[
  "logon_count",
  "logoff_count",
  "off_hours_logon",
  "logon_late_night_count",
  "file_open_count",
  "file_write_count",
  "file_copy_count",
  "file_delete_count",
  "off_hours_files_accessed",
  "file_late_night_count",
  "usb_insert_count",
  "usb_remove_count",
  "off_hours_usb_usage",
  "device_late_night_count",
  "emails_sent",
  "external_emails_sent",
  "attachments_sent",
  "off_hours_emails",
  "email_late_night_count",
  "http_total_requests",
  "http_visit_count",
  "http_download_count",
  "http_upload_count",
  "http_jobsite_visits",
  "http_cloud_storage_visits",
  "http_suspicious_site_visits",
  "off_hours_http_requests",
  "http_long_url_count",
  "http_late_night_count",
  "pc_seen_before",
  "new_pc_after_stable_history",
  "logon_hourly_entropy",
  "logon_peak_hour_count",
  "logon_longest_active_run_minutes",
  "file_hourly_entropy",
  "file_peak_hour_count",
  "file_longest_active_run_minutes",
  "device_hourly_entropy",
  "device_longest_active_run_minutes",
  "email_hourly_entropy",
  "email_peak_hour_count",
  "http_hourly_entropy",
  "http_peak_hour_count",
  "pc_prior_use_ratio",
  "primary_pc_activity_ratio",
  "distinct_pcs_used_prior",
  "pcs_used_count",
  "non_primary_pc_used_flag",
  "non_primary_pc_http_requests_flag",
  "non_primary_pc_usb_flag",
  "non_primary_pc_file_copy_flag",
  "unique_files_accessed",
  "unique_recipients",
  "unique_domains_visited",
  "logon_count_7d_sum",
  "logon_count_30d_sum",
  "logon_count_1d_over_30d_ratio",
  "logoff_count_7d_sum",
  "logoff_count_30d_sum",
  "logoff_count_1d_over_30d_ratio",
  "off_hours_logon_7d_sum",
  "off_hours_logon_30d_sum",
  "off_hours_logon_1d_over_30d_ratio",
  "logon_late_night_count_7d_sum",
  "logon_late_night_count_30d_sum",
  "logon_late_night_count_1d_over_30d_ratio",
  "logon_hourly_entropy_7d_sum",
  "logon_hourly_entropy_30d_sum",
  "logon_hourly_entropy_1d_over_30d_ratio",
  "logon_peak_hour_count_7d_sum",
  "logon_peak_hour_count_30d_sum",
  "logon_peak_hour_count_1d_over_30d_ratio",
  "logon_longest_active_run_minutes_7d_sum",
  "logon_longest_active_run_minutes_30d_sum",
  "logon_longest_active_run_minutes_1d_over_30d_ratio",
  "file_open_count_7d_sum",
  "file_open_count_30d_sum",
  "file_open_count_1d_over_30d_ratio",
  "file_write_count_7d_sum",
  "file_write_count_30d_sum",
  "file_write_count_1d_over_30d_ratio",
  "file_copy_count_7d_sum",
  "file_copy_count_30d_sum",
  "file_copy_count_1d_over_30d_ratio",
  "file_delete_count_7d_sum",
  "file_delete_count_30d_sum",
  "file_delete_count_1d_over_30d_ratio",
  "unique_files_accessed_7d_sum",
  "unique_files_accessed_30d_sum",
  "unique_files_accessed_1d_over_30d_ratio",
  "off_hours_files_accessed_7d_sum",
  "off_hours_files_accessed_30d_sum",
  "off_hours_files_accessed_1d_over_30d_ratio",
  "file_late_night_count_7d_sum",
  "file_late_night_count_30d_sum",
  "file_late_night_count_1d_over_30d_ratio",
  "file_hourly_entropy_7d_sum",
  "file_hourly_entropy_30d_sum",
  "file_hourly_entropy_1d_over_30d_ratio",
  "file_peak_hour_count_7d_sum",
  "file_peak_hour_count_30d_sum",
  "file_peak_hour_count_1d_over_30d_ratio",
  "file_longest_active_run_minutes_7d_sum",
  "file_longest_active_run_minutes_30d_sum",
  "file_longest_active_run_minutes_1d_over_30d_ratio",
  "usb_insert_count_7d_sum",
  "usb_insert_count_30d_sum",
  "usb_insert_count_1d_over_30d_ratio",
  "usb_remove_count_7d_sum",
  "usb_remove_count_30d_sum",
  "usb_remove_count_1d_over_30d_ratio",
  "off_hours_usb_usage_7d_sum",
  "off_hours_usb_usage_30d_sum",
  "off_hours_usb_usage_1d_over_30d_ratio",
