Graph Icon Descriptions

The following icons are used throughout Cisco XDR to represent assets and observables.

Icon	Category	Description
	Asset	endpoint, endpoint.digital-telephone-handset, endpoint.laptop, endpoint.pos-terminal, endpoint.printer, endpoint.sensor, endpoint.server, endpoint.smart meter, endpoint.smart-phone, endpoint.tablet, endpoint.workstation
	Asset	network, network.bridge, network.firewall, network.gateway, network.guard, network.hips, network.hub, network.ids, network.ips, network.modem, network.nic, network.proxy, network.router, network.security_manager, network.sense_making, network.sensor, network.switch, network.vpn, network.wap
	Asset/Observable	process, process_name, process_hash
	Asset	process,aaa-server, process.anti-virus-scanner, process.connection-scanner, process.directory-service, process.dns-server, process.email-service, process.file-scanner, process.location-service, process.network-scanner, process.remediation-service, process.reputation-service, process.sandbox, process.virtualization-server, process.vulnerability-scanner.
	Observable	amp_computer_guid
	Observable	certificate_common_name, certificate_issuer, certificate_serial, pki_serial.
	Observable	cisco_cm_id, cisco_mid, cisco_uc_id.
	Observable	crowdstrike_id, cybereason_id
	Observable	device
	Observable	domain
	Observable	email, email_messageid
	Observable	email_subject
	Observable	file_name, sha1, sha256
	Observable	file_path
	Observable	hostname
	Observable	imei, imsi
	Observable	ip, ipv6
	Observable	mac_address
	Observable	md5
	Observable	mutex
	Observable	ngfw_id, ngfw_name
	Observable	odns_identity, odns_identity_label
	Observable	orbital_node_id
	Observable	process_args, process_path, process_username
	Observable	registry_key, registry_name, registry_path
	Observable	serial_number
	Observable	swc_device_id, trend_micro_id, s1_agent_id, ms_machine_id
	Observable	url
	Observable	user, user_agent