This secondary interface defines the activity type element. It describes the specific fields required for a given activity when it's performed on the subject. This interface is also minimalist by design.
- ai_agent-request
- alert-create
- alert-delete
- alert-modify
- alert-read
- alert-trigger
- app-activity
- app-authentication
- app-login
- app-logout
- app-notification
- app-register
- app-scan
- app-start
- app-time-modify
- arp-traffic
- audit_policy-modify
- branch-create
- branch-modify
- branch-protection-disable
- branch-protection-enable
- branch-protection-modify
- bucket-accessblock-modify
- bucket-create
- bucket-list
- bucket-permission-modify
- bucket-permission-read
- bucket-policy-modify
- bucket-policy-read
- bucket-property-read
- bucket-write
- call-receive
- call-send
- case-create
- case-delete
- case-modify
- case-read
- certificate-create
- certificate-exchange
- certificate-expire
- certificate-modify
- certificate-request
- certificate-validate
- channel-create
- channel-delete
- channel-member-join
- channel-member-leave
- channel-modify
- clipboard-read
- cluster-modify
- collector-create
- collector-delete
- collector-disable
- collector-enable
- collector-modify
- configuration-create
- configuration-delete
- configuration-download
- configuration-load
- configuration-mfa-disable
- configuration-mfa-enable
- configuration-modify
- configuration-read
- configuration-routing-modify
- configuration-save
- context_table-create
- context_table-delete
- context_table-modify
- dashboard-create
- dashboard-delete
- dashboard-download
- dashboard-export
- dashboard-modify
- dashboard-publish
- dashboard-schedule
- database-activity
- database-create
- database-delete
- database-list
- database-login
- database-logout
- database-modify
- database-query
- datacenter-modify
- datastore-create
- datastore-delete
- datastore-disable
- datastore-enable
- datastore-modify
- dcom-activate
- detection_group_rule-create
- detection_group_rule-delete
- detection_group_rule-disable
- detection_group_rule-enable
- detection_group_rule-modify
- dhcp-acknowledge
- dhcp-discover
- dhcp-offer
- dhcp-session
- dhcp-traffic
- disk-attach
- disk-create
- disk-delete
- disk-list
- disk-modify
- disk-read
- disk-remove
- disk-scan
- disk-write
- dll-load
- dll-unload
- dns-request
- dns-response
- dns-traffic
- dns_record-create
- dns_record-delete
- dns_record-modify
- driver-load
- driver-unload
- ds-replication-modify
- ds-replication-start
- ds-replication-stop
- ds-replication
- ds_object-activity
- ds_object-create
- ds_object-delete
- ds_object-modify
- ds_object-move
- ds_object-read
- ds_object-restore
- email-create
- email-delete
- email-modify
- email-move
- email-read
- email-receive
- email-recipient-add
- email-recipient-remove
- email-send
- email_rule-create
- email_rule-delete
- email_rule-modify
- endpoint-activity
- endpoint-authentication
- endpoint-command
- endpoint-create
- endpoint-delete
- endpoint-domain-join
- endpoint-enable
- endpoint-key-create
- endpoint-key-write
- endpoint-list
- endpoint-lock
- endpoint-login
- endpoint-logout
- endpoint-modify
- endpoint-name-modify
- endpoint-notification
- endpoint-password-modify
- endpoint-policy-verify
- endpoint-scan
- endpoint-screenshot
- endpoint-start
- endpoint-stop
- endpoint-time-modify
- endpoint-unlock
- endpoint-write
- file-close
- file-copy
- file-create
- file-delete
- file-download
- file-list
- file-move
- file-owner-modify
- file-permission-modify
- file-permission-read
- file-property-delete
- file-property-modify
- file-property-read
- file-read
- file-rename
- file-restore
- file-search
- file-share
- file-stream-create
- file-time-modify
- file-unshare
- file-upload
- file-write
- folder-create
- folder-delete
- folder-modify
- ftp-close
- ftp-start
- ftp-traffic
- function-create
- function-modify
- function-write
- group-create
- group-delete
- group-list
- group-member-add
- group-member-list
- group-member-move
- group-member-remove
- group-modify
- group-permission-modify
- group-policy-attach
- group-read
- group-repository-add
- group-repository-remove
- group-role-assign
- group-role-modify
- group-role-revoke
- handle-close
- handle-copy
- handle-open
- handle-request
- hook-create
- hook-delete
- hook-modify
- http-close
- http-request
- http-response
- http-session
- http-traffic
- image-create
- image-delete
- image-import
- image-list
- image-modify
- image-write
- ip-assign
- ip-free
- key-create
- key-delete
