| Cloud acting user | Cloud acting user email address |
| Cloud app | Name of cloud app connected to Cyberhaven through APIs |
| Cloud domain | Cloud app domain |
| Cloud messaging groups | Cloud messaging app source or destination group name |
| Cloud messaging users | Cloud messaging app source or destination username |
| Cloud workspace | Cloud app workspace name |
| Domain | Website or email domain |
| Email address | To, from, cc or bcc email address |
| Endpoint app command line | Command line of the endpoint app accessing data |
| Endpoint app main window title | Main window title of the endpoint app accessing data |
| Endpoint application | Endpoint app that produced or accessed data |
| File path | A path of the file on an endpoint, in a shared folder or a cloud app |
| File size | Size of the file |
| GenAI app name | Name of the GenAI app |
| Hostname | Endpoint or shared folder hostname |
| IP address | IP address of the endpoint |
| Machine serial number | Endpoint hardware serial number for a specific device |
| Location type | Type of data location |
| Notion account id | Notion account id |
| Notion account name | Notion account name |
| Notion page full path | Notion page full path |
| Notion page id | Notion page id |
| Notion page name | Notion page name |
| Printer name | Name of the printer |
| Removable device USB ID | Unique hardware ID of the removable media |
| Removable media Product ID | Removable Product ID is a 16-bit number assigned to specific USB device models by the manufacturer. |
| Removable media Vendor ID | Removable Vendor ID is a 16-bit number assigned to USB device manufacturers by the USB Implementers Forum. |
| Removable media name | Name of the removable media |
| Removable media type | Type of the removable media |
| Salesforce account name | Salesforce account name |
| Salesforce case ID | Salesforce case ID |
| Salesforce opportunity ID | Salesforce opportunity ID |
| Salesforce opportunity name | Salesforce opportunity name |
| Salesforce report ID | Salesforce report ID |
| Salesforce report name | Salesforce report name |
| URL | Website or cloud app URL |
| Website category(deprecated) | Use location type instead |
| Website page title | Title of page that initiated download or upload |