---
title: "edr.all.threats"
canonical: "https://docs.devo.com/space/latest/95126148/edr.all.threats"
format: markdown
---
> Macro (toc)

## Introduction

This union table collects events generated by Endpoint Detection and Response (EDR) systems from different technologies to address possible threats.

## Source tables

The information displayed is extracted from the following tables:

- `av.sentinelone.rfc_5424`
- `cef0.bit9CarbonblackJson.cbResponse`
- `cef0.paloAltoNetworks.cortexXdr`
- `cef0.paloAltoNetworks.cortexXdrAgent`
- `cloud.sophos.central.alerts`
- `cloud.sophos.central.events`
- `edr.carbonblack.alert`
- `edr.carbonblack.protect`
- `edr.cbef.alert.cb_analytics`
- `edr.cbef.alert.watchlist`
- `edr.cortex_xdr.alerts`
- `edr.cortex_xdr.incident_alert`
- `edr.crowdstrike.cannon`
- `edr.crowdstrike.falcon`
- `edr.crowdstrike.falconstreaming.detection_summary`
- `edr.crowdstrike.falconstreaming.epp_detection_summary`
- `edr.cylance.device`
- `edr.cylance.threats`
- `edr.fireeye.alerts`
- `edr.microsoft_defender.endpoint.alerts`
- `edr.minervalabs.events`
- `edr.sentinelone.agent.threats`
- `edr.symantec.events`
- `edr.tanium.events`
- `edr.tanium.threats`
- `endpoint.carbonblack.protection`
- `xdr.cynet.alerts.events`

## Table structure

This is the set of columns displayed by this union table, which is the result of the collection of columns present in all source tables:

> ⚠️ **Extra columns**
> ⚠️ 
> ⚠️ Fields marked as *Extra *in the table below are not shown by default in data tables and need to be explicitly requested in the query. You can find them marked as *Extra *when you perform a query so they can be easily identified. Learn more about this in [Selecting unrevealed columns](#).

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *source* | `str` |  |  |
| *ip* | `ip4` |  |  |
| *mac* | `str` |  |  |
| *sha256* | `str` | *sha256hash* |  |
| *sha1* | `str` | *SHA1Hash* |  |
| *md5* | `str` | *MD5Hash* |  |
| *file_name* | `str` | *filename* |  |
| *file_path* | `str` | *path* |  |
| *message* | `str` |  |  |
| *status* | `str` |  |  |
| *rule* | `str` |  |  |
| *hostname* | `str` | *host* |  |
| *threat_name* | `str` | *threat* |  |
| *severity* | `str` | *severityuser* |  |
| *user* | `str` |  |  |
| *threat_type* | `str` | *type* |  |
| *pid* | `str` | *processIDstr* |  |
| *parent_pid* | `str` | *parentProcessID* |  |
| *rawMessage* | `str` | *rawSource* | **✓** |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` |  | **✓** |

### Special Sophos Information

The [Sophos](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94657315) source cloud.sophos.central.alerts does not contain `sha256`.  If the SHA 256 hash is required, use source cloud.sophos.central.events.  Otherwise, the alerts source is suitable.