---
title: "dmp.cohesity"
canonical: "https://docs.devo.com/space/latest/596705284/dmp.cohesity"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `dmp.cohesity` identify events generated by [Cohesity](https://www.cohesity.com/).

## Valid tags and data tables 

The full tag must have 4 levels. The first two are fixed as** **`dmp.cohesity`. The third level identifies the type of events sent. The fourth level indicates the event subtype.

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| Cohesity Helios | `dmp.cohesity.helios.alerts` | `dmp.cohesity.helios.alerts` |
| `dmp.cohesity.helios.audit` | `dmp.cohesity.helios.audit` |

For more information, read more [About Devo tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204).

## Table structure

These are the fields displayed in these tables:

- [dmp.cohesity.helios.alerts](#tag1)
- [dmp.cohesity.helios.audit](#tag1)

### > Macro (anchor)

dmp.cohesity.helios.alerts

| **Field** | **Type** | ***Extra***** fields** |
| --- | --- | --- |
| *eventdate* | `timestamp` |  |
| *hostname* | `str` |  |
| *id* | `str` |  |
| *alert_code* | `str` |  |
| *first_timestamp_usecs* | `int8` |  |
| *latest_timestamp_usecs* | `int8` |  |
| *alert_category* | `str` |  |
| *alert_type* | `int4` |  |
| *severity* | `str` |  |
| *alert_state* | `str` |  |
| *property_list* | `str` |  |
| *dedup_timestamps* | `str` |  |
| *dedup_count* | `int4` |  |
| *alert_name* | `str` |  |
| *alert_description* | `str` |  |
| *alert_cause* | `str` |  |
| *alert_help_text* | `str` |  |
| *cluster_name* | `str` |  |
| *cluster_id* | `str` |  |
| *event_source* | `str` |  |
| *alert_type_bucket* | `str` |  |
| *at_devo_pulling_id* | `str` |  |
| *hostchain* | `str` | ** ✓** |
| *tag* | `str` | ** ✓** |
| *rawMessage* | `str` | ** ✓** |

