---
title: "edr.cybereason"
canonical: "https://docs.devo.com/space/latest/355795056/edr.cybereason"
format: markdown
---
> Macro (toc)

## Introduction

The tags begin with `edr.cybereason`** **identify the events generated by [Cybereason](https://www.cybereason.com/).

## Tag structure

The full tag must have at least 2 levels. The first two are fixed as `edr.cybereason`. The third level identifies the type of events sent.

| **Product / Services** | **Tags** | **Data tables** |
| --- | --- | --- |
| Cybereason | `edr.cybereason.malop` | `edr.cybereason` |
| `edr.cybereason.api_malop` | `edr.cybereason.api_malop` |
| `edr.cybereason.api_malware` | `edr.cybereason.api_malware` |
| `edr.cybereason.malop` | `edr.cybereason.malop` |
| `edr.cybereason.malware` | `edr.cybereason.malware` |
| `edr.cybereason.useractions` | `edr.cybereason.useractions` |

For more information, read more [about Devo tags](https://docs.devo.com/space/latest/95126204).

## Table structure

These are the fields displayed in these tables:

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> - [edr.cybereason](#tag1)
> - [edr.cybereason.api_malop](#tag2)
> - [edr.cybereason.api_malware](#tag3)
> 
> ### > Macro (anchor)
> 
> edr.cybereason
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *hostname* | `str` | ```
> split(hostchain, "=", 0)
> ``` | *hostchain* |  |
> | *type* | `str` |  | *vtype* |  |
> | *cefVersion* | `str` |  |  |  |
> | *embDeviceVendor* | `str` |  |  |  |
> | *embDeviceProduct* | `str` |  |  |  |
> | *deviceVersion* | `str` |  |  |  |
> | *signatureID* | `str` |  |  |  |
> | *name* | `str` |  |  |  |
> | *severity* | `str` |  |  |  |
> | *cn1Label* | `str` |  |  |  |
> | *cn1* | `int8` |  |  |  |
> | *cn2Label* | `str` |  |  |  |
> | *cn2* | `int8` |  |  |  |
> | *cn3Label* | `str` |  |  |  |
> | *cn3* | `int8` |  |  |  |
> | *cs1Label* | `str` |  |  |  |
> | *cs1* | `str` |  |  |  |
> | *cs2Label* | `str` |  |  |  |
> | *cs2* | `str` |  |  |  |
> | *cs3Label* | `str` |  |  |  |
> | *cs3* | `str` |  |  |  |
> | *cs4Label* | `str` |  |  |  |
> | *cs4* | `str` |  |  |  |
> | *cs5Label* | `str` |  |  |  |
> | *cs5* | `str` |  |  |  |
> | *cs6Label* | `str` |  |  |  |
> | *cs6* | `str` |  |  |  |
> | *deviceCustomDate1Label* | `str` |  |  |  |
> | *deviceCustomDate1* | `timestamp` | ```
> parsedate(replace(deviceCustomDate1_tmp, " UTC", ""), "MMM DD YYYY, HH:mm:ss", "UTC")
> ``` | *deviceCustomDate1_tmp* |  |
> | *deviceCustomDate2Label* | `str` |  |  |  |
> | *deviceCustomDate2* | `timestamp` | ```
> parsedate(replace(deviceCustomDate2_tmp, " UTC", ""), "MMM DD YYYY, HH:mm:ss", "UTC")
> ``` | *deviceCustomDate2_tmp* |  |
> | *deviceDnsDomain* | `str` |  |  |  |
> | *dvc* | `ip4` |  |  |  |
> | *reason* | `str` |  |  |  |
> | *requestContext* | `str` |  |  |  |
> | *rt* | `timestamp` | ```
> parsedate(replace(rt_tmp, " UTC", ""), "MMM DD YYYY, HH:mm:ss", "UTC")
> ``` | *rt_tmp* |  |
> | *start* | `timestamp` | ```
> parsedate(replace(start_tmp, " UTC", ""), "MMM DD YYYY, HH:mm:ss", "UTC")
> ``` | *start_tmp* |  |
> | *suser* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> edr.cybereason.api_malop
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *id* | `str` |  |
> | *affectedMachines* | `str` |  |
> | *affectedUsers* | `str` |  |
