This section describes the fields that can be in an App Control event. Those shown as “required” can be expected to be present in each App Control event. Other fields are present only for certain events or under certain conditions.
Timestamp (required) Severity (required) Type (required) Subtype (required) Source (required) Unified Server Source Description (required) IP Address User File Events Process Events Process Name, Process Path, Process Key, Process Trust, and Process Threat Installer, Root Hash Policy Additional Fields