### > Macro (anchor)

dmp.cohesity.helios.audit

| **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- | --- |
| *eventdate* | `timestamp` |  | * * |  |
| *hostname* | `str` |  | * * |  |
| *details* | `str` |  | * * |  |
| *username* | `str` |  | * * |  |
| *domain* | `str` |  | * * |  |
| *source_type* | `str` |  | * * |  |
| *entity_name* | `str` |  | * * |  |
| *entity_type* | `str` |  | * * |  |
| *action* | `str` |  | * * |  |
| *timestamp_usecs* | `int8` |  | * * |  |
| *ip* | `str` |  | * * |  |
| *ipv4* | `ip4` |  | * * |  |
| *ipv6* | `ip6` |  | * * |  |
| *is_impersonation* | `bool` |  | * * |  |
| *cluster_identifier* | `str` |  | * * |  |
| *cluster_name* | `str` |  | * * |  |
| *tenant_id* | `str` |  | * * |  |
| *original_tenant_id* | `str` |  | * * |  |
| *previous_record* | `str` |  | * * |  |
| *service_context* | `str` |  | * * |  |
| *new_record_name* | `str` | ```
join(new_record_name_array, ',')
``` | *new_record_name_array* |  |
| *new_record_label* | `str` | ```
join(new_record_label_array, ',')
``` | *new_record_label_array* |  |
| *new_record_privileges* | `str` | ```
join(new_record_privileges_array, ',')
``` | *new_record_privileges_array* |  |
| *new_record_is_custom_role* | `str` | ```
replace(replace(stringify(json(new_record_is_custom_role_array)), '[', ''), ']', '')
``` | *new_record_is_custom_role_array* |  |
| *new_record_tenant_ids* | `str` | ```
join(new_record_tenant_ids_array, ',')
``` | *new_record_tenant_ids_array* |  |
| *new_record_username* | `str` | ```
join(new_record_username_array, ',')
``` | *new_record_username_array* |  |
| *new_record_domain* | `str` | ```
join(new_record_domain_array, ',')
``` | *new_record_domain_array* |  |
| *new_record_email_address* | `str` | ```
join(new_record_email_address_array, ',')
``` | *new_record_email_address_array* |  |
| *new_record_roles* | `str` | ```
join(new_record_roles_array, ',')
``` | *new_record_roles_array* |  |
| *new_record_privilege_ids* | `str` | ```
join(new_record_privilege_ids_array, ',')
``` | *new_record_privilege_ids_array* |  |
| *new_record_cluster_identifiers* | `str` | ```
join(new_record_cluster_identifiers_array, ',')
``` | *new_record_cluster_identifiers_array* |  |
| *new_record_effective_time_msecs* | `str` | ```
replace(replace(stringify(json(new_record_effective_time_msecs_array)), '[', ''), ']', '')
``` | *new_record_effective_time_msecs_array* |  |
| *new_record_restricted* | `str` | ```
replace(replace(stringify(json(new_record_restricted_array)), '[', ''), ']', '')
``` | *new_record_restricted_array* |  |
| *new_record_created_time_msecs* | `str` | ```
replace(replace(stringify(json(new_record_created_time_msecs_array)), '[', ''), ']', '')
``` | *new_record_created_time_msecs_array* |  |
| *new_record_last_updated_time_msecs* | `str` | ```
replace(replace(stringify(json(new_record_last_updated_time_msecs_array)), '[', ''), ']', '')
``` | *new_record_last_updated_time_msecs_array* |  |
| *new_record_sid* | `str` | ```
join(new_record_sid_array, ',')
``` | *new_record_sid_array* |  |
| *new_record_s3_account_id* | `str` | ```
join(new_record_s3_account_id_array, ',')
``` | *new_record_s3_account_id_array* |  |
| *new_record_s3_access_key_id* | `str` | ```
join(new_record_s3_access_key_id_array, ',')
``` | *new_record_s3_access_key_id_array* |  |
| *new_record_s3_secret_key* | `str` | ```
join(new_record_s3_secret_key_array, ',')
``` | *new_record_s3_secret_key_array* |  |
| *new_record_force_password_change* | `str` | ```
replace(replace(stringify(json(new_record_force_password_change_array)), '[', ''), ']', '')
``` | *new_record_force_password_change_array* |  |
| *new_record_is_account_locked* | `str` | ```
replace(replace(stringify(json(new_record_is_account_locked_array)), '[', ''), ']', '')
``` | *new_record_is_account_locked_array* |  |
| *new_record_lockout_reason* | `str` | ```
join(new_record_lockout_reason_array, ',')
``` | *new_record_lockout_reason_array* |  |
| *new_record_last_successful_login_time_msecs* | `str` | ```
replace(replace(stringify(json(new_record_last_successful_login_time_msecs_array)), '[', ''), ']', '')
``` | *new_record_last_successful_login_time_msecs_array* |  |
| *new_record_mfa_info_is_user_exempt_from_mfa_str* | `str` | ```
replace(replace(stringify(json(new_record_mfa_info_is_user_exempt_from_mfa)), '[', ''), ']', '')
``` | *new_record_mfa_info_is_user_exempt_from_mfa* |  |
| *new_record_mfa_info_is_totp_setup_done_str* | `str` | ```
replace(replace(stringify(json(new_record_mfa_info_is_totp_setup_done)), '[', ''), ']', '')
``` | *new_record_mfa_info_is_totp_setup_done* |  |
| *new_record_description* | `str` | ```
join(new_record_description_array, ',')
``` | *new_record_description_array* |  |
| *new_record_domain_name* | `str` | ```
join(new_record_domain_name_array, ',')
``` | *new_record_domain_name_array* |  |
| *new_record_machine_accounts* | `str` | ```
join(new_record_machine_accounts_array, ',')
``` | *new_record_machine_accounts_array* |  |
| *new_record_ou_name* | `str` | ```
join(new_record_ou_name_array, ',')
``` | *new_record_ou_name_array* |  |
| *new_record_workgroup* | `str` | ```
join(new_record_workgroup_array, ',')
``` | *new_record_workgroup_array* |  |
| *new_record_preferred_domain_controllers* | `str` | ```
join(new_record_preferred_domain_controllers_array, ',')
``` | *new_record_preferred_domain_controllers_array* |  |
| *new_record_trusted_domains_enabled* | `str` | ```
replace(replace(stringify(json(new_record_trusted_domains_enabled_array)), '[', ''), ']', '')
``` | *new_record_trusted_domains_enabled_array* |  |
| *new_record_task_path* | `str` | ```
join(new_record_task_path_array, ',')
``` | *new_record_task_path_array* |  |
| *at_devo_pulling_id* | `str` |  | * * |  |
| *hostchain* | `str` |  | * * | **✓** |
| *tag* | `str` |  | * * | **✓** |
| *rawMessage* | `str` |  | * * | **✓** |