cortex xdr Expression product = "cortex xdr" Fields There are no fields for this extension. Activity Types Activity Type Field Status Core Detection Informational app-activity domain Default ✓ domain_user_name user Default ✓