dropbox.md

dropbox

Expression

product = "dropbox"

Fields

Field	Core	Detection	Informational
src_ip		✓
domain			✓
fallback_user_name
domain_user_name
user	✓	✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-activity	additional_info	Default			✓
	resource	Default			✓
	object	Default			✓
app-login	additional_info	Default			✓
	operation	Default			✓
file-delete	additional_info				✓
file-download	additional_info				✓
file-permission-modify	src_file_name				✓
	access	Legacy		✓
	file_type	Legacy			✓
	file_dir_uri				✓
file-read	src_file_name				✓
	access	Legacy		✓
	additional_info
	file_type	Legacy			✓
	file_dir_uri				✓
	operation
file-write	src_file_name	Legacy		✓
	access	Legacy		✓
	additional_info
	file_type	Legacy			✓
	file_dir_uri				✓
	operation
report-export	additional_info	Default			✓
	operation	Default			✓
share-mount	additional_info	Default			✓
	operation	Default			✓
user-modify	additional_info
	operation