| [ | |
| "logon_count", | |
| "logoff_count", | |
| "off_hours_logon", | |
| "logon_late_night_count", | |
| "file_open_count", | |
| "file_write_count", | |
| "file_copy_count", | |
| "file_delete_count", | |
| "off_hours_files_accessed", | |
| "file_late_night_count", | |
| "usb_insert_count", | |
| "usb_remove_count", | |
| "off_hours_usb_usage", | |
| "device_late_night_count", | |
| "emails_sent", | |
| "external_emails_sent", | |
| "attachments_sent", | |
| "off_hours_emails", | |
| "email_late_night_count", | |
| "http_total_requests", | |
| "http_visit_count", | |
| "http_download_count", | |
| "http_upload_count", | |
| "http_jobsite_visits", | |
| "http_cloud_storage_visits", | |
| "http_suspicious_site_visits", | |
| "off_hours_http_requests", | |
| "http_long_url_count", | |
| "http_late_night_count", | |
| "pc_seen_before", | |
| "new_pc_after_stable_history", | |
| "logon_hourly_entropy", | |
| "logon_peak_hour_count", | |
| "logon_longest_active_run_minutes", | |
| "file_hourly_entropy", | |
| "file_peak_hour_count", | |
| "file_longest_active_run_minutes", | |
| "device_hourly_entropy", | |
| "device_longest_active_run_minutes", | |
| "email_hourly_entropy", | |
| "email_peak_hour_count", | |
| "http_hourly_entropy", | |
| "http_peak_hour_count", | |
| "pc_prior_use_ratio", | |
| "primary_pc_activity_ratio", | |
| "distinct_pcs_used_prior", | |
| "pcs_used_count", | |
| "non_primary_pc_used_flag", | |
| "non_primary_pc_http_requests_flag", | |
| "non_primary_pc_usb_flag", | |
| "non_primary_pc_file_copy_flag", | |
| "unique_files_accessed", | |
| "unique_recipients", | |
| "unique_domains_visited", | |
| "logon_count_7d_sum", | |
| "logon_count_30d_sum", | |
| "logon_count_1d_over_30d_ratio", | |
| "logoff_count_7d_sum", | |
| "logoff_count_30d_sum", | |
| "logoff_count_1d_over_30d_ratio", | |
| "off_hours_logon_7d_sum", | |
| "off_hours_logon_30d_sum", | |
| "off_hours_logon_1d_over_30d_ratio", | |
| "logon_late_night_count_7d_sum", | |
| "logon_late_night_count_30d_sum", | |
| "logon_late_night_count_1d_over_30d_ratio", | |
| "logon_hourly_entropy_7d_sum", | |
| "logon_hourly_entropy_30d_sum", | |
| "logon_hourly_entropy_1d_over_30d_ratio", | |
| "logon_peak_hour_count_7d_sum", | |
| "logon_peak_hour_count_30d_sum", | |
| "logon_peak_hour_count_1d_over_30d_ratio", | |
| "logon_longest_active_run_minutes_7d_sum", | |
| "logon_longest_active_run_minutes_30d_sum", | |
| "logon_longest_active_run_minutes_1d_over_30d_ratio", | |
| "file_open_count_7d_sum", | |
| "file_open_count_30d_sum", | |
| "file_open_count_1d_over_30d_ratio", | |
| "file_write_count_7d_sum", | |
| "file_write_count_30d_sum", | |
| "file_write_count_1d_over_30d_ratio", | |
| "file_copy_count_7d_sum", | |
| "file_copy_count_30d_sum", | |
| "file_copy_count_1d_over_30d_ratio", | |
| "file_delete_count_7d_sum", | |
| "file_delete_count_30d_sum", | |
| "file_delete_count_1d_over_30d_ratio", | |
| "unique_files_accessed_7d_sum", | |
| "unique_files_accessed_30d_sum", | |
| "unique_files_accessed_1d_over_30d_ratio", | |
| "off_hours_files_accessed_7d_sum", | |
| "off_hours_files_accessed_30d_sum", | |
| "off_hours_files_accessed_1d_over_30d_ratio", | |
