTHER)

The total count of discovered entities, by the classification job.

The unique identifier of the classification job.

Data from the source that was not mapped into the schema.