---
title: "casb.netskope"
canonical: "https://docs.devo.com/space/latest/94661346/casb.netskope"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `casb.netskope` identify events generated by [CASB Netskope](https://www.netskope.com/products/casb).

## Valid tags and data tables

<span style="color: #282828">The full tag must have </span>3<span style="color: #282828"> levels. The first two are fixed as</span>** **`casb.netskope`<span style="color: #282828">. The third level identifies the type of events sent.</span>

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| Netskope CASB (Cloud Access Security Broker) | `casb.netskope` | `casb.netskope` |
| `casb.netskope.alert` | `casb.netskope.alert` |
| `casb.netskope.application` | `casb.netskope.application` |
| `casb.netskope.audit` | `casb.netskope.audit` |
| `casb.netskope.client` | `casb.netskope.client` |
| `casb.netskope.compromisedcredential` | `casb.netskope.compromisedcredential` |
| `casb.netskope.incident` | `casb.netskope.incident` |
| `casb.netskope.infrastructure` | `casb.netskope.infrastructure` |
| `casb.netskope.malsite` | `casb.netskope.malsite` |
| `casb.netskope.malware` | `casb.netskope.malware` |
| `casb.netskope.network` | `casb.netskope.network` |
| `casb.netskope.page` | `casb.netskope.page` |
| `casb.netskope.policy` | `casb.netskope.policy` |
| `casb.netskope.transaction_events` | `casb.netskope.transaction_events` |
| `casb.netskope.uba` | `casb.netskope.uba` |

For more information, read more [About Devo tags](https://docs.devo.com/space/latest/95126204).

## <span style="color: #282828">How is the data sent to Devo?</span>

Logs generated by CASB Netskope are forwarded to Devo using a dedicated collector. [Contact us](mailto:support@devo.com) if you need to forward these events to your Devo domain so we can guide you through the process.

## Table structure

These are the fields displayed in these tables:

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> - [casb.netskope](#tag0)
> - [casb.netskope.alert](#tag1)
> - [casb.netskope.application](#tag2)
> - [casb.netskope.audit](#tag3)
> - [casb.netskope.client](#tag4)
> 
> ### > Macro (anchor)
> 
> casb.netskope
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *logtype* | `str` | *vtype* |  |
> | *timestamp* | `timestamp` |  |  |
> | *type* | `str` |  |  |
> | *id* | `str` |  |  |
> | *category* | `str` |  |  |
> | *access_method* | `str` |  |  |
> | *traffic_type* | `str` |  |  |
> | *action* | `str` |  |  |
> | *request_id* | `int8` |  |  |
> | *count* | `int4` |  |  |
> | *alert* | `str` |  |  |
> | *alert_type* | `str` |  |  |
> | *policy* | `str` |  |  |
> | *appcategory* | `str` |  |  |
> | *cci* | `int4` |  |  |
> | *ccl* | `str` |  |  |
> | *site* | `str` |  |  |
> | *object* | `str` |  |  |
> | *object_type* | `str` |  |  |
> | *user* | `str` |  |  |
> | *user_ip* | `ip4` |  |  |
> | *ur_normalized* | `str` |  |  |
> | *organization_unit* | `str` |  |  |
> | *os* | `str` |  |  |
> | *os_version* | `str` |  |  |
> | *browser* | `str` |  |  |
> | *device* | `str` |  |  |
> | *from_user* | `str` |  |  |
> | *severity* | `str` |  |  |
> | *url* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` |  | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.netskope.alert
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *machine* | `str` |  |  |  |
> | *timestamp* | `timestamp` |  |  |  |
> | *insertion_epoch_timestamp* | `timestamp` |  |  |  |
> | *type* | `str` |  |  |  |
> | *id* | `str` |  |  |  |
> | *category* | `str` |  |  |  |
> | *access_method* | `str` |  |  |  |
> | *traffic_type* | `str` |  |  |  |
> | *action* | `str` |  |  |  |
> | *request_id* | `int8` |  |  |  |
> | *suppression_key* | `str` |  |  |  |
> | *count* | `int4` |  |  |  |
> | *modified* | `timestamp` |  |  |  |
> | *alert* | `str` |  |  |  |
> | *alert_name* | `str` |  |  |  |
> | *alert_type* | `str` |  |  |  |
> | *acked* | `str` |  |  |  |
> | *policy* | `str` |  |  |  |
> | *app* | `str` |  |  |  |
> | *appcategory* | `str` |  |  |  |
> | *cci* | `int4` |  |  |  |
> | *ccl* | `str` |  |  |  |
> | *site* | `str` |  |  |  |
> | *instance_id* | `str` |  |  |  |
> | *instance* | `str` |  |  |  |
> | *object* | `str` |  |  |  |
> | *object_id* | `str` |  |  |  |
> | *object_type* | `str` |  |  |  |
> | *activity* | `str` |  |  |  |
> | *userkey* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *user* | `str` |  |  |  |
> | *user_ip* | `str` |  |  |  |
> | *ur_normalized* | `str` |  |  |  |
> | *organization_unit* | `str` |  |  |  |
> | *os* | `str` |  |  |  |
> | *browser* | `str` |  |  |  |
> | *device* | `str` |  |  |  |
> | *scan_type* | `str` |  |  |  |
> | *md5* | `str` |  |  |  |
> | *sha256* | `str` |  |  |  |
> | *mime_type* | `str` |  |  |  |
> | *netskope_pop* | `str` |  |  |  |
> | *file_size* | `int4` |  |  |  |
> | *file_type* | `str` |  |  |  |
> | *file_lang* | `str` |  |  |  |
> | *owner* | `str` |  |  |  |
> | *from_user* | `str` |  |  |  |
> | *shared_with* | `str` |  |  |  |
> | *shared_domains* | `str` |  |  |  |
> | *exposure* | `str` |  |  |  |
> | *external_collaborator_count* | `int4` |  |  |  |
> | *internal_collaborator_count* | `int4` |  |  |  |
> | *total_collaborator_count* | `int4` |  |  |  |
> | *dlp_incident_id* | `int8` |  |  |  |
> | *dlp_parent_id* | `int8` |  |  |  |
> | *dlp_file* | `str` |  |  |  |
> | *dlp_profile* | `str` |  |  |  |
> | *dlp_rule* | `str` |  |  |  |
> | *dlp_rule_count* | `int4` |  |  |  |
> | *dlp_rule_severity* | `str` |  |  |  |
> | *dlp_is_unique_count* | `str` |  |  |  |
> | *dlp_mail_parent_id* | `str` |  |  |  |
> | *true_obj_category* | `str` |  |  |  |
> | *true_obj_type* | `str` |  |  |  |
