Categories

The Integrated Cyber Defense Schema organizes event types into categories.
Application Activity
Application Activity

[3]

Application Activity events report detailed information about the behavior of applications.
Audit
Audit

[4]

Audit events report user activity at management consoles.
Diagnostic
Diagnostic

[6]

Diagnostic events report status, errors, and performance statistics of a service or application.
Evidence of Compromise
Evidence of Compromise

[7]

Evidence of Compromise (EoC) events report the results of EoC queries and remediations.
Information Protection
Information Protection

[8]

Information Protection events report the monitoring, detection, and resolution of content policy violations.
License
License

[2]

License events report client and management platform license-related activity.
Security
Security

[1]

Security events report the detection and resolution of threats, anomalies, and security policy violations, as well as traces of such.
System Activity
System Activity

[5]

System Activity events report actions that occur at devices and on the network.
Broadcom, the pulse logo, Connecting everything, Symantec, and the Symantec logo are among the trademarks of Broadcom. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Other names may be the trademarks of their respective owners.