---
title: "edr.cisco"
canonical: "https://docs.devo.com/space/latest/355565682/edr.cisco"
format: markdown
---
> Macro (toc)

## Introduction

The tags begin with `edr.cisco`** **identify the events generated by [Cisco](https://www.cisco.com/site/uk/en/index.html?team=digital_marketing&medium=paid_search&campaign=campaign_independent&ccid=cc003671&dtid=pseggl000015&gclid=CjwKCAjwoqGnBhAcEiwAwK-OkRoBgUUirXEuu676cdk23RN1FwbNbYNCaEiTJ3o_UN-cgObn69qeRxoCDUgQAvD_BwE&gclsrc=aw.ds).

## Tag structure

The full tag must have 3 levels. The first two are fixed as `edr.cisco`. The third level identifies the type of events sent.

| **Product / Services** | **Tags** | **Data tables** |
| --- | --- | --- |
| Cisco Secure Endpoint (Formerly AMP for Endpoints) | `edr.cisco.amp.computers` | `edr.cisco.amp.computers` |
| `edr.cisco.amp.events` | `edr.cisco.amp.events` |
| `edr.cisco.amp.vulnerabilities` | `edr.cisco.amp.vulnerabilities` |

For more information, read more [about Devo tags](https://docs.devo.com/space/latest/95126204).

## Table structure

These are the fields displayed in these tables:

- [edr.cisco.amp.computers](#tag1)
- [edr.cisco.amp.events](#tag2)
- [edr.cisco.amp.vulnerabilities](#tag3)

### > Macro (anchor)

edr.cisco.amp.computers

| **Field** | **Type** | ***Extra***** fields** |
| --- | --- | --- |
| *eventdate* | `timestamp` |  |
| *connector_guid* | `str` |  |
| *hostname* | `str` |  |
| *active* | `bool` |  |
| *links_computer* | `str` |  |
| *links_trajectory* | `str` |  |
| *links_group* | `str` |  |
| *connector_version* | `str` |  |
| *operating_system* | `str` |  |
| *internal_ips* | `str` |  |
| *external_ip* | `ip4` |  |
| *group_guid* | `str` |  |
| *install_date* | `timestamp` |  |
| *network_addresses* | `str` |  |
| *policy_guid* | `str` |  |
| *policy_name* | `str` |  |
| *last_seen* | `timestamp` |  |
| *faults* | `str` |  |
| *isolation_available* | `bool` |  |
| *isolation_status* | `str` |  |
| *hostchain* | `str` | **✓** |
| *tag* | `str` | **✓** |
| *rawMessage* | `str` | **✓** |