  "device_late_night_count_7d_sum",
  "device_late_night_count_30d_sum",
  "device_late_night_count_1d_over_30d_ratio",
  "device_hourly_entropy_7d_sum",
  "device_hourly_entropy_30d_sum",
  "device_hourly_entropy_1d_over_30d_ratio",
  "device_longest_active_run_minutes_7d_sum",
  "device_longest_active_run_minutes_30d_sum",
  "device_longest_active_run_minutes_1d_over_30d_ratio",
  "emails_sent_7d_sum",
  "emails_sent_30d_sum",
  "emails_sent_1d_over_30d_ratio",
  "external_emails_sent_7d_sum",
  "external_emails_sent_30d_sum",
  "external_emails_sent_1d_over_30d_ratio",
  "attachments_sent_7d_sum",
  "attachments_sent_30d_sum",
  "attachments_sent_1d_over_30d_ratio",
  "off_hours_emails_7d_sum",
  "off_hours_emails_30d_sum",
  "off_hours_emails_1d_over_30d_ratio",
  "unique_recipients_7d_sum",
  "unique_recipients_30d_sum",
  "unique_recipients_1d_over_30d_ratio",
  "email_late_night_count_7d_sum",
  "email_late_night_count_30d_sum",
  "email_late_night_count_1d_over_30d_ratio",
  "email_hourly_entropy_7d_sum",
  "email_hourly_entropy_30d_sum",
  "email_hourly_entropy_1d_over_30d_ratio",
  "email_peak_hour_count_7d_sum",
  "email_peak_hour_count_30d_sum",
  "email_peak_hour_count_1d_over_30d_ratio",
  "http_total_requests_7d_sum",
  "http_total_requests_30d_sum",
  "http_total_requests_1d_over_30d_ratio",
  "http_visit_count_7d_sum",
  "http_visit_count_30d_sum",
  "http_visit_count_1d_over_30d_ratio",
  "http_download_count_7d_sum",
  "http_download_count_30d_sum",
  "http_download_count_1d_over_30d_ratio",
  "http_upload_count_7d_sum",
  "http_upload_count_30d_sum",
  "http_upload_count_1d_over_30d_ratio",
  "http_jobsite_visits_7d_sum",
  "http_jobsite_visits_30d_sum",
  "http_jobsite_visits_1d_over_30d_ratio",
  "http_cloud_storage_visits_7d_sum",
  "http_cloud_storage_visits_30d_sum",
  "http_cloud_storage_visits_1d_over_30d_ratio",
  "http_suspicious_site_visits_7d_sum",
  "http_suspicious_site_visits_30d_sum",
  "http_suspicious_site_visits_1d_over_30d_ratio",
  "off_hours_http_requests_7d_sum",
  "off_hours_http_requests_30d_sum",
  "off_hours_http_requests_1d_over_30d_ratio",
  "http_long_url_count_7d_sum",
  "http_long_url_count_30d_sum",
  "http_long_url_count_1d_over_30d_ratio",
  "unique_domains_visited_7d_sum",
  "unique_domains_visited_30d_sum",
  "unique_domains_visited_1d_over_30d_ratio",
  "http_late_night_count_7d_sum",
  "http_late_night_count_30d_sum",
  "http_late_night_count_1d_over_30d_ratio",
  "http_hourly_entropy_7d_sum",
  "http_hourly_entropy_30d_sum",
  "http_hourly_entropy_1d_over_30d_ratio",
  "http_peak_hour_count_7d_sum",
  "http_peak_hour_count_30d_sum",
  "http_peak_hour_count_1d_over_30d_ratio",
  "pcs_used_count_7d_sum",
  "pcs_used_count_30d_sum",
  "pcs_used_count_1d_over_30d_ratio",
  "non_primary_pc_used_flag_7d_sum",
  "non_primary_pc_used_flag_30d_sum",
  "non_primary_pc_used_flag_1d_over_30d_ratio",
  "non_primary_pc_http_requests_flag_7d_sum",
  "non_primary_pc_http_requests_flag_30d_sum",
  "non_primary_pc_http_requests_flag_1d_over_30d_ratio",
  "non_primary_pc_usb_flag_7d_sum",
  "non_primary_pc_usb_flag_30d_sum",
  "non_primary_pc_usb_flag_1d_over_30d_ratio",
  "non_primary_pc_file_copy_flag_7d_sum",
  "non_primary_pc_file_copy_flag_30d_sum",
  "non_primary_pc_file_copy_flag_1d_over_30d_ratio",
  "logon_count_zscore",
  "logoff_count_zscore",
  "off_hours_logon_zscore",
  "logon_late_night_count_zscore",
  "logon_hourly_entropy_zscore",
  "logon_peak_hour_count_zscore",
  "logon_longest_active_run_minutes_zscore",
  "file_open_count_zscore",
  "file_write_count_zscore",
  "file_copy_count_zscore",
