Cisco Cisco Firepower Management Center 2000 Guia Do Programador

This chapter contains information on the schema and supported joins for user activity and identity 
events. The FireSIGHT System can detect user activity on your network by tracking various types of user 
logins, including LDAP, POP3, IMAP, SMTP, AIM, and SIP.

For more information, see the sections listed in the following table.

The 

 table contains detailed information about each user detected by the system. 

The 

 table supersedes the deprecated 

 table starting with Version 5.0 of the 

FireSIGHT System.

For more information, see the following sections:

The following table describes the fields you can access in the 

 table.

information about the users detected by the system.

5.0+

user discovery events, which communicate the details of user 
activity on your network.

5.0+

dept

The department of the user.

email

The email address for the user.

first_name

The first name for the user.