---
title: "endpoint.vmware"
canonical: "https://docs.devo.com/space/latest/94662786/endpoint.vmware"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `endpoint.vmware` identify events generated by <span style="color: #000000">[VM Ware Carbon Black](https://www.vmware.com/products/whats-new/carbon-black.html)</span>. 

## Valid tags and data tables

<span style="color: #282828">The full tag must have </span><span style="color: #000000">4</span><span style="color: #282828"> levels. The first two are fixed as</span><span style="color: #ff0000">** **</span>`endpoint.vmware`<span style="color: #282828">. The third level identifies the type of events sent, and the fourth level indicates the event subtype. </span>

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| VMware Carbon Black | `endpoint.vmware.cbc_api.alerts` | `endpoint.vmware.cbc_api.alerts` |
| `endpoint.vmware.cbc_defender.audit_logs` | `endpoint.vmware.cbc_defender.audit_logs` |
| `endpoint.vmware.cbc_event_forwarder` | `endpoint.vmware.cbc_event_forwarder` |
| `endpoint.vmware.cbc_event_forwarder.auth` | `endpoint.vmware.cbc_event_forwarder.auth` |
| `endpoint.vmware.cbc_event_forwarder.cb_analytics` | `endpoint.vmware.cbc_event_forwarder.cb_analytics` |
| `endpoint.vmware.cbc_event_forwarder.device_control` | `endpoint.vmware.cbc_event_forwarder.device_control` |
| `endpoint.vmware.cbc_event_forwarder.endpoint_event_apicall` | `endpoint.vmware.cbc_event_forwarder.endpoint_event_apicall` |
| `endpoint.vmware.cbc_event_forwarder.endpoint_event_crossproc` | `endpoint.vmware.cbc_event_forwarder.endpoint_event_crossproc` |
| `endpoint.vmware.cbc_event_forwarder.endpoint_event_fileless_scriptload` | `endpoint.vmware.cbc_event_forwarder.endpoint_event_fileless_scriptload` |
| `endpoint.vmware.cbc_event_forwarder.endpoint_event_filemod` | `endpoint.vmware.cbc_event_forwarder.endpoint_event_filemod` |
| `endpoint.vmware.cbc_event_forwarder.endpoint_event_moduleload` | `endpoint.vmware.cbc_event_forwarder.endpoint_event_moduleload` |
| `endpoint.vmware.cbc_event_forwarder.endpoint_event_netconn` | `endpoint.vmware.cbc_event_forwarder.endpoint_event_netconn` |
| `endpoint.vmware.cbc_event_forwarder.endpoint_event_procend` | `endpoint.vmware.cbc_event_forwarder.endpoint_event_procend` |
| `endpoint.vmware.cbc_event_forwarder.endpoint_event_procstart` | `endpoint.vmware.cbc_event_forwarder.endpoint_event_procstart` |
| `endpoint.vmware.cbc_event_forwarder.endpoint_event_regmod` | `endpoint.vmware.cbc_event_forwarder.endpoint_event_regmod` |
| `endpoint.vmware.cbc_event_forwarder.endpoint_event_scriptload` | `endpoint.vmware.cbc_event_forwarder.endpoint_event_scriptload` |
| `endpoint.vmware.cbc_event_forwarder.kognos_alerts` | `endpoint.vmware.cbc_event_forwarder.kognos_alerts` |
| `endpoint.vmware.cbc_event_forwarder.kognos_events` | `endpoint.vmware.cbc_event_forwarder.kognos_events` |
| `endpoint.vmware.cbc_event_forwarder.unknown` | `endpoint.vmware.cbc_event_forwarder.unknown` |
| `endpoint.vmware.cbc_event_forwarder.watchlist` | `endpoint.vmware.cbc_event_forwarder.watchlist` |
| `endpoint.vmware.cbc_event_forwarder.watchlist_hit` | `endpoint.vmware.cbc_event_forwarder.watchlist_hit` |
| `endpoint.vmware.cbc_liveops.live_query` | `endpoint.vmware.cbc_liveops.live_query` |

## Table structure

These are the fields displayed in these tables:

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> - [endpoint.vmware.cbc_api.alerts](#tag1)
> - [endpoint.vmware.cbc_defender.audit_logs](#tag2)
> - [endpoint.vmware.cbc_event_forwarder](#tag3)
> - [endpoint.vmware.cbc_event_forwarder.auth](#endpoint.vmware.cbc_event_forwarder.auth)
> - [endpoint.vmware.cbc_event_forwarder.cb_analytics](#tag4)
> - [endpoint.vmware.cbc_event_forwarder.device_control](#endpoint.vmware.cbc_event_forwarder.device_control)
> - [endpoint.vmware.cbc_event_forwarder.endpoint_event_apicall](#tag5)
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_api.alerts
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *devo_pulling_id* | `str` |  |  |
> | *id* | `str` |  |  |
> | *org_key* | `str` |  |  |
> | *last_update_time* | `timestamp` |  |  |
> | *threat_id* | `str` |  |  |
> | *severity* | `int4` |  |  |
> | *device_id* | `int8` |  |  |
> | *device_os* | `str` |  |  |
> | *device_os_version* | `str` |  |  |
> | *device_name* | `str` |  |  |
> | *device_username* | `str` |  |  |
> | *workflow__changed_by* | `str` |  |  |
> | *tags* | `str` |  |  |
> | *reason* | `str` |  |  |
> | *report_id* | `str` |  |  |
> | *report_name* | `str` |  |  |
> | *ioc_id* | `str` |  |  |
> | *ioc_hit* | `str` |  |  |
> | *watchlists* | `str` |  |  |