  "file_delete_count_zscore",
  "unique_files_accessed_zscore",
  "off_hours_files_accessed_zscore",
  "file_late_night_count_zscore",
  "file_hourly_entropy_zscore",
  "file_peak_hour_count_zscore",
  "file_longest_active_run_minutes_zscore",
  "usb_insert_count_zscore",
  "usb_remove_count_zscore",
  "off_hours_usb_usage_zscore",
  "device_late_night_count_zscore",
  "device_hourly_entropy_zscore",
  "device_longest_active_run_minutes_zscore",
  "emails_sent_zscore",
  "external_emails_sent_zscore",
  "attachments_sent_zscore",
  "off_hours_emails_zscore",
  "unique_recipients_zscore",
  "email_late_night_count_zscore",
  "email_hourly_entropy_zscore",
  "email_peak_hour_count_zscore",
  "http_total_requests_zscore",
  "http_visit_count_zscore",
  "http_download_count_zscore",
  "http_upload_count_zscore",
  "http_jobsite_visits_zscore",
  "http_cloud_storage_visits_zscore",
  "http_suspicious_site_visits_zscore",
  "off_hours_http_requests_zscore",
  "http_long_url_count_zscore",
  "unique_domains_visited_zscore",
  "http_late_night_count_zscore",
  "http_hourly_entropy_zscore",
  "http_peak_hour_count_zscore",
  "pcs_used_count_zscore",
  "non_primary_pc_used_flag_zscore",
  "non_primary_pc_http_requests_flag_zscore",
  "non_primary_pc_usb_flag_zscore",
  "non_primary_pc_file_copy_flag_zscore",
  "logon_count_zscore_90d",
  "logoff_count_zscore_90d",
  "off_hours_logon_zscore_90d",
  "logon_late_night_count_zscore_90d",
  "logon_hourly_entropy_zscore_90d",
  "logon_peak_hour_count_zscore_90d",
  "logon_longest_active_run_minutes_zscore_90d",
  "file_open_count_zscore_90d",
  "file_write_count_zscore_90d",
  "file_copy_count_zscore_90d",
  "file_delete_count_zscore_90d",
  "unique_files_accessed_zscore_90d",
  "off_hours_files_accessed_zscore_90d",
  "file_late_night_count_zscore_90d",
  "file_hourly_entropy_zscore_90d",
  "file_peak_hour_count_zscore_90d",
  "file_longest_active_run_minutes_zscore_90d",
  "usb_insert_count_zscore_90d",
  "usb_remove_count_zscore_90d",
  "off_hours_usb_usage_zscore_90d",
  "device_late_night_count_zscore_90d",
  "device_hourly_entropy_zscore_90d",
  "device_longest_active_run_minutes_zscore_90d",
  "emails_sent_zscore_90d",
  "external_emails_sent_zscore_90d",
  "attachments_sent_zscore_90d",
  "off_hours_emails_zscore_90d",
  "unique_recipients_zscore_90d",
  "email_late_night_count_zscore_90d",
  "email_hourly_entropy_zscore_90d",
  "email_peak_hour_count_zscore_90d",
  "http_total_requests_zscore_90d",
  "http_visit_count_zscore_90d",
  "http_download_count_zscore_90d",
  "http_upload_count_zscore_90d",
  "http_jobsite_visits_zscore_90d",
  "http_cloud_storage_visits_zscore_90d",
  "http_suspicious_site_visits_zscore_90d",
  "off_hours_http_requests_zscore_90d",
  "http_long_url_count_zscore_90d",
  "unique_domains_visited_zscore_90d",
  "http_late_night_count_zscore_90d",
  "http_hourly_entropy_zscore_90d",
  "http_peak_hour_count_zscore_90d",
  "pcs_used_count_zscore_90d",
  "non_primary_pc_used_flag_zscore_90d",
  "non_primary_pc_http_requests_flag_zscore_90d",
  "non_primary_pc_usb_flag_zscore_90d",
  "non_primary_pc_file_copy_flag_zscore_90d",
  "logon_count_rolling_delta",
  "logoff_count_rolling_delta",
  "off_hours_logon_rolling_delta",
  "logon_late_night_count_rolling_delta",
  "logon_hourly_entropy_rolling_delta",
  "logon_peak_hour_count_rolling_delta",
  "logon_longest_active_run_minutes_rolling_delta",
  "file_open_count_rolling_delta",
  "file_write_count_rolling_delta",
  "file_copy_count_rolling_delta",
  "file_delete_count_rolling_delta",
  "unique_files_accessed_rolling_delta",
