citrix virtual apps Expression product = "citrix virtual apps" Fields Field Core Detection Informational src_ip ✓ src_translated_ip ✓ protocol ✓ os ✓ dest_ip ✓ alert_id ✓ event_name ✓ src_host ✓ Activity Types Activity Type Field Status Core Detection Informational app-login