| "file_late_night_count_7d_sum", | |
| "file_late_night_count_30d_sum", | |
| "file_late_night_count_1d_over_30d_ratio", | |
| "file_hourly_entropy_7d_sum", | |
| "file_hourly_entropy_30d_sum", | |
| "file_hourly_entropy_1d_over_30d_ratio", | |
| "file_peak_hour_count_7d_sum", | |
| "file_peak_hour_count_30d_sum", | |
| "file_peak_hour_count_1d_over_30d_ratio", | |
| "file_longest_active_run_minutes_7d_sum", | |
| "file_longest_active_run_minutes_30d_sum", | |
| "file_longest_active_run_minutes_1d_over_30d_ratio", | |
| "usb_insert_count_7d_sum", | |
| "usb_insert_count_30d_sum", | |
| "usb_insert_count_1d_over_30d_ratio", | |
| "usb_remove_count_7d_sum", | |
| "usb_remove_count_30d_sum", | |
| "usb_remove_count_1d_over_30d_ratio", | |
| "off_hours_usb_usage_7d_sum", | |
| "off_hours_usb_usage_30d_sum", | |
| "off_hours_usb_usage_1d_over_30d_ratio", | |
| "device_late_night_count_7d_sum", | |
| "device_late_night_count_30d_sum", | |
| "device_late_night_count_1d_over_30d_ratio", | |
| "device_hourly_entropy_7d_sum", | |
| "device_hourly_entropy_30d_sum", | |
| "device_hourly_entropy_1d_over_30d_ratio", | |
| "device_longest_active_run_minutes_7d_sum", | |
| "device_longest_active_run_minutes_30d_sum", | |
| "device_longest_active_run_minutes_1d_over_30d_ratio", | |
| "emails_sent_7d_sum", | |
| "emails_sent_30d_sum", | |
| "emails_sent_1d_over_30d_ratio", | |
| "external_emails_sent_7d_sum", | |
| "external_emails_sent_30d_sum", | |
| "external_emails_sent_1d_over_30d_ratio", | |
| "attachments_sent_7d_sum", | |
| "attachments_sent_30d_sum", | |
| "attachments_sent_1d_over_30d_ratio", | |
| "off_hours_emails_7d_sum", | |
| "off_hours_emails_30d_sum", | |
| "off_hours_emails_1d_over_30d_ratio", | |
| "unique_recipients_7d_sum", | |
| "unique_recipients_30d_sum", | |
| "unique_recipients_1d_over_30d_ratio", | |
| "email_late_night_count_7d_sum", | |
| "email_late_night_count_30d_sum", | |
| "email_late_night_count_1d_over_30d_ratio", | |
| "email_hourly_entropy_7d_sum", | |
| "email_hourly_entropy_30d_sum", | |
| "email_hourly_entropy_1d_over_30d_ratio", | |
| "email_peak_hour_count_7d_sum", | |
| "email_peak_hour_count_30d_sum", | |
| "email_peak_hour_count_1d_over_30d_ratio", | |
| "http_total_requests_7d_sum", | |
| "http_total_requests_30d_sum", | |
| "http_total_requests_1d_over_30d_ratio", | |
| "http_visit_count_7d_sum", | |
| "http_visit_count_30d_sum", | |
| "http_visit_count_1d_over_30d_ratio", | |
| "http_download_count_7d_sum", | |
| "http_download_count_30d_sum", | |
| "http_download_count_1d_over_30d_ratio", | |
| "http_upload_count_7d_sum", | |
| "http_upload_count_30d_sum", | |
| "http_upload_count_1d_over_30d_ratio", | |
| "http_jobsite_visits_7d_sum", | |
| "http_jobsite_visits_30d_sum", | |
| "http_jobsite_visits_1d_over_30d_ratio", | |
| "http_cloud_storage_visits_7d_sum", | |
| "http_cloud_storage_visits_30d_sum", | |
| "http_cloud_storage_visits_1d_over_30d_ratio", | |
| "http_suspicious_site_visits_7d_sum", | |
| "http_suspicious_site_visits_30d_sum", | |
| "http_suspicious_site_visits_1d_over_30d_ratio", | |
| "off_hours_http_requests_7d_sum", | |
| "off_hours_http_requests_30d_sum", | |
| "off_hours_http_requests_1d_over_30d_ratio", | |
