macos Expression product = "macos" Fields There are no fields for this extension. Activity Types Activity Type Field Status Core Detection Informational endpoint-login login_id Default ✓ process_name Default ✓ dest_ip Default ✓