Dimensions and Measures for Cloud Data Storage Collections
This topic lists the Dimensions and Measures for the Cloud Data Storage Collections.
Cloud Data Storage - API Events
The following table lists events related to API scanning. Applies to data at rest in cloud applications integrated via API.
| Field | Type | Description |
|---|---|---|
| Action | Dimension | The action Forcepoint ONE took per policy match. |
| Activity Detail | Dimension | The activity the user was doing that generated the event. |
| Api Config Id | Dimension | Internal ID of the API scanning instance. |
| App Name | Dimension | The managed application name. |
| Classify Labels | Dimension | |
| Cloud File Id | Dimension | Internal ID of the file scanned. |
| Date | Dimension | Date of event – M/D/Y HH:MM:SS AM|PM For example: 7/25/2023, 3:33:31 AM |
| Dlp | Dimension | The name of the DLP classifier that matched. |
| Dlp Pattern | Dimension | The pattern or terms defined in the matched DLP classifier. |
| Email Bcc | Dimension | Email addresses on the BCC field of emails scanned. |
| Email Cc | Dimension | Email addresses on the CC field of emails scanned. |
| Email Sender | Dimension | The email address of the user sending an email that was scanned. |
| Email To Field | Dimension | Email addresses on the TO field of emails scanned. |
| File Creation Time | Dimension | File creation time of file scanned. |
| File Folder Path | Dimension | The file location of files scanned. |
| File Name | Dimension | The filename of a scanned file. |
| File Scan Config | Dimension | API scanning config |
| File States | Dimension | File sharing status |
| Group Id | Dimension | Internal ID of the user group that applies to this event. |
| Insert Time | Dimension | Timestamp when this event was inserted into the Forcepoint ONE Data lake—M/D/Y HH:MM:SS AM|PM For example: 7/25/2023, 3:33:31 AM |
| Label | Dimension | Has a value if the object scanned was an Email. Represents the folder of the email scanned. Otherwise set to None. |
| Log Key | Dimension | GUID for this event record. |
| Malware State | Dimension | The sharing status of the scanned object if malware is detected. |
| Modification Time | Dimension | Time when the scanned file was last modified. |
| Owner | Dimension | Email address of object owner. |
| Policy Id | Dimension | SSE Policy ID |
| Sf File Id | Dimension | Salesforce ID of the file scanned. |
| Shared With | Dimension | Who the object is shared with. Only includes PII if the entity is an email address. |
| Sharepoint Site | Dimension | URL of SharePoint site scanned. |
| Sharing State | Dimension | The sharing status of the scanned object. |
| State | Dimension | The sharing status of the scanned object. |
| Time | Dimension | Timestamp of event—M/D/Y HH:MM:SS AM|PM For example: 7/25/2023, 3:33:31 AM |
| Type | Dimension | Object type. For example: File, Email, Message, Globalfile or Calendar. |
| Zip Info | Dimension | Information related to zip archive files |
| Calendar Event Count | Measure | Calendar event count (where type = calendar) |
| Copy Event Count | Measure | Copy event count |
| Email Event Count | Measure | Email event count (where type – email) |
| Encrypt Event Count | Measure | Encrypt event count |
| Event Count | Measure | API event count |
| External Event Count | Measure | The number of scanned files that were shared externally. |
| File Event Count | Measure | File event count (where type = file) |
| Internal Event Count | Measure | The number of scanned files that were shared internally within the organization. |
| Message Event Count | Measure | Message event count. (where type = message) |
| Object Event Count | Measure | The number of objects scanned. |
| Owner Count | Measure | The number of unique file owners detected. |
| Private Event Count | Measure | The number of scanned objects that were not shared. |
| Public Event Count | Measure | The number of scanned objects that were shared publicly. |
| Quarantine Event Count | Measure | Event counts where the quarantine action was applied. |
| Share Event Count | Measure | The number of scanned objects that were shared irrespective of the type of sharing. |
| Sum Scan Bytes | Measure | Total bytes scanned for this event. |