> | *app_session_id* | `int8` |  |  |  |
> | *detection_engine* | `str` |  |  |  |
> | *src_country* | `str` |  |  |  |
> | *src_geoip_src* | `int4` |  |  |  |
> | *src_latitude* | `float8` |  |  |  |
> | *src_longitude* | `float8` |  |  |  |
> | *src_location* | `str` |  |  |  |
> | *src_region* | `str` |  |  |  |
> | *src_timezone* | `str` |  |  |  |
> | *src_zipcode* | `str` |  |  |  |
> | *srcip* | `str` |  |  |  |
> | *dst_country* | `str` |  |  |  |
> | *dst_geoip_src* | `int4` |  |  |  |
> | *dst_latitude* | `float8` |  |  |  |
> | *dst_longitude* | `float8` |  |  |  |
> | *dst_location* | `str` |  |  |  |
> | *dst_region* | `str` |  |  |  |
> | *dst_timezone* | `str` |  |  |  |
> | *dst_zipcode* | `str` |  |  |  |
> | *dstip* | `str` |  |  |  |
> | *hostname* | `str` |  |  |  |
> | *file_id* | `str` |  |  |  |
> | *file_path* | `str` |  |  |  |
> | *file_password_protected* | `str` |  |  |  |
> | *local_md5* | `str` |  |  |  |
> | *local_sha1* | `str` |  |  |  |
> | *local_sha256* | `str` |  |  |  |
> | *malware_id* | `str` |  |  |  |
> | *malware_name* | `str` |  |  |  |
> | *malware_severity* | `str` |  |  |  |
> | *malware_type* | `str` |  |  |  |
> | *severity* | `str` |  |  |  |
> | *severity_id* | `int4` |  |  |  |
> | *shared_type* | `str` |  |  |  |
> | *title* | `str` |  |  |  |
> | *tss_mode* | `str` |  |  |  |
> | *detection_type* | `str` |  |  |  |
> | *malware_profile* | `str` |  |  |  |
> | *scan_time* | `timestamp` |  |  |  |
> | *url* | `str` |  |  |  |
> | *path_id* | `str` |  |  |  |
> | *filename* | `str` |  |  |  |
> | *other_categories_str* | `str` | ```
> join(other_categories_arr, ',')
> ``` | *other_categories_arr* |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.netskope.application
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *machine* | `str` |  |  |  |
> | *timestamp* | `timestamp` |  |  |  |
> | *insertion_epoch_timestamp* | `timestamp` |  |  |  |
> | *type* | `str` |  |  |  |
> | *id* | `str` |  |  |  |
> | *category* | `str` |  |  |  |
> | *access_method* | `str` |  |  |  |
> | *traffic_type* | `str` |  |  |  |
> | *action* | `str` |  |  |  |
> | *request_id* | `int8` |  |  |  |
> | *transaction_id* | `int8` |  |  |  |
> | *suppression_key* | `str` |  |  |  |
> | *count* | `int4` |  |  |  |
> | *dst_geoip_src* | `int4` |  |  |  |
> | *src_geoip_src* | `int4` |  |  |  |
> | *modified* | `timestamp` |  |  |  |
> | *alert* | `str` |  |  |  |
> | *alert_type* | `str` |  |  |  |
> | *policy* | `str` |  |  |  |
> | *policy_id* | `str` |  |  |  |
> | *port* | `int4` |  |  |  |
> | *protocol* | `str` |  |  |  |
> | *app* | `str` |  |  |  |
> | *appcategory* | `str` |  |  |  |
> | *ccl* | `str` |  |  |  |
> | *cci* | `int4` |  |  |  |
> | *site* | `str` |  |  |  |
> | *url* | `str` |  |  |  |
> | *page* | `str` |  |  |  |
> | *page_id* | `int8` |  |  |  |
> | *page_site* | `str` |  |  |  |
> | *app_session_id* | `int8` |  |  |  |
> | *referer* | `str` |  |  |  |
> | *managed_app* | `str` |  |  |  |
> | *telemetry_app* | `str` |  |  |  |
> | *instance_id* | `str` |  |  |  |
> | *instance* | `str` |  |  |  |
> | *object* | `str` |  |  |  |
> | *object_id* | `str` |  |  |  |
> | *object_type* | `str` |  |  |  |
> | *activity* | `str` |  |  |  |
> | *userkey* | `str` |  |  |  |
> | *user_id* | `str` |  |  |  |
> | *user* | `str` |  |  |  |
> | *useragent* | `str` |  |  |  |
> | *ur_normalized* | `str` |  |  |  |
> | *userip* | `ip4` |  |  |  |
> | *organization_unit* | `str` |  |  |  |
> | *os* | `str` |  |  |  |
> | *os_version* | `str` |  |  |  |
> | *browser* | `str` |  |  |  |
> | *browser_version* | `str` |  |  |  |
> | *browser_session_id* | `int8` |  |  |  |
> | *device* | `str` |  |  |  |
> | *device_classification* | `str` |  |  |  |
> | *dom* | `str` |  |  |  |
> | *hostname* | `str` |  |  |  |
> | *incident_id* | `int8` |  |  |  |
> | *nsdeviceuid* | `str` |  |  |  |
> | *managementID* | `str` |  |  |  |
> | *srcip* | `ip4` |  |  |  |
> | *src_location* | `str` |  |  |  |
> | *src_region* | `str` |  |  |  |
> | *src_latitude* | `float8` |  |  |  |
> | *src_longitude* | `float8` |  |  |  |
> | *src_country* | `str` |  |  |  |
> | *src_zipcode* | `str` |  |  |  |
> | *src_timezone* | `str` |  |  |  |
> | *src_time* | `str` |  |  |  |
> | *dstip* | `ip4` |  |  |  |
> | *dst_location* | `str` |  |  |  |
> | *dst_region* | `str` |  |  |  |
> | *dst_latitude* | `float8` |  |  |  |
> | *dst_longitude* | `float8` |  |  |  |
> | *dst_country* | `str` |  |  |  |
> | *dst_zipcode* | `str` |  |  |  |
> | *dst_timezone* | `str` |  |  |  |
> | *scan_type* | `str` |  |  |  |
> | *mime_type* | `str` |  |  |  |
> | *md5* | `str` |  |  |  |
> | *sha256* | `str` |  |  |  |
> | *netskope_pop* | `str` |  |  |  |
> | *file_size* | `int4` |  |  |  |
> | *file_type* | `str` |  |  |  |
> | *file_lang* | `str` |  |  |  |
> | *file_path* | `str` |  |  |  |
> | *file_category* | `str` |  |  |  |
> | *malware_id* | `str` |  |  |  |
> | *malware_name* | `str` |  |  |  |
> | *malware_type* | `str` |  |  |  |
> | *malware_severity* | `str` |  |  |  |
> | *severity* | `str` |  |  |  |
> | *owner* | `str` |  |  |  |
> | *from_user* | `str` |  |  |  |
> | *to_user* | `str` |  |  |  |
> | *shared_with* | `str` |  |  |  |
> | *shared_domains* | `str` |  |  |  |
> | *exposure* | `str` |  |  |  |
> | *external_collaborator_count* | `int4` |  |  |  |
> | *total_collaborator_count* | `int4` |  |  |  |
> | *dlp_incident_id* | `int8` |  |  |  |
> | *dlp_parent_id* | `int8` |  |  |  |
> | *dlp_file* | `str` |  |  |  |
> | *dlp_profile* | `str` |  |  |  |
> | *dlp_rule* | `str` |  |  |  |
> | *dlp_rule_count* | `int4` |  |  |  |
> | *dlp_is_unique_count* | `str` |  |  |  |
