latest cim.json rerun

ActivityTypes/ActivityType_Interface.md

@@ -6,6 +6,10 @@
 This secondary interface defines the activity type element. It describes the specific fields required for a given activity when it's performed on the subject. This interface is also minimalist by design.
 
 
+ * [alert-create](alert-create.md)
+ * [alert-delete](alert-delete.md)
+ * [alert-modify](alert-modify.md)
+ * [alert-read](alert-read.md)
  * [alert-trigger](alert-trigger.md)
  * [app-activity](app-activity.md)
  * [app-authentication](app-authentication.md)
@@ -18,6 +22,7 @@ This secondary interface defines the activity type element. It describes the spe
  * [app-time-modify](app-time-modify.md)
  * [arp-traffic](arp-traffic.md)
  * [audit_policy-modify](audit_policy-modify.md)
+ * [branch-create](branch-create.md)
  * [branch-modify](branch-modify.md)
  * [branch-protection-disable](branch-protection-disable.md)
  * [branch-protection-enable](branch-protection-enable.md)
@@ -30,6 +35,10 @@ This secondary interface defines the activity type element. It describes the spe
  * [bucket-write](bucket-write.md)
  * [call-receive](call-receive.md)
  * [call-send](call-send.md)
+ * [case-create](case-create.md)
+ * [case-delete](case-delete.md)
+ * [case-modify](case-modify.md)
+ * [case-read](case-read.md)
  * [certificate-create](certificate-create.md)
  * [certificate-exchange](certificate-exchange.md)
  * [certificate-expire](certificate-expire.md)
@@ -52,6 +61,9 @@ This secondary interface defines the activity type element. It describes the spe
  * [configuration-read](configuration-read.md)
  * [configuration-routing-modify](configuration-routing-modify.md)
  * [configuration-save](configuration-save.md)
+ * [context_source-create](context_source-create.md)
+ * [context_source-delete](context_source-delete.md)
+ * [context_source-modify](context_source-modify.md)
  * [database-activity](database-activity.md)
  * [database-create](database-create.md)
  * [database-delete](database-delete.md)
@@ -119,6 +131,7 @@ This secondary interface defines the activity type element. It describes the spe
  * [endpoint-command](endpoint-command.md)
  * [endpoint-create](endpoint-create.md)
  * [endpoint-delete](endpoint-delete.md)
+ * [endpoint-domain-join](endpoint-domain-join.md)
  * [endpoint-enable](endpoint-enable.md)
  * [endpoint-key-create](endpoint-key-create.md)
  * [endpoint-key-write](endpoint-key-write.md)
@@ -140,6 +153,7 @@ This secondary interface defines the activity type element. It describes the spe
  * [endpoint-write](endpoint-write.md)
  * [file-close](file-close.md)
  * [file-copy](file-copy.md)
+ * [file-create](file-create.md)
  * [file-delete](file-delete.md)
  * [file-download](file-download.md)
  * [file-list](file-list.md)
@@ -179,6 +193,7 @@ This secondary interface defines the activity type element. It describes the spe
  * [group-modify](group-modify.md)
  * [group-permission-modify](group-permission-modify.md)
  * [group-policy-attach](group-policy-attach.md)
+ * [group-read](group-read.md)
  * [group-repository-add](group-repository-add.md)
  * [group-repository-remove](group-repository-remove.md)
  * [group-role-assign](group-role-assign.md)
@@ -202,9 +217,6 @@ This secondary interface defines the activity type element. It describes the spe
  * [image-list](image-list.md)
  * [image-modify](image-modify.md)
  * [image-write](image-write.md)
- * [incident-create](incident-create.md)
- * [incident-delete](incident-delete.md)
- * [incident-modify](incident-modify.md)
  * [ip-assign](ip-assign.md)
  * [ip-free](ip-free.md)
  * [key-create](key-create.md)
@@ -218,9 +230,15 @@ This secondary interface defines the activity type element. It describes the spe
  * [log-disable](log-disable.md)
  * [log-download](log-download.md)
  * [log-enable](log-enable.md)
+ * [log-export](log-export.md)
  * [log-read](log-read.md)
  * [log-search](log-search.md)
+ * [log_account-create](log_account-create.md)
+ * [log_account-delete](log_account-delete.md)
+ * [log_account-modify](log_account-modify.md)
  * [log_source-add](log_source-add.md)
+ * [log_source-disable](log_source-disable.md)
+ * [log_source-enable](log_source-enable.md)
  * [log_source-modify](log_source-modify.md)
  * [log_source-remove](log_source-remove.md)
  * [mailbox-create](mailbox-create.md)
@@ -230,6 +248,7 @@ This secondary interface defines the activity type element. It describes the spe
  * [mailbox-item-modify](mailbox-item-modify.md)
  * [mailbox-item-move](mailbox-item-move.md)
  * [mailbox-item-read](mailbox-item-read.md)
+ * [mailbox-list](mailbox-list.md)
  * [mailbox-modify](mailbox-modify.md)
  * [mailbox-permission-modify](mailbox-permission-modify.md)
  * [meeting-create](meeting-create.md)
@@ -245,6 +264,12 @@ This secondary interface defines the activity type element. It describes the spe
  * [network-session](network-session.md)
  * [network-start](network-start.md)
  * [network-traffic](network-traffic.md)
+ * [parser-create](parser-create.md)
+ * [parser-delete](parser-delete.md)
+ * [parser-disable](parser-disable.md)
+ * [parser-enable](parser-enable.md)
+ * [parser-import](parser-import.md)
+ * [parser-modify](parser-modify.md)
  * [password-checkin](password-checkin.md)
  * [password-checkout](password-checkout.md)
  * [password-copy](password-copy.md)
@@ -274,22 +299,26 @@ This secondary interface defines the activity type element. It describes the spe
  * [process-close](process-close.md)
  * [process-create](process-create.md)
  * [process-memory-allocate](process-memory-allocate.md)
+ * [process-memory-protect](process-memory-protect.md)
  * [process-memory-read](process-memory-read.md)
  * [process-modify](process-modify.md)
  * [process-open](process-open.md)
  * [process-pipe-create](process-pipe-create.md)
  * [process-thread-create](process-thread-create.md)
  * [process-token-assign](process-token-assign.md)
  * [process-token-modify](process-token-modify.md)
- * [radius-session	](radius-session.md)
+ * [radius-session](radius-session.md)
  * [radius-traffic](radius-traffic.md)
  * [rdp-traffic](rdp-traffic.md)
  * [registry-create](registry-create.md)
  * [registry-delete](registry-delete.md)
  * [registry-modify](registry-modify.md)
+ * [registry-read](registry-read.md)
  * [registry-rename](registry-rename.md)
  * [report-create](report-create.md)
+ * [report-delete](report-delete.md)
  * [report-download](report-download.md)
+ * [report-execute](report-execute.md)
  * [report-export](report-export.md)
  * [report-read](report-read.md)
  * [repository-create](repository-create.md)
@@ -298,6 +327,9 @@ This secondary interface defines the activity type element. It describes the spe
  * [repository-member-remove](repository-member-remove.md)
  * [repository-modify](repository-modify.md)
  * [repository-move](repository-move.md)
+ * [repository-pull](repository-pull.md)
+ * [repository-push](repository-push.md)
+ * [repository-read](repository-read.md)
  * [role-assume](role-assume.md)
  * [role-create](role-create.md)
  * [role-delete](role-delete.md)
@@ -308,6 +340,10 @@ This secondary interface defines the activity type element. It describes the spe
  * [role-write](role-write.md)
  * [rule-create](rule-create.md)
  * [rule-delete](rule-delete.md)
+ * [rule-disable](rule-disable.md)
+ * [rule-enable](rule-enable.md)
+ * [rule-modify](rule-modify.md)
+ * [rule-trigger-beta](rule-trigger-beta.md)
  * [rule-trigger](rule-trigger.md)
  * [scheduled_task-create](scheduled_task-create.md)
  * [scheduled_task-delete](scheduled_task-delete.md)

