USM Anywhere Event Type Templates

Role Availability	Read-Only	Investigator	Analyst	Manager

USM Anywhere includes a set of predefined templates based on the classification of event data source types and based on data sources.

You can find these templates on Reports > Event Type Templates.

There are these types of templates:

• Type of Data Source. Event Type Templates enable you to easily run a general firewall, authentication, and other types of normalized queries that do not require you to build complex filters based on specific data source or event types. USM Anywhere supports these reports: Anomaly Detection, Antivirus, Application, Application Firewall, Authentication, Authentication and DHCP, Cloud Application, Cloud Infrastructure, DNS Server, Data Protection, Database, Endpoint Protection, Endpoint Security, Firewall, IDS, Infrastructure Monitoring, Intrusion Detection, Intrusion Prevention, Load Balancer, Mail Security, Mail Server, Management Platform, Network Access Control, Operating System, Other Devices, Proxy, Router, Router/Switch, Server, Switch, Unified Threat Management, VPN, Web Server, Wireless Security/Management.
• Data Sources. You can find templates based on the most commonly used data sources including NIDS, AWS, Amazon DynamoDB, Amazon S3, AWS VPC Flow Logs, AWS Load Balancers, Azure, Cisco Umbrella, Cylance, FireEye, Fortigate, G Suite, McAfee ePO, Office 365, Okta, Palo Alto, SonicWall, Sophos UTM, Watchguard, VMware, Windows, LevelBlue Agent. There is also a template for the LevelBlue Generic Data Source.