> | *dlp_rule_severity* | `str` |  |  |  |
> | *true_obj_type* | `str` |  |  |  |
> | *true_obj_category* | `str` |  |  |  |
> | *sv* | `str` |  |  |  |
> | *other_categories_str* | `str` | ```
> join(other_categories, ',')
> ``` | *other_categories* |  |
> | *universal_connector* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.netskope.audit
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *machine* | `str` |  |  |  |
> | *timestamp* | `timestamp` |  |  |  |
> | *insertion_epoch_timestamp* | `timestamp` |  |  |  |
> | *type* | `str` |  |  |  |
> | *id* | `str` |  |  |  |
> | *category* | `str` |  |  |  |
> | *count* | `int4` |  |  |  |
> | *appcategory* | `str` |  |  |  |
> | *ccl* | `str` |  |  |  |
> | *user* | `str` |  |  |  |
> | *ur_normalized* | `str` |  |  |  |
> | *organization_unit* | `str` |  |  |  |
> | *severity_level* | `int4` |  |  |  |
> | *audit_log_event* | `str` |  |  |  |
> | *supporting_data__data_type* | `str` |  |  |  |
> | *supporting_data__data_values_str* | `str` | ```
> join(supporting_data__data_values, ',')
> ``` | *supporting_data__data_values* |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.netskope.client
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *machine* | `str` |  |  |  |
> | *id* | `str` |  |  |  |
> | *client_install_time* | `timestamp` |  |  |  |
> | *client_version* | `str` |  |  |  |
> | *device_id* | `str` |  |  |  |
> | *host_info__device_make* | `str` |  |  |  |
> | *host_info__device_model* | `str` |  |  |  |
> | *host_info__hostname* | `str` |  |  |  |
> | *host_info__managementID* | `str` |  |  |  |
> | *host_info__nsdeviceuid* | `str` |  |  |  |
> | *host_info__os* | `str` |  |  |  |
> | *host_info__os_version* | `str` |  |  |  |
> | *last_event__actor* | `str` |  |  |  |
> | *last_event__event* | `str` |  |  |  |
> | *last_event__npa_status* | `str` |  |  |  |
> | *last_event__status* | `str` |  |  |  |
> | *last_event__timestamp* | `timestamp` |  |  |  |
> | *users__id_str* | `str` | ```
> join(users__id, ',')
> ``` | *users__id* |  |
> | *users__device_classification_status_str* | `str` | ```
> join(users__device_classification_status, ',')
> ``` | *users__device_classification_status* |  |
> | *users__last_event__actor_str* | `str` | ```
> join(users__last_event__actor, ',')
> ``` | *users__last_event__actor* |  |
> | *users__last_event__event_str* | `str` | ```
> join(users__last_event__event, ',')
> ``` | *users__last_event__event* |  |
> | *users__last_event__npa_status_str* | `str` | ```
> join(users__last_event__npa_status, ',')
> ``` | *users__last_event__npa_status* |  |
> | *users__last_event__status_str* | `str` | ```
> join(users__last_event__status, ',')
> ``` | *users__last_event__status* |  |
> | *users__last_event__timestamp_str* | `str` | ```
> replace(replace(stringify(json(users__last_event__timestamp)), '[', ''), ']', '')
> ``` | *users__last_event__timestamp* |  |
> | *users__user_added_time_str* | `str` | ```
> replace(replace(stringify(json(users__user_added_time)), '[', ''), ']', '')
> ``` | *users__user_added_time* |  |
> | *users__user_source_str* | `str` | ```
> join(users__user_source, ',')
> ``` | *users__user_source* |  |
> | *users__userkey_str* | `str` | ```
> join(users__userkey, ',')
> ``` | *users__userkey* |  |
> | *users__username_str* | `str` | ```
> join(users__username, ',')
> ``` | *users__username* |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> > Macro (rw-tab)
> 
> - [casb.netskope.compromisedcredential](#tag5)
> - [casb.netskope.incident](#tag6)
> - [casb.netskope.infrastructure](#tag7)
> - [casb.netskope.malsite](#tag8)
> 
> ### > Macro (anchor)
> 
> casb.netskope.compromisedcredential
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *id* | `str` |  |
> | *acked* | `str` |  |
> | *alert* | `str` |  |
> | *alert_name* | `str` |  |
> | *alert_type* | `str` |  |
> | *application* | `str` |  |
> | *breach_date* | `timestamp` |  |
> | *breach_description* | `str` |  |
> | *breach_id* | `str` |  |
> | *breach_media_references* | `str` |  |
> | *breach_score* | `int4` |  |
> | *breach_target_references* | `str` |  |
> | *category* | `str` |  |
> | *cci* | `int4` |  |
> | *ccl* | `str` |  |
> | *count* | `int4` |  |
> | *email_source* | `str` |  |
> | *external_email* | `int4` |  |
> | *matched_username* | `str` |  |
> | *organization_unit* | `str` |  |
> | *password_type* | `str` |  |
> | *timestamp* | `timestamp` |  |
> | *type* | `str` |  |
> | *ur_normalized* | `str` |  |
> | *user* | `str` |  |
> | *userkey* | `str` |  |
> | *user_principal_name* | `str` |  |
> | *division* | `str` |  |
> | *s_am_account_type* | `str` |  |
> | *employee_type* | `str` |  |
> | *mail* | `str` |  |
> | *department* | `str` |  |
> | *distinguished_name* | `str` |  |
> | *s_am_account_name* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.netskope.incident
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *id* | `str` |  |
> | *access_method* | `str` |  |
> | *acting_user* | `str` |  |
> | *activity* | `str` |  |
> | *application* | `str` |  |
> | *application_session_id* | `int8` |  |
> | *assignee* | `str` |  |
> | *connection_id* | `int4` |  |
> | *destination_app* | `str` |  |
> | *destination_instance_id* | `str` |  |
> | *destination_location* | `str` |  |
> | *dlp_file* | `str` |  |
> | *dlp_incident_id* | `int8` |  |
> | *dlp_match_info* | `str` |  |
> | *dlp_parent_id* | `int8` |  |
> | *file_language* | `str` |  |
> | *file_size* | `int4` |  |
> | *file_type* | `str` |  |
> | *md5* | `str` |  |
> | *object* | `str` |  |
> | *object_type* | `str` |  |
> | *referrer* | `str` |  |
> | *site* | `str` |  |
> | *source_location* | `str` |  |
> | *status* | `str` |  |