> | *process_guid* | `str` |  |  |
> | *process_name* | `str` |  |  |
> | *run_state* | `str` |  |  |
> | *type* | `str` |  |  |
> | *alert_url* | `str` |  |  |
> | *is_updated* | `bool` |  |  |
> | *backend_timestamp* | `timestamp` |  |  |
> | *user_update_timestamp* | `timestamp` |  |  |
> | *backend_update_timestamp* | `timestamp` |  |  |
> | *reason_code* | `str` |  |  |
> | *sensor_action* | `str` |  |  |
> | *alert_notes_present* | `bool` |  |  |
> | *alert_origin* | `str` |  |  |
> | *asset_group* | `str` |  |  |
> | *device_uem_id* | `str` |  |  |
> | *device_policy* | `str` |  |  |
> | *device_policy_id* | `int4` |  |  |
> | *device_location* | `str` |  |  |
> | *device_external_ip* | `str` |  |  |
> | *device_external_ipv4* | `ip4` |  |  |
> | *device_external_ipv6* | `ip6` |  |  |
> | *device_internal_ip* | `str` |  |  |
> | *device_internal_ipv4* | `ip4` |  |  |
> | *device_internal_ipv6* | `ip6` |  |  |
> | *mdr_alert* | `bool` |  |  |
> | *mdr_alert_notes_present* | `bool` |  |  |
> | *mdr_threat_notes_present* | `bool` |  |  |
> | *report_link* | `str` |  |  |
> | *threat_notes_present* | `bool` |  |  |
> | *primary_event_id* | `str` |  |  |
> | *process_pid* | `str` |  |  |
> | *process_sha256* | `str` |  |  |
> | *process_md5* | `str` |  |  |
> | *process_reputation* | `str` |  |  |
> | *process_effective_reputation* | `str` |  |  |
> | *process_cmdline* | `str` |  |  |
> | *process_username* | `str` |  |  |
> | *process_issuer* | `str` |  |  |
> | *process_publisher* | `str` |  |  |
> | *parent_guid* | `str` |  |  |
> | *parent_pid* | `str` |  |  |
> | *parent_name* | `str` |  |  |
> | *parent_sha256* | `str` |  |  |
> | *parent_md5* | `str` |  |  |
> | *parent_reputation* | `str` |  |  |
> | *parent_effective_reputation* | `str` |  |  |
> | *parent_cmdline* | `str` |  |  |
> | *parent_username* | `str` |  |  |
> | *childproc_guid* | `str` |  |  |
> | *childproc_username* | `str` |  |  |
> | *childproc_cmdline* | `str` |  |  |
> | *ml_classification_final_verdict* | `str` |  |  |
> | *ml_classification_global_prevalence* | `str` |  |  |
> | *ml_classification_org_prevalence* | `str` |  |  |
> | *ml_classification_anomalies* | `str` |  |  |
> | *workflow__changed_by_type* | `str` |  |  |
> | *workflow__closure_reason* | `str` |  |  |
> | *determination__change_timestamp* | `timestamp` |  |  |
> | *determination__value* | `str` |  |  |
> | *determination__changed_by_type* | `str` |  |  |
> | *determination__changed_by* | `str` |  |  |
> | *report_description* | `str` |  |  |
> | *report_tags* | `str` |  |  |
> | *detection_timestamp* | `timestamp` | *create_time* |  |
> | *first_event_timestamp* | `timestamp` | *first_event_time* |  |
> | *last_event_timestamp* | `timestamp` | *last_event_time* |  |
> | *workflow__status* | `str` | *workflow__state* |  |
> | *device_target_value* | `str` | *target_value* |  |
> | *workflow__change_timestamp* | `timestamp` | *workflow__last_update_time* |  |
> | *policy_applied* | `str` | *policy_name* |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` |  | **✓** |
> | *rawMessage* | `str` |  | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_defender.audit_logs
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *devo_pulling_id* | `str` |  |
> | *org_key* | `str` |  |
> | *requestUrl* | `str` |  |
> | *orgName* | `str` |  |
> | *eventId* | `str` |  |
> | *eventTime* | `timestamp` |  |
> | *loginName* | `str` |  |
> | *flagged* | `bool` |  |
> | *clientIp* | `ip4` |  |
> | *verbose* | `bool` |  |
> | *description* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *hostname* | `str` |  |  |
> | *type* | `str` |  |  |
> | *eventType* | `str` | *vEventType* |  |
> | *at_devo_pulling_id* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` |  | **✓** |
> | *rawMessage* | `str` |  |  |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.auth
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *version* | `str` |  |
> | *type* | `str` |  |
> | *event_id* | `str` |  |
> | *process_guid* | `str` |  |
> | *parent_guid* | `str` |  |
> | *backend_stamp* | `str` |  |
> | *organization_key* | `str` |  |
> | *device_id* | `str` |  |
> | *device_name* | `str` |  |
> | *device_os* | `str` |  |
> | *device_os_version* | `str` |  |
> | *device_policy* | `str` |  |
> | *device_target_priority* | `str` |  |
> | *device_timestamp* | `str` |  |
> | *device_installed_by* | `str` |  |
> | *device_external_ip* | `str` |  |
> | *device_external_ipv4* | `ip4` |  |
> | *device_internal_ip* | `str` |  |
> | *device_internal_ipv4* | `ip4` |  |
> | *parent_pid* | `str` |  |
> | *parent_reputation* | `str` |  |
> | *parent_effective_reputation* | `str` |  |
