Supported Features for Linking Elements in a Custom Detection Rule

The following tables list Features available per Element. Use the following values in the “UI Name” columns when constructing queries in the Cybereason UI, and use the values in the “API Name” columns in API query requests.

Connection Element

Use these Features to connect a Connection Element to other Elements:

API Feature Name	UI Feature Name	API Target Element
DomainName	Domain Name	DomainName
remoteMachine	Remote Machine	Machine
urlDomains	URL Domains	DomainName

File Element

Use these Features to connect a File Element to other Elements:

API Feature Name	UI Feature Name	API Target Element
fileHash	File Hash	FileHash
ownerMachine	Machine	Machine

Logon Session Element

Use these Features to connect a Logon Session Element to other Elements:

API Feature Name	UI Feature Name	API Target Element
ownerMachine	Owner machine	Machine
remoteMachine	Remote Machine	Machine
user	User	User

Module Element

Use these Features to connect a File Element to other Elements:

API Feature Name	UI Feature Name	API Target Element
file	File	File

Process Element

Use these Features to connect a Process Element to other Elements:

API Feature Name	UI Feature Name	API Target Element
autorun	Registry entry	Autorun
children	Children	Process
connections	Connections	Connection
hostedChildren	Hosted injected children	Process
hostProcess	Host Process	Process
imageFile	Image file	File
injectedChildren	Injected Child Processes	Process
loadedModules	Loaded Modules	Module
originInjector	Original Injector Process	Process
ownerMachine	Machine	Machine
parentProcess	Parent process	Process
scheduledTask	Scheduled task	ScheduledTask
service	Service	Service
user	User	User

Scheduled Task Element

Use these Features to connect a Scheduled Task Element to other Elements:

API Feature Name	UI Feature Name	API Target Element
executableActions	Scheduled Task Actions	ExecutableTaskActions

Service Element

Use these Features to connect a Service Element to other Elements:

API Feature Name	UI Feature Name	API Target Element
binaryFile	Binary file	File
ownerMachine	Machine	Machine