> | *timestamp* | `timestamp` |  |
> | *title* | `str` |  |
> | *true_object_category* | `str` |  |
> | *true_object_type* | `str` |  |
> | *url* | `str` |  |
> | *user* | `str` |  |
> | *user_id* | `str` |  |
> | *zip_file_id* | `str` |  |
> | *classification* | `str` |  |
> | *exposure* | `str` |  |
> | *inline_dlp_match_info* | `str` |  |
> | *original_file_snapshot_id* | `str` |  |
> | *severity* | `str` |  |
> | *bcc* | `str` |  |
> | *cc* | `str` |  |
> | *owner* | `str` |  |
> | *channel* | `str` |  |
> | *instance_id* | `str` |  |
> | *file_path* | `str` |  |
> | *to_user* | `str` |  |
> | *owner_pdl* | `str` |  |
> | *instance2* | `str` |  |
> | *destination_site* | `str` |  |
> | *from_user* | `str` |  |
> | *latest_incident_id* | `int4` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.netskope.infrastructure
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *machine* | `str` |  |
> | *timestamp* | `timestamp` |  |
> | *severity* | `str` |  |
> | *alarm_name* | `str` |  |
> | *device_name* | `str` |  |
> | *metric_value* | `int4` |  |
> | *alarm_description* | `str` |  |
> | *serial* | `str` |  |
> | *supporting_data* | `str` |  |
> | *id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.netskope.malsite
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *id* | `str` |  |
> | *access_method* | `str` |  |
> | *acked* | `str` |  |
> | *action* | `str` |  |
> | *alert* | `str` |  |
> | *alert_name* | `str` |  |
> | *alert_type* | `str` |  |
> | *application* | `str` |  |
> | *application_session_id* | `int8` |  |
> | *appcategory* | `str` |  |
> | *browser* | `str` |  |
> | *browser_session_id* | `int8` |  |
> | *browser_version* | `ip4` |  |
> | *category* | `str` |  |
> | *cci* | `int4` |  |
> | *ccl* | `str` |  |
> | *connection_id* | `int4` |  |
> | *count* | `int4` |  |
> | *device* | `str` |  |
> | *device_classification* | `str` |  |
> | *destination_country* | `str` |  |
> | *destination_latitude* | `float8` |  |
> | *destination_location* | `str` |  |
> | *destination_longitude* | `float8` |  |
> | *destination_region* | `str` |  |
> | *destination_timezone* | `str` |  |
> | *destination_zipcode* | `str` |  |
> | *destination_ip* | `ip4` |  |
> | *destination_host* | `str` |  |
> | *destination_port* | `int4` |  |
> | *destination_geoip_source* | `int4` |  |
> | *event_hostname* | `str` |  |
> | *incident_id* | `int8` |  |
> | *malicious* | `str` |  |
> | *malsite_category* | `str` |  |
> | *malsite_country* | `str` |  |
> | *malsite_id* | `str` |  |
> | *malsite_ip_host* | `ip4` |  |
> | *malsite_latitude* | `float8` |  |
> | *malsite_longitude* | `float8` |  |
> | *malsite_region* | `str` |  |
> | *malsite_first_seen* | `int4` |  |
> | *malsite_last_seen* | `int4` |  |
> | *malsite_confidence* | `int4` |  |
> | *malsite_reputation* | `str` |  |
> | *malsite_hostility* | `str` |  |
> | *malsite_consecutive* | `str` |  |
> | *managed_app* | `str` |  |
> | *notify_template* | `str` |  |
> | *organization_unit* | `str` |  |
> | *os* | `str` |  |
> | *os_version* | `str` |  |
> | *other_categories* | `str` |  |
> | *page* | `str` |  |
> | *page_site* | `str` |  |
> | *policy* | `str` |  |
> | *policy_id* | `str` |  |
> | *protocol* | `str` |  |
> | *request_id* | `int8` |  |
> | *severity* | `str` |  |
> | *severity_level* | `str` |  |
> | *severity_level_id* | `int4` |  |
> | *site* | `str` |  |
> | *source_geo_country_name* | `str` |  |
> | *source_latitude* | `float8` |  |
> | *source_location* | `str` |  |
> | *source_longitude* | `float8` |  |
> | *source_region* | `str` |  |
> | *source_time* | `timestamp` |  |
> | *source_timezone* | `str` |  |
> | *source_zipcode* | `str` |  |
> | *source_ip* | `ip4` |  |
> | *source_geoip_source* | `int4` |  |
> | *telemetry_app* | `str` |  |
> | *threat_match_field* | `str` |  |
> | *threat_match_value* | `str` |  |
> | *threat_source_id* | `int4` |  |
> | *timestamp* | `timestamp` |  |
> | *traffic_type* | `str` |  |
> | *transaction_id* | `int8` |  |
> | *type* | `str` |  |
> | *ur_normalized* | `str` |  |
> | *url* | `str` |  |
> | *user* | `str` |  |
> | *userip* | `ip4` |  |
> | *sfwder* | `str` |  |
> | *suppression_start_time* | `int4` |  |
> | *client_bytes* | `int4` |  |
> | *server_bytes* | `int4` |  |
> | *suppression_end_time* | `int4` |  |
> | *serial* | `str` |  |
> | *object_type* | `str` |  |
> | *malsite_active* | `str` |  |
> | *department* | `str` |  |
> | *log_file_name* | `str` |  |
> | *useragent* | `str` |  |
> | *connection_duration* | `int4` |  |
> | *organization* | `str` |  |
> | *fromlogs* | `str` |  |
> | *referrer* | `str` |  |
> | *co* | `str` |  |
> | *gateway* | `str` |  |
> | *object* | `str` |  |
> | *s_am_account_name* | `str` |  |
> | *appsuite* | `str` |  |
> | *request_count* | `int4` |  |
> | *response_count* | `int4` |  |
> | *from_user* | `str` |  |
> | *division* | `str` |  |
> | *aggregated_user* | `str` |  |
> | *numbytes* | `int4` |  |
> | *universal_connector* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [casb.netskope.malware](#tag9)
> - [casb.netskope.network](#tag10)
> - [casb.netskope.page](#tag11)
> - [casb.netskope.policy](#tag12)
> - [casb.netskope.transaction_event](#tag13)
> - [casb.netskope.uba](#tag14)
> 
> ### > Macro (anchor)
> 
> casb.netskope.malware
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *id* | `str` |  |
> | *access_method* | `str` |  |
> | *acked* | `str` |  |
> | *action* | `str` |  |
> | *activity* | `str` |  |
> | *alert* | `str` |  |
> | *alert_name* | `str` |  |
> | *alert_type* | `str` |  |
> | *application* | `str` |  |
> | *application_name* | `str` |  |
> | *application_session_id* | `int8` |  |
> | *appcategory* | `str` |  |