> | *parent_effective_reputation_source* | `str` |  |
> | *parent_publisher* | `str` |  |
> | *parent_name* | `str` |  |
> | *parent_username* | `str` |  |
> | *parent_hash* | `str` |  |
> | *parent_cmdline* | `str` |  |
> | *parent_cmdline_length* | `int4` |  |
> | *parent_issuer* | `str` |  |
> | *parent_product_name* | `str` |  |
> | *process_reputation* | `str` |  |
> | *process_effective_reputation* | `str` |  |
> | *process_effective_reputation_source* | `str` |  |
> | *process_pid* | `str` |  |
> | *process_elevated* | `bool` |  |
> | *process_integrity_level* | `str` |  |
> | *process_internal_name* | `str` |  |
> | *process_publisher* | `str` |  |
> | *process_issuer* | `str` |  |
> | *process_hash* | `str` |  |
> | *process_cmdline* | `str` |  |
> | *process_cmdline_length* | `int4` |  |
> | *process_username* | `str` |  |
> | *process_name* | `str` |  |
> | *process_sha256* | `str` |  |
> | *process_company_name* | `str` |  |
> | *process_file_description* | `str` |  |
> | *process_original_filename* | `str` |  |
> | *process_privileges* | `str` |  |
> | *process_product_name* | `str` |  |
> | *process_product_version* | `str` |  |
> | *process_start_time* | `str` |  |
> | *process_end_time* | `str` |  |
> | *process_duration* | `int8` |  |
> | *process_container_pid* | `str` |  |
> | *sensor_action* | `str` |  |
> | *sensor_version* | `str` |  |
> | *device_location* | `str` |  |
> | *device_policy_id* | `str` |  |
> | *filemod_count* | `int4` |  |
> | *modload_count* | `int4` |  |
> | *netconn_count* | `int4` |  |
> | *regmod_count* | `int4` |  |
> | *scriptload_count* | `int4` |  |
> | *auth_user_id* | `str` |  |
> | *auth_username* | `str` |  |
> | *auth_domain_name* | `str` |  |
> | *auth_user_principal_name* | `str` |  |
> | *auth_event_action* | `str` |  |
> | *auth_virtual_account_logon* | `bool` |  |
> | *auth_restricted_admin_logon* | `bool` |  |
> | *auth_remote_logon* | `bool` |  |
> | *auth_logon_type* | `int4` |  |
> | *auth_interactive_logon* | `bool` |  |
> | *auth_impersonation_level* | `str` |  |
> | *auth_cleartext_credentials_logon* | `bool` |  |
> | *auth_package* | `str` |  |
> | *auth_elevated_token_logon* | `bool` |  |
> | *auth_key_length* | `int4` |  |
> | *windows_event_id* | `str` |  |
> | *auth_failure_status* | `str` |  |
> | *auth_failure_sub_status* | `str` |  |
> | *auth_logon_id* | `str` |  |
> | *auth_daemon_logon* | `bool` |  |
> | *auth_remote_device* | `str` |  |
> | *auth_remote_port* | `int4` |  |
> | *auth_failed_logon_count* | `int4` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.cb_analytics 
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `str` |  |
> | *id* | `str` |  |
> | *legacy_alert_id* | `str` |  |
> | *org_key* | `str` |  |
> | *create_time* | `timestamp` |  |
> | *last_update_time* | `timestamp` |  |
> | *first_event_time* | `timestamp` |  |
> | *last_event_time* | `timestamp` |  |
> | *threat_id* | `str` |  |
> | *severity* | `int4` |  |
> | *category* | `str` |  |
> | *device_id* | `str` |  |
> | *device_os* | `str` |  |
> | *device_os_version* | `str` |  |
> | *device_name* | `str` |  |
> | *device_username* | `str` |  |
> | *policy_id* | `str` |  |
> | *policy_name* | `str` |  |
> | *target_value* | `str` |  |
> | *workflow__state* | `str` |  |
> | *workflow__remediation* | `str` |  |
> | *workflow__last_update_time* | `timestamp` |  |
> | *workflow__comment* | `str` |  |
> | *workflow__changed_by* | `str` |  |
> | *device_internal_ip* | `ip4` |  |
> | *device_external_ip* | `ip4` |  |
> | *alert_url* | `str` |  |
> | *reason* | `str` |  |
> | *reason_code* | `str` |  |
> | *process_name* | `str` |  |
> | *device_location* | `str` |  |
> | *created_by_event_id* | `str` |  |
> | *threat_indicators* | `str` |  |
> | *threat_cause_actor_sha256* | `str` |  |
> | *threat_cause_actor_name* | `str` |  |
> | *threat_cause_actor_process_pid* | `str` |  |
> | *threat_cause_reputation* | `str` |  |
> | *threat_cause_threat_category* | `str` |  |
> | *threat_cause_vector* | `str` |  |
> | *threat_cause_cause_event_id* | `str` |  |
> | *blocked_threat_category* | `str` |  |
> | *not_blocked_threat_category* | `str` |  |
> | *kill_chain_status* | `str` |  |
> | *run_state* | `str` |  |
> | *policy_applied* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *sensor_action* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.device_control
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `str` |  |
> | *id* | `str` |  |
> | *legacy_alert_id* | `str` |  |
> | *organization_key* | `str` |  |
> | *create_time* | `timestamp` |  |
> | *last_update_time* | `timestamp` |  |
> | *first_event_time* | `timestamp` |  |