- key-migrate
- key-read
- key-write
- link-create
- log-backup
- log-clear
- log-disable
- log-download
- log-enable
- log-export
- log-read
- log-search
- log_account-create
- log_account-delete
- log_account-modify
- log_source-add
- log_source-disable
- log_source-enable
- log_source-modify
- log_source-remove
- mailbox-create
- mailbox-delete
- mailbox-item-create
- mailbox-item-delete
- mailbox-item-modify
- mailbox-item-move
- mailbox-item-read
- mailbox-list
- mailbox-modify
- mailbox-permission-modify
- meeting-create
- meeting-end
- meeting-member-join
- meeting-member-leave
- meeting-modify
- meeting-start
- message-receive
- message-send
- network-close
- network-listen
- network-notification
- network-session
- network-start
- network-traffic
- parser-create
- parser-delete
- parser-disable
- parser-enable
- parser-import
- parser-modify
- password-checkin
- password-checkout
- password-copy
- password-create
- password-download
- password-modify
- password-read
- password-use
- peripheral_device-activity
- peripheral_device-enable
- peripheral_device-insert
- peripheral_device-remove
- peripheral_storage-activity
- peripheral_storage-insert
- peripheral_storage-remove
- physical_location-access
- physical_location-modify
- playbook-create
- playbook-delete
- playbook-disable
- playbook-enable
- playbook-execute
- playbook-modify
- policy-apply
- policy-create
- policy-delete
- policy-disable
- policy-enable
- policy-list
- policy-modify
- policy-read
- policy-write
- port-block
- port-disable
- port-enable
- printer-activity
- process-close
- process-create
- process-memory-allocate
- process-memory-protect
- process-memory-read
- process-modify
- process-open
- process-pipe-create
- process-thread-create
- process-token-assign
- process-token-modify
- radius-session
- radius-traffic
- rdp-traffic
- registry-create
- registry-delete
- registry-export
- registry-modify
- registry-read
- registry-rename
- report-create
- report-delete
- report-download
- report-execute
- report-export
- report-read
- repository-create
- repository-delete
- repository-member-add
- repository-member-remove
- repository-modify
- repository-move
- repository-pull
- repository-push
- repository-read
- role-assume
- role-create
- role-delete
- role-list
- role-modify
- role-permission-modify
- role-policy-attach
- role-write
- rule-create
- rule-delete
- rule-disable
- rule-enable
- rule-modify
- rule-trigger-test
- rule-trigger
- scheduled_task-create
- scheduled_task-delete
- scheduled_task-disable
- scheduled_task-enable
- scheduled_task-finish
- scheduled_task-modify
- scheduled_task-start
- scheduled_task-trigger
- script-execute
- secret-copy
- secret-create
- secret-delete
- secret-modify
- secret-read
- service-create
- service-modify
- service-start
- service-state-modify
- service-stop
- share-access
- share-create
- share-delete
- share-modify
- share-mount
- share_link-open
- site_collector-create
- site_collector-delete
- site_collector-disable
- site_collector-enable
- site_collector-modify
- smtp-close
- smtp-start
- snapshot-create
- snapshot-list
- snapshot-modify
- snapshot-read
- snapshot-write
- ssh-close
- ssh-start
- ssh-traffic
- ssl-close
- ssl-start
- ssl-traffic
- syscall-execute
- template-create
- template-delete
- template-modify
- user-create
- user-delete
- user-device-remember
- user-disable
- user-enable
- user-invite-cancel
- user-invite
- user-key-create
- user-list
- user-lock
- user-mfa-disable
- user-mfa-enable
- user-modify
- user-name-modify
- user-password-create
- user-password-delete
- user-password-expire
- user-password-forget
- user-password-modify
- user-password-read
- user-password-reset
- user-permission-modify
- user-policy-attach
- user-privilege-assign
- user-privilege-modify
- user-privilege-use
- user-read
- user-role-assign
- user-role-modify
- user-role-revoke
- user-search
- user-switch
- user-token-create
- user-token-modify
- user-token-revoke
- user-unlock
- visualization-create
- visualization-delete
- visualization-download
- visualization-export
- visualization-modify
- visualization-publish
- visualization-schedule
- vm_host-create
- vm_host-delete
- vm_host-disabled
- vm_host-enable
- vm_host-modify
- vm_pool-create
- vm_pool-delete
- vm_pool-endpoint-add
- vm_pool-endpoint-remove
- vm_pool-modify
- vm_template-create
- vm_template-delete
- vpn-authentication
- vpn-login
- vpn-logout
- vpn-session
- workspace-create
- workspace-delete
- workspace-member-add