> | *browser* | `str` |  |
> | *browser_session_id* | `int8` |  |
> | *browser_version* | `str` |  |
> | *category* | `str` |  |
> | *cci* | `str` |  |
> | *ccl* | `str` |  |
> | *connection_id* | `int8` |  |
> | *count* | `int4` |  |
> | *detection_engine* | `str` |  |
> | *device* | `str` |  |
> | *device_classification* | `str` |  |
> | *destination_country* | `str` |  |
> | *destination_latitude* | `float8` |  |
> | *destination_location* | `str` |  |
> | *destination_longitude* | `float8` |  |
> | *destination_region* | `str` |  |
> | *destination_timezone* | `str` |  |
> | *destination_zipcode* | `str` |  |
> | *destination_ip* | `ip4` |  |
> | *destination_geoip_source* | `int4` |  |
> | *file_category* | `str` |  |
> | *file_id* | `str` |  |
> | *file_type* | `str` |  |
> | *event_hostname* | `str` |  |
> | *incident_id* | `int8` |  |
> | *event_instance* | `str` |  |
> | *local_md5* | `str` |  |
> | *local_sha256* | `str` |  |
> | *malware_id* | `str` |  |
> | *malware_name* | `str` |  |
> | *malware_profile* | `str` |  |
> | *malware_severity* | `str` |  |
> | *malware_type* | `str` |  |
> | *managed_app* | `str` |  |
> | *management_id* | `str` |  |
> | *md5* | `str` |  |
> | *ml_detection* | `str` |  |
> | *nsdeviceuid* | `str` |  |
> | *object_type* | `str` |  |
> | *organization_unit* | `str` |  |
> | *os* | `str` |  |
> | *os_version* | `str` |  |
> | *page* | `str` |  |
> | *page_site* | `str` |  |
> | *policy* | `str` |  |
> | *policy_id* | `str` |  |
> | *protocol* | `str` |  |
> | *request_id* | `int8` |  |
> | *scanner_result* | `str` |  |
> | *severity* | `str` |  |
> | *severity_id* | `int4` |  |
> | *site* | `str` |  |
> | *source_geo_country_name* | `str` |  |
> | *source_latitude* | `float8` |  |
> | *source_location* | `str` |  |
> | *source_longitude* | `float8` |  |
> | *source_region* | `str` |  |
> | *source_time* | `timestamp` |  |
> | *source_timezone* | `str` |  |
> | *source_zipcode* | `str` |  |
> | *source_ip* | `ip4` |  |
> | *source_geoip_source* | `int4` |  |
> | *timestamp* | `timestamp` |  |
> | *traffic_type* | `str` |  |
> | *transaction_id* | `int8` |  |
> | *true_filetype* | `str` |  |
> | *tss_scan* | `str` |  |
> | *tss_mode* | `str` |  |
> | *type* | `str` |  |
> | *ur_normalized* | `str` |  |
> | *url* | `str` |  |
> | *user* | `str` |  |
> | *user_id* | `str` |  |
> | *userip* | `ip4` |  |
> | *appsuite* | `str` |  |
> | *user_principal_name* | `str` |  |
> | *user_display_name* | `str` |  |
> | *user_title* | `str` |  |
> | *user_country* | `str` |  |
> | *user_status* | `str` |  |
> | *user_udf_employeeid* | `str` |  |
> | *user_udf_companyname* | `str` |  |
> | *user_udf_supervisorid* | `str` |  |
> | *user_udf_supervisorname* | `str` |  |
> | *user_udf_businesssegmentlevel1* | `str` |  |
> | *user_udf_businesssegmentlevel2* | `str` |  |
> | *user_udf_businesssegmentlevel3* | `str` |  |
> | *user_udf_businesssegmentlevel4* | `str` |  |
> | *user_udf_primarydomain* | `str` |  |
> | *referrer* | `str` |  |
> | *scan_time* | `int4` |  |
> | *instance_id* | `str` |  |
> | *department* | `str` |  |
> | *object* | `str` |  |
> | *file_name* | `str` |  |
> | *modified_date* | `int4` |  |
> | *object_id* | `str` |  |
> | *fastscan_results* | `str` |  |
> | *detection_type* | `str` |  |
> | *scan_type* | `str` |  |
> | *file_path* | `str` |  |
> | *created_date* | `int4` |  |
> | *parent_id* | `str` |  |
> | *sha1* | `str` |  |
> | *manager* | `str` |  |
> | *tss_license* | `str` |  |
> | *sanctioned_instance* | `str` |  |
> | *from_user* | `str` |  |
> | *mime_type* | `str` |  |
> | *company* | `str` |  |
> | *file_size* | `int4` |  |
> | *shared_with* | `str` |  |
> | *title* | `str` |  |
> | *shared_type* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.netskope.network
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *machine* | `str` |  |
> | *timestamp* | `timestamp` |  |
> | *insertion_epoch_timestamp* | `timestamp` |  |
> | *type* | `str` |  |
> | *id* | `str` |  |
> | *category* | `str` |  |
> | *access_method* | `str` |  |
> | *traffic_type* | `str` |  |
> | *action* | `str` |  |
> | *count* | `int4` |  |
> | *policy* | `str` |  |
> | *app* | `str` |  |
> | *appcategory* | `str` |  |
> | *ccl* | `str` |  |
> | *cci* | `str` |  |
> | *client_bytes* | `int4` |  |
> | *client_packets* | `int4` |  |
> | *server_bytes* | `int4` |  |
> | *server_packets* | `int4` |  |
> | *numbytes* | `int4` |  |
> | *total_packets* | `int4` |  |
> | *protocol* | `str` |  |
> | *ip_protocol* | `str` |  |
> | *network_session_id* | `int8` |  |
> | *num_sessions* | `int4` |  |
> | *session_duration* | `str` |  |
> | *userkey* | `str` |  |
> | *user* | `str` |  |
> | *userip* | `ip4` |  |
> | *ur_normalized* | `str` |  |
> | *organization_unit* | `str` |  |
> | *os* | `str` |  |
> | *os_version* | `str` |  |
> | *device* | `str` |  |
> | *domain* | `str` |  |
> | *site* | `str` |  |
> | *srcip* | `ip4` |  |
> | *srcport* | `int4` |  |
> | *src_geoip_src* | `int4` |  |
> | *src_latitude* | `int4` |  |
> | *src_longitude* | `int4` |  |
> | *dsthost* | `str` |  |
> | *dstip* | `ip4` |  |
> | *dstport* | `int4` |  |
> | *start_time* | `str` |  |
> | *end_time* | `str` |  |
> | *tunnel_id* | `int8` |  |
> | *tunnel_type* | `str` |  |
> | *tunnel_up_time* | `str` |  |
> | *host_name* | `str` |  |
> | *netskope_pop* | `str` |  |
> | *publisher_cn* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.netskope.page
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *machine* | `str` |  |  |  |
> | *timestamp* | `timestamp` |  |  |  |
> | *insertion_epoch_timestamp* | `timestamp` |  |  |  |
> | *type* | `str` |  |  |  |
> | *id* | `str` |  |  |  |