> | *last_event_time* | `timestamp` |  |
> | *threat_id* | `str` |  |
> | *severity* | `int4` |  |
> | *category* | `str` |  |
> | *device_id* | `str` |  |
> | *device_os* | `str` |  |
> | *device_os_version* | `str` |  |
> | *device_name* | `str` |  |
> | *device_username* | `str` |  |
> | *policy_id* | `str` |  |
> | *policy_name* | `str` |  |
> | *target_value* | `str` |  |
> | *workflow__state* | `str` |  |
> | *workflow__remediation* | `str` |  |
> | *workflow__last_update_time* | `timestamp` |  |
> | *workflow__comment* | `str` |  |
> | *workflow__changed_by* | `str` |  |
> | *device_external_ip* | `str` |  |
> | *device_external_ipv4* | `ip4` |  |
> | *device_internal_ip* | `str` |  |
> | *device_internal_ipv4* | `ip4` |  |
> | *alert_url* | `str` |  |
> | *reason* | `str` |  |
> | *reason_code* | `str` |  |
> | *device_location* | `str` |  |
> | *threat_cause_threat_category* | `str` |  |
> | *threat_cause_vector* | `str` |  |
> | *threat_cause_cause_event_id* | `str` |  |
> | *sensor_action* | `str` |  |
> | *run_state* | `str` |  |
> | *policy_applied* | `str` |  |
> | *vendor_name* | `str` |  |
> | *vendor_id* | `str` |  |
> | *product_name* | `str` |  |
> | *product_id* | `str` |  |
> | *serial_number* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.endpoint_event_apicall
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `str` |  |
> | *process_guid* | `str` |  |
> | *parent_guid* | `str` |  |
> | *backend_timestamp* | `str` |  |
> | *org_key* | `str` |  |
> | *device_id* | `str` |  |
> | *device_name* | `str` |  |
> | *device_external_ip* | `ip4` |  |
> | *device_os* | `str` |  |
> | *device_group* | `str` |  |
> | *action* | `str` |  |
> | *schema* | `int4` |  |
> | *event_description* | `str` |  |
> | *event_id* | `str` |  |
> | *device_timestamp* | `str` |  |
> | *process_terminated* | `bool` |  |
> | *process_reputation* | `str` |  |
> | *parent_reputation* | `str` |  |
> | *process_pid* | `str` |  |
> | *parent_pid* | `str` |  |
> | *process_path* | `str` |  |
> | *parent_path* | `str` |  |
> | *process_hash* | `str` |  |
> | *parent_hash* | `str` |  |
> | *process_cmdline* | `str` |  |
> | *parent_cmdline* | `str` |  |
> | *process_username* | `str` |  |
> | *sensor_action* | `str` |  |
> | *event_origin* | `str` |  |
> | *crossproc_api* | `str` |  |
> | *target_cmdline* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *alert_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [endpoint.vmware.cbc_event_forwarder.endpoint_event_crossproc](#)
> - [endpoint.vmware.cbc_event_forwarder.endpoint_event_fileless_scriptload](#tag7)
> - [endpoint.vmware.cbc_event_forwarder.endpoint_event_filemod](#tag8)
> - [endpoint.vmware.cbc_event_forwarder.endpoint_event_moduleload](#tag9)
> - [endpoint.vmware.cbc_event_forwarder.endpoint_event_netconn](#tag10)
> - [endpoint.vmware.cbc_event_forwarder.endpoint_event_procend](#tag11)
> - [endpoint.vmware.cbc_event_forwarder.endpoint_event_procstart](#tag12)
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.endpoint_event_crossproc
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `str` |  |
> | *process_guid* | `str` |  |
> | *parent_guid* | `str` |  |
> | *backend_timestamp* | `str` |  |
> | *org_key* | `str` |  |
> | *device_id* | `str` |  |
> | *device_name* | `str` |  |
> | *device_external_ip* | `ip4` |  |
> | *device_os* | `str` |  |
> | *device_group* | `str` |  |
> | *action* | `str` |  |
> | *schema* | `int4` |  |
> | *device_timestamp* | `str` |  |
> | *process_terminated* | `bool` |  |
> | *process_reputation* | `str` |  |
> | *parent_reputation* | `str` |  |
> | *process_pid* | `str` |  |
> | *parent_pid* | `str` |  |
> | *process_publisher* | `str` |  |
> | *process_path* | `str` |  |
> | *parent_path* | `str` |  |
> | *process_hash* | `str` |  |
> | *parent_hash* | `str` |  |
> | *process_cmdline* | `str` |  |
> | *parent_cmdline* | `str` |  |
> | *process_username* | `str` |  |
> | *sensor_action* | `str` |  |
> | *event_origin* | `str` |  |
> | *crossproc_name* | `str` |  |
> | *crossproc_guid* | `str` |  |
> | *crossproc_hash* | `str` |  |
> | *crossproc_action* | `str` |  |
> | *crossproc_publisher* | `str` |  |
> | *crossproc_reputation* | `str` |  |
> | *crossproc_target* | `bool` |  |
> | *target_cmdline* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.endpoint_event_fileless_scriptload
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `str` |  |
> | *process_guid* | `str` |  |
> | *parent_guid* | `str` |  |
> | *backend_timestamp* | `str` |  |
> | *org_key* | `str` |  |
> | *device_id* | `str` |  |
> | *device_name* | `str` |  |
> | *device_external_ip* | `ip4` |  |