ActivityTypes/alert-create.md

@@ -0,0 +1,33 @@
+alert-create
+============
+
+Description
+-----------
+
+
+Parameters
+----------
+| Parameter     | Value        |
+| ------------- | ------------ |
+| Subject       | alert        |
+| Activity      | create       |
+| Activity Type | alert-create |
+| Pretty Name   | Alert Create |
+
+
+Fields
+------
+
+The possible fields for this activity type will vary depending on whether the activity was a [success](#alert-createsuccess) or a [fail](#alert-createfail).
+
+
+alert-create:success
+--------------------
+
+There are no fields for this activity type.
+
+
+alert-create:fail
+-----------------
+
+There are no fields for this activity type.

ActivityTypes/alert-delete.md

@@ -0,0 +1,33 @@
+alert-delete
+============
+
+Description
+-----------
+
+
+Parameters
+----------
+| Parameter     | Value        |
+| ------------- | ------------ |
+| Subject       | alert        |
+| Activity      | delete       |
+| Activity Type | alert-delete |
+| Pretty Name   | Alert Delete |
+
+
+Fields
+------
+
+The possible fields for this activity type will vary depending on whether the activity was a [success](#alert-deletesuccess) or a [fail](#alert-deletefail).
+
+
+alert-delete:success
+--------------------
+
+There are no fields for this activity type.
+
+
+alert-delete:fail
+-----------------
+
+There are no fields for this activity type.