  "off_hours_files_accessed_rolling_delta",
  "file_late_night_count_rolling_delta",
  "file_hourly_entropy_rolling_delta",
  "file_peak_hour_count_rolling_delta",
  "file_longest_active_run_minutes_rolling_delta",
  "usb_insert_count_rolling_delta",
  "usb_remove_count_rolling_delta",
  "off_hours_usb_usage_rolling_delta",
  "device_late_night_count_rolling_delta",
  "device_hourly_entropy_rolling_delta",
  "device_longest_active_run_minutes_rolling_delta",
  "emails_sent_rolling_delta",
  "external_emails_sent_rolling_delta",
  "attachments_sent_rolling_delta",
  "off_hours_emails_rolling_delta",
  "unique_recipients_rolling_delta",
  "email_late_night_count_rolling_delta",
  "email_hourly_entropy_rolling_delta",
  "email_peak_hour_count_rolling_delta",
  "http_total_requests_rolling_delta",
  "http_visit_count_rolling_delta",
  "http_download_count_rolling_delta",
  "http_upload_count_rolling_delta",
  "http_jobsite_visits_rolling_delta",
  "http_cloud_storage_visits_rolling_delta",
  "http_suspicious_site_visits_rolling_delta",
  "off_hours_http_requests_rolling_delta",
  "http_long_url_count_rolling_delta",
  "unique_domains_visited_rolling_delta",
  "http_late_night_count_rolling_delta",
  "http_hourly_entropy_rolling_delta",
  "http_peak_hour_count_rolling_delta",
  "pcs_used_count_rolling_delta",
  "non_primary_pc_used_flag_rolling_delta",
  "non_primary_pc_http_requests_flag_rolling_delta",
  "non_primary_pc_usb_flag_rolling_delta",
  "non_primary_pc_file_copy_flag_rolling_delta",
  "off_hours_activity_flag",
  "usb_file_activity_flag",
  "external_comm_activity_flag",
  "jobsite_usb_activity_flag",
  "suspicious_upload_flag",
  "cloud_upload_flag",
  "non_primary_pc_risk_flag",
  "logon_count_peer_zscore",
  "logoff_count_peer_zscore",
  "off_hours_logon_peer_zscore",
  "logon_late_night_count_peer_zscore",
  "logon_hourly_entropy_peer_zscore",
  "logon_peak_hour_count_peer_zscore",
  "logon_longest_active_run_minutes_peer_zscore",
  "file_open_count_peer_zscore",
  "file_write_count_peer_zscore",
  "file_copy_count_peer_zscore",
  "file_delete_count_peer_zscore",
  "unique_files_accessed_peer_zscore",
  "off_hours_files_accessed_peer_zscore",
  "file_late_night_count_peer_zscore",
  "file_hourly_entropy_peer_zscore",
  "file_peak_hour_count_peer_zscore",
  "file_longest_active_run_minutes_peer_zscore",
  "usb_insert_count_peer_zscore",
  "usb_remove_count_peer_zscore",
  "off_hours_usb_usage_peer_zscore",
  "device_late_night_count_peer_zscore",
  "device_hourly_entropy_peer_zscore",
  "device_longest_active_run_minutes_peer_zscore",
  "emails_sent_peer_zscore",
  "external_emails_sent_peer_zscore",
  "attachments_sent_peer_zscore",
  "off_hours_emails_peer_zscore",
  "unique_recipients_peer_zscore",
  "email_late_night_count_peer_zscore",
  "email_hourly_entropy_peer_zscore",
  "email_peak_hour_count_peer_zscore",
  "http_total_requests_peer_zscore",
  "http_visit_count_peer_zscore",
  "http_download_count_peer_zscore",
  "http_upload_count_peer_zscore",
  "http_jobsite_visits_peer_zscore",
  "http_cloud_storage_visits_peer_zscore",
  "http_suspicious_site_visits_peer_zscore",
  "off_hours_http_requests_peer_zscore",
  "http_long_url_count_peer_zscore",
  "unique_domains_visited_peer_zscore",
  "http_late_night_count_peer_zscore",
  "http_hourly_entropy_peer_zscore",
  "http_peak_hour_count_peer_zscore",
  "pcs_used_count_peer_zscore",
  "non_primary_pc_used_flag_peer_zscore",
  "non_primary_pc_http_requests_flag_peer_zscore",
  "non_primary_pc_usb_flag_peer_zscore",
  "non_primary_pc_file_copy_flag_peer_zscore"
]