Detection EMAIL Fields

Table of Contents

The following table identifies the Detection field names that the Log Forwarding app uses when you forward logs using the EMAIL log format.

EMAIL Name	Query Name
AgentID	agent_id
CortexDataLakeTenantId	customer_id
DetectionDetails	detection_details
DetectionID	detection_id
DetectionRiskScore	detection_risk_score
DetectorType	detector_type
FirstSeenAt	first_seen_at
LasSeenAt	last_seen_at
LogSource	log_source
LogSourceGroupID	log_source_group_id
DeviceSN	log_source_id
DeviceName	log_source_name
LogSourceTimeZoneOffset	log_source_tz_offset
TimeReceived	log_time
LogType	log_type.value
PlatformType	platform_type
SaaSAppID	saas_app_id
ScanID	scan_id
SubType	sub_type.value
TimeGenerated	time_generated
TimeGeneratedHighResolution	time_generated_high_res
TSGID	tsg_id
VendorName	vendor_name