| "http_long_url_count_7d_sum", | |
| "http_long_url_count_30d_sum", | |
| "http_long_url_count_1d_over_30d_ratio", | |
| "unique_domains_visited_7d_sum", | |
| "unique_domains_visited_30d_sum", | |
| "unique_domains_visited_1d_over_30d_ratio", | |
| "http_late_night_count_7d_sum", | |
| "http_late_night_count_30d_sum", | |
| "http_late_night_count_1d_over_30d_ratio", | |
| "http_hourly_entropy_7d_sum", | |
| "http_hourly_entropy_30d_sum", | |
| "http_hourly_entropy_1d_over_30d_ratio", | |
| "http_peak_hour_count_7d_sum", | |
| "http_peak_hour_count_30d_sum", | |
| "http_peak_hour_count_1d_over_30d_ratio", | |
| "pcs_used_count_7d_sum", | |
| "pcs_used_count_30d_sum", | |
| "pcs_used_count_1d_over_30d_ratio", | |
| "non_primary_pc_used_flag_7d_sum", | |
| "non_primary_pc_used_flag_30d_sum", | |
| "non_primary_pc_used_flag_1d_over_30d_ratio", | |
| "non_primary_pc_http_requests_flag_7d_sum", | |
| "non_primary_pc_http_requests_flag_30d_sum", | |
| "non_primary_pc_http_requests_flag_1d_over_30d_ratio", | |
| "non_primary_pc_usb_flag_7d_sum", | |
| "non_primary_pc_usb_flag_30d_sum", | |
| "non_primary_pc_usb_flag_1d_over_30d_ratio", | |
| "non_primary_pc_file_copy_flag_7d_sum", | |
| "non_primary_pc_file_copy_flag_30d_sum", | |
| "non_primary_pc_file_copy_flag_1d_over_30d_ratio", | |
| "logon_count_zscore", | |
| "logoff_count_zscore", | |
| "off_hours_logon_zscore", | |
| "logon_late_night_count_zscore", | |
| "logon_hourly_entropy_zscore", | |
| "logon_peak_hour_count_zscore", | |
| "logon_longest_active_run_minutes_zscore", | |
| "file_open_count_zscore", | |
| "file_write_count_zscore", | |
| "file_copy_count_zscore", | |
| "file_delete_count_zscore", | |
| "unique_files_accessed_zscore", | |
| "off_hours_files_accessed_zscore", | |
| "file_late_night_count_zscore", | |
| "file_hourly_entropy_zscore", | |
| "file_peak_hour_count_zscore", | |
| "file_longest_active_run_minutes_zscore", | |
| "usb_insert_count_zscore", | |
| "usb_remove_count_zscore", | |
| "off_hours_usb_usage_zscore", | |
| "device_late_night_count_zscore", | |
| "device_hourly_entropy_zscore", | |
| "device_longest_active_run_minutes_zscore", | |
| "emails_sent_zscore", | |
| "external_emails_sent_zscore", | |
| "attachments_sent_zscore", | |
| "off_hours_emails_zscore", | |
| "unique_recipients_zscore", | |
| "email_late_night_count_zscore", | |
| "email_hourly_entropy_zscore", | |
| "email_peak_hour_count_zscore", | |
| "http_total_requests_zscore", | |
| "http_visit_count_zscore", | |
| "http_download_count_zscore", | |
| "http_upload_count_zscore", | |
| "http_jobsite_visits_zscore", | |
| "http_cloud_storage_visits_zscore", | |
| "http_suspicious_site_visits_zscore", | |
| "off_hours_http_requests_zscore", | |
| "http_long_url_count_zscore", | |
| "unique_domains_visited_zscore", | |
| "http_late_night_count_zscore", | |
| "http_hourly_entropy_zscore", | |
| "http_peak_hour_count_zscore", | |
| "pcs_used_count_zscore", | |
| "non_primary_pc_used_flag_zscore", | |
| "non_primary_pc_http_requests_flag_zscore", | |
| "non_primary_pc_usb_flag_zscore", | |
| "non_primary_pc_file_copy_flag_zscore", | |
| "logon_count_zscore_90d", | |
| "logoff_count_zscore_90d", | |