> | *allRansomwareProcessesSuspended* | `str` |  |
> | *closeTime* | `str` |  |
> | *closerName* | `str` |  |
> | *creationTime* | `timestamp` |  |
> | *customClassification* | `str` |  |
> | *decisionFeature* | `str` |  |
> | *detectionType* | `str` |  |
> | *elementDisplayName* | `str` |  |
> | *hasRansomwareSuspendedProcesses* | `str` |  |
> | *isBlocked* | `str` |  |
> | *isMalicious* | `bool` |  |
> | *malopActivityTypes* | `str` |  |
> | *malopLastUpdateTime* | `timestamp` |  |
> | *malopStartTime* | `timestamp` |  |
> | *managementStatus* | `str` |  |
> | *primaryRootCauseElements* | `str` |  |
> | *rootCauseElementHashes* | `str` |  |
> | *rootCauseElementNames* | `str` |  |
> | *rootCauseElementTypes* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` |  |
> 
> ### > Macro (anchor)
> 
> edr.cybereason.api_malware
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *detectionEngine* | `str` |  |
> | *detectionValue* | `str` |  |
> | *detectionValueType* | `str` |  |
> | *elementType* | `str` |  |
> | *guid* | `str` |  |
> | *id__elementType* | `str` |  |
> | *id__guid* | `str` |  |
> | *id__malwareType* | `str` |  |
> | *id__timestamp* | `timestamp` |  |
> | *machineName* | `str` |  |
> | *malwareDataModel__Class* | `str` |  |
> | *malwareDataModel__description* | `str` |  |
> | *malwareDataModel__detectionRule* | `str` |  |
> | *malwareDataModel__detectionName* | `str` |  |
> | *malwareDataModel__documentType* | `str` |  |
> | *malwareDataModel__filePath* | `str` |  |
> | *malwareDataModel__type* | `str` |  |
> | *malwareDataModel__module* | `str` |  |
> | *malwareDataModel__processName* | `str` |  |
> | *malwareDataModel__url* | `str` |  |
> | *name* | `str` |  |
> | *needsAttention* | `bool` |  |
> | *referenceElementType* | `str` |  |
> | *referenceGuid* | `str` |  |
> | *schedulerScan* | `bool` |  |
> | *score* | `float8` |  |
> | *status* | `str` |  |
> | *timestamp* | `timestamp` |  |
> | *type* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` |  |
> 
> > Macro (rw-tab)
> 
> - [edr.cybereason.malop](#tag4)
> - [edr.cybereason.malware](#tag5)
> - [edr.cybereason.useractions](#tag6)
> 
> ### > Macro (anchor)
> 
> edr.cybereason.malop
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  | * * |  |
> | *hostname* | `str` | ```
> split(hostchain, "=", 0)
> ``` | *hostchain* |  |
> | *cefVersion* | `str` |  | * * |  |
> | *embDeviceVendor* | `str` |  | * * |  |
> | *embDeviceProduct* | `str` |  | * * |  |
> | *deviceVersion* | `str` |  | * * |  |
> | *signatureID* | `str` |  | * * |  |
> | *name* | `str` |  | * * |  |
> | *severity* | `str` |  | * * |  |
> | *deviceDnsDomain* | `str` |  | * * |  |
> | *dvc* | `ip4` |  | * * |  |
> | *reason* | `str` |  | * * |  |
> | *requestContext* | `str` |  | * * |  |
> | *rt* | `timestamp` | ```
> parsedate(replace(rt_tmp, " UTC", ""), "MMM DD YYYY, HH:mm:ss", "UTC")
> ``` | *rt_tmp* |  |
> | *start* | `timestamp` | ```
> parsedate(replace(start_tmp, " UTC", ""), "MMM DD YYYY, HH:mm:ss", "UTC")
> ``` | *start_tmp* |  |
> | *suser* | `str` |  | * * |  |
> | *malopId* | `str` |  | * * |  |
> | *malopDetectionType* | `str` |  | * * |  |
> | *malopActivityType* | `str` |  | * * |  |
> | *malopSuspect* | `str` |  | * * |  |
> | *malopKeySuspicion* | `str` |  | * * |  |
> | *linkToMalop* | `str` |  | * * |  |
