Skip to main content

Event SelectionEvent Selection Guide

Default Event Selection Policy

Exabeam provides a default Event Selection policy containing recommended event statements for sending logs to Advanced Analytics.

Note

If you are a new customer, refer to Initial Policy Configuration for information on loading the default policy.

The default policy is updated periodically as data needs evolve. When the default policy is updated, you will receive a notification as shown in the following example. For info on managing these updates, see Manage a Default Policy Update.

Policy-Update-Notification.png

The following table displays the current default Event Selection policy. Each row corresponds to a single event statement. The table lists each statement alphabetically by subject. A dash (—) indicates an event source is not specified as part of the event statement.

Subject

Activity Type

alert

alert-trigger

app

  • app-activity

  • app-authentication

  • app-login

audit_policy

audit_policy-modify

bucket

  • bucket-accessblock-modify

  • bucket-create

  • bucket-list

  • bucket-permission-modify

  • bucket-policy-modify

  • bucket-write

configuration

  • configuration-create

  • configuration-load

  • configuration-mfa-disable

  • configuration-mfa-enable

  • configuration-modify

  • configuration-routing-modify

database

  • database-activity

  • database-create

  • database-delete

  • database-login

  • database-modify

  • database-query

dcom

dcom-activate

dhcp

dhcp-session

disk

  • disk-attach

  • disk-create

  • disk-modify

  • disk-read

  • disk-write

dll

dll-load

dns

  • dns-request

  • dns-response

  • dns_record-create

  • dns_record-delete

  • dns_record-modify

driver

driver-load

ds

  • ds-replication

  • ds-replication-modify

  • ds-replication-start

ds_object

  • ds_object-activity

  • ds_object-create

  • ds_object-delete

  • ds_object-modify

  • ds_object-move

  • ds_object-read

  • ds_object-restore

email

  • email-receive

  • email-send

email_rule

  • email_rule-create

  • email_rule-modify

endpoint

  • endpoint-activity

  • endpoint-authentication

  • endpoint-command

  • endpoint-create

  • endpoint-enable

  • endpoint-key-create

  • endpoint-key-write

  • endpoint-lock

  • endpoint-login

  • endpoint-logout

  • endpoint-modify

  • endpoint-password-modify

  • endpoint-policy-verify

  • endpoint-screenshot

  • endpoint-start

  • endpoint-stop

  • endpoint-unlock

  • endpoint-write

file

  • file-close

  • file-copy

  • file-delete

  • file-download

  • file-move

  • file-owner-modify

  • file-permission-modify

  • file-read

  • file-rename

  • file-share

  • file-stream-create

  • file-upload

  • file-write

function

  • function-create

  • function-modify

  • function-write

group

  • group-create

  • group-member-add

  • group-member-remove

  • group-modify

  • group-permission-modify

  • group-policy-attach

  • group-role-assign

  • group-role-modify

http

  • http-request

  • http-response

  • http-session

  • http-traffic

image

  • image-create

  • image-modify

  • image-write

key

  • key-create

  • key-write

log

  • log-clear

  • log-disable

mailbox

mailbox-permission-modify

meeting

  • meeting-create

  • meeting-end

  • meeting-member-join

  • meeting-modify

  • meeting-start

network

  • network-session

  • network-traffic

password

  • password-checkout

  • password-copy

  • password-create

  • password-download

  • password-read

peripheral_storage

  • peripheral_storage-activity

  • peripheral_storage-insert

physical_location

  • physical_location-access

  • physical_location-modify

policy

  • policy-apply

  • policy-create

  • policy-delete

  • policy-disable

  • policy-enable

  • policy-list

  • policy-modify

  • policy-read

  • policy-write

printer

printer-activity

process

process-create

radius

radius-traffic

rdp

rdp-traffic

registry

  • registry-create

  • registry-modify

repository

  • repository-create

  • repository-delete

  • repository-member-add

  • repository-member-remove

  • repository-modify

  • repository-move

role

  • role-assume

  • role-create

  • role-delete

  • role-list

  • role-modify

  • role-permission-modify

  • role-policy-attach

  • role-write

rule

rule-trigger

scheduled_task

  • scheduled_task-create

  • scheduled_task-disable

  • scheduled_task-enable

  • scheduled_task-modify

  • scheduled_task-start

script

script-execute

service

  • service-create

  • service-modify

  • service-state-modify

  • service-stop

share

  • share-access

  • share-create

  • share-delete

  • share-modify

  • share-mount

snapshot

  • snapshot-create

  • snapshot-modify

  • snapshot-read

  • snapshot-write

ssh

ssh-traffic

user

  • user-create

  • user-delete

  • user-disable

  • user-enable

  • user-invite

  • user-key-create

  • user-lock

  • user-mfa-disable

  • user-mfa-enable

  • user-modify

  • user-password-create

  • user-password-modify

  • user-password-read

  • user-password-reset

  • user-permission-modify

  • user-policy-attach

  • user-policy-attach

  • user-privilege-assign

  • user-privilege-modify

  • user-privilege-use

  • user-role-assign

  • user-role-modify

  • user-role-revoke

  • user-switch

  • user-unlock

vpn

  • vpn-authentication

  • vpn-login

  • vpn-logout

  • vpn-session