> | *category* | `str` |  |  |  |
> | *access_method* | `str` |  |  |  |
> | *traffic_type* | `str` |  |  |  |
> | *user_generated* | `str` |  |  |  |
> | *req_cnt* | `int4` |  |  |  |
> | *resp_cnt* | `int4` |  |  |  |
> | *http_transaction_count* | `int4` |  |  |  |
> | *numbytes* | `int4` |  |  |  |
> | *client_bytes* | `int4` |  |  |  |
> | *server_bytes* | `int4` |  |  |  |
> | *count* | `int4` |  |  |  |
> | *bypass_traffic* | `str` |  |  |  |
> | *bypass_reason* | `str` |  |  |  |
> | *dst_geoip_src* | `int4` |  |  |  |
> | *src_geoip_src* | `int4` |  |  |  |
> | *app* | `str` |  |  |  |
> | *appcategory* | `str` |  |  |  |
> | *ccl* | `str` |  |  |  |
> | *cci* | `int4` |  |  |  |
> | *site* | `str` |  |  |  |
> | *url* | `str` |  |  |  |
> | *page* | `str` |  |  |  |
> | *page_id* | `int8` |  |  |  |
> | *page_starttime* | `timestamp` |  |  |  |
> | *page_endtime* | `timestamp` |  |  |  |
> | *page_duration* | `int4` |  |  |  |
> | *domain* | `str` |  |  |  |
> | *app_session_id* | `int8` |  |  |  |
> | *userkey* | `str` |  |  |  |
> | *user* | `str` |  |  |  |
> | *ur_normalized* | `str` |  |  |  |
> | *userip* | `ip4` |  |  |  |
> | *useragent* | `str` |  |  |  |
> | *organization_unit* | `str` |  |  |  |
> | *os* | `str` |  |  |  |
> | *os_version* | `str` |  |  |  |
> | *browser* | `str` |  |  |  |
> | *browser_version* | `str` |  |  |  |
> | *browser_session_id* | `int8` |  |  |  |
> | *device* | `str` |  |  |  |
> | *hostname* | `str` |  |  |  |
> | *srcip* | `ip4` |  |  |  |
> | *src_location* | `str` |  |  |  |
> | *src_region* | `str` |  |  |  |
> | *src_latitude* | `float8` |  |  |  |
> | *src_longitude* | `float8` |  |  |  |
> | *src_country* | `str` |  |  |  |
> | *src_zipcode* | `str` |  |  |  |
> | *src_time* | `str` |  |  |  |
> | *src_timezone* | `str` |  |  |  |
> | *ssl_decrypt_policy* | `str` |  |  |  |
> | *policy* | `str` |  |  |  |
> | *request_id* | `int8` |  |  |  |
> | *other_categories_str* | `str` | ```
> join(other_categories, ',')
> ``` | other_categories |  |
> | *dstip* | `ip4` |  |  |  |
> | *dstport* | `int4` |  |  |  |
> | *incident_id* | `int8` |  |  |  |
> | *dst_location* | `str` |  |  |  |
> | *dst_region* | `str` |  |  |  |
> | *dst_latitude* | `float8` |  |  |  |
> | *dst_longitude* | `float8` |  |  |  |
> | *dst_country* | `str` |  |  |  |
> | *dst_zipcode* | `str` |  |  |  |
> | *dst_timezone* | `str` |  |  |  |
> | *sv* | `str` |  |  |  |
> | *netskope_pop* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.netskope.policy
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *id* | `str` |  |
> | *access_method* | `str` |  |
> | *acked* | `str` |  |
> | *action* | `str` |  |
> | *activity* | `str` |  |
> | *alert* | `str` |  |
> | *alert_name* | `str` |  |
> | *alert_type* | `str` |  |
> | *application* | `str` |  |
> | *application_session_id* | `int8` |  |
> | *appcategory* | `str` |  |
> | *browser* | `str` |  |
> | *browser_session_id* | `int8` |  |
> | *browser_version* | `ip4` |  |
> | *category* | `str` |  |
> | *cci* | `int4` |  |
> | *ccl* | `str` |  |
> | *connection_id* | `int4` |  |
> | *count* | `int4` |  |
> | *device* | `str` |  |
> | *device_classification* | `str` |  |
> | *destination_country* | `str` |  |
> | *destination_latitude* | `float8` |  |
> | *destination_location* | `str` |  |
> | *destination_longitude* | `float8` |  |
> | *destination_region* | `str` |  |
> | *destination_timezone* | `str` |  |
> | *destination_zipcode* | `str` |  |
> | *destination_ip* | `ip4` |  |
> | *destination_geoip_source* | `int4` |  |
> | *destination_host* | `str` |  |
> | *destination_port* | `int4` |  |
> | *event_hostname* | `str` |  |
> | *incident_id* | `int8` |  |
> | *managed_app* | `str` |  |
> | *management_id* | `str` |  |
> | *nsdeviceuid* | `str` |  |
> | *object_type* | `str` |  |
> | *organization_unit* | `str` |  |
> | *os* | `str` |  |
> | *os_version* | `str` |  |
> | *other_categories* | `str` |  |
> | *page* | `str` |  |
> | *page_site* | `str` |  |
> | *policy* | `str` |  |
> | *policy_id* | `str` |  |
> | *protocol* | `str` |  |
> | *referrer* | `str` |  |
> | *request_id* | `int8` |  |
> | *severity* | `str` |  |
> | *site* | `str` |  |
> | *source_geo_country_name* | `str` |  |
> | *source_latitude* | `float8` |  |
> | *source_location* | `str` |  |
> | *source_longitude* | `float8` |  |
> | *source_region* | `str` |  |
> | *source_time* | `timestamp` |  |
> | *source_timezone* | `str` |  |
> | *source_zipcode* | `str` |  |
> | *source_ip* | `ip4` |  |
> | *source_geoip_source* | `int4` |  |
> | *source_port* | `int4` |  |
> | *telemetry_app* | `str` |  |
> | *timestamp* | `timestamp` |  |
> | *traffic_type* | `str` |  |
> | *transaction_id* | `int8` |  |
> | *type* | `str` |  |
> | *ur_normalized* | `str` |  |
> | *url* | `str` |  |
> | *user* | `str` |  |
> | *useragent* | `str` |  |
> | *userip* | `ip4` |  |
> | *bcc* | `str` |  |
> | *malsite_category* | `str` |  |
> | *file_path* | `str` |  |
> | *message_id* | `str` |  |
> | *profile_emails* | `str` |  |
> | *numbytes* | `int4` |  |
> | *tunnel_id* | `str` |  |
> | *aggregated_user* | `str` |  |
> | *http_status* | `str` |  |
> | *s_am_account_name* | `str` |  |
> | *from_user* | `str` |  |
> | *from_object* | `str` |  |
> | *from_storage* | `str` |  |
> | *to_user* | `str` |  |
> | *to_object* | `str` |  |
> | *to_storage* | `str` |  |
> | *division* | `str` |  |
> | *client_packets* | `int4` |  |
> | *dlp_fail_reason* | `str` |  |
> | *serial* | `str` |  |
> | *threat_match_field* | `str` |  |
> | *data_type* | `str` |  |
> | *smtp_status* | `str` |  |
> | *session_duration* | `int4` |  |
> | *client_bytes* | `int4` |  |
> | *total_collaborator_count* | `int4` |  |