ActivityTypes/alert-modify.md

@@ -0,0 +1,33 @@
+alert-modify
+============
+
+Description
+-----------
+
+
+Parameters
+----------
+| Parameter     | Value        |
+| ------------- | ------------ |
+| Subject       | alert        |
+| Activity      | modify       |
+| Activity Type | alert-modify |
+| Pretty Name   | Alert Modify |
+
+
+Fields
+------
+
+The possible fields for this activity type will vary depending on whether the activity was a [success](#alert-modifysuccess) or a [fail](#alert-modifyfail).
+
+
+alert-modify:success
+--------------------
+
+There are no fields for this activity type.
+
+
+alert-modify:fail
+-----------------
+
+There are no fields for this activity type.

ActivityTypes/alert-read.md

@@ -0,0 +1,33 @@
+alert-read
+==========
+
+Description
+-----------
+
+
+Parameters
+----------
+| Parameter     | Value      |
+| ------------- | ---------- |
+| Subject       | alert      |
+| Activity      | read       |
+| Activity Type | alert-read |
+| Pretty Name   | Alert Read |
+
+
+Fields
+------
+
+The possible fields for this activity type will vary depending on whether the activity was a [success](#alert-readsuccess) or a [fail](#alert-readfail).
+
+
+alert-read:success
+------------------
+
+There are no fields for this activity type.
+
+
+alert-read:fail
+---------------
+
+There are no fields for this activity type.

ActivityTypes/alert-trigger.md

@@ -29,7 +29,22 @@ The possible fields for this activity type will vary depending on whether the ac
 alert-trigger:success
 ---------------------
 
-There are no fields for this activity type.
-
+| Field           | Core     | Detection | Informational |
+| --------------- | -------- | --------- | ------------- |
+| alert_severity  | ✓ |           |               |
+| local_user_name |          |           |               |
+| alert_subject   |          | ✓  | ✓      |
+| src_host        |          | ✓  |               |
+| alert_type      | ✓ |           |               |
+| protocol        |          | ✓  |               |
+| top_domain      |          | ✓  |               |
+| process_name    |          | ✓  |               |
+| bytes           |          | ✓  |               |
+| dest_ip         |          | ✓  |               |
+| alert_source    | ✓ |           |               |
+| dest_host       |          | ✓  |               |
+| user            |          | ✓  |               |
+| dest_port       |          | ✓  |               |
+| cid             |          |           | ✓      |
 
 A failure activity is not currently supported for this activity-type.

ActivityTypes/app-activity.md

@@ -29,15 +29,37 @@ The possible fields for this activity type will vary depending on whether the ac
 app-activity:success
 --------------------
 
-| Field     | Core | Detection | Informational |
-| --------- | ---- | --------- | ------------- |
-| operation |      |           |               |
+| Field           | Core | Detection | Informational |
+| --------------- | ---- | --------- | ------------- |
+| src_ip          |      | ✓  |               |
+| os              |      | ✓  |               |
+| browser         |      | ✓  |               |
+| mime            |      | ✓  |               |
+| local_user_name |      |           |               |
+| fingerprint     |      | ✓  |               |
+| src_host        |      | ✓  |               |
+| operation       |      | ✓  |               |
+| user            |      | ✓  |               |
+| user_agent      |      | ✓  |               |
+| object          |      | ✓  |               |
+| cid             |      |           | ✓      |
 
 app-activity:fail
 -----------------
 
-| Field          | Core | Detection | Informational |
-| -------------- | ---- | --------- | ------------- |
-| failure_code   |      | ✓  |               |
-| failure_reason |      | ✓  |               |
-| operation      |      |           |               |
+| Field           | Core | Detection | Informational |
+| --------------- | ---- | --------- | ------------- |
+| failure_code    |      | ✓  |               |
+| os              |      | ✓  |               |
+| mime            |      | ✓  |               |
+| local_user_name |      |           |               |
+| failure_reason  |      | ✓  |               |
+| src_host        |      | ✓  |               |
+| src_ip          |      | ✓  |               |
+| browser         |      | ✓  |               |
+| fingerprint     |      | ✓  |               |
+| operation       |      | ✓  |               |
+| user            |      | ✓  |               |
+| user_agent      |      | ✓  |               |
+| object          |      | ✓  |               |
+| cid             |      |           | ✓      |