> | *device_group* | `str` |  |
> | *action* | `str` |  |
> | *schema* | `str` |  |
> | *device_timestamp* | `str` |  |
> | *process_terminated* | `bool` |  |
> | *process_reputation* | `str` |  |
> | *parent_reputation* | `str` |  |
> | *process_pid* | `str` |  |
> | *parent_pid* | `str` |  |
> | *process_publisher* | `str` |  |
> | *process_path* | `str` |  |
> | *parent_path* | `str` |  |
> | *process_hash* | `str` |  |
> | *parent_hash* | `str` |  |
> | *process_cmdline* | `str` |  |
> | *parent_cmdline* | `str` |  |
> | *process_username* | `str` |  |
> | *sensor_action* | `str` |  |
> | *event_origin* | `str` |  |
> | *fileless_scriptload_cmdline* | `str` |  |
> | *fileless_scriptload_cmdline_length* | `int4` |  |
> | *fileless_scriptload_hash* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *device_os* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.endpoint_event_filemod
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `str` |  |
> | *process_guid* | `str` |  |
> | *parent_guid* | `str` |  |
> | *backend_timestamp* | `str` |  |
> | *org_key* | `str` |  |
> | *device_id* | `str` |  |
> | *device_name* | `str` |  |
> | *device_external_ip* | `ip4` |  |
> | *device_os* | `str` |  |
> | *device_group* | `str` |  |
> | *action* | `str` |  |
> | *schema* | `str` |  |
> | *device_timestamp* | `str` |  |
> | *process_terminated* | `bool` |  |
> | *process_reputation* | `str` |  |
> | *parent_reputation* | `str` |  |
> | *process_pid* | `str` |  |
> | *parent_pid* | `str` |  |
> | *process_publisher* | `str` |  |
> | *process_path* | `str` |  |
> | *parent_path* | `str` |  |
> | *process_hash* | `str` |  |
> | *parent_hash* | `str` |  |
> | *process_cmdline* | `str` |  |
> | *parent_cmdline* | `str` |  |
> | *process_username* | `str` |  |
> | *sensor_action* | `str` |  |
> | *event_origin* | `str` |  |
> | *filemod_hash* | `str` |  |
> | *filemod_name* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *event_description* | `str` |  |
> | *event_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.endpoint_event_moduleload
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `str` |  |
> | *process_guid* | `str` |  |
> | *parent_guid* | `str` |  |
> | *backend_timestamp* | `str` |  |
> | *org_key* | `str` |  |
> | *device_id* | `str` |  |
> | *device_name* | `str` |  |
> | *device_external_ip* | `ip4` |  |
> | *device_os* | `str` |  |
> | *device_group* | `str` |  |
> | *action* | `str` |  |
> | *schema* | `str` |  |
> | *device_timestamp* | `str` |  |
> | *process_terminated* | `bool` |  |
> | *process_reputation* | `str` |  |
> | *parent_reputation* | `str` |  |
> | *process_pid* | `str` |  |
> | *parent_pid* | `str` |  |
> | *process_publisher* | `str` |  |
> | *process_path* | `str` |  |
> | *parent_path* | `str` |  |
> | *process_hash* | `str` |  |
> | *parent_hash* | `str` |  |
> | *process_cmdline* | `str` |  |
> | *parent_cmdline* | `str` |  |
> | *process_username* | `str` |  |
> | *sensor_action* | `str` |  |
> | *event_origin* | `str` |  |
> | *modload_name* | `str` |  |
> | *modload_count* | `int4` |  |
> | *modload_effective_reputation* | `str` |  |
> | *modload_hash* | `str` |  |
> | *modload_md5* | `str` |  |
> | *modload_publisher* | `str` |  |
> | *modload_sha256* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.endpoint_event_netconn
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `str` |  |
> | *process_guid* | `str` |  |
> | *parent_guid* | `str` |  |
> | *backend_timestamp* | `str` |  |
> | *org_key* | `str` |  |
> | *device_id* | `str` |  |
> | *device_name* | `str` |  |
> | *device_external_ip* | `ip4` |  |
> | *device_os* | `str` |  |
> | *device_group* | `str` |  |
> | *action* | `str` |  |
> | *schema* | `str` |  |
> | *event_description* | `str` |  |
> | *event_id* | `str` |  |
> | *device_timestamp* | `str` |  |
> | *process_terminated* | `bool` |  |
> | *process_reputation* | `str` |  |
> | *parent_reputation* | `str` |  |
> | *process_pid* | `str` |  |
> | *parent_pid* | `str` |  |
> | *process_path* | `str` |  |
> | *parent_path* | `str` |  |
> | *process_hash* | `str` |  |
> | *parent_hash* | `str` |  |
> | *process_cmdline* | `str` |  |
> | *parent_cmdline* | `str` |  |
> | *process_username* | `str` |  |
> | *sensor_action* | `str` |  |
> | *event_origin* | `str` |  |
> | *remote_port* | `int4` |  |
> | *remote_ip* | `ip4` |  |
> | *local_port* | `int4` |  |
> | *local_ip* | `ip4` |  |
> | *netconn_domain* | `str` |  |
> | *netconn_inbound* | `bool` |  |
> | *netconn_protocol* | `str` |  |
> | *process_fork_pid* | `int4` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *process_publisher* | `str` |  |
