Carbon Black Cloud: What types include the process_username in the Data Forwarder?

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

What types sent to the SIEM by the Data Forwarder include information on what user ran a process, i.e., process_username?

Environment

• Carbon Black Cloud: All Versions
• Data Forwarder

Resolution

The event and alert types that include the process username can be found in the latest Data Forwarder Fields guide
https://developer.carbonblack.com/reference/carbon-black-cloud/platform/latest/data-forwarder-data/