> | *suppression_start_time* | `int4` |  |
> | *scan_type* | `str` |  |
> | *tunnel_up_time* | `int4` |  |
> | *end_time* | `str` |  |
> | *notify_template* | `str` |  |
> | *publisher_cn* | `str` |  |
> | *trust_computer_checked* | `str` |  |
> | *modified* | `int4` |  |
> | *shared_domains* | `str` |  |
> | *q_original_shared* | `str` |  |
> | *justification_type* | `str` |  |
> | *title* | `str` |  |
> | *organization* | `str` |  |
> | *display_name* | `str` |  |
> | *dlp_scan_failed* | `str` |  |
> | *owner* | `str` |  |
> | *cc* | `str` |  |
> | *parent_id* | `str` |  |
> | *dlp_profile* | `str` |  |
> | *app_scopes* | `str` |  |
> | *all_policy_matches* | `str` |  |
> | *appsuite* | `str` |  |
> | *last_name* | `str` |  |
> | *remediation_profile* | `str` |  |
> | *object_id* | `str` |  |
> | *publisher_name* | `str` |  |
> | *file_category* | `str` |  |
> | *sfwder* | `str` |  |
> | *file_size* | `int4` |  |
> | *manager* | `str` |  |
> | *smtp_to* | `str` |  |
> | *threat_match_value* | `str` |  |
> | *exposure* | `str` |  |
> | *file_id* | `str` |  |
> | *server_packets* | `int4` |  |
> | *q_original_filename* | `str` |  |
> | *q_original_version* | `str` |  |
> | *q_admin* | `str` |  |
> | *q_original_filepath* | `str` |  |
> | *q_instance* | `str` |  |
> | *q_app* | `str` |  |
> | *encrypt_failure* | `str` |  |
> | *user_tmp* | `str` |  |
> | *custom_connector* | `str` |  |
> | *s_am_account_type* | `str` |  |
> | *user_country* | `str` |  |
> | *activity_status* | `str` |  |
> | *app_activity* | `str` |  |
> | *gateway* | `str` |  |
> | *sanctioned_instance* | `str` |  |
> | *malicious* | `str` |  |
> | *member_of* | `str` |  |
> | *tunnel_type* | `str` |  |
> | *user_id* | `str` |  |
> | *conn_duration* | `int4` |  |
> | *suppression_end_time* | `int4` |  |
> | *universal_connector* | `str` |  |
> | *orignal_file_path* | `str` |  |
> | *event_instance* | `str` |  |
> | *network* | `str` |  |
> | *start_time* | `str` |  |
> | *num_sessions* | `int4` |  |
> | *external_collaborator_count* | `int4` |  |
> | *mime_type* | `str` |  |
> | *network_session_id* | `str` |  |
> | *sender* | `str` |  |
> | *log_file_name* | `str` |  |
> | *shared_with* | `str` |  |
> | *md5* | `str` |  |
> | *file_type* | `str` |  |
> | *malware_name* | `str` |  |
> | *malware_id* | `str` |  |
> | *malware_type* | `str` |  |
> | *malware_severity* | `str` |  |
> | *tss_mode* | `str` |  |
> | *tss_scan* | `str` |  |
> | *tss_scan_failed* | `str` |  |
> | *tss_fail_reason* | `str` |  |
> | *instance_id* | `str` |  |
> | *justification_reason* | `str` |  |
> | *internal_collaborator_count* | `int4` |  |
> | *mail* | `str` |  |
> | *quarantine_file_name* | `str` |  |
> | *quarantine_file_id* | `str` |  |
> | *quarantine_profile* | `str` |  |
> | *quarantine_profile_id* | `str` |  |
> | *server_bytes* | `int4` |  |
> | *group* | `str` |  |
> | *object* | `str` |  |
> | *dynamic_classification* | `str` |  |
> | *forward_to_proxy_xau* | `str` |  |
> | *ip_protocol* | `str` |  |
> | *two_factor_auth* | `str` |  |
> | *act_user* | `str` |  |
> | *redirect_url* | `str` |  |
> | *threat_source_id* | `int4` |  |
> | *activity_type* | `str` |  |
> | *total_packets* | `int4` |  |
> | *object_count* | `int4` |  |
> | *event_type* | `str` |  |
> | *distinguished_name* | `str` |  |
> | *protocol_port* | `str` |  |
> | *risk_level* | `str` |  |
> | *suppression_key* | `str` |  |
> | *request_count* | `int4` |  |
> | *response_count* | `int4` |  |
> | *sessionid* | `str` |  |
> | *message_size* | `int4` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.netskope.transaction_events
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  | * * |  |
> | *hostname* | `str` |  | * * |  |
> | *serverdate* | `timestamp` | ```
> parsedate(serverdate_str, dateformat("YYYY-MM-DD HH:mm:ss"))
> ``` | *serverdate_str* |  |
> | *time_taken* | `int4` | ```
> int4(time_taken_tmp)
> ``` | *time_taken_tmp* |  |
> | *cs_bytes* | `int4` | ```
> int4(cs_bytes_tmp)
> ``` | *cs_bytes_tmp* |  |
> | *sc_bytes* | `int4` | ```
> int4(sc_bytes_tmp)
> ``` | *sc_bytes_tmp* |  |
> | *bytes* | `int4` | ```
> int4(bytes_tmp)
> ``` | *bytes_tmp* |  |
> | *c_ip* | `ip4` | ```
> ip4(c_ip_tmp)
> ``` | *c_ip_tmp* |  |
> | *s_ip* | `ip4` | ```
> ip4(s_ip_tmp)
> ``` | *s_ip_tmp* |  |
> | *cs_username* | `str` |  | * * |  |
> | *cs_method* | `str` |  | * * |  |
> | *cs_uri_scheme* | `str` |  | * * |  |
> | *cs_uri_query* | `str` |  | * * |  |
> | *cs_user_agent* | `str` |  | * * |  |
> | *cs_content_type* | `str` |  | * * |  |
> | *sc_status* | `str` |  | * * |  |
> | *sc_content_type* | `str` |  | * * |  |
> | *cs_dns* | `str` |  | * * |  |
> | *cs_host* | `str` |  | * * |  |
> | *cs_uri* | `str` |  | * * |  |
> | *cs_url* | `str` | ```
> cs_host + cs_uri
> ``` | *cs_host*<br>*cs_uri* |  |
> | *cs_uri_port* | `str` |  | * * |  |
> | *cs_referer* | `str` |  | * * |  |
> | *x_cs_session_id* | `str` |  | * * |  |
> | *x_cs_access_method* | `str` |  | * * |  |
> | *x_cs_app* | `str` |  | * * |  |
> | *x_s_country* | `str` |  | * * |  |
> | *x_s_latitude* | `str` |  | * * |  |
> | *x_s_longitude* | `str` |  | * * |  |
> | *x_s_location* | `str` |  | * * |  |
> | *x_s_region* | `str` |  | * * |  |
> | *x_s_zipcode* | `str` |  | * * |  |
> | *x_c_country* | `str` |  | * * |  |
> | *x_c_latitude* | `str` |  | * * |  |
> | *x_c_longitude* | `str` |  | * * |  |
> | *x_c_location* | `str` |  | * * |  |
> | *x_c_region* | `str` |  | * * |  |
> | *x_c_zipcode* | `str` |  | * * |  |
> | *x_c_os* | `str` |  | * * |  |
> | *x_c_browser* | `str` |  | * * |  |
> | *x_c_browser_version* | `str` |  | * * |  |
> | *x_c_device* | `str` |  | * * |  |
