The ICDx Data Center Security collector accumulates and forwards information from the DCS product but it is not clear what the values collected for product_data.operation mean.
The collected values are [A, C, D, M, N, R, U]
The product_data.operation values have the following meaning:
A: Accessed
C: Created
M: Modified
D: Deleted
R: Renamed
N: Mounted
U: Unmounted