### > Macro (anchor)

edr.cisco.amp.events

| **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- | --- |
| *eventdate* | `timestamp` |  | * * |  |
| *id* | `int8` |  | * * |  |
| *timestamp* | `int8` |  | * * |  |
| *timestamp_nanoseconds* | `int8` |  | * * |  |
| *date* | `str` |  | * * |  |
| *event_type* | `str` |  | * * |  |
| *event_type_id* | `int8` |  | * * |  |
| *detection* | `str` |  | * * |  |
| *detection_id* | `str` |  | * * |  |
| *connector_guid* | `str` |  | * * |  |
| *group_guids* | `str` |  | * * |  |
| *severity* | `str` |  | * * |  |
| *computer_connector_guid* | `str` |  | * * |  |
| *computer_hostname* | `str` |  | * * |  |
| *computer_external_ip* | `ip4` |  | * * |  |
| *computer_user* | `str` |  | * * |  |
| *computer_active* | `bool` |  | * * |  |
| *computer_network_addresses* | `str` |  | * * |  |
| *computer_network_addresses_ip* | `ip4` |  | * * |  |
| *computer_network_addresses_ip_str* | `str` | ```
join(computer_network_addresses_ip_values, ',')
``` | *computer_network_addresses_ip_values* |  |
| *computer_network_addresses_mac* | `str` |  | * * |  |
| *computer_network_addresses_mac_str* | `str` | ```
join(computer_network_addresses_mac_values, ',')
``` | *computer_network_addresses_mac_values* |  |
| *computer_links_computer* | `str` |  | * * |  |
| *computer_links_trajectory* | `str` |  | * * |  |
| *computer_links_group* | `str` |  | * * |  |
| *cloud_ioc_description* | `str` |  | * * |  |
| *cloud_ioc_short_description* | `str` |  | * * |  |
| *file_disposition* | `str` |  | * * |  |
| *file_file_name* | `str` |  | * * |  |
| *file_file_path* | `str` |  | * * |  |
| *file_identity_sha256* | `str` |  | * * |  |
| *file_identity_sha1* | `str` |  | * * |  |
| *file_identity_md5* | `str` |  | * * |  |
| *file_parent_process_id* | `int8` |  | * * |  |
| *file_parent_disposition* | `str` |  | * * |  |
| *file_parent_file_name* | `str` |  | * * |  |
| *file_parent_identity_sha256* | `str` |  | * * |  |
| *file_parent_identity_sha1* | `str` |  | * * |  |
| *file_parent_identity_md5* | `str` |  | * * |  |
| *file_attack_details_application* | `str` |  | * * |  |
| *file_attack_details_attacked_module* | `str` |  | * * |  |
| *file_attack_details_base_address* | `str` |  | * * |  |
| *file_attack_details_suspicious_files_str* | `str` | ```
join(file_attack_details_suspicious_files, ',')
``` | *file_attack_details_suspicious_files* |  |
| *file_attack_details_indicators* | `json` |  | * * |  |
| *command_line_arguments* | `str` |  | * * |  |
| *tactics_str* | `str` | ```
join(tactics, ',')
``` | *tactics* |  |
| *techniques_str* | `str` | ```
join(techniques, ',')
``` | *techniques* |  |
| *bp_data__id* | `str` |  | * * |  |
| *bp_data__name* | `str` |  | * * |  |
| *bp_data__type* | `str` |  | * * |  |
| *bp_data__details__matched_activity__events__process_start__cmd_line_str* | `str` | ```
join(bp_data__details__matched_activity__events__process_start__cmd_line, ',')
``` | *bp_data__details__matched_activity__events__process_start__cmd_line* |  |
| *bp_data__details__matched_activity__events__process_start__parent_app__name_str* | `str` | ```
join(bp_data__details__matched_activity__events__process_start__parent_app__name, ',')
``` | *bp_data__details__matched_activity__events__process_start__parent_app__name* |  |
| *bp_data__details__matched_activity__events__process_start__parent_app__path_str* | `str` | ```
join(bp_data__details__matched_activity__events__process_start__parent_app__path, ',')
``` | *bp_data__details__matched_activity__events__process_start__parent_app__path* |  |
| *bp_data__details__matched_activity__events__process_start__parent_user__domain_str* | `str` | ```
join(bp_data__details__matched_activity__events__process_start__parent_user__domain, ',')
``` | *bp_data__details__matched_activity__events__process_start__parent_user__domain* |  |
| *bp_data__details__matched_activity__events__process_start__parent_user__name_str* | `str` | ```
join(bp_data__details__matched_activity__events__process_start__parent_user__name, ',')
``` | *bp_data__details__matched_activity__events__process_start__parent_user__name* |  |
| *bp_data__details__matched_activity__events__process_start__parent_user__sid_str* | `str` | ```
join(bp_data__details__matched_activity__events__process_start__parent_user__sid, ',')
``` | *bp_data__details__matched_activity__events__process_start__parent_user__sid* |  |
| *hostchain* | `str` |  | * * | **✓** |
| *tag* | `str` |  | * * | **✓** |
| *rawMessage* | `str` |  | * * |  |

### > Macro (anchor)

edr.cisco.amp.vulnerabilities

| **Field** | **Type** | ***Extra***** fields** |
| --- | --- | --- |
| *eventdate* | `timestamp` |  |
| *application* | `str` |  |
| *version* | `str` |  |
| *file_filename* | `str` |  |
| *file_identity_sha256* | `str` |  |
| *cves* | `str` |  |
| *latest_timestamp* | `int8` |  |
| *latest_date* | `str` |  |
| *groups* | `str` |  |
| *computers_total_count* | `int8` |  |
| *computers* | `str` |  |
| *hostchain* | `str` | **✓** |
| *tag* | `str` | **✓** |
| *rawMessage* | `str` | **✓** |