| "off_hours_logon_zscore_90d", | |
| "logon_late_night_count_zscore_90d", | |
| "logon_hourly_entropy_zscore_90d", | |
| "logon_peak_hour_count_zscore_90d", | |
| "logon_longest_active_run_minutes_zscore_90d", | |
| "file_open_count_zscore_90d", | |
| "file_write_count_zscore_90d", | |
| "file_copy_count_zscore_90d", | |
| "file_delete_count_zscore_90d", | |
| "unique_files_accessed_zscore_90d", | |
| "off_hours_files_accessed_zscore_90d", | |
| "file_late_night_count_zscore_90d", | |
| "file_hourly_entropy_zscore_90d", | |
| "file_peak_hour_count_zscore_90d", | |
| "file_longest_active_run_minutes_zscore_90d", | |
| "usb_insert_count_zscore_90d", | |
| "usb_remove_count_zscore_90d", | |
| "off_hours_usb_usage_zscore_90d", | |
| "device_late_night_count_zscore_90d", | |
| "device_hourly_entropy_zscore_90d", | |
| "device_longest_active_run_minutes_zscore_90d", | |
| "emails_sent_zscore_90d", | |
| "external_emails_sent_zscore_90d", | |
| "attachments_sent_zscore_90d", | |
| "off_hours_emails_zscore_90d", | |
| "unique_recipients_zscore_90d", | |
| "email_late_night_count_zscore_90d", | |
| "email_hourly_entropy_zscore_90d", | |
| "email_peak_hour_count_zscore_90d", | |
| "http_total_requests_zscore_90d", | |
| "http_visit_count_zscore_90d", | |
| "http_download_count_zscore_90d", | |
| "http_upload_count_zscore_90d", | |
| "http_jobsite_visits_zscore_90d", | |
| "http_cloud_storage_visits_zscore_90d", | |
| "http_suspicious_site_visits_zscore_90d", | |
| "off_hours_http_requests_zscore_90d", | |
| "http_long_url_count_zscore_90d", | |
| "unique_domains_visited_zscore_90d", | |
| "http_late_night_count_zscore_90d", | |
| "http_hourly_entropy_zscore_90d", | |
| "http_peak_hour_count_zscore_90d", | |
| "pcs_used_count_zscore_90d", | |
| "non_primary_pc_used_flag_zscore_90d", | |
| "non_primary_pc_http_requests_flag_zscore_90d", | |
| "non_primary_pc_usb_flag_zscore_90d", | |
| "non_primary_pc_file_copy_flag_zscore_90d", | |
| "logon_count_rolling_delta", | |
| "logoff_count_rolling_delta", | |
| "off_hours_logon_rolling_delta", | |
| "logon_late_night_count_rolling_delta", | |
| "logon_hourly_entropy_rolling_delta", | |
| "logon_peak_hour_count_rolling_delta", | |
| "logon_longest_active_run_minutes_rolling_delta", | |
| "file_open_count_rolling_delta", | |
| "file_write_count_rolling_delta", | |
| "file_copy_count_rolling_delta", | |
| "file_delete_count_rolling_delta", | |
| "unique_files_accessed_rolling_delta", | |
| "off_hours_files_accessed_rolling_delta", | |
| "file_late_night_count_rolling_delta", | |
| "file_hourly_entropy_rolling_delta", | |
| "file_peak_hour_count_rolling_delta", | |
| "file_longest_active_run_minutes_rolling_delta", | |
| "usb_insert_count_rolling_delta", | |
| "usb_remove_count_rolling_delta", | |
| "off_hours_usb_usage_rolling_delta", | |
| "device_late_night_count_rolling_delta", | |
| "device_hourly_entropy_rolling_delta", | |
| "device_longest_active_run_minutes_rolling_delta", | |
| "emails_sent_rolling_delta", | |
| "external_emails_sent_rolling_delta", | |
| "attachments_sent_rolling_delta", | |
| "off_hours_emails_rolling_delta", | |
| "unique_recipients_rolling_delta", | |
| "email_late_night_count_rolling_delta", | |