> | *x_cs_site* | `str` |  | * * |  |
> | *x_cs_timestamp* | `timestamp` | ```
> timestamp(int8(x_cs_timestamp_tmp) * 1000)
> ``` | *x_cs_timestamp_tmp* |  |
> | *x_cs_page_id* | `str` |  | * * |  |
> | *x_cs_userip* | `ip4` | ```
> ip4(x_cs_userip_tmp)
> ``` | *x_cs_userip_tmp* |  |
> | *x_cs_traffic_type* | `str` |  | * * |  |
> | *x_cs_tunnel_id* | `str` |  | * * |  |
> | *x_category* | `str` |  | * * |  |
> | *x_other_category* | `str` |  | * * |  |
> | *x_type* | `str` |  | * * |  |
> | *x_server_ssl_err* | `str` |  | * * |  |
> | *x_client_ssl_err* | `str` |  | * * |  |
> | *x_transaction_id* | `str` |  | * * |  |
> | *x_request_id* | `str` |  | * * |  |
> | *x_cs_domain_fronted_sni* | `str` |  | * * |  |
> | *x_cs_sni* | `str` |  | * * |  |
> | *hostchain* | `str` |  | * * | **✓** |
> | *tag* | `str` |  | * * | **✓** |
> | *rawMessage* | `str` |  | * * | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.netskope.uba
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *id* | `str` |  |
> | *access_method* | `str` |  |
> | *acked* | `str` |  |
> | *action* | `str` |  |
> | *activity* | `str` |  |
> | *alert* | `str` |  |
> | *alert_id* | `str` |  |
> | *alert_name* | `str` |  |
> | *alert_type* | `str` |  |
> | *application* | `str` |  |
> | *application_session_id* | `int8` |  |
> | *appcategory* | `str` |  |
> | *bin_timestamp* | `timestamp` |  |
> | *browser* | `str` |  |
> | *browser_session_id* | `int8` |  |
> | *browser_version* | `ip4` |  |
> | *category* | `str` |  |
> | *cci* | `int4` |  |
> | *ccl* | `str` |  |
> | *connection_id* | `int4` |  |
> | *count* | `int4` |  |
> | *device* | `str` |  |
> | *device_classification* | `str` |  |
> | *destination_country* | `str` |  |
> | *destination_location* | `str` |  |
> | *destination_region* | `str` |  |
> | *destination_timezone* | `str` |  |
> | *destination_zipcode* | `str` |  |
> | *destination_geoip_source* | `int4` |  |
> | *destination_longitude* | `float8` |  |
> | *destination_latitude* | `float8` |  |
> | *destination_ip* | `ip4` |  |
> | *event_type* | `str` |  |
> | *from_user* | `str` |  |
> | *event_hostname* | `str` |  |
> | *incident_id* | `int8` |  |
> | *instance_id* | `str` |  |
> | *managed_app* | `str` |  |
> | *management_id* | `str` |  |
> | *object* | `str` |  |
> | *object_type* | `str` |  |
> | *organization_unit* | `str` |  |
> | *os* | `str` |  |
> | *os_version* | `str` |  |
> | *page* | `str` |  |
> | *page_site* | `str` |  |
> | *policy* | `str` |  |
> | *policy_actions* | `str` |  |
> | *policy_id* | `str` |  |
> | *profile_id* | `str` |  |
> | *protocol* | `str` |  |
> | *referrer* | `str` |  |
> | *request_id* | `int8` |  |
> | *risk_level* | `str` |  |
> | *risk_level_id* | `int4` |  |
> | *sanctioned_instance* | `str` |  |
> | *score* | `str` |  |
> | *severity* | `str` |  |
> | *shared_credential_user* | `str` |  |
> | *site* | `str` |  |
> | *source_geo_country_name* | `str` |  |
> | *source_location* | `str` |  |
> | *source_region* | `str` |  |
> | *source_time* | `timestamp` |  |
> | *source_timezone* | `str` |  |
> | *source_zipcode* | `str` |  |
> | *source_ip* | `ip4` |  |
> | *source_longitude* | `float8` |  |
> | *source_latitude* | `float8` |  |
> | *source_geoip_source* | `int4` |  |
> | *surhn* | `str` |  |
> | *telemetry_app* | `str` |  |
> | *threshold_time* | `int4` |  |
> | *timestamp* | `timestamp` |  |
> | *traffic_type* | `str` |  |
> | *transaction_id* | `int8` |  |
> | *type* | `str` |  |
> | *ur_normalized* | `str` |  |
> | *url* | `str` |  |
> | *user* | `str` |  |
> | *useragent* | `str` |  |
> | *userip* | `ip4` |  |
> | *userkey* | `str` |  |
> | *tss_scan* | `str` |  |
> | *to_object* | `str` |  |
> | *division* | `str` |  |
> | *app_category* | `str` |  |
> | *from_user_category* | `str` |  |
> | *last_device* | `str` |  |
> | *scopes* | `str` |  |
> | *user_space_name* | `str` |  |
> | *suppression_end_time* | `int4` |  |
> | *download_app* | `str` |  |
> | *window_id* | `int4` |  |
> | *event_source_channel* | `str` |  |
> | *last_timestamp* | `int4` |  |
> | *created_time* | `str` |  |
> | *app_activity* | `str` |  |
> | *distinguished_name* | `str` |  |
> | *netskope_activity* | `str` |  |
> | *md5* | `str` |  |
> | *object_id* | `str` |  |
> | *uba_ap1* | `str` |  |
> | *file_size* | `int4` |  |
> | *manager* | `str` |  |
> | *audit_type* | `str` |  |
> | *last_country* | `str` |  |
> | *loginurl* | `str` |  |
> | *tss_scan_failed* | `str` |  |
> | *act_user* | `str` |  |
> | *user_principal_name* | `str` |  |
> | *logintype* | `str` |  |
> | *uba_ap2* | `str` |  |
> | *user_space_id* | `str` |  |
> | *display_name* | `str` |  |
> | *two_factor_auth* | `str` |  |
> | *uba_inst2* | `str` |  |
> | *audit_category* | `str` |  |
> | *file_category* | `str` |  |
> | *employee_type* | `str` |  |
> | *object_count* | `int4` |  |
> | *file_type* | `str` |  |
> | *to_user_category* | `str` |  |
> | *mail* | `str` |  |
> | *user_category* | `str` |  |
> | *last_app* | `str` |  |
> | *all_policy_matches* | `str` |  |
> | *account_type* | `str` |  |
> | *group* | `str` |  |
> | *tss_fail_reason* | `str` |  |
> | *to_user* | `str` |  |
> | *uba_inst1* | `str` |  |
> | *parent_id* | `str` |  |
> | *user_id* | `str` |  |
> | *last_region* | `str` |  |
> | *anomaly_type* | `str` |  |
> | *policy_name* | `str` |  |
> | *activity_status* | `str` |  |
> | *appsuite* | `str` |  |
> | *web_universal_connector* | `str` |  |
> | *threshold* | `int4` |  |
> | *username* | `str` |  |
> | *s_am_account_name* | `str` |  |
> | *suppression_start_time* | `int4` |  |
> | *last_location* | `str` |  |
> | *user_role* | `str` |  |
> | *tss_mode* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |