---
title: "vuln.beyondtrust"
canonical: "https://docs.devo.com/space/latest/94666051/vuln.beyondtrust"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `vuln.beyondtrust` identify events generated by [BeyondTrust vulnerability management](https://www.beyondtrust.com/brand?utm_source=google&utm_medium=cpc&utm_campaign=8659243355&utm_content=410270084128&utm_term=beyond%20trust&gclid=CjwKCAjwloynBhBbEiwAGY25dFZgA1iZhHQqM9TA-2wqdCbwBzqAw3jTUIQ8Fe-oAEaRQFBWKv1-ARoCUPUQAvD_BwE).

## Valid tags and data tables

The full tag must have 3 levels. The first two are fixed as `vuln.beyondtrust`. The third level identifies the type of events sent.

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| Beyond Trust vulnerability management | `vuln.beyondtrust.appaudit` | `vuln.beyondtrust.appaudit` |
| `vuln.beyondtrust.appaudit.csv` |
| `vuln.beyondtrust.pbps` | `vuln.beyondtrust.pbps` |
| `vuln.beyondtrust.pbps.csv` |
| `vuln.beyondtrust.retina` | `vuln.beyondtrust.retina` |

For more information, read more [About Devo tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204).

## Send it

Data should be sent using the [relay](https://docs.devo.com/space/latest/96468993/Devo+Relay).

In BeyondTrust solutions, you can set up a connector that enables syslog event forwarding. The events should be directed to a Devo relay where a relay rule applies the correct tag, then forwards the events securely to your Devo domain.

For information about setting up syslog event forwarding, see the [BeyondInsight and Password Safe Third-Party Integration Guide](https://www.beyondtrust.com/docs/password-safe/documents/bi/bi-ps-third-party-integration-guide.pdf).

### Example [relay rules](https://docs.devo.com/space/latest/96469377/Defining+a+relay+rule)

```
         Source message: 
            Source data: Agent ID: ([^ ]+)
             Source tag: 
             Target tag: vuln.beyondtrust.\\D1
Sent without syslog tag: false
        Stop processing: true
```

## Table structure

These are the fields displayed in these tables:

- [vuln.beyondtrust.appaudit](#tag1)
- [vuln.beyondtrust.pbps](#tag2)
- [vuln.beyondtrust.retina](#tag3)

### > Macro (anchor)

vuln.beyondtrust.applaudit

| **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |  |
| *host* | `str` |  |  |  |
| *agent_desc* | `str` |  |  |  |
| *agent_id* | `str` |  |  |  |
| *agent_ver* | `str` |  |  |  |
| *category* | `str` |  |  |  |
| *source_host* | `str` |  |  |  |
| *event_desc* | `str` |  |  |  |
| *event_name* | `str` |  |  |  |
| *os* | `str` |  |  |  |
| *event_severity* | `int4` |  |  |  |
| *source_ip* | `ip4` |  |  |  |
| *event_subject* | `str` |  |  |  |
| *event_type* | `str` |  |  |  |
| *user* | `str` |  |  |  |
| *workgroup_desc* | `str` |  |  |  |
| *workgroup_id* | `str` |  |  |  |
| *workgroup_location* | `str` |  |  |  |
| *audit_id* | `int8` |  |  |  |
| *action_type* | `str` |  |  |  |
| *system_name* | `str` |  |  |  |
| *app_user_id* | `int4` |  |  |  |
| *create_date* | `timestamp` | ```
parsedate(mycreatedate, "M/DD/YYYY h:mm:ss A")
``` | *mycreatedate* |  |
| *ip_address* | `ip4` |  |  |  |
| *user_name2* | `str` |  |  |  |
| *groupp* | `str` |  |  |  |
| *auth_type* | `str` |  |  |  |
| *domain_name* | `str` |  |  |  |
| *sam_account_name* | `str` |  |  |  |
| *source* | `str` |  |  |  |
| *message* | `str` |  |  |  |
| *address_group_name* | `str` |  |  |  |
| *id* | `int4` |  |  |  |
| *smart_rule_name* | `str` |  |  |  |
| *report_name* | `str` |  |  |  |
| *asset_name* | `str` |  |  |  |
| *unknown* | `str` |  |  |  |
| *rawMessage* | `str` |  |  |  |
| *hostchain* | `str` |  |  | **✓** |
| *tag* | `str` |  |  | **✓** |

### > Macro (anchor)

vuln.beyondtrust.pbps

| **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |  |
| *host* | `str` | ```
split(hostchain, "=", 0)
``` | *hostchain* |  |
| *agent_desc* | `str` |  |  |  |
| *agent_id* | `str` |  |  |  |
| *agent_ver* | `str` |  |  |  |
| *category* | `str` |  |  |  |
| *source_host* | `str` |  |  |  |
| *event_desc* | `str` |  |  |  |
| *event_name* | `str` |  |  |  |
| *os* | `str` |  |  |  |
| *event_severity* | `int4` |  |  |  |
| *source_ip* | `ip4` |  |  |  |
| *event_subject* | `str` |  |  |  |
| *event_type* | `str` |  |  |  |
| *user* | `str` |  |  |  |
| *workgroup_desc* | `str` |  |  |  |
| *workgroup_id* | `str` |  |  |  |
| *workgroup_location* | `str` |  |  |  |
| *log_system_id* | `int8` |  |  |  |
| *log_time* | `str` |  |  |  |
| *user_name* | `str` |  |  |  |
| *role_used* | `str` |  |  |  |
| *object_type_id* | `int4` | ```
parsedate(mycreatedate, "M/DD/YYYY h:mm:ss A")
``` | *mycreatedate* |  |
| *object_type* | `str` |  |  |  |
| *object_id* | `int4` |  |  |  |
| *operation* | `str` |  |  |  |
| *failed* | `str` |  |  |  |
| *target* | `str` |  |  |  |
| *details* | `str` |  |  |  |
| *user_id* | `int4` |  |  |  |
| *time_stamp* | `str` |  |  |  |
| *ip_address* | `ip4` |  |  |  |
| *unknown* | `str` |  |  |  |
| *rawMessage* | `str` |  |  |  |
| *hostchain* | `str` |  |  | **✓** |
| *tag* | `str` |  |  | **✓** |

### > Macro (anchor)

vuln.beyondtrust.retina

| **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |  |
| *host* | `str` | ```
split(hostchain, "=", 0)
``` | *hostchain* |  |
| *agent_desc* | `str` |  |  |  |
| *agent_id* | `str` |  |  |  |
| *agent_ver* | `str` |  |  |  |
| *category* | `str` |  |  |  |
| *source_host* | `str` |  |  |  |
| *event_desc* | `str` |  |  |  |
| *event_name* | `str` |  |  |  |
| *os* | `str` |  |  |  |
| *event_severity* | `int4` |  |  |  |
| *source_ip* | `ip4` |  |  |  |
| *event_subject* | `str` |  |  |  |
| *event_type* | `str` |  |  |  |
| *user* | `str` |  |  |  |
| *workgroup_desc* | `str` |  |  |  |
| *workgroup_id* | `str` |  |  |  |
| *workgroup_location* | `str` |  |  |  |
| *company_name* | `str` |  |  |  |
| *description* | `str` |  |  |  |
| *filename* | `str` |  |  |  |
| *md5* | `str` |  |  |  |
| *signer* | `str` | ```
parsedate(mycreatedate, "M/DD/YYYY h:mm:ss A")
``` | *mycreatedate* |  |
| *version* | `str` |  |  |  |
| *product_name* | `str` |  |  |  |
| *author* | `str` |  |  |  |
| *idle_time* | `str` |  |  |  |
| *last_result* | `str` |  |  |  |
| *logon_mode* | `str` |  |  |  |
| *power_management* | `str` |  |  |  |
| *run_as_user* | `str` |  |  |  |
| *volume_name* | `str` |  |  |  |
| *stop_task_hours* | `str` |  |  |  |
| *task_name* | `str` |  |  |  |
| *task_to_run* | `str` |  |  |  |
| *startup_type* | `str` |  |  |  |
| *disable_auditing* | `str` |  |  |  |
| *disable_auditing_01* | `str` |  |  |  |
| *rth_id* | `int4` |  |  |  |
| *detected_protocol* | `str` |  |  |  |
| *port_state* | `str` |  |  |  |
| *port_type* | `str` |  |  |  |
| *response_type* | `str` |  |  |  |
| *wb_checked* | `str` |  |  |  |
| *wb_text* | `str` |  |  |  |
| *wb_context* | `str` |  |  |  |
| *cpe* | `str` |  |  |  |
| *product* | `str` |  |  |  |
| *image_path* | `str` |  |  |  |
| *detected_protocol_01* | `str` | ```
trim(mydetected_protocol)
``` | *mydetected_protocol* |  |
| *port_state_01* | `str` |  |  |  |
| *port_type_01* | `str` |  |  |  |
| *version_01* | `str` |  |  |  |
| *response_type_01* | `str` |  |  |  |
| *free_vir_mem_01* | `str` |  |  |  |
| *drive_desc_01* | `str` |  |  |  |
| *sys_model_01* | `str` |  |  |  |
| *member_count_01* | `str` |  |  |  |
| *sid_01* | `str` |  |  |  |
| *bad_pw_count_01* | `str` |  |  |  |
| *enum_src_01* | `str` |  |  |  |
| *asset_name_01* | `str` |  |  |  |
| *dns_server* | `ip4` |  |  |  |
| *dhcp_name_server* | `ip4` |  |  |  |
| *destination* | `ip4` |  |  |  |
| *dcal* | `str` |  |  |  |
| *dependencies* | `str` |  |  |  |
| *state* | `str` |  |  |  |
| *alias* | `str` |  |  |  |
| *antispy_sig_last_update* | `str` |  |  |  |
| *attributes* | `str` |  |  |  |
| *dist_name_0* | `str` |  |  |  |
| *registry_value* | `str` |  |  |  |
| *dns_name_01* | `ip4` |  |  |  |
| *prin_group_id* | `str` |  |  |  |
| *base_address* | `str` |  |  |  |
| *folder_path* | `str` |  |  |  |
| *rth_ids_0* | `str` |  |  |  |
| *rth_ids_1* | `str` |  |  |  |
| *rth_ids_2* | `str` |  |  |  |
| *rth_ids_3* | `str` |  |  |  |
| *rth_ids_4* | `str` |  |  |  |
| *rth_ids_5* | `str` |  |  |  |
| *rth_ids_6* | `str` |  |  |  |
| *rth_ids_7* | `str` |  |  |  |
| *rth_ids_8* | `str` |  |  |  |
| *rth_ids_9* | `str` |  |  |  |
| *rth_ids_10* | `str` |  |  |  |
| *rth_ids_11* | `str` |  |  |  |
| *rth_ids_12* | `str` |  |  |  |
| *rth_ids_13* | `str` |  |  |  |
| *unknown* | `str` |  |  |  |
| *rawMessage* | `str` |  |  |  |
| *hostchain* | `str` |  |  | **✓** |
| *tag* | `str` |  |  | **✓** |

#### Related articles

- [BeyondInsight and Password Safe Third-Party Integration Guide](https://www.beyondtrust.com/docs/password-safe/documents/bi/bi-ps-third-party-integration-guide.pdf)
- [About Devo tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204)
- [Scenario 4: Assign dynamic Devo tag using inbound source data](https://devodocs.atlassian.net/wiki/pages/createpage.action?spaceKey=NDT5&title=Scenario%204%3A%20Assign%20dynamic%20Devo%20tag%20using%20inbound%20source%20data)