> | *netconn_community_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.endpoint_event_procend
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `str` |  |
> | *process_guid* | `str` |  |
> | *parent_guid* | `str` |  |
> | *backend_timestamp* | `str` |  |
> | *org_key* | `str` |  |
> | *device_id* | `str` |  |
> | *device_name* | `str` |  |
> | *device_external_ip* | `ip4` |  |
> | *device_os* | `str` |  |
> | *device_group* | `str` |  |
> | *action* | `str` |  |
> | *schema* | `str` |  |
> | *device_timestamp* | `str` |  |
> | *process_terminated* | `bool` |  |
> | *process_duration* | `int4` |  |
> | *process_reputation* | `str` |  |
> | *parent_reputation* | `str` |  |
> | *process_pid* | `str` |  |
> | *parent_pid* | `str` |  |
> | *process_publisher* | `str` |  |
> | *process_path* | `str` |  |
> | *parent_path* | `str` |  |
> | *process_hash* | `str` |  |
> | *parent_hash* | `str` |  |
> | *process_cmdline* | `str` |  |
> | *parent_cmdline* | `str` |  |
> | *process_username* | `str` |  |
> | *sensor_action* | `str` |  |
> | *event_origin* | `str` |  |
> | *target_cmdline* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.endpoint_event_procstart
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `str` |  |
> | *process_guid* | `str` |  |
> | *parent_guid* | `str` |  |
> | *backend_timestamp* | `str` |  |
> | *org_key* | `str` |  |
> | *device_id* | `str` |  |
> | *device_name* | `str` |  |
> | *device_external_ip* | `ip4` |  |
> | *device_os* | `str` |  |
> | *device_group* | `str` |  |
> | *action* | `str` |  |
> | *schema* | `str` |  |
> | *device_timestamp* | `str` |  |
> | *process_terminated* | `bool` |  |
> | *process_reputation* | `str` |  |
> | *parent_reputation* | `str` |  |
> | *process_pid* | `str` |  |
> | *parent_pid* | `str` |  |
> | *process_publisher* | `str` |  |
> | *process_path* | `str` |  |
> | *parent_path* | `str` |  |
> | *process_hash* | `str` |  |
> | *parent_hash* | `str` |  |
> | *process_cmdline* | `str` |  |
> | *parent_cmdline* | `str` |  |
> | *process_username* | `str` |  |
> | *sensor_action* | `str` |  |
> | *event_origin* | `str` |  |
> | *childproc_name* | `str` |  |
> | *childproc_hash* | `str` |  |
> | *childproc_pid* | `str` |  |
> | *childproc_guid* | `str` |  |
> | *childproc_username* | `str` |  |
> | *childproc_publisher* | `str` |  |
> | *childproc_reputation* | `str` |  |
> | *target_cmdline* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *event_description* | `str` |  |
> | *event_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [endpoint.vmware.cbc_event_forwarder.endpoint_event_regmod](#tag13)
> - [endpoint.vmware.cbc_event_forwarder.endpoint_event_scriptload](#tag14)
> - [endpoint.vmware.cbc_event_forwarder.kognos_alerts](#tag15)
> - [endpoint.vmware.cbc_event_forwarder.kognos_events](#tag16)
> - [endpoint.vmware.cbc_event_forwarder.unknown](#tag17)
> - [endpoint.vmware.cbc_event_forwarder.watchlist](#endpoint.vmware.cbc_event_forwarder.watchlist)
> - [endpoint.vmware.cbc_event_forwarder.watchlist_hit](#endpoint.vmware.cbc_event_forwarder.watchlist_hit)
> - [endpoint.vmware.cbc_liveops.live_query](#tag18)
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.endpoint_event_regmod
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `str` |  |
> | *process_guid* | `str` |  |
> | *parent_guid* | `str` |  |
> | *backend_timestamp* | `str` |  |
> | *org_key* | `str` |  |
> | *device_id* | `str` |  |
> | *device_name* | `str` |  |
> | *device_external_ip* | `ip4` |  |
> | *device_os* | `str` |  |
> | *device_group* | `str` |  |
> | *action* | `str` |  |
> | *schema* | `str` |  |
> | *device_timestamp* | `str` |  |
> | *process_terminated* | `bool` |  |
> | *process_reputation* | `str` |  |
> | *parent_reputation* | `str` |  |
> | *process_pid* | `str` |  |
> | *parent_pid* | `str` |  |
> | *process_publisher* | `str` |  |
> | *process_path* | `str` |  |
> | *parent_path* | `str` |  |
> | *process_hash* | `str` |  |
> | *parent_hash* | `str` |  |
> | *process_cmdline* | `str` |  |
> | *parent_cmdline* | `str` |  |
> | *process_username* | `str` |  |
> | *sensor_action* | `str` |  |
> | *event_origin* | `str` |  |
> | *regmod_name* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.endpoint_event_scriptload
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `str` |  |
> | *process_guid* | `str` |  |
> | *parent_guid* | `str` |  |
> | *backend_timestamp* | `str` |  |
> | *org_key* | `str` |  |
> | *device_id* | `str` |  |
> | *device_name* | `str` |  |
> | *device_external_ip* | `ip4` |  |
> | *device_os* | `str` |  |
> | *device_group* | `str` |  |
> | *action* | `str` |  |
> | *schema* | `str` |  |
> | *device_timestamp* | `str` |  |
> | *process_terminated* | `bool` |  |
> | *process_reputation* | `str` |  |
> | *parent_reputation* | `str` |  |
> | *process_pid* | `str` |  |
> | *parent_pid* | `str` |  |
> | *process_publisher* | `str` |  |
> | *process_path* | `str` |  |
> | *parent_path* | `str` |  |
> | *process_hash* | `str` |  |
> | *parent_hash* | `str` |  |
> | *process_cmdline* | `str` |  |
> | *parent_cmdline* | `str` |  |
> | *process_username* | `str` |  |
> | *sensor_action* | `str` |  |
> | *event_origin* | `str` |  |
> | *scriptload_count* | `int4` |  |
> | *scriptload_reputation* | `str` |  |
> | *scriptload_effective_reputation* | `str` |  |
> | *scriptload_publisher* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.kognos_alerts
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `str` |  |
> | *id* | `str` |  |
> | *legacy_alert_id* | `str` |  |
> | *org_key* | `str` |  |
> | *create_time* | `timestamp` |  |
> | *last_update_time* | `timestamp` |  |
> | *first_event_time* | `timestamp` |  |
> | *last_event_time* | `timestamp` |  |
> | *threat_id* | `str` |  |
> | *severity* | `int4` |  |
> | *category* | `str` |  |
> | *device_id* | `str` |  |
> | *device_os* | `str` |  |
> | *device_os_version* | `str` |  |
> | *device_name* | `str` |  |
> | *device_username* | `str` |  |
> | *policy_id* | `str` |  |
> | *policy_name* | `str` |  |
> | *target_value* | `str` |  |
> | *workflow__state* | `str` |  |
> | *workflow__remediation* | `str` |  |
> | *workflow__last_update_time* | `timestamp` |  |
> | *workflow__comment* | `str` |  |
> | *workflow__changed_by* | `str` |  |
> | *device_internal_ip* | `ip4` |  |
> | *device_external_ip* | `ip4` |  |
> | *alert_url* | `str` |  |
> | *reason* | `str` |  |
> | *reason_code* | `str` |  |
> | *process_name* | `str` |  |
> | *device_location* | `str` |  |
> | *created_by_event_id* | `str` |  |
> | *threat_indicators* | `str` |  |
> | *threat_cause_actor_sha256* | `str` |  |
> | *threat_cause_actor_name* | `str` |  |
> | *threat_cause_actor_process_pid* | `str` |  |
> | *threat_cause_reputation* | `str` |  |
> | *threat_cause_threat_category* | `str` |  |
> | *threat_cause_vector* | `str` |  |
> | *threat_cause_cause_event_id* | `str` |  |
> | *blocked_threat_category* | `str` |  |
> | *not_blocked_threat_category* | `str` |  |
> | *kill_chain_status* | `str` |  |
> | *run_state* | `str` |  |
> | *policy_applied* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *sensor_action* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.kognos_events
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `str` |  |
> | *process_guid* | `str` |  |
> | *parent_guid* | `str` |  |
> | *backend_timestamp* | `str` |  |
> | *org_key* | `str` |  |
> | *device_id* | `str` |  |
> | *device_name* | `str` |  |
> | *device_external_ip* | `ip4` |  |
> | *device_group* | `str` |  |
> | *action* | `str` |  |
> | *schema* | `int4` |  |
> | *device_timestamp* | `str` |  |
> | *process_terminated* | `bool` |  |
> | *process_reputation* | `str` |  |
> | *parent_reputation* | `str` |  |
> | *process_pid* | `int8` |  |
> | *parent_pid* | `int8` |  |
> | *process_publisher* | `str` |  |
> | *process_path* | `str` |  |
> | *parent_path* | `str` |  |
> | *process_hash* | `str` |  |
> | *parent_hash* | `str` |  |
> | *process_cmdline* | `str` |  |
> | *parent_cmdline* | `str` |  |
> | *process_username* | `str` |  |
> | *sensor_action* | `str` |  |
> | *event_origin* | `str` |  |
> | *regmod_name* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *process_duration* | `int4` |  |
> | *target_cmdline* | `str` |  |
> | *remote_port* | `int4` |  |
> | *remote_ip* | `ip4` |  |
> | *local_port* | `int4` |  |
> | *local_ip* | `ip4` |  |
> | *netconn_domain* | `str` |  |
> | *netconn_inbound* | `bool` |  |
> | *netconn_protocol* | `str` |  |
> | *netconn_community_id* | `str` |  |
> | *event_description* | `str` |  |
> | *event_id* | `str` |  |
> | *crossproc_api* | `str` |  |
> | *childproc_name* | `str` |  |
> | *childproc_hash* | `str` |  |
> | *childproc_pid* | `int4` |  |
> | *childproc_guid* | `str` |  |
> | *childproc_username* | `str` |  |
> | *childproc_publisher* | `str` |  |
> | *childproc_reputation* | `str` |  |
> | *modload_name* | `str` |  |
> | *modload_count* | `int4` |  |
> | *modload_effective_reputation* | `str` |  |
> | *modload_hash* | `str` |  |
> | *modload_md5* | `str` |  |
> | *modload_publisher* | `str` |  |
> | *modload_sha256* | `str` |  |
> | *filemod_hash* | `str` |  |
> | *filemod_name* | `str` |  |
> | *crossproc_name* | `str` |  |
> | *crossproc_guid* | `str` |  |
> | *crossproc_hash* | `str` |  |
> | *crossproc_action* | `str` |  |