| "email_hourly_entropy_rolling_delta", | |
| "email_peak_hour_count_rolling_delta", | |
| "http_total_requests_rolling_delta", | |
| "http_visit_count_rolling_delta", | |
| "http_download_count_rolling_delta", | |
| "http_upload_count_rolling_delta", | |
| "http_jobsite_visits_rolling_delta", | |
| "http_cloud_storage_visits_rolling_delta", | |
| "http_suspicious_site_visits_rolling_delta", | |
| "off_hours_http_requests_rolling_delta", | |
| "http_long_url_count_rolling_delta", | |
| "unique_domains_visited_rolling_delta", | |
| "http_late_night_count_rolling_delta", | |
| "http_hourly_entropy_rolling_delta", | |
| "http_peak_hour_count_rolling_delta", | |
| "pcs_used_count_rolling_delta", | |
| "non_primary_pc_used_flag_rolling_delta", | |
| "non_primary_pc_http_requests_flag_rolling_delta", | |
| "non_primary_pc_usb_flag_rolling_delta", | |
| "non_primary_pc_file_copy_flag_rolling_delta", | |
| "off_hours_activity_flag", | |
| "usb_file_activity_flag", | |
| "external_comm_activity_flag", | |
| "jobsite_usb_activity_flag", | |
| "suspicious_upload_flag", | |
| "cloud_upload_flag", | |
| "non_primary_pc_risk_flag", | |
| "logon_count_peer_zscore", | |
| "logoff_count_peer_zscore", | |
| "off_hours_logon_peer_zscore", | |
| "logon_late_night_count_peer_zscore", | |
| "logon_hourly_entropy_peer_zscore", | |
| "logon_peak_hour_count_peer_zscore", | |
| "logon_longest_active_run_minutes_peer_zscore", | |
| "file_open_count_peer_zscore", | |
| "file_write_count_peer_zscore", | |
| "file_copy_count_peer_zscore", | |
| "file_delete_count_peer_zscore", | |
| "unique_files_accessed_peer_zscore", | |
| "off_hours_files_accessed_peer_zscore", | |
| "file_late_night_count_peer_zscore", | |
| "file_hourly_entropy_peer_zscore", | |
| "file_peak_hour_count_peer_zscore", | |
| "file_longest_active_run_minutes_peer_zscore", | |
| "usb_insert_count_peer_zscore", | |
| "usb_remove_count_peer_zscore", | |
| "off_hours_usb_usage_peer_zscore", | |
| "device_late_night_count_peer_zscore", | |
| "device_hourly_entropy_peer_zscore", | |
| "device_longest_active_run_minutes_peer_zscore", | |
| "emails_sent_peer_zscore", | |
| "external_emails_sent_peer_zscore", | |
| "attachments_sent_peer_zscore", | |
| "off_hours_emails_peer_zscore", | |
| "unique_recipients_peer_zscore", | |
| "email_late_night_count_peer_zscore", | |
| "email_hourly_entropy_peer_zscore", | |
| "email_peak_hour_count_peer_zscore", | |
| "http_total_requests_peer_zscore", | |
| "http_visit_count_peer_zscore", | |
| "http_download_count_peer_zscore", | |
| "http_upload_count_peer_zscore", | |
| "http_jobsite_visits_peer_zscore", | |
| "http_cloud_storage_visits_peer_zscore", | |
| "http_suspicious_site_visits_peer_zscore", | |
| "off_hours_http_requests_peer_zscore", | |
| "http_long_url_count_peer_zscore", | |
| "unique_domains_visited_peer_zscore", | |
| "http_late_night_count_peer_zscore", | |
| "http_hourly_entropy_peer_zscore", | |
| "http_peak_hour_count_peer_zscore", | |
| "pcs_used_count_peer_zscore", | |
| "non_primary_pc_used_flag_peer_zscore", | |
| "non_primary_pc_http_requests_flag_peer_zscore", | |
| "non_primary_pc_usb_flag_peer_zscore", | |
| "non_primary_pc_file_copy_flag_peer_zscore" | |
| ] |