> | *affectedMachine* | `str` |  | * * |  |
> | *affectedMachinesCount* | `int8` |  | * * |  |
> | *affectedUsers* | `int8` |  | * * |  |
> | *malopCreationTime* | `timestamp` | ```
> parsedate(replace(malopCreationTime_tmp, " UTC", ""), "MMM DD YYYY, HH:mm:ss", "UTC")
> ``` | *malopCreationTime_tmp* |  |
> | *malopUpdateTime* | `timestamp` | ```
> parsedate(replace(malopUpdateTime_tmp, " UTC", ""), "MMM DD YYYY, HH:mm:ss", "UTC")
> ``` | *malopUpdateTime_tmp* |  |
> | *isSigned* | `int4` |  | * * |  |
> | *isOnline* | `int4` |  | * * |  |
> | *isOriginalMachine* | `int4` |  | * * |  |
> | *parentProcess* | `str` |  | * * |  |
> | *childrenProcess* | `str` |  | * * |  |
> | *OSandVersion* | `str` |  | * * |  |
> | *hostchain* | `str` |  | * * | **✓** |
> | *tag* | `str` |  | * * | **✓** |
> | *rawMessage* | `str` |  | * * | **✓** |
> 
> ### > Macro (anchor)
> 
> edr.cybereason.malware
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *hostname* | `str` | ```
> split(hostchain, "=", 0)
> ``` | *hostchain* |  |
> | *cefVersion* | `str` |  |  |  |
> | *embDeviceVendor* | `str` |  |  |  |
> | *embDeviceProduct* | `str` |  |  |  |
> | *deviceVersion* | `str` |  |  |  |
> | *signatureID* | `str` |  |  |  |
> | *name* | `str` |  |  |  |
> | *severity* | `str` |  |  |  |
> | *eventId* | `str` |  |  |  |
> | *virusName* | `str` |  |  |  |
> | *context* | `str` |  |  |  |
> | *investigation* | `str` |  |  |  |
> | *malwareCreationTime* | `timestamp` | ```
> parsedate(replace(malwareCreationTime_tmp, " UTC", ""), "MMM DD YYYY, HH:mm:ss", "UTC")
> ``` | *malwareCreationTime_tmp* |  |
> | *dvchost* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> edr.cybereason.useractions
> 
> | **Field** | **Type** | **Field transformation** | ***Source *****field***** name*** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  | * * |  |
> | *hostname* | `str` | ```
> split(hostchain, "=", 0)
> ``` | *hostchain* |  |
> | *cefVersion* | `str` |  | * * |  |
> | *embDeviceVendor* | `str` |  | * * |  |
> | *embDeviceProduct* | `str` |  | * * |  |
> | *deviceVersion* | `str` |  | * * |  |
> | *signatureID* | `str` |  | * * |  |
> | *name* | `str` |  | * * |  |
> | *severity* | `str` |  | * * |  |
> | *username* | `str` |  | * * |  |
> | *actionSuccess* | `int4` |  | * * |  |
> | *userActionTime* | `timestamp` | ```
> parsedate(replace(userActionTime_tmp, " UTC", ""), "MMM DD YYYY, HH:mm:ss", "UTC")
> ``` | *userActionTime_tmp* |  |
> | *actionOccuranceTime* | `timestamp` | ```
> parsedate(replace(actionOccuranceTime_tmp, " UTC", ""), "MMM DD YYYY, HH:mm:ss", "UTC")
> ``` | *actionOccuranceTime_tmp* |  |
> | *cn2Label* | `str` |  | * * |  |
> | *cn2* | `int8` |  | * * |  |
> | *cn3Label* | `str` |  | * * |  |
> | *cn3* | `int8` |  | * * |  |
> | *cs2Label* | `str` |  | * * |  |
> | *cs2* | `str` |  | * * |  |
> | *cs3Label* | `str` |  | * * |  |
> | *cs3* | `str` |  | * * |  |
> | *cs4Label* | `str` |  | * * |  |
> | *cs4* | `str` |  | * * |  |
> | *cs5Label* | `str` |  | * * |  |
> | *cs5* | `str` |  | * * |  |
> | *cs6Label* | `str` |  | * * |  |
> | *cs6* | `str` |  | * * |  |
> | *deviceCustomDate2Label* | `str` |  | * * |  |
> | *deviceCustomDate2* | `timestamp` |  | * * |  |
> | *hostchain* | `str` |  | * * | **✓** |
> | *tag* | `str` |  | * * | **✓** |
> | *rawMessage* | `str` |  | * * | **✓** |