> | *crossproc_publisher* | `str` |  |
> | *crossproc_reputation* | `str` |  |
> | *crossproc_target* | `bool` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.unknown
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` |  |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.watchlist
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *version* | `str` |  |
> | *organization_key* | `str` |  |
> | *alert_url* | `str` |  |
> | *id* | `str` |  |
> | *type* | `str` |  |
> | *is_updated* | `bool` |  |
> | *detection_timestamp* | `timestamp` |  |
> | *backend_stamp* | `timestamp` |  |
> | *backend_update_timestamp* | `timestamp` |  |
> | *first_event_timestamp* | `timestamp` |  |
> | *last_event_timestamp* | `timestamp` |  |
> | *severity* | `int4` |  |
> | *reason* | `str` |  |
> | *threat_id* | `str` |  |
> | *primary_event_id* | `str` |  |
> | *workflow__status* | `str` |  |
> | *workflow__change_timestamp* | `timestamp` |  |
> | *workflow__changed_by_type* | `str` |  |
> | *workflow__changed_by* | `str` |  |
> | *workflow__closure_reason* | `str` |  |
> | *determination__value* | `str` |  |
> | *determination__change_timestamp* | `timestamp` |  |
> | *alert_notes_present* | `bool` |  |
> | *policy_applied* | `str` |  |
> | *run_state* | `str` |  |
> | *reason_code* | `str` |  |
> | *sensor_action* | `str` |  |
> | *device_target_value* | `str` |  |
> | *device_policy_id* | `str` |  |
> | *device_policy* | `str` |  |
> | *device_id* | `str` |  |
> | *device_name* | `str` |  |
> | *device_os* | `str` |  |
> | *device_os_version* | `str` |  |
> | *device_username* | `str` |  |
> | *device_location* | `str` |  |
> | *device_external_ip* | `str` |  |
> | *device_external_ipv4* | `ip4` |  |
> | *device_internal_ip* | `str` |  |
> | *device_internal_ipv4* | `ip4` |  |
> | *report_id* | `str` |  |
> | *report_name* | `str` |  |
> | *report_description* | `str` |  |
> | *report_tags* | `str` |  |
> | *report_link* | `str` |  |
> | *ioc_id* | `str` |  |
> | *ioc_hit* | `str` |  |
> | *watchlists* | `str` |  |
> | *process_guid* | `str` |  |
> | *process_pid* | `str` |  |
> | *process_name* | `str` |  |
> | *process_sha256* | `str` |  |
> | *process_md5* | `str` |  |
> | *process_reputation* | `str` |  |
> | *process_effective_reputation* | `str` |  |
> | *process_cmdline* | `str` |  |
> | *process_username* | `str` |  |
> | *process_issuer* | `str` |  |
> | *process_publisher* | `str` |  |
> | *parent_guid* | `str` |  |
> | *parent_pid* | `str` |  |
> | *parent_name* | `str` |  |
> | *parent_sha256* | `str` |  |
> | *parent_md5* | `str` |  |
> | *parent_reputation* | `str` |  |
> | *parent_effective_reputation* | `str` |  |
> | *parent_cmdline* | `str` |  |
> | *parent_username* | `str` |  |
> | *mdr_alert_notes_present* | `bool` |  |
> | *mdr_alert* | `bool` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_event_forwarder.watchlist_hit
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *device_id* | `str` |  |
> | *device_name* | `str` |  |
> | *device_external_ip* | `str` |  |
> | *device_external_ipv4* | `ip4` |  |
> | *device_internal_ip* | `str` |  |
> | *device_internal_ipv4* | `ip4` |  |
> | *ioc_hit* | `str` |  |
> | *ioc_id* | `str` |  |
> | *organization_key* | `str` |  |
> | *parent_cmdline* | `str` |  |
> | *parent_path* | `str` |  |
> | *parent_pid* | `str` |  |
> | *process_cmdline* | `str` |  |
> | *process_path* | `str` |  |
> | *process_pid* | `str` |  |
> | *parent_username* | `str` |  |
> | *process_username* | `str` |  |
> | *report_id* | `str` |  |
> | *report_name* | `str` |  |
> | *severity* | `int4` |  |
> | *report_tags* | `str` |  |
> | *schema* | `int4` |  |
> | *create_time* | `timestamp` |  |
> | *device_os* | `str` |  |
> | *parent_guid* | `str` |  |
> | *parent_hash* | `str` |  |
> | *parent_publisher* | `str` |  |
> | *parent_reputation* | `str` |  |
> | *process_guid* | `str` |  |
> | *process_hash* | `str` |  |
> | *process_publisher* | `str` |  |
> | *process_reputation* | `str` |  |
> | *type* | `str` |  |
> | *watchlists* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> endpoint.vmware.cbc_liveops.live_query
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *devo_pulling_id* | `str` |  |
> | *query_name* | `str` |  |
> | *org_key* | `str` |  |
> | *id* | `str` |  |
> | *device* | `str` |  |
> | *device__id* | `int8` |  |
> | *device__name* | `str` |  |
> | *device__policy_id* | `int8` |  |
> | *device__policy_name* | `str` |  |
> | *device__os* | `str` |  |
> | *status* | `str` |  |
> | *time_received* | `timestamp` |  |
> | *device_message* | `str` |  |
> | *fields* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |