ECS field reference

The ECS schema is the normalized field vocabulary every mapped event in Perpetual uses. It is the Elastic Common Schema, carried in the platform as the ECS system schema.

A mapper writes these fields, and the events_ecs.<integration> dataset its output branches into carries them. A detection reads them, and a Hamelin query addresses a nested field by its dotted path (user.name.text). The schema holds 2,450 fields under 48 top-level entries. Two are required: timestamp and event.id. A mapper writes the fields its source supports and leaves the rest empty.

Types

Eight type names appear in the schema. A mapper's output type must match the schema's type name exactly.

Type	Meaning
string	Text.
int	Integer.
double	Floating point.
boolean	True or false.
timestamp	A point in time.
struct	A container. Its members appear as their own rows, addressed by dotted path.
array(string)	A list of strings. Every one of the 199 arrays in the schema is an array(string). The schema contains no array of struct.
map	A key/value map. Every one of the 80 maps in the schema is keyed by string with string values.

A struct whose only member is text is not a string. 120 fields are declared struct with a single text member, among them user.name, file.path, process.command_line, and url.full. The value belongs in the .text member. Assigning a string to the parent is a type mismatch against the schema.

A description that says "array" or "list of objects" does not make the field an array. dns.answers, email.attachments, and threat.enrichments are each declared struct. The Type column is the fact the conformance check uses.

Descriptions are the schema's own text, reproduced as the schema carries them. A few repeat a neighboring field's wording. process.pe.file_version reads "Process name." and host.domain reads "Name of the directory the group is a member of." 337 struct containers carry no description at all.

Top-level fields

Four root scalars, documented in Root fields, and 44 objects, each with its own section below.

agent · client · cloud · container · data_stream · destination · device · dll · dns · ecs · email · entity · error · event · faas · file · gen_ai · group · host · http · log · mapper · network · observer · orchestrator · organization · package · process · registry · related · rule · server · service · source · span · threat · tls · trace · transaction · url · user · user_agent · volume · vulnerability

Root fields

Field	Type	Description
timestamp	timestamp	Date/time when the event originated. Required.
labels	map	Custom key/value pairs.
message	string	Log message optimized for viewing in a log viewer.
tags	array(string)	List of keywords used to tag each event.

agent

Field	Type	Description
agent	struct
agent.build	struct
agent.build.original	string	Extended build information for the agent.
agent.ephemeral_id	string	Ephemeral identifier of this agent.
agent.id	string	Unique identifier of this agent.
agent.name	string	Custom name of the agent.
agent.type	string	Type of the agent.
agent.version	string	Version of the agent.

client

Field	Type	Description
client	struct
client.address	string	Client network address.
client.as	struct
client.as.number	int	Unique number allocated to the autonomous system.
client.as.organization	struct
client.as.organization.name	struct	Organization name.
client.as.organization.name.text	string	Organization name.
client.bytes	int	Bytes sent from the client to the server.
client.domain	string	The domain name of the client.
client.geo	struct
client.geo.city_name	string	City name.
client.geo.continent_code	string	Continent code.
client.geo.continent_name	string	Name of the continent.
client.geo.country_iso_code	string	Country ISO code.
client.geo.country_name	string	Country name.
client.geo.location	string	Longitude and latitude.
client.geo.name	string	User-defined description of a location.
client.geo.postal_code	string	Postal code.
client.geo.region_iso_code	string	Region ISO code.
client.geo.region_name	string	Region name.
client.geo.timezone	string	Time zone.
client.ip	string	IP address of the client.
client.mac	string	MAC address of the client.
client.nat	struct
client.nat.ip	string	Client NAT ip address
client.nat.port	int	Client NAT port
client.packets	int	Packets sent from the client to the server.
client.port	int	Port of the client.
client.registered_domain	string	The highest registered client domain, stripped of the subdomain.
client.subdomain	string	The subdomain of the domain.
client.top_level_domain	string	The effective top level domain (com, org, net, co.uk).
client.user	struct
client.user.domain	string	Name of the directory the user is a member of.
client.user.email	string	User email address.
client.user.full_name	struct	User's full name, if available.
client.user.full_name.text	string	User's full name, if available.
client.user.group	struct
client.user.group.domain	string	Name of the directory the group is a member of.
client.user.group.id	string	Unique identifier for the group on the system/platform.
client.user.group.name	string	Name of the group.
client.user.hash	string	Unique user hash to correlate information for a user in anonymized form.
client.user.id	string	Unique identifier of the user.
client.user.name	struct	Short name or login of the user.
client.user.name.text	string	Short name or login of the user.
client.user.roles	array(string)	Array of user roles at the time of the event.

cloud

Field	Type	Description
cloud	struct
cloud.account	struct
cloud.account.id	string	The cloud account or organization id.
cloud.account.name	string	The cloud account name.
cloud.availability_zone	string	Availability zone in which this host, resource, or service is located.
cloud.entity	struct
cloud.entity.attributes	map	A set of static or semi-static attributes of the entity.
cloud.entity.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
cloud.entity.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
cloud.entity.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
cloud.entity.id	string	Unique identifier for the entity.
cloud.entity.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
cloud.entity.lifecycle	map	A set of temporal characteristics of the entity.
cloud.entity.metrics	map	Field set for any fields containing numeric entity metrics.
cloud.entity.name	struct	The name of the entity.
cloud.entity.name.text	string	The name of the entity.
cloud.entity.raw	map	Original, unmodified fields from the source system.
cloud.entity.reference	string	A URI, URL, or other direct reference to access or locate the entity.
cloud.entity.source	string	Source module or integration that provided the entity data.
cloud.entity.sub_type	string	The specific type designation for the entity as defined by its provider or system.
cloud.entity.type	array(string)	Standardized high-level classification of the entity.
cloud.instance	struct
cloud.instance.id	string	Instance ID of the host machine.
cloud.instance.name	string	Instance name of the host machine.
cloud.machine	struct
cloud.machine.type	string	Machine type of the host machine.
cloud.origin	struct
cloud.origin.account	struct
cloud.origin.account.id	string	The cloud account or organization id.
cloud.origin.account.name	string	The cloud account name.
cloud.origin.availability_zone	string	Availability zone in which this host, resource, or service is located.
cloud.origin.entity	struct
cloud.origin.entity.attributes	map	A set of static or semi-static attributes of the entity.
cloud.origin.entity.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
cloud.origin.entity.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
cloud.origin.entity.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
cloud.origin.entity.id	string	Unique identifier for the entity.
cloud.origin.entity.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
cloud.origin.entity.lifecycle	map	A set of temporal characteristics of the entity.
cloud.origin.entity.metrics	map	Field set for any fields containing numeric entity metrics.
cloud.origin.entity.name	struct	The name of the entity.
cloud.origin.entity.name.text	string	The name of the entity.
cloud.origin.entity.raw	map	Original, unmodified fields from the source system.
cloud.origin.entity.reference	string	A URI, URL, or other direct reference to access or locate the entity.
cloud.origin.entity.source	string	Source module or integration that provided the entity data.
cloud.origin.entity.sub_type	string	The specific type designation for the entity as defined by its provider or system.
cloud.origin.entity.type	array(string)	Standardized high-level classification of the entity.
cloud.origin.instance	struct
cloud.origin.instance.id	string	Instance ID of the host machine.
cloud.origin.instance.name	string	Instance name of the host machine.
cloud.origin.machine	struct
cloud.origin.machine.type	string	Machine type of the host machine.
cloud.origin.project	struct
cloud.origin.project.id	string	The cloud project id.
cloud.origin.project.name	string	The cloud project name.
cloud.origin.provider	string	Name of the cloud provider.
cloud.origin.region	string	Region in which this host, resource, or service is located.
cloud.origin.service	struct
cloud.origin.service.name	string	The cloud service name.
cloud.project	struct
cloud.project.id	string	The cloud project id.
cloud.project.name	string	The cloud project name.
cloud.provider	string	Name of the cloud provider.
cloud.region	string	Region in which this host, resource, or service is located.
cloud.service	struct
cloud.service.name	string	The cloud service name.
cloud.target	struct
cloud.target.account	struct
cloud.target.account.id	string	The cloud account or organization id.
cloud.target.account.name	string	The cloud account name.
cloud.target.availability_zone	string	Availability zone in which this host, resource, or service is located.
cloud.target.entity	struct
cloud.target.entity.attributes	map	A set of static or semi-static attributes of the entity.
cloud.target.entity.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
cloud.target.entity.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
cloud.target.entity.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
cloud.target.entity.id	string	Unique identifier for the entity.
cloud.target.entity.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
cloud.target.entity.lifecycle	map	A set of temporal characteristics of the entity.
cloud.target.entity.metrics	map	Field set for any fields containing numeric entity metrics.
cloud.target.entity.name	struct	The name of the entity.
cloud.target.entity.name.text	string	The name of the entity.
cloud.target.entity.raw	map	Original, unmodified fields from the source system.
cloud.target.entity.reference	string	A URI, URL, or other direct reference to access or locate the entity.
cloud.target.entity.source	string	Source module or integration that provided the entity data.
cloud.target.entity.sub_type	string	The specific type designation for the entity as defined by its provider or system.
cloud.target.entity.type	array(string)	Standardized high-level classification of the entity.
cloud.target.instance	struct
cloud.target.instance.id	string	Instance ID of the host machine.
cloud.target.instance.name	string	Instance name of the host machine.
cloud.target.machine	struct
cloud.target.machine.type	string	Machine type of the host machine.
cloud.target.project	struct
cloud.target.project.id	string	The cloud project id.
cloud.target.project.name	string	The cloud project name.
cloud.target.provider	string	Name of the cloud provider.
cloud.target.region	string	Region in which this host, resource, or service is located.
cloud.target.service	struct
cloud.target.service.name	string	The cloud service name.

container

Field	Type	Description
container	struct
container.cpu	struct
container.cpu.usage	double	Percent CPU used, between 0 and 1.
container.disk	struct
container.disk.read	struct
container.disk.read.bytes	int	The number of bytes read by all disks.
container.disk.write	struct
container.disk.write.bytes	int	The number of bytes written on all disks.
container.id	string	Unique container id.
container.image	struct
container.image.hash	struct
container.image.hash.all	array(string)	An array of digests of the image the container was built on.
container.image.name	string	Name of the image the container was built on.
container.image.tag	array(string)	Container image tags.
container.labels	map	Image labels.
container.memory	struct
container.memory.usage	double	Percent memory used, between 0 and 1.
container.name	string	Container name.
container.network	struct
container.network.egress	struct
container.network.egress.bytes	int	The number of bytes sent on all network interfaces.
container.network.ingress	struct
container.network.ingress.bytes	int	The number of bytes received on all network interfaces.
container.runtime	string	Runtime managing this container.
container.security_context	struct
container.security_context.privileged	boolean	Indicates whether the container is running in privileged mode.

data_stream

Field	Type	Description
data_stream	struct
data_stream.dataset	string	The field can contain anything that makes sense to signify the source of the data.
data_stream.namespace	string	A user defined namespace. Namespaces are useful to allow grouping of data.
data_stream.type	string	An overarching type for the data stream.

destination

Field	Type	Description
destination	struct
destination.address	string	Destination network address.
destination.as	struct
destination.as.number	int	Unique number allocated to the autonomous system.
destination.as.organization	struct
destination.as.organization.name	struct	Organization name.
destination.as.organization.name.text	string	Organization name.
destination.bytes	int	Bytes sent from the destination to the source.
destination.domain	string	The domain name of the destination.
destination.geo	struct
destination.geo.city_name	string	City name.
destination.geo.continent_code	string	Continent code.
destination.geo.continent_name	string	Name of the continent.
destination.geo.country_iso_code	string	Country ISO code.
destination.geo.country_name	string	Country name.
destination.geo.location	string	Longitude and latitude.
destination.geo.name	string	User-defined description of a location.
destination.geo.postal_code	string	Postal code.
destination.geo.region_iso_code	string	Region ISO code.
destination.geo.region_name	string	Region name.
destination.geo.timezone	string	Time zone.
destination.ip	string	IP address of the destination.
destination.mac	string	MAC address of the destination.
destination.nat	struct
destination.nat.ip	string	Destination NAT ip
destination.nat.port	int	Destination NAT Port
destination.packets	int	Packets sent from the destination to the source.
destination.port	int	Port of the destination.
destination.registered_domain	string	The highest registered destination domain, stripped of the subdomain.
destination.subdomain	string	The subdomain of the domain.
destination.top_level_domain	string	The effective top level domain (com, org, net, co.uk).
destination.user	struct
destination.user.domain	string	Name of the directory the user is a member of.
destination.user.email	string	User email address.
destination.user.full_name	struct	User's full name, if available.
destination.user.full_name.text	string	User's full name, if available.
destination.user.group	struct
destination.user.group.domain	string	Name of the directory the group is a member of.
destination.user.group.id	string	Unique identifier for the group on the system/platform.
destination.user.group.name	string	Name of the group.
destination.user.hash	string	Unique user hash to correlate information for a user in anonymized form.
destination.user.id	string	Unique identifier of the user.
destination.user.name	struct	Short name or login of the user.
destination.user.name.text	string	Short name or login of the user.
destination.user.roles	array(string)	Array of user roles at the time of the event.

device

Field	Type	Description
device	struct
device.id	string	The unique identifier of a device.
device.manufacturer	string	The vendor name of the device manufacturer.
device.model	struct
device.model.identifier	string	The machine readable identifier of the device model.
device.model.name	string	The human readable marketing name of the device model.
device.product	struct
device.product.id	string	ProductID of the device
device.product.name	string	Product name of the device
device.serial_number	string	Serial Number of the device
device.type	string	Device type classification
device.vendor	struct
device.vendor.id	string	VendorID of the device
device.vendor.name	string	Vendor name of the device

dll

Field	Type	Description
dll	struct
dll.code_signature	struct
dll.code_signature.digest_algorithm	string	Hashing algorithm used to sign the process.
dll.code_signature.exists	boolean	Boolean to capture if a signature is present.
dll.code_signature.flags	string	Code signing flags of the process
dll.code_signature.signing_id	string	The identifier used to sign the process.
dll.code_signature.status	string	Additional information about the certificate status.
dll.code_signature.subject_name	string	Subject name of the code signer
dll.code_signature.team_id	string	The team identifier used to sign the process.
dll.code_signature.thumbprint_sha256	string	SHA256 hash of the certificate.
dll.code_signature.timestamp	timestamp	When the signature was generated and signed.
dll.code_signature.trusted	boolean	Stores the trust status of the certificate chain.
dll.code_signature.valid	boolean	Boolean to capture if the digital signature is verified against the binary content.
dll.hash	struct
dll.hash.cdhash	string	The Code Directory (CD) hash of an executable.
dll.hash.md5	string	MD5 hash.
dll.hash.sha1	string	SHA1 hash.
dll.hash.sha256	string	SHA256 hash.
dll.hash.sha384	string	SHA384 hash.
dll.hash.sha512	string	SHA512 hash.
dll.hash.ssdeep	string	SSDEEP hash.
dll.hash.tlsh	string	TLSH hash.
dll.name	string	Name of the library.
dll.origin_referrer_url	string	The URL of the webpage that linked to the dll file.
dll.origin_url	string	The URL where the dll file is hosted.
dll.path	string	Full file path of the library.
dll.pe	struct
dll.pe.architecture	string	CPU architecture target for the file.
dll.pe.company	string	Internal company name of the file, provided at compile-time.
dll.pe.description	string	Internal description of the file, provided at compile-time.
dll.pe.file_version	string	Process name.
dll.pe.go_import_hash	string	A hash of the Go language imports in a PE file.
dll.pe.go_imports	string	List of imported Go language element names and types.
dll.pe.go_imports_names_entropy	int	Shannon entropy calculation from the list of Go imports.
dll.pe.go_imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of Go imports.
dll.pe.go_stripped	boolean	Whether the file is a stripped or obfuscated Go executable.
dll.pe.imphash	string	A hash of the imports in a PE file.
dll.pe.import_hash	string	A hash of the imports in a PE file.
dll.pe.imports	array(string)	List of imported element names and types.
dll.pe.imports_names_entropy	int	Shannon entropy calculation from the list of imported element names and types.
dll.pe.imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of imported element names and types.
dll.pe.original_file_name	string	Internal name of the file, provided at compile-time.
dll.pe.pehash	string	A hash of the PE header and data from one or more PE sections.
dll.pe.product	string	Internal product name of the file, provided at compile-time.
dll.pe.sections	struct	Section information of the PE file.
dll.pe.sections.entropy	int	Shannon entropy calculation from the section.
dll.pe.sections.name	string	PE Section List name.
dll.pe.sections.physical_size	int	PE Section List physical size.
dll.pe.sections.var_entropy	int	Variance for Shannon entropy calculation from the section.
dll.pe.sections.virtual_size	int	PE Section List virtual size. This is always the same as physical_size.

dns

Field	Type	Description
dns	struct
dns.answers	struct	Array of DNS answers.
dns.answers.class	string	The class of DNS data contained in this resource record.
dns.answers.data	string	The data describing the resource.
dns.answers.name	string	The domain name to which this resource record pertains.
dns.answers.ttl	int	The time interval in seconds that this resource record may be cached before it should be discarded.
dns.answers.type	string	The type of data contained in this resource record.
dns.header_flags	array(string)	Array of DNS header flags.
dns.id	string	The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.
dns.op_code	string	The DNS operation code that specifies the kind of query in the message.
dns.question	struct
dns.question.class	string	The class of records being queried.
dns.question.name	string	The name being queried.
dns.question.registered_domain	string	The highest registered domain, stripped of the subdomain.
dns.question.subdomain	string	The subdomain of the domain.
dns.question.top_level_domain	string	The effective top level domain (com, org, net, co.uk).
dns.question.type	string	The type of record being queried.
dns.resolved_ip	array(string)	Array containing all IPs seen in answers.data
dns.response_code	string	The DNS response code.
dns.type	string	The type of DNS event captured, query or answer.

ecs

Field	Type	Description
ecs	struct
ecs.version	string	ECS version this event conforms to.

email

Field	Type	Description
email	struct
email.attachments	struct	List of objects describing the attachments.
email.attachments.file	struct
email.attachments.file.extension	string	Attachment file extension.
email.attachments.file.hash	struct
email.attachments.file.hash.cdhash	string	The Code Directory (CD) hash of an executable.
email.attachments.file.hash.md5	string	MD5 hash.
email.attachments.file.hash.sha1	string	SHA1 hash.
email.attachments.file.hash.sha256	string	SHA256 hash.
email.attachments.file.hash.sha384	string	SHA384 hash.
email.attachments.file.hash.sha512	string	SHA512 hash.
email.attachments.file.hash.ssdeep	string	SSDEEP hash.
email.attachments.file.hash.tlsh	string	TLSH hash.
email.attachments.file.mime_type	string	MIME type of the attachment file.
email.attachments.file.name	string	Name of the attachment file.
email.attachments.file.size	int	Attachment file size.
email.bcc	struct
email.bcc.address	array(string)	Email address of BCC recipient
email.cc	struct
email.cc.address	array(string)	Email address of CC recipient
email.content_type	string	MIME type of the email message.
email.delivery_timestamp	timestamp	Date and time when message was delivered.
email.direction	string	Direction of the message.
email.from	struct
email.from.address	array(string)	The sender's email address.
email.local_id	string	Unique identifier given by the source.
email.message_id	string	Value from the Message-ID header.
email.origination_timestamp	timestamp	Date and time the email was composed.
email.reply_to	struct
email.reply_to.address	array(string)	Address replies should be delivered to.
email.sender	struct
email.sender.address	string	Address of the message sender.
email.subject	struct	The subject of the email message.
email.subject.text	string	The subject of the email message.
email.to	struct
email.to.address	array(string)	Email address of recipient
email.x_mailer	string	Application that drafted email.

entity

Field	Type	Description
entity	struct
entity.attributes	map	A set of static or semi-static attributes of the entity.
entity.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
entity.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
entity.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
entity.id	string	Unique identifier for the entity.
entity.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
entity.lifecycle	map	A set of temporal characteristics of the entity.
entity.metrics	map	Field set for any fields containing numeric entity metrics.
entity.name	struct	The name of the entity.
entity.name.text	string	The name of the entity.
entity.raw	map	Original, unmodified fields from the source system.
entity.reference	string	A URI, URL, or other direct reference to access or locate the entity.
entity.source	string	Source module or integration that provided the entity data.
entity.sub_type	string	The specific type designation for the entity as defined by its provider or system.
entity.target	struct
entity.target.attributes	map	A set of static or semi-static attributes of the entity.
entity.target.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
entity.target.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
entity.target.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
entity.target.id	string	Unique identifier for the entity.
entity.target.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
entity.target.lifecycle	map	A set of temporal characteristics of the entity.
entity.target.metrics	map	Field set for any fields containing numeric entity metrics.
entity.target.name	struct	The name of the entity.
entity.target.name.text	string	The name of the entity.
entity.target.raw	map	Original, unmodified fields from the source system.
entity.target.reference	string	A URI, URL, or other direct reference to access or locate the entity.
entity.target.source	string	Source module or integration that provided the entity data.
entity.target.sub_type	string	The specific type designation for the entity as defined by its provider or system.
entity.target.type	array(string)	Standardized high-level classification of the entity.
entity.type	array(string)	Standardized high-level classification of the entity.

error

Field	Type	Description
error	struct
error.code	string	Error code describing the error.
error.id	string	Unique identifier for the error.
error.message	string	Error message.
error.stack_trace	struct	The stack trace of this error in plain text.
error.stack_trace.text	string	The stack trace of this error in plain text.
error.type	string	The type of the error, for example the class name of the exception.

event

Field	Type	Description
event	struct
event.action	string	The action captured by the event.
event.agent_id_status	string	Validation status of the event's agent.id field.
event.category	array(string)	Event category. The second categorization field in the hierarchy.
event.code	string	Identification code for this event.
event.created	timestamp	Time when the event was first read by an agent or by your pipeline.
event.dataset	string	Name of the dataset.
event.duration	int	Duration of the event in nanoseconds.
event.end	timestamp	event.end contains the date when the event ended or when the activity was last observed.
event.hash	string	Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.
event.id	string	Unique ID to describe the event. Required.
event.ingested	timestamp	Timestamp when an event arrived in the central data store.
event.kind	string	The kind of the event. The highest categorization field in the hierarchy.
event.module	string	Name of the module this data is coming from.
event.original	string	Raw text message of entire event.
event.outcome	string	The outcome of the event. The lowest level categorization field in the hierarchy.
event.provider	string	Source of the event.
event.reason	string	Reason why this event happened, according to the source
event.reference	string	Event reference URL
event.risk_score	double	Risk score or priority of the event (e.g. security solutions). Use your system's original value here.
event.risk_score_norm	double	Normalized risk score or priority of the event (0-100).
event.sequence	int	Sequence number of the event.
event.severity	int	Numeric severity of the event.
event.start	timestamp	event.start contains the date when the event started or when the activity was first observed.
event.timezone	string	Event time zone.
event.type	array(string)	Event type. The third categorization field in the hierarchy.
event.url	string	Event investigation URL

faas

Field	Type	Description
faas	struct
faas.coldstart	boolean	Boolean value indicating a cold start of a function.
faas.execution	string	The execution ID of the current function execution.
faas.id	string	The unique identifier of a serverless function.
faas.name	string	The name of a serverless function.
faas.trigger	struct
faas.trigger.request_id	string	The ID of the trigger request , message, event, etc.
faas.trigger.type	string	The trigger for the function execution.
faas.version	string	The version of a serverless function.

file

Field	Type	Description
file	struct
file.accessed	timestamp	Last time the file was accessed.
file.attributes	array(string)	Array of file attributes.
file.code_signature	struct
file.code_signature.digest_algorithm	string	Hashing algorithm used to sign the process.
file.code_signature.exists	boolean	Boolean to capture if a signature is present.
file.code_signature.flags	string	Code signing flags of the process
file.code_signature.signing_id	string	The identifier used to sign the process.
file.code_signature.status	string	Additional information about the certificate status.
file.code_signature.subject_name	string	Subject name of the code signer
file.code_signature.team_id	string	The team identifier used to sign the process.
file.code_signature.thumbprint_sha256	string	SHA256 hash of the certificate.
file.code_signature.timestamp	timestamp	When the signature was generated and signed.
file.code_signature.trusted	boolean	Stores the trust status of the certificate chain.
file.code_signature.valid	boolean	Boolean to capture if the digital signature is verified against the binary content.
file.created	timestamp	File creation time.
file.ctime	timestamp	Last time the file attributes or metadata changed.
file.device	string	Device that is the source of the file.
file.directory	string	Directory where the file is located.
file.drive_letter	string	Drive letter where the file is located.
file.elf	struct
file.elf.architecture	string	Machine architecture of the ELF file.
file.elf.byte_order	string	Byte sequence of ELF file.
file.elf.cpu_type	string	CPU type of the ELF file.
file.elf.creation_date	timestamp	Build or compile date.
file.elf.exports	array(string)	List of exported element names and types.
file.elf.go_import_hash	string	A hash of the Go language imports in an ELF file.
file.elf.go_imports	string	List of imported Go language element names and types.
file.elf.go_imports_names_entropy	int	Shannon entropy calculation from the list of Go imports.
file.elf.go_imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of Go imports.
file.elf.go_stripped	boolean	Whether the file is a stripped or obfuscated Go executable.
file.elf.header	struct
file.elf.header.abi_version	string	Version of the ELF Application Binary Interface (ABI).
file.elf.header.class	string	Header class of the ELF file.
file.elf.header.data	string	Data table of the ELF header.
file.elf.header.entrypoint	int	Header entrypoint of the ELF file.
file.elf.header.object_version	string	"0x1" for original ELF files.
file.elf.header.os_abi	string	Application Binary Interface (ABI) of the Linux OS.
file.elf.header.type	string	Header type of the ELF file.
file.elf.header.version	string	Version of the ELF header.
file.elf.import_hash	string	A hash of the imports in an ELF file.
file.elf.imports	array(string)	List of imported element names and types.
file.elf.imports_names_entropy	int	Shannon entropy calculation from the list of imported element names and types.
file.elf.imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of imported element names and types.
file.elf.sections	struct	Section information of the ELF file.
file.elf.sections.chi2	int	Chi-square probability distribution of the section.
file.elf.sections.entropy	int	Shannon entropy calculation from the section.
file.elf.sections.flags	string	ELF Section List flags.
file.elf.sections.name	string	ELF Section List name.
file.elf.sections.physical_offset	string	ELF Section List offset.
file.elf.sections.physical_size	int	ELF Section List physical size.
file.elf.sections.type	string	ELF Section List type.
file.elf.sections.var_entropy	int	Variance for Shannon entropy calculation from the section.
file.elf.sections.virtual_address	int	ELF Section List virtual address.
file.elf.sections.virtual_size	int	ELF Section List virtual size.
file.elf.segments	struct	ELF object segment list.
file.elf.segments.sections	string	ELF object segment sections.
file.elf.segments.type	string	ELF object segment type.
file.elf.shared_libraries	array(string)	List of shared libraries used by this ELF object.
file.elf.telfhash	string	telfhash hash for ELF file.
file.extension	string	File extension, excluding the leading dot.
file.fork_name	string	A fork is additional data associated with a filesystem object.
file.gid	string	Primary group ID (GID) of the file.
file.group	string	Primary group name of the file.
file.hash	struct
file.hash.cdhash	string	The Code Directory (CD) hash of an executable.
file.hash.md5	string	MD5 hash.
file.hash.sha1	string	SHA1 hash.
file.hash.sha256	string	SHA256 hash.
file.hash.sha384	string	SHA384 hash.
file.hash.sha512	string	SHA512 hash.
file.hash.ssdeep	string	SSDEEP hash.
file.hash.tlsh	string	TLSH hash.
file.inode	string	Inode representing the file in the filesystem.
file.macho	struct
file.macho.go_import_hash	string	A hash of the Go language imports in a Mach-O file.
file.macho.go_imports	string	List of imported Go language element names and types.
file.macho.go_imports_names_entropy	int	Shannon entropy calculation from the list of Go imports.
file.macho.go_imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of Go imports.
file.macho.go_stripped	boolean	Whether the file is a stripped or obfuscated Go executable.
file.macho.import_hash	string	A hash of the imports in a Mach-O file.
file.macho.imports	array(string)	List of imported element names and types.
file.macho.imports_names_entropy	int	Shannon entropy calculation from the list of imported element names and types.
file.macho.imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of imported element names and types.
file.macho.sections	struct	Section information of the Mach-O file.
file.macho.sections.entropy	int	Shannon entropy calculation from the section.
file.macho.sections.name	string	Mach-O Section List name.
file.macho.sections.physical_size	int	Mach-O Section List physical size.
file.macho.sections.var_entropy	int	Variance for Shannon entropy calculation from the section.
file.macho.sections.virtual_size	int	Mach-O Section List virtual size. This is always the same as physical_size.
file.macho.symhash	string	A hash of the imports in a Mach-O file.
file.mime_type	string	Media type of file, document, or arrangement of bytes.
file.mode	string	Mode of the file in octal representation.
file.mtime	timestamp	Last time the file content was modified.
file.name	string	Name of the file including the extension, without the directory.
file.origin_referrer_url	string	The URL of the webpage that linked to the file.
file.origin_url	string	The URL where the file is hosted.
file.owner	string	File owner's username.
file.path	struct	Full path to the file, including the file name.
file.path.text	string	Full path to the file, including the file name.
file.pe	struct
file.pe.architecture	string	CPU architecture target for the file.
file.pe.company	string	Internal company name of the file, provided at compile-time.
file.pe.description	string	Internal description of the file, provided at compile-time.
file.pe.file_version	string	Process name.
file.pe.go_import_hash	string	A hash of the Go language imports in a PE file.
file.pe.go_imports	string	List of imported Go language element names and types.
file.pe.go_imports_names_entropy	int	Shannon entropy calculation from the list of Go imports.
file.pe.go_imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of Go imports.
file.pe.go_stripped	boolean	Whether the file is a stripped or obfuscated Go executable.
file.pe.imphash	string	A hash of the imports in a PE file.
file.pe.import_hash	string	A hash of the imports in a PE file.
file.pe.imports	array(string)	List of imported element names and types.
file.pe.imports_names_entropy	int	Shannon entropy calculation from the list of imported element names and types.
file.pe.imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of imported element names and types.
file.pe.original_file_name	string	Internal name of the file, provided at compile-time.
file.pe.pehash	string	A hash of the PE header and data from one or more PE sections.
file.pe.product	string	Internal product name of the file, provided at compile-time.
file.pe.sections	struct	Section information of the PE file.
file.pe.sections.entropy	int	Shannon entropy calculation from the section.
file.pe.sections.name	string	PE Section List name.
file.pe.sections.physical_size	int	PE Section List physical size.
file.pe.sections.var_entropy	int	Variance for Shannon entropy calculation from the section.
file.pe.sections.virtual_size	int	PE Section List virtual size. This is always the same as physical_size.
file.size	int	File size in bytes.
file.target_path	struct	Target path for symlinks.
file.target_path.text	string	Target path for symlinks.
file.type	string	File type (file, dir, or symlink).
file.uid	string	The user ID (UID) or security identifier (SID) of the file owner.
file.x509	struct
file.x509.alternative_names	array(string)	List of subject alternative names (SAN).
file.x509.issuer	struct
file.x509.issuer.common_name	array(string)	List of common name (CN) of issuing certificate authority.
file.x509.issuer.country	array(string)	List of country (C) codes
file.x509.issuer.distinguished_name	string	Distinguished name (DN) of issuing certificate authority.
file.x509.issuer.locality	array(string)	List of locality names (L)
file.x509.issuer.organization	array(string)	List of organizations (O) of issuing certificate authority.
file.x509.issuer.organizational_unit	array(string)	List of organizational units (OU) of issuing certificate authority.
file.x509.issuer.state_or_province	array(string)	List of state or province names (ST, S, or P)
file.x509.not_after	timestamp	Time at which the certificate is no longer considered valid.
file.x509.not_before	timestamp	Time at which the certificate is first considered valid.
file.x509.public_key_algorithm	string	Algorithm used to generate the public key.
file.x509.public_key_curve	string	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
file.x509.public_key_exponent	int	Exponent used to derive the public key. This is algorithm specific.
file.x509.public_key_size	int	The size of the public key space in bits.
file.x509.serial_number	string	Unique serial number issued by the certificate authority.
file.x509.signature_algorithm	string	Identifier for certificate signature algorithm.
file.x509.subject	struct
file.x509.subject.common_name	array(string)	List of common names (CN) of subject.
file.x509.subject.country	array(string)	List of country (C) code
file.x509.subject.distinguished_name	string	Distinguished name (DN) of the certificate subject entity.
file.x509.subject.locality	array(string)	List of locality names (L)
file.x509.subject.organization	array(string)	List of organizations (O) of subject.
file.x509.subject.organizational_unit	array(string)	List of organizational units (OU) of subject.
file.x509.subject.state_or_province	array(string)	List of state or province names (ST, S, or P)
file.x509.version_number	string	Version of x509 format.

gen_ai

Field	Type	Description
gen_ai	struct
gen_ai.agent	struct
gen_ai.agent.description	string	Free-form description of the GenAI agent provided by the application.
gen_ai.agent.id	string	The unique identifier of the GenAI agent.
gen_ai.agent.name	string	Human-readable name of the GenAI agent provided by the application.
gen_ai.operation	struct
gen_ai.operation.name	string	The name of the operation being performed.
gen_ai.output	struct
gen_ai.output.type	string	Represents the content type requested by the client.
gen_ai.request	struct
gen_ai.request.choice	struct
gen_ai.request.choice.count	int	The target number of candidate completions to return.
gen_ai.request.encoding_formats	map	The encoding formats requested in an embeddings operation, if specified.
gen_ai.request.frequency_penalty	double	The frequency penalty setting for the GenAI request.
gen_ai.request.max_tokens	int	The maximum number of tokens the model generates for a request.
gen_ai.request.model	string	The name of the GenAI model a request is being made to.
gen_ai.request.presence_penalty	double	The presence penalty setting for the GenAI request.
gen_ai.request.seed	int	Requests with same seed value more likely to return same result.
gen_ai.request.stop_sequences	map	List of sequences that the model will use to stop generating further tokens.
gen_ai.request.temperature	double	The temperature setting for the GenAI request.
gen_ai.request.top_k	double	The top_k sampling setting for the GenAI request.
gen_ai.request.top_p	double	The top_p sampling setting for the GenAI request.
gen_ai.response	struct
gen_ai.response.finish_reasons	map	Array of reasons the model stopped generating tokens, corresponding to each generation received.
gen_ai.response.id	string	The unique identifier for the completion.
gen_ai.response.model	string	The name of the model that generated the response.
gen_ai.system	string	The Generative AI product as identified by the client or server instrumentation.
gen_ai.token	struct
gen_ai.token.type	string	The type of token being counted.
gen_ai.tool	struct
gen_ai.tool.call	struct
gen_ai.tool.call.id	string	The tool call identifier.
gen_ai.tool.name	string	Name of the tool utilized by the agent.
gen_ai.tool.type	string	Type of the tool utilized by the agent
gen_ai.usage	struct
gen_ai.usage.input_tokens	int	The number of tokens used in the GenAI input (prompt).
gen_ai.usage.output_tokens	int	The number of tokens used in the GenAI response (completion).

group

Field	Type	Description
group	struct
group.domain	string	Name of the directory the group is a member of.
group.id	string	Unique identifier for the group on the system/platform.
group.name	string	Name of the group.

host

Field	Type	Description
host	struct
host.architecture	string	Operating system architecture.
host.boot	struct
host.boot.id	string	Linux boot uuid taken from /proc/sys/kernel/random/boot_id
host.cpu	struct
host.cpu.usage	double	Percent CPU used, between 0 and 1.
host.disk	struct
host.disk.read	struct
host.disk.read.bytes	int	The number of bytes read by all disks.
host.disk.write	struct
host.disk.write.bytes	int	The number of bytes written on all disks.
host.domain	string	Name of the directory the group is a member of.
host.entity	struct
host.entity.attributes	map	A set of static or semi-static attributes of the entity.
host.entity.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
host.entity.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
host.entity.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
host.entity.id	string	Unique identifier for the entity.
host.entity.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
host.entity.lifecycle	map	A set of temporal characteristics of the entity.
host.entity.metrics	map	Field set for any fields containing numeric entity metrics.
host.entity.name	struct	The name of the entity.
host.entity.name.text	string	The name of the entity.
host.entity.raw	map	Original, unmodified fields from the source system.
host.entity.reference	string	A URI, URL, or other direct reference to access or locate the entity.
host.entity.source	string	Source module or integration that provided the entity data.
host.entity.sub_type	string	The specific type designation for the entity as defined by its provider or system.
host.entity.type	array(string)	Standardized high-level classification of the entity.
host.geo	struct
host.geo.city_name	string	City name.
host.geo.continent_code	string	Continent code.
host.geo.continent_name	string	Name of the continent.
host.geo.country_iso_code	string	Country ISO code.
host.geo.country_name	string	Country name.
host.geo.location	string	Longitude and latitude.
host.geo.name	string	User-defined description of a location.
host.geo.postal_code	string	Postal code.
host.geo.region_iso_code	string	Region ISO code.
host.geo.region_name	string	Region name.
host.geo.timezone	string	Time zone.
host.hostname	string	Hostname of the host.
host.id	string	Unique host id.
host.ip	array(string)	Host ip addresses.
host.mac	array(string)	Host MAC addresses.
host.name	string	Name of the host.
host.network	struct
host.network.egress	struct
host.network.egress.bytes	int	The number of bytes sent on all network interfaces.
host.network.egress.packets	int	The number of packets sent on all network interfaces.
host.network.ingress	struct
host.network.ingress.bytes	int	The number of bytes received on all network interfaces.
host.network.ingress.packets	int	The number of packets received on all network interfaces.
host.os	struct
host.os.family	string	OS family (such as redhat, debian, freebsd, windows).
host.os.full	struct	Operating system name, including the version or code name.
host.os.full.text	string	Operating system name, including the version or code name.
host.os.kernel	string	Operating system kernel version as a raw string.
host.os.name	struct	Operating system name, without the version.
host.os.name.text	string	Operating system name, without the version.
host.os.platform	string	Operating system platform (such centos, ubuntu, windows).
host.os.type	string	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
host.os.version	string	Operating system version as a raw string.
host.pid_ns_ino	string	Pid namespace inode
host.risk	struct
host.risk.calculated_level	string	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
host.risk.calculated_score	double	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
host.risk.calculated_score_norm	double	A normalized risk score calculated by an internal system.
host.risk.static_level	string	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
host.risk.static_score	double	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
host.risk.static_score_norm	double	A normalized risk score calculated by an external system.
host.target	struct
host.target.architecture	string	Operating system architecture.
host.target.boot	struct
host.target.boot.id	string	Linux boot uuid taken from /proc/sys/kernel/random/boot_id
host.target.cpu	struct
host.target.cpu.usage	double	Percent CPU used, between 0 and 1.
host.target.disk	struct
host.target.disk.read	struct
host.target.disk.read.bytes	int	The number of bytes read by all disks.
host.target.disk.write	struct
host.target.disk.write.bytes	int	The number of bytes written on all disks.
host.target.domain	string	Name of the directory the group is a member of.
host.target.entity	struct
host.target.entity.attributes	map	A set of static or semi-static attributes of the entity.
host.target.entity.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
host.target.entity.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
host.target.entity.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
host.target.entity.id	string	Unique identifier for the entity.
host.target.entity.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
host.target.entity.lifecycle	map	A set of temporal characteristics of the entity.
host.target.entity.metrics	map	Field set for any fields containing numeric entity metrics.
host.target.entity.name	struct	The name of the entity.
host.target.entity.name.text	string	The name of the entity.
host.target.entity.raw	map	Original, unmodified fields from the source system.
host.target.entity.reference	string	A URI, URL, or other direct reference to access or locate the entity.
host.target.entity.source	string	Source module or integration that provided the entity data.
host.target.entity.sub_type	string	The specific type designation for the entity as defined by its provider or system.
host.target.entity.type	array(string)	Standardized high-level classification of the entity.
host.target.geo	struct
host.target.geo.city_name	string	City name.
host.target.geo.continent_code	string	Continent code.
host.target.geo.continent_name	string	Name of the continent.
host.target.geo.country_iso_code	string	Country ISO code.
host.target.geo.country_name	string	Country name.
host.target.geo.location	string	Longitude and latitude.
host.target.geo.name	string	User-defined description of a location.
host.target.geo.postal_code	string	Postal code.
host.target.geo.region_iso_code	string	Region ISO code.
host.target.geo.region_name	string	Region name.
host.target.geo.timezone	string	Time zone.
host.target.hostname	string	Hostname of the host.
host.target.id	string	Unique host id.
host.target.ip	array(string)	Host ip addresses.
host.target.mac	array(string)	Host MAC addresses.
host.target.name	string	Name of the host.
host.target.network	struct
host.target.network.egress	struct
host.target.network.egress.bytes	int	The number of bytes sent on all network interfaces.
host.target.network.egress.packets	int	The number of packets sent on all network interfaces.
host.target.network.ingress	struct
host.target.network.ingress.bytes	int	The number of bytes received on all network interfaces.
host.target.network.ingress.packets	int	The number of packets received on all network interfaces.
host.target.os	struct
host.target.os.family	string	OS family (such as redhat, debian, freebsd, windows).
host.target.os.full	struct	Operating system name, including the version or code name.
host.target.os.full.text	string	Operating system name, including the version or code name.
host.target.os.kernel	string	Operating system kernel version as a raw string.
host.target.os.name	struct	Operating system name, without the version.
host.target.os.name.text	string	Operating system name, without the version.
host.target.os.platform	string	Operating system platform (such centos, ubuntu, windows).
host.target.os.type	string	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
host.target.os.version	string	Operating system version as a raw string.
host.target.pid_ns_ino	string	Pid namespace inode
host.target.risk	struct
host.target.risk.calculated_level	string	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
host.target.risk.calculated_score	double	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
host.target.risk.calculated_score_norm	double	A normalized risk score calculated by an internal system.
host.target.risk.static_level	string	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
host.target.risk.static_score	double	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
host.target.risk.static_score_norm	double	A normalized risk score calculated by an external system.
host.target.type	string	Type of host.
host.target.uptime	int	Seconds the host has been up.
host.type	string	Type of host.
host.uptime	int	Seconds the host has been up.

http

Field	Type	Description
http	struct
http.request	struct
http.request.body	struct
http.request.body.bytes	int	Size in bytes of the request body.
http.request.body.content	struct	The full HTTP request body.
http.request.body.content.text	string	The full HTTP request body.
http.request.bytes	int	Total size in bytes of the request (body and headers).
http.request.id	string	HTTP request ID.
http.request.method	string	HTTP request method.
http.request.mime_type	string	Mime type of the body of the request.
http.request.referrer	string	Referrer for this HTTP request.
http.response	struct
http.response.body	struct
http.response.body.bytes	int	Size in bytes of the response body.
http.response.body.content	struct	The full HTTP response body.
http.response.body.content.text	string	The full HTTP response body.
http.response.bytes	int	Total size in bytes of the response (body and headers).
http.response.mime_type	string	Mime type of the body of the response.
http.response.status_code	int	HTTP response status code.
http.version	string	HTTP version.

log

Field	Type	Description
log	struct
log.file	struct
log.file.path	string	Full path to the log file this event came from.
log.level	string	Log level of the log event.
log.logger	string	Name of the logger.
log.origin	struct
log.origin.file	struct
log.origin.file.line	int	The line number of the file which originated the log event.
log.origin.file.name	string	The code file which originated the log event.
log.origin.function	string	The function which originated the log event.
log.syslog	struct	Syslog metadata
log.syslog.appname	string	The device or application that originated the Syslog message.
log.syslog.facility	struct
log.syslog.facility.code	int	Syslog numeric facility of the event.
log.syslog.facility.name	string	Syslog text-based facility of the event.
log.syslog.hostname	string	The host that originated the Syslog message.
log.syslog.msgid	string	An identifier for the type of Syslog message.
log.syslog.priority	int	Syslog priority of the event.
log.syslog.procid	string	The process name or ID that originated the Syslog message.
log.syslog.severity	struct
log.syslog.severity.code	int	Syslog numeric severity of the event.
log.syslog.severity.name	string	Syslog text-based severity of the event.
log.syslog.structured_data	string	Structured data expressed in RFC 5424 messages.
log.syslog.version	string	Syslog protocol version.

mapper

Field	Type	Description
mapper	struct	Metadata identifying which integration mapper produced this event. Injected automatically during view composition.
mapper.id	string	Unique identifier of the mapper that produced this event.
mapper.name	string	Sanitized name of the mapper that produced this event.

network

Field	Type	Description
network	struct
network.application	string	Application level protocol name.
network.bytes	int	Total bytes transferred in both directions.
network.community_id	string	A hash of source and destination IPs and ports.
network.direction	string	Direction of the network traffic.
network.forwarded_ip	string	Host IP address when the source IP address is the proxy.
network.iana_number	string	IANA Protocol Number.
network.inner	struct	Inner VLAN tag information
network.inner.vlan	struct
network.inner.vlan.id	string	VLAN ID as reported by the observer.
network.inner.vlan.name	string	Optional VLAN name as reported by the observer.
network.name	string	Name given by operators to sections of their network.
network.packets	int	Total packets transferred in both directions.
network.protocol	string	Application protocol name.
network.transport	string	Protocol Name corresponding to the field iana_number.
network.type	string	In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
network.vlan	struct
network.vlan.id	string	VLAN ID as reported by the observer.
network.vlan.name	string	Optional VLAN name as reported by the observer.

observer

Field	Type	Description
observer	struct
observer.egress	struct	Object field for egress information
observer.egress.interface	struct
observer.egress.interface.alias	string	Interface alias
observer.egress.interface.id	string	Interface ID
observer.egress.interface.name	string	Interface name
observer.egress.vlan	struct
observer.egress.vlan.id	string	VLAN ID as reported by the observer.
observer.egress.vlan.name	string	Optional VLAN name as reported by the observer.
observer.egress.zone	string	Observer Egress zone
observer.geo	struct
observer.geo.city_name	string	City name.
observer.geo.continent_code	string	Continent code.
observer.geo.continent_name	string	Name of the continent.
observer.geo.country_iso_code	string	Country ISO code.
observer.geo.country_name	string	Country name.
observer.geo.location	string	Longitude and latitude.
observer.geo.name	string	User-defined description of a location.
observer.geo.postal_code	string	Postal code.
observer.geo.region_iso_code	string	Region ISO code.
observer.geo.region_name	string	Region name.
observer.geo.timezone	string	Time zone.
observer.hostname	string	Hostname of the observer.
observer.ingress	struct	Object field for ingress information
observer.ingress.interface	struct
observer.ingress.interface.alias	string	Interface alias
observer.ingress.interface.id	string	Interface ID
observer.ingress.interface.name	string	Interface name
observer.ingress.vlan	struct
observer.ingress.vlan.id	string	VLAN ID as reported by the observer.
observer.ingress.vlan.name	string	Optional VLAN name as reported by the observer.
observer.ingress.zone	string	Observer ingress zone
observer.ip	array(string)	IP addresses of the observer.
observer.mac	array(string)	MAC addresses of the observer.
observer.name	string	Custom name of the observer.
observer.os	struct
observer.os.family	string	OS family (such as redhat, debian, freebsd, windows).
observer.os.full	struct	Operating system name, including the version or code name.
observer.os.full.text	string	Operating system name, including the version or code name.
observer.os.kernel	string	Operating system kernel version as a raw string.
observer.os.name	struct	Operating system name, without the version.
observer.os.name.text	string	Operating system name, without the version.
observer.os.platform	string	Operating system platform (such centos, ubuntu, windows).
observer.os.type	string	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
observer.os.version	string	Operating system version as a raw string.
observer.product	string	The product name of the observer.
observer.serial_number	string	Observer serial number.
observer.type	string	The type of the observer the data is coming from.
observer.vendor	string	Vendor name of the observer.
observer.version	string	Observer version.

orchestrator

Field	Type	Description
orchestrator	struct
orchestrator.api_version	string	API version being used to carry out the action
orchestrator.cluster	struct
orchestrator.cluster.id	string	Unique ID of the cluster.
orchestrator.cluster.name	string	Name of the cluster.
orchestrator.cluster.url	string	URL of the API used to manage the cluster.
orchestrator.cluster.version	string	The version of the cluster.
orchestrator.entity	struct
orchestrator.entity.attributes	map	A set of static or semi-static attributes of the entity.
orchestrator.entity.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
orchestrator.entity.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
orchestrator.entity.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
orchestrator.entity.id	string	Unique identifier for the entity.
orchestrator.entity.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
orchestrator.entity.lifecycle	map	A set of temporal characteristics of the entity.
orchestrator.entity.metrics	map	Field set for any fields containing numeric entity metrics.
orchestrator.entity.name	struct	The name of the entity.
orchestrator.entity.name.text	string	The name of the entity.
orchestrator.entity.raw	map	Original, unmodified fields from the source system.
orchestrator.entity.reference	string	A URI, URL, or other direct reference to access or locate the entity.
orchestrator.entity.source	string	Source module or integration that provided the entity data.
orchestrator.entity.sub_type	string	The specific type designation for the entity as defined by its provider or system.
orchestrator.entity.type	array(string)	Standardized high-level classification of the entity.
orchestrator.namespace	string	Namespace in which the action is taking place.
orchestrator.organization	string	Organization affected by the event (for multi-tenant orchestrator setups).
orchestrator.resource	struct
orchestrator.resource.annotation	array(string)	The list of annotations added to the resource.
orchestrator.resource.id	string	Unique ID of the resource being acted upon.
orchestrator.resource.ip	array(string)	IP address assigned to the resource associated with the event being observed.
orchestrator.resource.label	array(string)	The list of labels added to the resource.
orchestrator.resource.name	string	Name of the resource being acted upon.
orchestrator.resource.parent	struct
orchestrator.resource.parent.type	string	Type or kind of the parent resource associated with the event being observed.
orchestrator.resource.type	string	Type of resource being acted upon.
orchestrator.type	string	Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).

organization

Field	Type	Description
organization	struct
organization.id	string	Unique identifier for the organization.
organization.name	struct	Organization name.
organization.name.text	string	Organization name.

package

Field	Type	Description
package	struct
package.architecture	string	Package architecture.
package.build_version	string	Build version information
package.checksum	string	Checksum of the installed package for verification.
package.description	string	Description of the package.
package.install_scope	string	Indicating how the package was installed, e.g. user-local, global.
package.installed	timestamp	Time when package was installed.
package.license	string	Package license
package.name	string	Package name
package.path	string	Path where the package is installed.
package.reference	string	Package home page or reference URL
package.size	int	Package size in bytes.
package.type	string	Package type
package.version	string	Package version

process

Field	Type	Description
process	struct
process.args	array(string)	Array of process arguments.
process.args_count	int	Length of the process.args array.
process.code_signature	struct
process.code_signature.digest_algorithm	string	Hashing algorithm used to sign the process.
process.code_signature.exists	boolean	Boolean to capture if a signature is present.
process.code_signature.flags	string	Code signing flags of the process
process.code_signature.signing_id	string	The identifier used to sign the process.
process.code_signature.status	string	Additional information about the certificate status.
process.code_signature.subject_name	string	Subject name of the code signer
process.code_signature.team_id	string	The team identifier used to sign the process.
process.code_signature.thumbprint_sha256	string	SHA256 hash of the certificate.
process.code_signature.timestamp	timestamp	When the signature was generated and signed.
process.code_signature.trusted	boolean	Stores the trust status of the certificate chain.
process.code_signature.valid	boolean	Boolean to capture if the digital signature is verified against the binary content.
process.command_line	struct	Full command line that started the process.
process.command_line.text	string	Full command line that started the process.
process.elf	struct
process.elf.architecture	string	Machine architecture of the ELF file.
process.elf.byte_order	string	Byte sequence of ELF file.
process.elf.cpu_type	string	CPU type of the ELF file.
process.elf.creation_date	timestamp	Build or compile date.
process.elf.exports	array(string)	List of exported element names and types.
process.elf.go_import_hash	string	A hash of the Go language imports in an ELF file.
process.elf.go_imports	string	List of imported Go language element names and types.
process.elf.go_imports_names_entropy	int	Shannon entropy calculation from the list of Go imports.
process.elf.go_imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of Go imports.
process.elf.go_stripped	boolean	Whether the file is a stripped or obfuscated Go executable.
process.elf.header	struct
process.elf.header.abi_version	string	Version of the ELF Application Binary Interface (ABI).
process.elf.header.class	string	Header class of the ELF file.
process.elf.header.data	string	Data table of the ELF header.
process.elf.header.entrypoint	int	Header entrypoint of the ELF file.
process.elf.header.object_version	string	"0x1" for original ELF files.
process.elf.header.os_abi	string	Application Binary Interface (ABI) of the Linux OS.
process.elf.header.type	string	Header type of the ELF file.
process.elf.header.version	string	Version of the ELF header.
process.elf.import_hash	string	A hash of the imports in an ELF file.
process.elf.imports	array(string)	List of imported element names and types.
process.elf.imports_names_entropy	int	Shannon entropy calculation from the list of imported element names and types.
process.elf.imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of imported element names and types.
process.elf.sections	struct	Section information of the ELF file.
process.elf.sections.chi2	int	Chi-square probability distribution of the section.
process.elf.sections.entropy	int	Shannon entropy calculation from the section.
process.elf.sections.flags	string	ELF Section List flags.
process.elf.sections.name	string	ELF Section List name.
process.elf.sections.physical_offset	string	ELF Section List offset.
process.elf.sections.physical_size	int	ELF Section List physical size.
process.elf.sections.type	string	ELF Section List type.
process.elf.sections.var_entropy	int	Variance for Shannon entropy calculation from the section.
process.elf.sections.virtual_address	int	ELF Section List virtual address.
process.elf.sections.virtual_size	int	ELF Section List virtual size.
process.elf.segments	struct	ELF object segment list.
process.elf.segments.sections	string	ELF object segment sections.
process.elf.segments.type	string	ELF object segment type.
process.elf.shared_libraries	array(string)	List of shared libraries used by this ELF object.
process.elf.telfhash	string	telfhash hash for ELF file.
process.end	timestamp	The time the process ended.
process.entity_id	string	Unique identifier for the process.
process.entry_leader	struct
process.entry_leader.args	array(string)	Array of process arguments.
process.entry_leader.args_count	int	Length of the process.args array.
process.entry_leader.attested_groups	struct
process.entry_leader.attested_groups.name	string	Name of the group.
process.entry_leader.attested_user	struct
process.entry_leader.attested_user.id	string	Unique identifier of the user.
process.entry_leader.attested_user.name	struct	Short name or login of the user.
process.entry_leader.attested_user.name.text	string	Short name or login of the user.
process.entry_leader.command_line	struct	Full command line that started the process.
process.entry_leader.command_line.text	string	Full command line that started the process.
process.entry_leader.entity_id	string	Unique identifier for the process.
process.entry_leader.entry_meta	struct
process.entry_leader.entry_meta.source	struct
process.entry_leader.entry_meta.source.ip	string	IP address of the source.
process.entry_leader.entry_meta.type	string	The entry type for the entry session leader.
process.entry_leader.executable	struct	Absolute path to the process executable.
process.entry_leader.executable.text	string	Absolute path to the process executable.
process.entry_leader.group	struct
process.entry_leader.group.id	string	Unique identifier for the group on the system/platform.
process.entry_leader.group.name	string	Name of the group.
process.entry_leader.interactive	boolean	Whether the process is connected to an interactive shell.
process.entry_leader.name	struct	Process name.
process.entry_leader.name.text	string	Process name.
process.entry_leader.parent	struct
process.entry_leader.parent.entity_id	string	Unique identifier for the process.
process.entry_leader.parent.pid	int	Process id.
process.entry_leader.parent.session_leader	struct
process.entry_leader.parent.session_leader.entity_id	string	Unique identifier for the process.
process.entry_leader.parent.session_leader.pid	int	Process id.
process.entry_leader.parent.session_leader.start	timestamp	The time the process started.
process.entry_leader.parent.session_leader.vpid	int	Virtual process id.
process.entry_leader.parent.start	timestamp	The time the process started.
process.entry_leader.parent.vpid	int	Virtual process id.
process.entry_leader.pid	int	Process id.
process.entry_leader.real_group	struct
process.entry_leader.real_group.id	string	Unique identifier for the group on the system/platform.
process.entry_leader.real_group.name	string	Name of the group.
process.entry_leader.real_user	struct
process.entry_leader.real_user.id	string	Unique identifier of the user.
process.entry_leader.real_user.name	struct	Short name or login of the user.
process.entry_leader.real_user.name.text	string	Short name or login of the user.
process.entry_leader.same_as_process	boolean	This boolean is used to identify if a leader process is the same as the top level process.
process.entry_leader.saved_group	struct
process.entry_leader.saved_group.id	string	Unique identifier for the group on the system/platform.
process.entry_leader.saved_group.name	string	Name of the group.
process.entry_leader.saved_user	struct
process.entry_leader.saved_user.id	string	Unique identifier of the user.
process.entry_leader.saved_user.name	struct	Short name or login of the user.
process.entry_leader.saved_user.name.text	string	Short name or login of the user.
process.entry_leader.start	timestamp	The time the process started.
process.entry_leader.supplemental_groups	struct
process.entry_leader.supplemental_groups.id	string	Unique identifier for the group on the system/platform.
process.entry_leader.supplemental_groups.name	string	Name of the group.
process.entry_leader.tty	struct	Information about the controlling TTY device.
process.entry_leader.tty.char_device	struct
process.entry_leader.tty.char_device.major	int	The TTY character device's major number.
process.entry_leader.tty.char_device.minor	int	The TTY character device's minor number.
process.entry_leader.user	struct
process.entry_leader.user.id	string	Unique identifier of the user.
process.entry_leader.user.name	struct	Short name or login of the user.
process.entry_leader.user.name.text	string	Short name or login of the user.
process.entry_leader.vpid	int	Virtual process id.
process.entry_leader.working_directory	struct	The working directory of the process.
process.entry_leader.working_directory.text	string	The working directory of the process.
process.env_vars	array(string)	Array of environment variable bindings.
process.executable	struct	Absolute path to the process executable.
process.executable.text	string	Absolute path to the process executable.
process.exit_code	int	The exit code of the process.
process.group	struct
process.group.id	string	Unique identifier for the group on the system/platform.
process.group.name	string	Name of the group.
process.group_leader	struct
process.group_leader.args	array(string)	Array of process arguments.
process.group_leader.args_count	int	Length of the process.args array.
process.group_leader.command_line	struct	Full command line that started the process.
process.group_leader.command_line.text	string	Full command line that started the process.
process.group_leader.entity_id	string	Unique identifier for the process.
process.group_leader.executable	struct	Absolute path to the process executable.
process.group_leader.executable.text	string	Absolute path to the process executable.
process.group_leader.group	struct
process.group_leader.group.id	string	Unique identifier for the group on the system/platform.
process.group_leader.group.name	string	Name of the group.
process.group_leader.interactive	boolean	Whether the process is connected to an interactive shell.
process.group_leader.name	struct	Process name.
process.group_leader.name.text	string	Process name.
process.group_leader.pid	int	Process id.
process.group_leader.real_group	struct
process.group_leader.real_group.id	string	Unique identifier for the group on the system/platform.
process.group_leader.real_group.name	string	Name of the group.
process.group_leader.real_user	struct
process.group_leader.real_user.id	string	Unique identifier of the user.
process.group_leader.real_user.name	struct	Short name or login of the user.
process.group_leader.real_user.name.text	string	Short name or login of the user.
process.group_leader.same_as_process	boolean	This boolean is used to identify if a leader process is the same as the top level process.
process.group_leader.saved_group	struct
process.group_leader.saved_group.id	string	Unique identifier for the group on the system/platform.
process.group_leader.saved_group.name	string	Name of the group.
process.group_leader.saved_user	struct
process.group_leader.saved_user.id	string	Unique identifier of the user.
process.group_leader.saved_user.name	struct	Short name or login of the user.
process.group_leader.saved_user.name.text	string	Short name or login of the user.
process.group_leader.start	timestamp	The time the process started.
process.group_leader.supplemental_groups	struct
process.group_leader.supplemental_groups.id	string	Unique identifier for the group on the system/platform.
process.group_leader.supplemental_groups.name	string	Name of the group.
process.group_leader.tty	struct	Information about the controlling TTY device.
process.group_leader.tty.char_device	struct
process.group_leader.tty.char_device.major	int	The TTY character device's major number.
process.group_leader.tty.char_device.minor	int	The TTY character device's minor number.
process.group_leader.user	struct
process.group_leader.user.id	string	Unique identifier of the user.
process.group_leader.user.name	struct	Short name or login of the user.
process.group_leader.user.name.text	string	Short name or login of the user.
process.group_leader.vpid	int	Virtual process id.
process.group_leader.working_directory	struct	The working directory of the process.
process.group_leader.working_directory.text	string	The working directory of the process.
process.hash	struct
process.hash.cdhash	string	The Code Directory (CD) hash of an executable.
process.hash.md5	string	MD5 hash.
process.hash.sha1	string	SHA1 hash.
process.hash.sha256	string	SHA256 hash.
process.hash.sha384	string	SHA384 hash.
process.hash.sha512	string	SHA512 hash.
process.hash.ssdeep	string	SSDEEP hash.
process.hash.tlsh	string	TLSH hash.
process.interactive	boolean	Whether the process is connected to an interactive shell.
process.io	struct	A chunk of input or output (IO) from a single process.
process.io.bytes_skipped	struct	An array of byte offsets and lengths denoting where IO data has been skipped.
process.io.bytes_skipped.length	int	The length of bytes skipped.
process.io.bytes_skipped.offset	int	The byte offset into this event's io.text (or io.bytes in the future) where length bytes were skipped.
process.io.max_bytes_per_process_exceeded	boolean	If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.
process.io.text	string	A chunk of output or input sanitized to UTF-8.
process.io.total_bytes_captured	int	The total number of bytes captured in this event.
process.io.total_bytes_skipped	int	The total number of bytes that were not captured due to implementation restrictions such as buffer size limits.
process.io.type	string	The type of object on which the IO action (read or write) was taken.
process.macho	struct
process.macho.go_import_hash	string	A hash of the Go language imports in a Mach-O file.
process.macho.go_imports	string	List of imported Go language element names and types.
process.macho.go_imports_names_entropy	int	Shannon entropy calculation from the list of Go imports.
process.macho.go_imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of Go imports.
process.macho.go_stripped	boolean	Whether the file is a stripped or obfuscated Go executable.
process.macho.import_hash	string	A hash of the imports in a Mach-O file.
process.macho.imports	array(string)	List of imported element names and types.
process.macho.imports_names_entropy	int	Shannon entropy calculation from the list of imported element names and types.
process.macho.imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of imported element names and types.
process.macho.sections	struct	Section information of the Mach-O file.
process.macho.sections.entropy	int	Shannon entropy calculation from the section.
process.macho.sections.name	string	Mach-O Section List name.
process.macho.sections.physical_size	int	Mach-O Section List physical size.
process.macho.sections.var_entropy	int	Variance for Shannon entropy calculation from the section.
process.macho.sections.virtual_size	int	Mach-O Section List virtual size. This is always the same as physical_size.
process.macho.symhash	string	A hash of the imports in a Mach-O file.
process.name	struct	Process name.
process.name.text	string	Process name.
process.parent	struct
process.parent.args	array(string)	Array of process arguments.
process.parent.args_count	int	Length of the process.args array.
process.parent.code_signature	struct
process.parent.code_signature.digest_algorithm	string	Hashing algorithm used to sign the process.
process.parent.code_signature.exists	boolean	Boolean to capture if a signature is present.
process.parent.code_signature.flags	string	Code signing flags of the process
process.parent.code_signature.signing_id	string	The identifier used to sign the process.
process.parent.code_signature.status	string	Additional information about the certificate status.
process.parent.code_signature.subject_name	string	Subject name of the code signer
process.parent.code_signature.team_id	string	The team identifier used to sign the process.
process.parent.code_signature.thumbprint_sha256	string	SHA256 hash of the certificate.
process.parent.code_signature.timestamp	timestamp	When the signature was generated and signed.
process.parent.code_signature.trusted	boolean	Stores the trust status of the certificate chain.
process.parent.code_signature.valid	boolean	Boolean to capture if the digital signature is verified against the binary content.
process.parent.command_line	struct	Full command line that started the process.
process.parent.command_line.text	string	Full command line that started the process.
process.parent.elf	struct
process.parent.elf.architecture	string	Machine architecture of the ELF file.
process.parent.elf.byte_order	string	Byte sequence of ELF file.
process.parent.elf.cpu_type	string	CPU type of the ELF file.
process.parent.elf.creation_date	timestamp	Build or compile date.
process.parent.elf.exports	array(string)	List of exported element names and types.
process.parent.elf.go_import_hash	string	A hash of the Go language imports in an ELF file.
process.parent.elf.go_imports	string	List of imported Go language element names and types.
process.parent.elf.go_imports_names_entropy	int	Shannon entropy calculation from the list of Go imports.
process.parent.elf.go_imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of Go imports.
process.parent.elf.go_stripped	boolean	Whether the file is a stripped or obfuscated Go executable.
process.parent.elf.header	struct
process.parent.elf.header.abi_version	string	Version of the ELF Application Binary Interface (ABI).
process.parent.elf.header.class	string	Header class of the ELF file.
process.parent.elf.header.data	string	Data table of the ELF header.
process.parent.elf.header.entrypoint	int	Header entrypoint of the ELF file.
process.parent.elf.header.object_version	string	"0x1" for original ELF files.
process.parent.elf.header.os_abi	string	Application Binary Interface (ABI) of the Linux OS.
process.parent.elf.header.type	string	Header type of the ELF file.
process.parent.elf.header.version	string	Version of the ELF header.
process.parent.elf.import_hash	string	A hash of the imports in an ELF file.
process.parent.elf.imports	array(string)	List of imported element names and types.
process.parent.elf.imports_names_entropy	int	Shannon entropy calculation from the list of imported element names and types.
process.parent.elf.imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of imported element names and types.
process.parent.elf.sections	struct	Section information of the ELF file.
process.parent.elf.sections.chi2	int	Chi-square probability distribution of the section.
process.parent.elf.sections.entropy	int	Shannon entropy calculation from the section.
process.parent.elf.sections.flags	string	ELF Section List flags.
process.parent.elf.sections.name	string	ELF Section List name.
process.parent.elf.sections.physical_offset	string	ELF Section List offset.
process.parent.elf.sections.physical_size	int	ELF Section List physical size.
process.parent.elf.sections.type	string	ELF Section List type.
process.parent.elf.sections.var_entropy	int	Variance for Shannon entropy calculation from the section.
process.parent.elf.sections.virtual_address	int	ELF Section List virtual address.
process.parent.elf.sections.virtual_size	int	ELF Section List virtual size.
process.parent.elf.segments	struct	ELF object segment list.
process.parent.elf.segments.sections	string	ELF object segment sections.
process.parent.elf.segments.type	string	ELF object segment type.
process.parent.elf.shared_libraries	array(string)	List of shared libraries used by this ELF object.
process.parent.elf.telfhash	string	telfhash hash for ELF file.
process.parent.end	timestamp	The time the process ended.
process.parent.entity_id	string	Unique identifier for the process.
process.parent.executable	struct	Absolute path to the process executable.
process.parent.executable.text	string	Absolute path to the process executable.
process.parent.exit_code	int	The exit code of the process.
process.parent.group	struct
process.parent.group.id	string	Unique identifier for the group on the system/platform.
process.parent.group.name	string	Name of the group.
process.parent.group_leader	struct
process.parent.group_leader.entity_id	string	Unique identifier for the process.
process.parent.group_leader.pid	int	Process id.
process.parent.group_leader.start	timestamp	The time the process started.
process.parent.group_leader.vpid	int	Virtual process id.
process.parent.hash	struct
process.parent.hash.cdhash	string	The Code Directory (CD) hash of an executable.
process.parent.hash.md5	string	MD5 hash.
process.parent.hash.sha1	string	SHA1 hash.
process.parent.hash.sha256	string	SHA256 hash.
process.parent.hash.sha384	string	SHA384 hash.
process.parent.hash.sha512	string	SHA512 hash.
process.parent.hash.ssdeep	string	SSDEEP hash.
process.parent.hash.tlsh	string	TLSH hash.
process.parent.interactive	boolean	Whether the process is connected to an interactive shell.
process.parent.macho	struct
process.parent.macho.go_import_hash	string	A hash of the Go language imports in a Mach-O file.
process.parent.macho.go_imports	string	List of imported Go language element names and types.
process.parent.macho.go_imports_names_entropy	int	Shannon entropy calculation from the list of Go imports.
process.parent.macho.go_imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of Go imports.
process.parent.macho.go_stripped	boolean	Whether the file is a stripped or obfuscated Go executable.
process.parent.macho.import_hash	string	A hash of the imports in a Mach-O file.
process.parent.macho.imports	array(string)	List of imported element names and types.
process.parent.macho.imports_names_entropy	int	Shannon entropy calculation from the list of imported element names and types.
process.parent.macho.imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of imported element names and types.
process.parent.macho.sections	struct	Section information of the Mach-O file.
process.parent.macho.sections.entropy	int	Shannon entropy calculation from the section.
process.parent.macho.sections.name	string	Mach-O Section List name.
process.parent.macho.sections.physical_size	int	Mach-O Section List physical size.
process.parent.macho.sections.var_entropy	int	Variance for Shannon entropy calculation from the section.
process.parent.macho.sections.virtual_size	int	Mach-O Section List virtual size. This is always the same as physical_size.
process.parent.macho.symhash	string	A hash of the imports in a Mach-O file.
process.parent.name	struct	Process name.
process.parent.name.text	string	Process name.
process.parent.pe	struct
process.parent.pe.architecture	string	CPU architecture target for the file.
process.parent.pe.company	string	Internal company name of the file, provided at compile-time.
process.parent.pe.description	string	Internal description of the file, provided at compile-time.
process.parent.pe.file_version	string	Process name.
process.parent.pe.go_import_hash	string	A hash of the Go language imports in a PE file.
process.parent.pe.go_imports	string	List of imported Go language element names and types.
process.parent.pe.go_imports_names_entropy	int	Shannon entropy calculation from the list of Go imports.
process.parent.pe.go_imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of Go imports.
process.parent.pe.go_stripped	boolean	Whether the file is a stripped or obfuscated Go executable.
process.parent.pe.imphash	string	A hash of the imports in a PE file.
process.parent.pe.import_hash	string	A hash of the imports in a PE file.
process.parent.pe.imports	array(string)	List of imported element names and types.
process.parent.pe.imports_names_entropy	int	Shannon entropy calculation from the list of imported element names and types.
process.parent.pe.imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of imported element names and types.
process.parent.pe.original_file_name	string	Internal name of the file, provided at compile-time.
process.parent.pe.pehash	string	A hash of the PE header and data from one or more PE sections.
process.parent.pe.product	string	Internal product name of the file, provided at compile-time.
process.parent.pe.sections	struct	Section information of the PE file.
process.parent.pe.sections.entropy	int	Shannon entropy calculation from the section.
process.parent.pe.sections.name	string	PE Section List name.
process.parent.pe.sections.physical_size	int	PE Section List physical size.
process.parent.pe.sections.var_entropy	int	Variance for Shannon entropy calculation from the section.
process.parent.pe.sections.virtual_size	int	PE Section List virtual size. This is always the same as physical_size.
process.parent.pid	int	Process id.
process.parent.real_group	struct
process.parent.real_group.id	string	Unique identifier for the group on the system/platform.
process.parent.real_group.name	string	Name of the group.
process.parent.real_user	struct
process.parent.real_user.id	string	Unique identifier of the user.
process.parent.real_user.name	struct	Short name or login of the user.
process.parent.real_user.name.text	string	Short name or login of the user.
process.parent.saved_group	struct
process.parent.saved_group.id	string	Unique identifier for the group on the system/platform.
process.parent.saved_group.name	string	Name of the group.
process.parent.saved_user	struct
process.parent.saved_user.id	string	Unique identifier of the user.
process.parent.saved_user.name	struct	Short name or login of the user.
process.parent.saved_user.name.text	string	Short name or login of the user.
process.parent.start	timestamp	The time the process started.
process.parent.supplemental_groups	struct
process.parent.supplemental_groups.id	string	Unique identifier for the group on the system/platform.
process.parent.supplemental_groups.name	string	Name of the group.
process.parent.thread	struct
process.parent.thread.capabilities	struct
process.parent.thread.capabilities.effective	array(string)	Array of capabilities used for permission checks.
process.parent.thread.capabilities.permitted	array(string)	Array of capabilities a thread could assume.
process.parent.thread.id	int	Thread ID.
process.parent.thread.name	string	Thread name.
process.parent.title	struct	Process title.
process.parent.title.text	string	Process title.
process.parent.tty	struct	Information about the controlling TTY device.
process.parent.tty.char_device	struct
process.parent.tty.char_device.major	int	The TTY character device's major number.
process.parent.tty.char_device.minor	int	The TTY character device's minor number.
process.parent.uptime	int	Seconds the process has been up.
process.parent.user	struct
process.parent.user.id	string	Unique identifier of the user.
process.parent.user.name	struct	Short name or login of the user.
process.parent.user.name.text	string	Short name or login of the user.
process.parent.vpid	int	Virtual process id.
process.parent.working_directory	struct	The working directory of the process.
process.parent.working_directory.text	string	The working directory of the process.
process.pe	struct
process.pe.architecture	string	CPU architecture target for the file.
process.pe.company	string	Internal company name of the file, provided at compile-time.
process.pe.description	string	Internal description of the file, provided at compile-time.
process.pe.file_version	string	Process name.
process.pe.go_import_hash	string	A hash of the Go language imports in a PE file.
process.pe.go_imports	string	List of imported Go language element names and types.
process.pe.go_imports_names_entropy	int	Shannon entropy calculation from the list of Go imports.
process.pe.go_imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of Go imports.
process.pe.go_stripped	boolean	Whether the file is a stripped or obfuscated Go executable.
process.pe.imphash	string	A hash of the imports in a PE file.
process.pe.import_hash	string	A hash of the imports in a PE file.
process.pe.imports	array(string)	List of imported element names and types.
process.pe.imports_names_entropy	int	Shannon entropy calculation from the list of imported element names and types.
process.pe.imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of imported element names and types.
process.pe.original_file_name	string	Internal name of the file, provided at compile-time.
process.pe.pehash	string	A hash of the PE header and data from one or more PE sections.
process.pe.product	string	Internal product name of the file, provided at compile-time.
process.pe.sections	struct	Section information of the PE file.
process.pe.sections.entropy	int	Shannon entropy calculation from the section.
process.pe.sections.name	string	PE Section List name.
process.pe.sections.physical_size	int	PE Section List physical size.
process.pe.sections.var_entropy	int	Variance for Shannon entropy calculation from the section.
process.pe.sections.virtual_size	int	PE Section List virtual size. This is always the same as physical_size.
process.pid	int	Process id.
process.previous	struct
process.previous.args	array(string)	Array of process arguments.
process.previous.args_count	int	Length of the process.args array.
process.previous.executable	struct	Absolute path to the process executable.
process.previous.executable.text	string	Absolute path to the process executable.
process.real_group	struct
process.real_group.id	string	Unique identifier for the group on the system/platform.
process.real_group.name	string	Name of the group.
process.real_user	struct
process.real_user.id	string	Unique identifier of the user.
process.real_user.name	struct	Short name or login of the user.
process.real_user.name.text	string	Short name or login of the user.
process.saved_group	struct
process.saved_group.id	string	Unique identifier for the group on the system/platform.
process.saved_group.name	string	Name of the group.
process.saved_user	struct
process.saved_user.id	string	Unique identifier of the user.
process.saved_user.name	struct	Short name or login of the user.
process.saved_user.name.text	string	Short name or login of the user.
process.session_leader	struct
process.session_leader.args	array(string)	Array of process arguments.
process.session_leader.args_count	int	Length of the process.args array.
process.session_leader.command_line	struct	Full command line that started the process.
process.session_leader.command_line.text	string	Full command line that started the process.
process.session_leader.entity_id	string	Unique identifier for the process.
process.session_leader.executable	struct	Absolute path to the process executable.
process.session_leader.executable.text	string	Absolute path to the process executable.
process.session_leader.group	struct
process.session_leader.group.id	string	Unique identifier for the group on the system/platform.
process.session_leader.group.name	string	Name of the group.
process.session_leader.interactive	boolean	Whether the process is connected to an interactive shell.
process.session_leader.name	struct	Process name.
process.session_leader.name.text	string	Process name.
process.session_leader.parent	struct
process.session_leader.parent.entity_id	string	Unique identifier for the process.
process.session_leader.parent.pid	int	Process id.
process.session_leader.parent.session_leader	struct
process.session_leader.parent.session_leader.entity_id	string	Unique identifier for the process.
process.session_leader.parent.session_leader.pid	int	Process id.
process.session_leader.parent.session_leader.start	timestamp	The time the process started.
process.session_leader.parent.session_leader.vpid	int	Virtual process id.
process.session_leader.parent.start	timestamp	The time the process started.
process.session_leader.parent.vpid	int	Virtual process id.
process.session_leader.pid	int	Process id.
process.session_leader.real_group	struct
process.session_leader.real_group.id	string	Unique identifier for the group on the system/platform.
process.session_leader.real_group.name	string	Name of the group.
process.session_leader.real_user	struct
process.session_leader.real_user.id	string	Unique identifier of the user.
process.session_leader.real_user.name	struct	Short name or login of the user.
process.session_leader.real_user.name.text	string	Short name or login of the user.
process.session_leader.same_as_process	boolean	This boolean is used to identify if a leader process is the same as the top level process.
process.session_leader.saved_group	struct
process.session_leader.saved_group.id	string	Unique identifier for the group on the system/platform.
process.session_leader.saved_group.name	string	Name of the group.
process.session_leader.saved_user	struct
process.session_leader.saved_user.id	string	Unique identifier of the user.
process.session_leader.saved_user.name	struct	Short name or login of the user.
process.session_leader.saved_user.name.text	string	Short name or login of the user.
process.session_leader.start	timestamp	The time the process started.
process.session_leader.supplemental_groups	struct
process.session_leader.supplemental_groups.id	string	Unique identifier for the group on the system/platform.
process.session_leader.supplemental_groups.name	string	Name of the group.
process.session_leader.tty	struct	Information about the controlling TTY device.
process.session_leader.tty.char_device	struct
process.session_leader.tty.char_device.major	int	The TTY character device's major number.
process.session_leader.tty.char_device.minor	int	The TTY character device's minor number.
process.session_leader.user	struct
process.session_leader.user.id	string	Unique identifier of the user.
process.session_leader.user.name	struct	Short name or login of the user.
process.session_leader.user.name.text	string	Short name or login of the user.
process.session_leader.vpid	int	Virtual process id.
process.session_leader.working_directory	struct	The working directory of the process.
process.session_leader.working_directory.text	string	The working directory of the process.
process.start	timestamp	The time the process started.
process.supplemental_groups	struct
process.supplemental_groups.id	string	Unique identifier for the group on the system/platform.
process.supplemental_groups.name	string	Name of the group.
process.thread	struct
process.thread.capabilities	struct
process.thread.capabilities.effective	array(string)	Array of capabilities used for permission checks.
process.thread.capabilities.permitted	array(string)	Array of capabilities a thread could assume.
process.thread.id	int	Thread ID.
process.thread.name	string	Thread name.
process.title	struct	Process title.
process.title.text	string	Process title.
process.tty	struct	Information about the controlling TTY device.
process.tty.char_device	struct
process.tty.char_device.major	int	The TTY character device's major number.
process.tty.char_device.minor	int	The TTY character device's minor number.
process.tty.columns	int	The number of character columns per line. e.g terminal width
process.tty.rows	int	The number of character rows in the terminal. e.g terminal height
process.uptime	int	Seconds the process has been up.
process.user	struct
process.user.id	string	Unique identifier of the user.
process.user.name	struct	Short name or login of the user.
process.user.name.text	string	Short name or login of the user.
process.vpid	int	Virtual process id.
process.working_directory	struct	The working directory of the process.
process.working_directory.text	string	The working directory of the process.

registry

Field	Type	Description
registry	struct
registry.data	struct
registry.data.bytes	string	Original bytes written with base64 encoding.
registry.data.strings	array(string)	List of strings representing what was written to the registry.
registry.data.type	string	Standard registry type for encoding contents
registry.hive	string	Abbreviated name for the hive.
registry.key	string	Hive-relative path of keys.
registry.path	string	Full path, including hive, key and value
registry.value	string	Name of the value written.

related

Field	Type	Description
related	struct
related.hash	array(string)	All the hashes seen on your event.
related.hosts	array(string)	All the host identifiers seen on your event.
related.ip	array(string)	All of the IPs seen on your event.
related.user	array(string)	All the user names or other user identifiers seen on the event.

rule

Field	Type	Description
rule	struct
rule.author	array(string)	Rule author
rule.category	string	Rule category
rule.description	string	Rule description
rule.id	string	Rule ID
rule.license	string	Rule license
rule.name	string	Rule name
rule.reference	string	Rule reference URL
rule.ruleset	string	Rule ruleset
rule.uuid	string	Rule UUID
rule.version	string	Rule version

server

Field	Type	Description
server	struct
server.address	string	Server network address.
server.as	struct
server.as.number	int	Unique number allocated to the autonomous system.
server.as.organization	struct
server.as.organization.name	struct	Organization name.
server.as.organization.name.text	string	Organization name.
server.bytes	int	Bytes sent from the server to the client.
server.domain	string	The domain name of the server.
server.geo	struct
server.geo.city_name	string	City name.
server.geo.continent_code	string	Continent code.
server.geo.continent_name	string	Name of the continent.
server.geo.country_iso_code	string	Country ISO code.
server.geo.country_name	string	Country name.
server.geo.location	string	Longitude and latitude.
server.geo.name	string	User-defined description of a location.
server.geo.postal_code	string	Postal code.
server.geo.region_iso_code	string	Region ISO code.
server.geo.region_name	string	Region name.
server.geo.timezone	string	Time zone.
server.ip	string	IP address of the server.
server.mac	string	MAC address of the server.
server.nat	struct
server.nat.ip	string	Server NAT ip
server.nat.port	int	Server NAT port
server.packets	int	Packets sent from the server to the client.
server.port	int	Port of the server.
server.registered_domain	string	The highest registered server domain, stripped of the subdomain.
server.subdomain	string	The subdomain of the domain.
server.top_level_domain	string	The effective top level domain (com, org, net, co.uk).
server.user	struct
server.user.domain	string	Name of the directory the user is a member of.
server.user.email	string	User email address.
server.user.full_name	struct	User's full name, if available.
server.user.full_name.text	string	User's full name, if available.
server.user.group	struct
server.user.group.domain	string	Name of the directory the group is a member of.
server.user.group.id	string	Unique identifier for the group on the system/platform.
server.user.group.name	string	Name of the group.
server.user.hash	string	Unique user hash to correlate information for a user in anonymized form.
server.user.id	string	Unique identifier of the user.
server.user.name	struct	Short name or login of the user.
server.user.name.text	string	Short name or login of the user.
server.user.roles	array(string)	Array of user roles at the time of the event.

service

Field	Type	Description
service	struct
service.address	string	Address of this service.
service.entity	struct
service.entity.attributes	map	A set of static or semi-static attributes of the entity.
service.entity.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
service.entity.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
service.entity.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
service.entity.id	string	Unique identifier for the entity.
service.entity.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
service.entity.lifecycle	map	A set of temporal characteristics of the entity.
service.entity.metrics	map	Field set for any fields containing numeric entity metrics.
service.entity.name	struct	The name of the entity.
service.entity.name.text	string	The name of the entity.
service.entity.raw	map	Original, unmodified fields from the source system.
service.entity.reference	string	A URI, URL, or other direct reference to access or locate the entity.
service.entity.source	string	Source module or integration that provided the entity data.
service.entity.sub_type	string	The specific type designation for the entity as defined by its provider or system.
service.entity.type	array(string)	Standardized high-level classification of the entity.
service.environment	string	Environment of the service.
service.ephemeral_id	string	Ephemeral identifier of this service.
service.id	string	Unique identifier of the running service.
service.name	string	Name of the service.
service.node	struct
service.node.name	string	Name of the service node.
service.node.role	string	Deprecated role (singular) of the service node.
service.node.roles	array(string)	Roles of the service node.
service.origin	struct
service.origin.address	string	Address of this service.
service.origin.entity	struct
service.origin.entity.attributes	map	A set of static or semi-static attributes of the entity.
service.origin.entity.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
service.origin.entity.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
service.origin.entity.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
service.origin.entity.id	string	Unique identifier for the entity.
service.origin.entity.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
service.origin.entity.lifecycle	map	A set of temporal characteristics of the entity.
service.origin.entity.metrics	map	Field set for any fields containing numeric entity metrics.
service.origin.entity.name	struct	The name of the entity.
service.origin.entity.name.text	string	The name of the entity.
service.origin.entity.raw	map	Original, unmodified fields from the source system.
service.origin.entity.reference	string	A URI, URL, or other direct reference to access or locate the entity.
service.origin.entity.source	string	Source module or integration that provided the entity data.
service.origin.entity.sub_type	string	The specific type designation for the entity as defined by its provider or system.
service.origin.entity.type	array(string)	Standardized high-level classification of the entity.
service.origin.environment	string	Environment of the service.
service.origin.ephemeral_id	string	Ephemeral identifier of this service.
service.origin.id	string	Unique identifier of the running service.
service.origin.name	string	Name of the service.
service.origin.node	struct
service.origin.node.name	string	Name of the service node.
service.origin.node.role	string	Deprecated role (singular) of the service node.
service.origin.node.roles	array(string)	Roles of the service node.
service.origin.state	string	Current state of the service.
service.origin.type	string	The type of the service.
service.origin.version	string	Version of the service.
service.state	string	Current state of the service.
service.target	struct
service.target.address	string	Address of this service.
service.target.entity	struct
service.target.entity.attributes	map	A set of static or semi-static attributes of the entity.
service.target.entity.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
service.target.entity.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
service.target.entity.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
service.target.entity.id	string	Unique identifier for the entity.
service.target.entity.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
service.target.entity.lifecycle	map	A set of temporal characteristics of the entity.
service.target.entity.metrics	map	Field set for any fields containing numeric entity metrics.
service.target.entity.name	struct	The name of the entity.
service.target.entity.name.text	string	The name of the entity.
service.target.entity.raw	map	Original, unmodified fields from the source system.
service.target.entity.reference	string	A URI, URL, or other direct reference to access or locate the entity.
service.target.entity.source	string	Source module or integration that provided the entity data.
service.target.entity.sub_type	string	The specific type designation for the entity as defined by its provider or system.
service.target.entity.type	array(string)	Standardized high-level classification of the entity.
service.target.environment	string	Environment of the service.
service.target.ephemeral_id	string	Ephemeral identifier of this service.
service.target.id	string	Unique identifier of the running service.
service.target.name	string	Name of the service.
service.target.node	struct
service.target.node.name	string	Name of the service node.
service.target.node.role	string	Deprecated role (singular) of the service node.
service.target.node.roles	array(string)	Roles of the service node.
service.target.state	string	Current state of the service.
service.target.type	string	The type of the service.
service.target.version	string	Version of the service.
service.type	string	The type of the service.
service.version	string	Version of the service.

source

Field	Type	Description
source	struct
source.address	string	Source network address.
source.as	struct
source.as.number	int	Unique number allocated to the autonomous system.
source.as.organization	struct
source.as.organization.name	struct	Organization name.
source.as.organization.name.text	string	Organization name.
source.bytes	int	Bytes sent from the source to the destination.
source.domain	string	The domain name of the source.
source.geo	struct
source.geo.city_name	string	City name.
source.geo.continent_code	string	Continent code.
source.geo.continent_name	string	Name of the continent.
source.geo.country_iso_code	string	Country ISO code.
source.geo.country_name	string	Country name.
source.geo.location	string	Longitude and latitude.
source.geo.name	string	User-defined description of a location.
source.geo.postal_code	string	Postal code.
source.geo.region_iso_code	string	Region ISO code.
source.geo.region_name	string	Region name.
source.geo.timezone	string	Time zone.
source.ip	string	IP address of the source.
source.mac	string	MAC address of the source.
source.nat	struct
source.nat.ip	string	Source NAT ip
source.nat.port	int	Source NAT port
source.packets	int	Packets sent from the source to the destination.
source.port	int	Port of the source.
source.registered_domain	string	The highest registered source domain, stripped of the subdomain.
source.subdomain	string	The subdomain of the domain.
source.top_level_domain	string	The effective top level domain (com, org, net, co.uk).
source.user	struct
source.user.domain	string	Name of the directory the user is a member of.
source.user.email	string	User email address.
source.user.full_name	struct	User's full name, if available.
source.user.full_name.text	string	User's full name, if available.
source.user.group	struct
source.user.group.domain	string	Name of the directory the group is a member of.
source.user.group.id	string	Unique identifier for the group on the system/platform.
source.user.group.name	string	Name of the group.
source.user.hash	string	Unique user hash to correlate information for a user in anonymized form.
source.user.id	string	Unique identifier of the user.
source.user.name	struct	Short name or login of the user.
source.user.name.text	string	Short name or login of the user.
source.user.roles	array(string)	Array of user roles at the time of the event.

span

Field	Type	Description
span	struct
span.id	string	Unique identifier of the span within the scope of its trace.

threat

Field	Type	Description
threat	struct
threat.enrichments	struct	List of objects containing indicators enriching the event.
threat.enrichments.indicator	struct	Object containing indicators enriching the event.
threat.enrichments.indicator.as	struct
threat.enrichments.indicator.as.number	int	Unique number allocated to the autonomous system.
threat.enrichments.indicator.as.organization	struct
threat.enrichments.indicator.as.organization.name	struct	Organization name.
threat.enrichments.indicator.as.organization.name.text	string	Organization name.
threat.enrichments.indicator.confidence	string	Indicator confidence rating
threat.enrichments.indicator.description	string	Indicator description
threat.enrichments.indicator.email	struct
threat.enrichments.indicator.email.address	string	Indicator email address
threat.enrichments.indicator.file	struct
threat.enrichments.indicator.file.accessed	timestamp	Last time the file was accessed.
threat.enrichments.indicator.file.attributes	array(string)	Array of file attributes.
threat.enrichments.indicator.file.code_signature	struct
threat.enrichments.indicator.file.code_signature.digest_algorithm	string	Hashing algorithm used to sign the process.
threat.enrichments.indicator.file.code_signature.exists	boolean	Boolean to capture if a signature is present.
threat.enrichments.indicator.file.code_signature.flags	string	Code signing flags of the process
threat.enrichments.indicator.file.code_signature.signing_id	string	The identifier used to sign the process.
threat.enrichments.indicator.file.code_signature.status	string	Additional information about the certificate status.
threat.enrichments.indicator.file.code_signature.subject_name	string	Subject name of the code signer
threat.enrichments.indicator.file.code_signature.team_id	string	The team identifier used to sign the process.
threat.enrichments.indicator.file.code_signature.thumbprint_sha256	string	SHA256 hash of the certificate.
threat.enrichments.indicator.file.code_signature.timestamp	timestamp	When the signature was generated and signed.
threat.enrichments.indicator.file.code_signature.trusted	boolean	Stores the trust status of the certificate chain.
threat.enrichments.indicator.file.code_signature.valid	boolean	Boolean to capture if the digital signature is verified against the binary content.
threat.enrichments.indicator.file.created	timestamp	File creation time.
threat.enrichments.indicator.file.ctime	timestamp	Last time the file attributes or metadata changed.
threat.enrichments.indicator.file.device	string	Device that is the source of the file.
threat.enrichments.indicator.file.directory	string	Directory where the file is located.
threat.enrichments.indicator.file.drive_letter	string	Drive letter where the file is located.
threat.enrichments.indicator.file.elf	struct
threat.enrichments.indicator.file.elf.architecture	string	Machine architecture of the ELF file.
threat.enrichments.indicator.file.elf.byte_order	string	Byte sequence of ELF file.
threat.enrichments.indicator.file.elf.cpu_type	string	CPU type of the ELF file.
threat.enrichments.indicator.file.elf.creation_date	timestamp	Build or compile date.
threat.enrichments.indicator.file.elf.exports	array(string)	List of exported element names and types.
threat.enrichments.indicator.file.elf.go_import_hash	string	A hash of the Go language imports in an ELF file.
threat.enrichments.indicator.file.elf.go_imports	string	List of imported Go language element names and types.
threat.enrichments.indicator.file.elf.go_imports_names_entropy	int	Shannon entropy calculation from the list of Go imports.
threat.enrichments.indicator.file.elf.go_imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of Go imports.
threat.enrichments.indicator.file.elf.go_stripped	boolean	Whether the file is a stripped or obfuscated Go executable.
threat.enrichments.indicator.file.elf.header	struct
threat.enrichments.indicator.file.elf.header.abi_version	string	Version of the ELF Application Binary Interface (ABI).
threat.enrichments.indicator.file.elf.header.class	string	Header class of the ELF file.
threat.enrichments.indicator.file.elf.header.data	string	Data table of the ELF header.
threat.enrichments.indicator.file.elf.header.entrypoint	int	Header entrypoint of the ELF file.
threat.enrichments.indicator.file.elf.header.object_version	string	"0x1" for original ELF files.
threat.enrichments.indicator.file.elf.header.os_abi	string	Application Binary Interface (ABI) of the Linux OS.
threat.enrichments.indicator.file.elf.header.type	string	Header type of the ELF file.
threat.enrichments.indicator.file.elf.header.version	string	Version of the ELF header.
threat.enrichments.indicator.file.elf.import_hash	string	A hash of the imports in an ELF file.
threat.enrichments.indicator.file.elf.imports	array(string)	List of imported element names and types.
threat.enrichments.indicator.file.elf.imports_names_entropy	int	Shannon entropy calculation from the list of imported element names and types.
threat.enrichments.indicator.file.elf.imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of imported element names and types.
threat.enrichments.indicator.file.elf.sections	struct	Section information of the ELF file.
threat.enrichments.indicator.file.elf.sections.chi2	int	Chi-square probability distribution of the section.
threat.enrichments.indicator.file.elf.sections.entropy	int	Shannon entropy calculation from the section.
threat.enrichments.indicator.file.elf.sections.flags	string	ELF Section List flags.
threat.enrichments.indicator.file.elf.sections.name	string	ELF Section List name.
threat.enrichments.indicator.file.elf.sections.physical_offset	string	ELF Section List offset.
threat.enrichments.indicator.file.elf.sections.physical_size	int	ELF Section List physical size.
threat.enrichments.indicator.file.elf.sections.type	string	ELF Section List type.
threat.enrichments.indicator.file.elf.sections.var_entropy	int	Variance for Shannon entropy calculation from the section.
threat.enrichments.indicator.file.elf.sections.virtual_address	int	ELF Section List virtual address.
threat.enrichments.indicator.file.elf.sections.virtual_size	int	ELF Section List virtual size.
threat.enrichments.indicator.file.elf.segments	struct	ELF object segment list.
threat.enrichments.indicator.file.elf.segments.sections	string	ELF object segment sections.
threat.enrichments.indicator.file.elf.segments.type	string	ELF object segment type.
threat.enrichments.indicator.file.elf.shared_libraries	array(string)	List of shared libraries used by this ELF object.
threat.enrichments.indicator.file.elf.telfhash	string	telfhash hash for ELF file.
threat.enrichments.indicator.file.extension	string	File extension, excluding the leading dot.
threat.enrichments.indicator.file.fork_name	string	A fork is additional data associated with a filesystem object.
threat.enrichments.indicator.file.gid	string	Primary group ID (GID) of the file.
threat.enrichments.indicator.file.group	string	Primary group name of the file.
threat.enrichments.indicator.file.hash	struct
threat.enrichments.indicator.file.hash.cdhash	string	The Code Directory (CD) hash of an executable.
threat.enrichments.indicator.file.hash.md5	string	MD5 hash.
threat.enrichments.indicator.file.hash.sha1	string	SHA1 hash.
threat.enrichments.indicator.file.hash.sha256	string	SHA256 hash.
threat.enrichments.indicator.file.hash.sha384	string	SHA384 hash.
threat.enrichments.indicator.file.hash.sha512	string	SHA512 hash.
threat.enrichments.indicator.file.hash.ssdeep	string	SSDEEP hash.
threat.enrichments.indicator.file.hash.tlsh	string	TLSH hash.
threat.enrichments.indicator.file.inode	string	Inode representing the file in the filesystem.
threat.enrichments.indicator.file.mime_type	string	Media type of file, document, or arrangement of bytes.
threat.enrichments.indicator.file.mode	string	Mode of the file in octal representation.
threat.enrichments.indicator.file.mtime	timestamp	Last time the file content was modified.
threat.enrichments.indicator.file.name	string	Name of the file including the extension, without the directory.
threat.enrichments.indicator.file.origin_referrer_url	string	The URL of the webpage that linked to the file.
threat.enrichments.indicator.file.origin_url	string	The URL where the file is hosted.
threat.enrichments.indicator.file.owner	string	File owner's username.
threat.enrichments.indicator.file.path	struct	Full path to the file, including the file name.
threat.enrichments.indicator.file.path.text	string	Full path to the file, including the file name.
threat.enrichments.indicator.file.pe	struct
threat.enrichments.indicator.file.pe.architecture	string	CPU architecture target for the file.
threat.enrichments.indicator.file.pe.company	string	Internal company name of the file, provided at compile-time.
threat.enrichments.indicator.file.pe.description	string	Internal description of the file, provided at compile-time.
threat.enrichments.indicator.file.pe.file_version	string	Process name.
threat.enrichments.indicator.file.pe.go_import_hash	string	A hash of the Go language imports in a PE file.
threat.enrichments.indicator.file.pe.go_imports	string	List of imported Go language element names and types.
threat.enrichments.indicator.file.pe.go_imports_names_entropy	int	Shannon entropy calculation from the list of Go imports.
threat.enrichments.indicator.file.pe.go_imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of Go imports.
threat.enrichments.indicator.file.pe.go_stripped	boolean	Whether the file is a stripped or obfuscated Go executable.
threat.enrichments.indicator.file.pe.imphash	string	A hash of the imports in a PE file.
threat.enrichments.indicator.file.pe.import_hash	string	A hash of the imports in a PE file.
threat.enrichments.indicator.file.pe.imports	array(string)	List of imported element names and types.
threat.enrichments.indicator.file.pe.imports_names_entropy	int	Shannon entropy calculation from the list of imported element names and types.
threat.enrichments.indicator.file.pe.imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of imported element names and types.
threat.enrichments.indicator.file.pe.original_file_name	string	Internal name of the file, provided at compile-time.
threat.enrichments.indicator.file.pe.pehash	string	A hash of the PE header and data from one or more PE sections.
threat.enrichments.indicator.file.pe.product	string	Internal product name of the file, provided at compile-time.
threat.enrichments.indicator.file.pe.sections	struct	Section information of the PE file.
threat.enrichments.indicator.file.pe.sections.entropy	int	Shannon entropy calculation from the section.
threat.enrichments.indicator.file.pe.sections.name	string	PE Section List name.
threat.enrichments.indicator.file.pe.sections.physical_size	int	PE Section List physical size.
threat.enrichments.indicator.file.pe.sections.var_entropy	int	Variance for Shannon entropy calculation from the section.
threat.enrichments.indicator.file.pe.sections.virtual_size	int	PE Section List virtual size. This is always the same as physical_size.
threat.enrichments.indicator.file.size	int	File size in bytes.
threat.enrichments.indicator.file.target_path	struct	Target path for symlinks.
threat.enrichments.indicator.file.target_path.text	string	Target path for symlinks.
threat.enrichments.indicator.file.type	string	File type (file, dir, or symlink).
threat.enrichments.indicator.file.uid	string	The user ID (UID) or security identifier (SID) of the file owner.
threat.enrichments.indicator.file.x509	struct
threat.enrichments.indicator.file.x509.alternative_names	array(string)	List of subject alternative names (SAN).
threat.enrichments.indicator.file.x509.issuer	struct
threat.enrichments.indicator.file.x509.issuer.common_name	array(string)	List of common name (CN) of issuing certificate authority.
threat.enrichments.indicator.file.x509.issuer.country	array(string)	List of country (C) codes
threat.enrichments.indicator.file.x509.issuer.distinguished_name	string	Distinguished name (DN) of issuing certificate authority.
threat.enrichments.indicator.file.x509.issuer.locality	array(string)	List of locality names (L)
threat.enrichments.indicator.file.x509.issuer.organization	array(string)	List of organizations (O) of issuing certificate authority.
threat.enrichments.indicator.file.x509.issuer.organizational_unit	array(string)	List of organizational units (OU) of issuing certificate authority.
threat.enrichments.indicator.file.x509.issuer.state_or_province	array(string)	List of state or province names (ST, S, or P)
threat.enrichments.indicator.file.x509.not_after	timestamp	Time at which the certificate is no longer considered valid.
threat.enrichments.indicator.file.x509.not_before	timestamp	Time at which the certificate is first considered valid.
threat.enrichments.indicator.file.x509.public_key_algorithm	string	Algorithm used to generate the public key.
threat.enrichments.indicator.file.x509.public_key_curve	string	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
threat.enrichments.indicator.file.x509.public_key_exponent	int	Exponent used to derive the public key. This is algorithm specific.
threat.enrichments.indicator.file.x509.public_key_size	int	The size of the public key space in bits.
threat.enrichments.indicator.file.x509.serial_number	string	Unique serial number issued by the certificate authority.
threat.enrichments.indicator.file.x509.signature_algorithm	string	Identifier for certificate signature algorithm.
threat.enrichments.indicator.file.x509.subject	struct
threat.enrichments.indicator.file.x509.subject.common_name	array(string)	List of common names (CN) of subject.
threat.enrichments.indicator.file.x509.subject.country	array(string)	List of country (C) code
threat.enrichments.indicator.file.x509.subject.distinguished_name	string	Distinguished name (DN) of the certificate subject entity.
threat.enrichments.indicator.file.x509.subject.locality	array(string)	List of locality names (L)
threat.enrichments.indicator.file.x509.subject.organization	array(string)	List of organizations (O) of subject.
threat.enrichments.indicator.file.x509.subject.organizational_unit	array(string)	List of organizational units (OU) of subject.
threat.enrichments.indicator.file.x509.subject.state_or_province	array(string)	List of state or province names (ST, S, or P)
threat.enrichments.indicator.file.x509.version_number	string	Version of x509 format.
threat.enrichments.indicator.first_seen	timestamp	Date/time indicator was first reported.
threat.enrichments.indicator.geo	struct
threat.enrichments.indicator.geo.city_name	string	City name.
threat.enrichments.indicator.geo.continent_code	string	Continent code.
threat.enrichments.indicator.geo.continent_name	string	Name of the continent.
threat.enrichments.indicator.geo.country_iso_code	string	Country ISO code.
threat.enrichments.indicator.geo.country_name	string	Country name.
threat.enrichments.indicator.geo.location	string	Longitude and latitude.
threat.enrichments.indicator.geo.name	string	User-defined description of a location.
threat.enrichments.indicator.geo.postal_code	string	Postal code.
threat.enrichments.indicator.geo.region_iso_code	string	Region ISO code.
threat.enrichments.indicator.geo.region_name	string	Region name.
threat.enrichments.indicator.geo.timezone	string	Time zone.
threat.enrichments.indicator.ip	string	Indicator IP address
threat.enrichments.indicator.last_seen	timestamp	Date/time indicator was last reported.
threat.enrichments.indicator.marking	struct
threat.enrichments.indicator.marking.tlp	string	Indicator TLP marking
threat.enrichments.indicator.marking.tlp_version	string	Indicator TLP version
threat.enrichments.indicator.modified_at	timestamp	Date/time indicator was last updated.
threat.enrichments.indicator.name	string	Indicator display name
threat.enrichments.indicator.port	int	Indicator port
threat.enrichments.indicator.provider	string	Indicator provider
threat.enrichments.indicator.reference	string	Indicator reference URL
threat.enrichments.indicator.registry	struct
threat.enrichments.indicator.registry.data	struct
threat.enrichments.indicator.registry.data.bytes	string	Original bytes written with base64 encoding.
threat.enrichments.indicator.registry.data.strings	array(string)	List of strings representing what was written to the registry.
threat.enrichments.indicator.registry.data.type	string	Standard registry type for encoding contents
threat.enrichments.indicator.registry.hive	string	Abbreviated name for the hive.
threat.enrichments.indicator.registry.key	string	Hive-relative path of keys.
threat.enrichments.indicator.registry.path	string	Full path, including hive, key and value
threat.enrichments.indicator.registry.value	string	Name of the value written.
threat.enrichments.indicator.scanner_stats	int	Scanner statistics
threat.enrichments.indicator.sightings	int	Number of times indicator observed
threat.enrichments.indicator.type	string	Type of indicator
threat.enrichments.indicator.url	struct
threat.enrichments.indicator.url.domain	string	Domain of the url.
threat.enrichments.indicator.url.extension	string	File extension from the request url, excluding the leading dot.
threat.enrichments.indicator.url.fragment	string	Portion of the url after the #.
threat.enrichments.indicator.url.full	struct	Full unparsed URL.
threat.enrichments.indicator.url.full.text	string	Full unparsed URL.
threat.enrichments.indicator.url.original	struct	Unmodified original url as seen in the event source.
threat.enrichments.indicator.url.original.text	string	Unmodified original url as seen in the event source.
threat.enrichments.indicator.url.password	string	Password of the request.
threat.enrichments.indicator.url.path	string	Path of the request, such as "/search".
threat.enrichments.indicator.url.port	int	Port of the request, such as 443.
threat.enrichments.indicator.url.query	string	Query string of the request.
threat.enrichments.indicator.url.registered_domain	string	The highest registered url domain, stripped of the subdomain.
threat.enrichments.indicator.url.scheme	string	Scheme of the url.
threat.enrichments.indicator.url.subdomain	string	The subdomain of the domain.
threat.enrichments.indicator.url.top_level_domain	string	The effective top level domain (com, org, net, co.uk).
threat.enrichments.indicator.url.username	string	Username of the request.
threat.enrichments.indicator.x509	struct
threat.enrichments.indicator.x509.alternative_names	array(string)	List of subject alternative names (SAN).
threat.enrichments.indicator.x509.issuer	struct
threat.enrichments.indicator.x509.issuer.common_name	array(string)	List of common name (CN) of issuing certificate authority.
threat.enrichments.indicator.x509.issuer.country	array(string)	List of country (C) codes
threat.enrichments.indicator.x509.issuer.distinguished_name	string	Distinguished name (DN) of issuing certificate authority.
threat.enrichments.indicator.x509.issuer.locality	array(string)	List of locality names (L)
threat.enrichments.indicator.x509.issuer.organization	array(string)	List of organizations (O) of issuing certificate authority.
threat.enrichments.indicator.x509.issuer.organizational_unit	array(string)	List of organizational units (OU) of issuing certificate authority.
threat.enrichments.indicator.x509.issuer.state_or_province	array(string)	List of state or province names (ST, S, or P)
threat.enrichments.indicator.x509.not_after	timestamp	Time at which the certificate is no longer considered valid.
threat.enrichments.indicator.x509.not_before	timestamp	Time at which the certificate is first considered valid.
threat.enrichments.indicator.x509.public_key_algorithm	string	Algorithm used to generate the public key.
threat.enrichments.indicator.x509.public_key_curve	string	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
threat.enrichments.indicator.x509.public_key_exponent	int	Exponent used to derive the public key. This is algorithm specific.
threat.enrichments.indicator.x509.public_key_size	int	The size of the public key space in bits.
threat.enrichments.indicator.x509.serial_number	string	Unique serial number issued by the certificate authority.
threat.enrichments.indicator.x509.signature_algorithm	string	Identifier for certificate signature algorithm.
threat.enrichments.indicator.x509.subject	struct
threat.enrichments.indicator.x509.subject.common_name	array(string)	List of common names (CN) of subject.
threat.enrichments.indicator.x509.subject.country	array(string)	List of country (C) code
threat.enrichments.indicator.x509.subject.distinguished_name	string	Distinguished name (DN) of the certificate subject entity.
threat.enrichments.indicator.x509.subject.locality	array(string)	List of locality names (L)
threat.enrichments.indicator.x509.subject.organization	array(string)	List of organizations (O) of subject.
threat.enrichments.indicator.x509.subject.organizational_unit	array(string)	List of organizational units (OU) of subject.
threat.enrichments.indicator.x509.subject.state_or_province	array(string)	List of state or province names (ST, S, or P)
threat.enrichments.indicator.x509.version_number	string	Version of x509 format.
threat.enrichments.matched	struct
threat.enrichments.matched.atomic	string	Matched indicator value
threat.enrichments.matched.field	string	Matched indicator field
threat.enrichments.matched.id	string	Matched indicator identifier
threat.enrichments.matched.index	string	Matched indicator index
threat.enrichments.matched.occurred	timestamp	Date of match
threat.enrichments.matched.type	string	Type of indicator match
threat.feed	struct
threat.feed.dashboard_id	string	Feed dashboard ID.
threat.feed.description	string	Description of the threat feed.
threat.feed.name	string	Name of the threat feed.
threat.feed.reference	string	Reference for the threat feed.
threat.framework	string	Threat classification framework.
threat.group	struct
threat.group.alias	array(string)	Alias of the group.
threat.group.id	string	ID of the group.
threat.group.name	string	Name of the group.
threat.group.reference	string	Reference URL of the group.
threat.indicator	struct
threat.indicator.as	struct
threat.indicator.as.number	int	Unique number allocated to the autonomous system.
threat.indicator.as.organization	struct
threat.indicator.as.organization.name	struct	Organization name.
threat.indicator.as.organization.name.text	string	Organization name.
threat.indicator.confidence	string	Indicator confidence rating
threat.indicator.description	string	Indicator description
threat.indicator.email	struct
threat.indicator.email.address	string	Indicator email address
threat.indicator.file	struct
threat.indicator.file.accessed	timestamp	Last time the file was accessed.
threat.indicator.file.attributes	array(string)	Array of file attributes.
threat.indicator.file.code_signature	struct
threat.indicator.file.code_signature.digest_algorithm	string	Hashing algorithm used to sign the process.
threat.indicator.file.code_signature.exists	boolean	Boolean to capture if a signature is present.
threat.indicator.file.code_signature.flags	string	Code signing flags of the process
threat.indicator.file.code_signature.signing_id	string	The identifier used to sign the process.
threat.indicator.file.code_signature.status	string	Additional information about the certificate status.
threat.indicator.file.code_signature.subject_name	string	Subject name of the code signer
threat.indicator.file.code_signature.team_id	string	The team identifier used to sign the process.
threat.indicator.file.code_signature.thumbprint_sha256	string	SHA256 hash of the certificate.
threat.indicator.file.code_signature.timestamp	timestamp	When the signature was generated and signed.
threat.indicator.file.code_signature.trusted	boolean	Stores the trust status of the certificate chain.
threat.indicator.file.code_signature.valid	boolean	Boolean to capture if the digital signature is verified against the binary content.
threat.indicator.file.created	timestamp	File creation time.
threat.indicator.file.ctime	timestamp	Last time the file attributes or metadata changed.
threat.indicator.file.device	string	Device that is the source of the file.
threat.indicator.file.directory	string	Directory where the file is located.
threat.indicator.file.drive_letter	string	Drive letter where the file is located.
threat.indicator.file.elf	struct
threat.indicator.file.elf.architecture	string	Machine architecture of the ELF file.
threat.indicator.file.elf.byte_order	string	Byte sequence of ELF file.
threat.indicator.file.elf.cpu_type	string	CPU type of the ELF file.
threat.indicator.file.elf.creation_date	timestamp	Build or compile date.
threat.indicator.file.elf.exports	array(string)	List of exported element names and types.
threat.indicator.file.elf.go_import_hash	string	A hash of the Go language imports in an ELF file.
threat.indicator.file.elf.go_imports	string	List of imported Go language element names and types.
threat.indicator.file.elf.go_imports_names_entropy	int	Shannon entropy calculation from the list of Go imports.
threat.indicator.file.elf.go_imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of Go imports.
threat.indicator.file.elf.go_stripped	boolean	Whether the file is a stripped or obfuscated Go executable.
threat.indicator.file.elf.header	struct
threat.indicator.file.elf.header.abi_version	string	Version of the ELF Application Binary Interface (ABI).
threat.indicator.file.elf.header.class	string	Header class of the ELF file.
threat.indicator.file.elf.header.data	string	Data table of the ELF header.
threat.indicator.file.elf.header.entrypoint	int	Header entrypoint of the ELF file.
threat.indicator.file.elf.header.object_version	string	"0x1" for original ELF files.
threat.indicator.file.elf.header.os_abi	string	Application Binary Interface (ABI) of the Linux OS.
threat.indicator.file.elf.header.type	string	Header type of the ELF file.
threat.indicator.file.elf.header.version	string	Version of the ELF header.
threat.indicator.file.elf.import_hash	string	A hash of the imports in an ELF file.
threat.indicator.file.elf.imports	array(string)	List of imported element names and types.
threat.indicator.file.elf.imports_names_entropy	int	Shannon entropy calculation from the list of imported element names and types.
threat.indicator.file.elf.imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of imported element names and types.
threat.indicator.file.elf.sections	struct	Section information of the ELF file.
threat.indicator.file.elf.sections.chi2	int	Chi-square probability distribution of the section.
threat.indicator.file.elf.sections.entropy	int	Shannon entropy calculation from the section.
threat.indicator.file.elf.sections.flags	string	ELF Section List flags.
threat.indicator.file.elf.sections.name	string	ELF Section List name.
threat.indicator.file.elf.sections.physical_offset	string	ELF Section List offset.
threat.indicator.file.elf.sections.physical_size	int	ELF Section List physical size.
threat.indicator.file.elf.sections.type	string	ELF Section List type.
threat.indicator.file.elf.sections.var_entropy	int	Variance for Shannon entropy calculation from the section.
threat.indicator.file.elf.sections.virtual_address	int	ELF Section List virtual address.
threat.indicator.file.elf.sections.virtual_size	int	ELF Section List virtual size.
threat.indicator.file.elf.segments	struct	ELF object segment list.
threat.indicator.file.elf.segments.sections	string	ELF object segment sections.
threat.indicator.file.elf.segments.type	string	ELF object segment type.
threat.indicator.file.elf.shared_libraries	array(string)	List of shared libraries used by this ELF object.
threat.indicator.file.elf.telfhash	string	telfhash hash for ELF file.
threat.indicator.file.extension	string	File extension, excluding the leading dot.
threat.indicator.file.fork_name	string	A fork is additional data associated with a filesystem object.
threat.indicator.file.gid	string	Primary group ID (GID) of the file.
threat.indicator.file.group	string	Primary group name of the file.
threat.indicator.file.hash	struct
threat.indicator.file.hash.cdhash	string	The Code Directory (CD) hash of an executable.
threat.indicator.file.hash.md5	string	MD5 hash.
threat.indicator.file.hash.sha1	string	SHA1 hash.
threat.indicator.file.hash.sha256	string	SHA256 hash.
threat.indicator.file.hash.sha384	string	SHA384 hash.
threat.indicator.file.hash.sha512	string	SHA512 hash.
threat.indicator.file.hash.ssdeep	string	SSDEEP hash.
threat.indicator.file.hash.tlsh	string	TLSH hash.
threat.indicator.file.inode	string	Inode representing the file in the filesystem.
threat.indicator.file.mime_type	string	Media type of file, document, or arrangement of bytes.
threat.indicator.file.mode	string	Mode of the file in octal representation.
threat.indicator.file.mtime	timestamp	Last time the file content was modified.
threat.indicator.file.name	string	Name of the file including the extension, without the directory.
threat.indicator.file.origin_referrer_url	string	The URL of the webpage that linked to the file.
threat.indicator.file.origin_url	string	The URL where the file is hosted.
threat.indicator.file.owner	string	File owner's username.
threat.indicator.file.path	struct	Full path to the file, including the file name.
threat.indicator.file.path.text	string	Full path to the file, including the file name.
threat.indicator.file.pe	struct
threat.indicator.file.pe.architecture	string	CPU architecture target for the file.
threat.indicator.file.pe.company	string	Internal company name of the file, provided at compile-time.
threat.indicator.file.pe.description	string	Internal description of the file, provided at compile-time.
threat.indicator.file.pe.file_version	string	Process name.
threat.indicator.file.pe.go_import_hash	string	A hash of the Go language imports in a PE file.
threat.indicator.file.pe.go_imports	string	List of imported Go language element names and types.
threat.indicator.file.pe.go_imports_names_entropy	int	Shannon entropy calculation from the list of Go imports.
threat.indicator.file.pe.go_imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of Go imports.
threat.indicator.file.pe.go_stripped	boolean	Whether the file is a stripped or obfuscated Go executable.
threat.indicator.file.pe.imphash	string	A hash of the imports in a PE file.
threat.indicator.file.pe.import_hash	string	A hash of the imports in a PE file.
threat.indicator.file.pe.imports	array(string)	List of imported element names and types.
threat.indicator.file.pe.imports_names_entropy	int	Shannon entropy calculation from the list of imported element names and types.
threat.indicator.file.pe.imports_names_var_entropy	int	Variance for Shannon entropy calculation from the list of imported element names and types.
threat.indicator.file.pe.original_file_name	string	Internal name of the file, provided at compile-time.
threat.indicator.file.pe.pehash	string	A hash of the PE header and data from one or more PE sections.
threat.indicator.file.pe.product	string	Internal product name of the file, provided at compile-time.
threat.indicator.file.pe.sections	struct	Section information of the PE file.
threat.indicator.file.pe.sections.entropy	int	Shannon entropy calculation from the section.
threat.indicator.file.pe.sections.name	string	PE Section List name.
threat.indicator.file.pe.sections.physical_size	int	PE Section List physical size.
threat.indicator.file.pe.sections.var_entropy	int	Variance for Shannon entropy calculation from the section.
threat.indicator.file.pe.sections.virtual_size	int	PE Section List virtual size. This is always the same as physical_size.
threat.indicator.file.size	int	File size in bytes.
threat.indicator.file.target_path	struct	Target path for symlinks.
threat.indicator.file.target_path.text	string	Target path for symlinks.
threat.indicator.file.type	string	File type (file, dir, or symlink).
threat.indicator.file.uid	string	The user ID (UID) or security identifier (SID) of the file owner.
threat.indicator.file.x509	struct
threat.indicator.file.x509.alternative_names	array(string)	List of subject alternative names (SAN).
threat.indicator.file.x509.issuer	struct
threat.indicator.file.x509.issuer.common_name	array(string)	List of common name (CN) of issuing certificate authority.
threat.indicator.file.x509.issuer.country	array(string)	List of country (C) codes
threat.indicator.file.x509.issuer.distinguished_name	string	Distinguished name (DN) of issuing certificate authority.
threat.indicator.file.x509.issuer.locality	array(string)	List of locality names (L)
threat.indicator.file.x509.issuer.organization	array(string)	List of organizations (O) of issuing certificate authority.
threat.indicator.file.x509.issuer.organizational_unit	array(string)	List of organizational units (OU) of issuing certificate authority.
threat.indicator.file.x509.issuer.state_or_province	array(string)	List of state or province names (ST, S, or P)
threat.indicator.file.x509.not_after	timestamp	Time at which the certificate is no longer considered valid.
threat.indicator.file.x509.not_before	timestamp	Time at which the certificate is first considered valid.
threat.indicator.file.x509.public_key_algorithm	string	Algorithm used to generate the public key.
threat.indicator.file.x509.public_key_curve	string	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
threat.indicator.file.x509.public_key_exponent	int	Exponent used to derive the public key. This is algorithm specific.
threat.indicator.file.x509.public_key_size	int	The size of the public key space in bits.
threat.indicator.file.x509.serial_number	string	Unique serial number issued by the certificate authority.
threat.indicator.file.x509.signature_algorithm	string	Identifier for certificate signature algorithm.
threat.indicator.file.x509.subject	struct
threat.indicator.file.x509.subject.common_name	array(string)	List of common names (CN) of subject.
threat.indicator.file.x509.subject.country	array(string)	List of country (C) code
threat.indicator.file.x509.subject.distinguished_name	string	Distinguished name (DN) of the certificate subject entity.
threat.indicator.file.x509.subject.locality	array(string)	List of locality names (L)
threat.indicator.file.x509.subject.organization	array(string)	List of organizations (O) of subject.
threat.indicator.file.x509.subject.organizational_unit	array(string)	List of organizational units (OU) of subject.
threat.indicator.file.x509.subject.state_or_province	array(string)	List of state or province names (ST, S, or P)
threat.indicator.file.x509.version_number	string	Version of x509 format.
threat.indicator.first_seen	timestamp	Date/time indicator was first reported.
threat.indicator.geo	struct
threat.indicator.geo.city_name	string	City name.
threat.indicator.geo.continent_code	string	Continent code.
threat.indicator.geo.continent_name	string	Name of the continent.
threat.indicator.geo.country_iso_code	string	Country ISO code.
threat.indicator.geo.country_name	string	Country name.
threat.indicator.geo.location	string	Longitude and latitude.
threat.indicator.geo.name	string	User-defined description of a location.
threat.indicator.geo.postal_code	string	Postal code.
threat.indicator.geo.region_iso_code	string	Region ISO code.
threat.indicator.geo.region_name	string	Region name.
threat.indicator.geo.timezone	string	Time zone.
threat.indicator.id	array(string)	ID of the indicator
threat.indicator.ip	string	Indicator IP address
threat.indicator.last_seen	timestamp	Date/time indicator was last reported.
threat.indicator.marking	struct
threat.indicator.marking.tlp	string	Indicator TLP marking
threat.indicator.marking.tlp_version	string	Indicator TLP version
threat.indicator.modified_at	timestamp	Date/time indicator was last updated.
threat.indicator.name	string	Indicator display name
threat.indicator.port	int	Indicator port
threat.indicator.provider	string	Indicator provider
threat.indicator.reference	string	Indicator reference URL
threat.indicator.registry	struct
threat.indicator.registry.data	struct
threat.indicator.registry.data.bytes	string	Original bytes written with base64 encoding.
threat.indicator.registry.data.strings	array(string)	List of strings representing what was written to the registry.
threat.indicator.registry.data.type	string	Standard registry type for encoding contents
threat.indicator.registry.hive	string	Abbreviated name for the hive.
threat.indicator.registry.key	string	Hive-relative path of keys.
threat.indicator.registry.path	string	Full path, including hive, key and value
threat.indicator.registry.value	string	Name of the value written.
threat.indicator.scanner_stats	int	Scanner statistics
threat.indicator.sightings	int	Number of times indicator observed
threat.indicator.type	string	Type of indicator
threat.indicator.url	struct
threat.indicator.url.domain	string	Domain of the url.
threat.indicator.url.extension	string	File extension from the request url, excluding the leading dot.
threat.indicator.url.fragment	string	Portion of the url after the #.
threat.indicator.url.full	struct	Full unparsed URL.
threat.indicator.url.full.text	string	Full unparsed URL.
threat.indicator.url.original	struct	Unmodified original url as seen in the event source.
threat.indicator.url.original.text	string	Unmodified original url as seen in the event source.
threat.indicator.url.password	string	Password of the request.
threat.indicator.url.path	string	Path of the request, such as "/search".
threat.indicator.url.port	int	Port of the request, such as 443.
threat.indicator.url.query	string	Query string of the request.
threat.indicator.url.registered_domain	string	The highest registered url domain, stripped of the subdomain.
threat.indicator.url.scheme	string	Scheme of the url.
threat.indicator.url.subdomain	string	The subdomain of the domain.
threat.indicator.url.top_level_domain	string	The effective top level domain (com, org, net, co.uk).
threat.indicator.url.username	string	Username of the request.
threat.indicator.x509	struct
threat.indicator.x509.alternative_names	array(string)	List of subject alternative names (SAN).
threat.indicator.x509.issuer	struct
threat.indicator.x509.issuer.common_name	array(string)	List of common name (CN) of issuing certificate authority.
threat.indicator.x509.issuer.country	array(string)	List of country (C) codes
threat.indicator.x509.issuer.distinguished_name	string	Distinguished name (DN) of issuing certificate authority.
threat.indicator.x509.issuer.locality	array(string)	List of locality names (L)
threat.indicator.x509.issuer.organization	array(string)	List of organizations (O) of issuing certificate authority.
threat.indicator.x509.issuer.organizational_unit	array(string)	List of organizational units (OU) of issuing certificate authority.
threat.indicator.x509.issuer.state_or_province	array(string)	List of state or province names (ST, S, or P)
threat.indicator.x509.not_after	timestamp	Time at which the certificate is no longer considered valid.
threat.indicator.x509.not_before	timestamp	Time at which the certificate is first considered valid.
threat.indicator.x509.public_key_algorithm	string	Algorithm used to generate the public key.
threat.indicator.x509.public_key_curve	string	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
threat.indicator.x509.public_key_exponent	int	Exponent used to derive the public key. This is algorithm specific.
threat.indicator.x509.public_key_size	int	The size of the public key space in bits.
threat.indicator.x509.serial_number	string	Unique serial number issued by the certificate authority.
threat.indicator.x509.signature_algorithm	string	Identifier for certificate signature algorithm.
threat.indicator.x509.subject	struct
threat.indicator.x509.subject.common_name	array(string)	List of common names (CN) of subject.
threat.indicator.x509.subject.country	array(string)	List of country (C) code
threat.indicator.x509.subject.distinguished_name	string	Distinguished name (DN) of the certificate subject entity.
threat.indicator.x509.subject.locality	array(string)	List of locality names (L)
threat.indicator.x509.subject.organization	array(string)	List of organizations (O) of subject.
threat.indicator.x509.subject.organizational_unit	array(string)	List of organizational units (OU) of subject.
threat.indicator.x509.subject.state_or_province	array(string)	List of state or province names (ST, S, or P)
threat.indicator.x509.version_number	string	Version of x509 format.
threat.software	struct
threat.software.alias	array(string)	Alias of the software
threat.software.id	string	ID of the software
threat.software.name	string	Name of the software.
threat.software.platforms	array(string)	Platforms of the software.
threat.software.reference	string	Software reference URL.
threat.software.type	string	Software type.
threat.tactic	struct
threat.tactic.id	array(string)	Threat tactic id.
threat.tactic.name	array(string)	Threat tactic.
threat.tactic.reference	array(string)	Threat tactic URL reference.
threat.technique	struct
threat.technique.id	array(string)	Threat technique id.
threat.technique.name	struct	Threat technique name.
threat.technique.name.text	string	Threat technique name.
threat.technique.reference	array(string)	Threat technique URL reference.
threat.technique.subtechnique	struct
threat.technique.subtechnique.id	array(string)	Threat subtechnique id.
threat.technique.subtechnique.name	struct	Threat subtechnique name.
threat.technique.subtechnique.name.text	string	Threat subtechnique name.
threat.technique.subtechnique.reference	array(string)	Threat subtechnique URL reference.

tls

Field	Type	Description
tls	struct
tls.cipher	string	String indicating the cipher used during the current connection.
tls.client	struct
tls.client.certificate	string	PEM-encoded stand-alone certificate offered by the client.
tls.client.certificate_chain	array(string)	Array of PEM-encoded certificates that make up the certificate chain offered by the client.
tls.client.hash	struct
tls.client.hash.md5	string	Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client.
tls.client.hash.sha1	string	Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client.
tls.client.hash.sha256	string	Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client.
tls.client.issuer	string	Distinguished name of subject of the issuer of the x.509 certificate presented by the client.
tls.client.ja3	string	A hash that identifies clients based on how they perform an SSL/TLS handshake.
tls.client.not_after	timestamp	Date/Time indicating when client certificate is no longer considered valid.
tls.client.not_before	timestamp	Date/Time indicating when client certificate is first considered valid.
tls.client.server_name	string	Hostname the client is trying to connect to. Also called the SNI.
tls.client.subject	string	Distinguished name of subject of the x.509 certificate presented by the client.
tls.client.supported_ciphers	array(string)	Array of ciphers offered by the client during the client hello.
tls.client.x509	struct
tls.client.x509.alternative_names	array(string)	List of subject alternative names (SAN).
tls.client.x509.issuer	struct
tls.client.x509.issuer.common_name	array(string)	List of common name (CN) of issuing certificate authority.
tls.client.x509.issuer.country	array(string)	List of country (C) codes
tls.client.x509.issuer.distinguished_name	string	Distinguished name (DN) of issuing certificate authority.
tls.client.x509.issuer.locality	array(string)	List of locality names (L)
tls.client.x509.issuer.organization	array(string)	List of organizations (O) of issuing certificate authority.
tls.client.x509.issuer.organizational_unit	array(string)	List of organizational units (OU) of issuing certificate authority.
tls.client.x509.issuer.state_or_province	array(string)	List of state or province names (ST, S, or P)
tls.client.x509.not_after	timestamp	Time at which the certificate is no longer considered valid.
tls.client.x509.not_before	timestamp	Time at which the certificate is first considered valid.
tls.client.x509.public_key_algorithm	string	Algorithm used to generate the public key.
tls.client.x509.public_key_curve	string	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
tls.client.x509.public_key_exponent	int	Exponent used to derive the public key. This is algorithm specific.
tls.client.x509.public_key_size	int	The size of the public key space in bits.
tls.client.x509.serial_number	string	Unique serial number issued by the certificate authority.
tls.client.x509.signature_algorithm	string	Identifier for certificate signature algorithm.
tls.client.x509.subject	struct
tls.client.x509.subject.common_name	array(string)	List of common names (CN) of subject.
tls.client.x509.subject.country	array(string)	List of country (C) code
tls.client.x509.subject.distinguished_name	string	Distinguished name (DN) of the certificate subject entity.
tls.client.x509.subject.locality	array(string)	List of locality names (L)
tls.client.x509.subject.organization	array(string)	List of organizations (O) of subject.
tls.client.x509.subject.organizational_unit	array(string)	List of organizational units (OU) of subject.
tls.client.x509.subject.state_or_province	array(string)	List of state or province names (ST, S, or P)
tls.client.x509.version_number	string	Version of x509 format.
tls.curve	string	String indicating the curve used for the given cipher, when applicable.
tls.established	boolean	Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel.
tls.next_protocol	string	String indicating the protocol being tunneled.
tls.resumed	boolean	Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation.
tls.server	struct
tls.server.certificate	string	PEM-encoded stand-alone certificate offered by the server.
tls.server.certificate_chain	array(string)	Array of PEM-encoded certificates that make up the certificate chain offered by the server.
tls.server.hash	struct
tls.server.hash.md5	string	Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server.
tls.server.hash.sha1	string	Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server.
tls.server.hash.sha256	string	Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server.
tls.server.issuer	string	Subject of the issuer of the x.509 certificate presented by the server.
tls.server.ja3s	string	A hash that identifies servers based on how they perform an SSL/TLS handshake.
tls.server.not_after	timestamp	Timestamp indicating when server certificate is no longer considered valid.
tls.server.not_before	timestamp	Timestamp indicating when server certificate is first considered valid.
tls.server.subject	string	Subject of the x.509 certificate presented by the server.
tls.server.x509	struct
tls.server.x509.alternative_names	array(string)	List of subject alternative names (SAN).
tls.server.x509.issuer	struct
tls.server.x509.issuer.common_name	array(string)	List of common name (CN) of issuing certificate authority.
tls.server.x509.issuer.country	array(string)	List of country (C) codes
tls.server.x509.issuer.distinguished_name	string	Distinguished name (DN) of issuing certificate authority.
tls.server.x509.issuer.locality	array(string)	List of locality names (L)
tls.server.x509.issuer.organization	array(string)	List of organizations (O) of issuing certificate authority.
tls.server.x509.issuer.organizational_unit	array(string)	List of organizational units (OU) of issuing certificate authority.
tls.server.x509.issuer.state_or_province	array(string)	List of state or province names (ST, S, or P)
tls.server.x509.not_after	timestamp	Time at which the certificate is no longer considered valid.
tls.server.x509.not_before	timestamp	Time at which the certificate is first considered valid.
tls.server.x509.public_key_algorithm	string	Algorithm used to generate the public key.
tls.server.x509.public_key_curve	string	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
tls.server.x509.public_key_exponent	int	Exponent used to derive the public key. This is algorithm specific.
tls.server.x509.public_key_size	int	The size of the public key space in bits.
tls.server.x509.serial_number	string	Unique serial number issued by the certificate authority.
tls.server.x509.signature_algorithm	string	Identifier for certificate signature algorithm.
tls.server.x509.subject	struct
tls.server.x509.subject.common_name	array(string)	List of common names (CN) of subject.
tls.server.x509.subject.country	array(string)	List of country (C) code
tls.server.x509.subject.distinguished_name	string	Distinguished name (DN) of the certificate subject entity.
tls.server.x509.subject.locality	array(string)	List of locality names (L)
tls.server.x509.subject.organization	array(string)	List of organizations (O) of subject.
tls.server.x509.subject.organizational_unit	array(string)	List of organizational units (OU) of subject.
tls.server.x509.subject.state_or_province	array(string)	List of state or province names (ST, S, or P)
tls.server.x509.version_number	string	Version of x509 format.
tls.version	string	Numeric part of the version parsed from the original string.
tls.version_protocol	string	Normalized lowercase protocol name parsed from original string.

trace

Field	Type	Description
trace	struct
trace.id	string	Unique identifier of the trace.

transaction

Field	Type	Description
transaction	struct
transaction.id	string	Unique identifier of the transaction within the scope of its trace.

url

Field	Type	Description
url	struct
url.domain	string	Domain of the url.
url.extension	string	File extension from the request url, excluding the leading dot.
url.fragment	string	Portion of the url after the #.
url.full	struct	Full unparsed URL.
url.full.text	string	Full unparsed URL.
url.original	struct	Unmodified original url as seen in the event source.
url.original.text	string	Unmodified original url as seen in the event source.
url.password	string	Password of the request.
url.path	string	Path of the request, such as "/search".
url.port	int	Port of the request, such as 443.
url.query	string	Query string of the request.
url.registered_domain	string	The highest registered url domain, stripped of the subdomain.
url.scheme	string	Scheme of the url.
url.subdomain	string	The subdomain of the domain.
url.top_level_domain	string	The effective top level domain (com, org, net, co.uk).
url.username	string	Username of the request.

user

Field	Type	Description
user	struct
user.changes	struct
user.changes.domain	string	Name of the directory the user is a member of.
user.changes.email	string	User email address.
user.changes.entity	struct
user.changes.entity.attributes	map	A set of static or semi-static attributes of the entity.
user.changes.entity.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
user.changes.entity.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
user.changes.entity.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
user.changes.entity.id	string	Unique identifier for the entity.
user.changes.entity.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
user.changes.entity.lifecycle	map	A set of temporal characteristics of the entity.
user.changes.entity.metrics	map	Field set for any fields containing numeric entity metrics.
user.changes.entity.name	struct	The name of the entity.
user.changes.entity.name.text	string	The name of the entity.
user.changes.entity.raw	map	Original, unmodified fields from the source system.
user.changes.entity.reference	string	A URI, URL, or other direct reference to access or locate the entity.
user.changes.entity.source	string	Source module or integration that provided the entity data.
user.changes.entity.sub_type	string	The specific type designation for the entity as defined by its provider or system.
user.changes.entity.type	array(string)	Standardized high-level classification of the entity.
user.changes.full_name	struct	User's full name, if available.
user.changes.full_name.text	string	User's full name, if available.
user.changes.group	struct
user.changes.group.domain	string	Name of the directory the group is a member of.
user.changes.group.id	string	Unique identifier for the group on the system/platform.
user.changes.group.name	string	Name of the group.
user.changes.hash	string	Unique user hash to correlate information for a user in anonymized form.
user.changes.id	string	Unique identifier of the user.
user.changes.name	struct	Short name or login of the user.
user.changes.name.text	string	Short name or login of the user.
user.changes.risk	struct
user.changes.risk.calculated_level	string	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
user.changes.risk.calculated_score	double	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
user.changes.risk.calculated_score_norm	double	A normalized risk score calculated by an internal system.
user.changes.risk.static_level	string	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
user.changes.risk.static_score	double	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
user.changes.risk.static_score_norm	double	A normalized risk score calculated by an external system.
user.changes.roles	array(string)	Array of user roles at the time of the event.
user.domain	string	Name of the directory the user is a member of.
user.effective	struct
user.effective.domain	string	Name of the directory the user is a member of.
user.effective.email	string	User email address.
user.effective.entity	struct
user.effective.entity.attributes	map	A set of static or semi-static attributes of the entity.
user.effective.entity.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
user.effective.entity.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
user.effective.entity.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
user.effective.entity.id	string	Unique identifier for the entity.
user.effective.entity.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
user.effective.entity.lifecycle	map	A set of temporal characteristics of the entity.
user.effective.entity.metrics	map	Field set for any fields containing numeric entity metrics.
user.effective.entity.name	struct	The name of the entity.
user.effective.entity.name.text	string	The name of the entity.
user.effective.entity.raw	map	Original, unmodified fields from the source system.
user.effective.entity.reference	string	A URI, URL, or other direct reference to access or locate the entity.
user.effective.entity.source	string	Source module or integration that provided the entity data.
user.effective.entity.sub_type	string	The specific type designation for the entity as defined by its provider or system.
user.effective.entity.type	array(string)	Standardized high-level classification of the entity.
user.effective.full_name	struct	User's full name, if available.
user.effective.full_name.text	string	User's full name, if available.
user.effective.group	struct
user.effective.group.domain	string	Name of the directory the group is a member of.
user.effective.group.id	string	Unique identifier for the group on the system/platform.
user.effective.group.name	string	Name of the group.
user.effective.hash	string	Unique user hash to correlate information for a user in anonymized form.
user.effective.id	string	Unique identifier of the user.
user.effective.name	struct	Short name or login of the user.
user.effective.name.text	string	Short name or login of the user.
user.effective.risk	struct
user.effective.risk.calculated_level	string	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
user.effective.risk.calculated_score	double	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
user.effective.risk.calculated_score_norm	double	A normalized risk score calculated by an internal system.
user.effective.risk.static_level	string	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
user.effective.risk.static_score	double	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
user.effective.risk.static_score_norm	double	A normalized risk score calculated by an external system.
user.effective.roles	array(string)	Array of user roles at the time of the event.
user.email	string	User email address.
user.entity	struct
user.entity.attributes	map	A set of static or semi-static attributes of the entity.
user.entity.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
user.entity.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
user.entity.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
user.entity.id	string	Unique identifier for the entity.
user.entity.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
user.entity.lifecycle	map	A set of temporal characteristics of the entity.
user.entity.metrics	map	Field set for any fields containing numeric entity metrics.
user.entity.name	struct	The name of the entity.
user.entity.name.text	string	The name of the entity.
user.entity.raw	map	Original, unmodified fields from the source system.
user.entity.reference	string	A URI, URL, or other direct reference to access or locate the entity.
user.entity.source	string	Source module or integration that provided the entity data.
user.entity.sub_type	string	The specific type designation for the entity as defined by its provider or system.
user.entity.type	array(string)	Standardized high-level classification of the entity.
user.full_name	struct	User's full name, if available.
user.full_name.text	string	User's full name, if available.
user.group	struct
user.group.domain	string	Name of the directory the group is a member of.
user.group.id	string	Unique identifier for the group on the system/platform.
user.group.name	string	Name of the group.
user.hash	string	Unique user hash to correlate information for a user in anonymized form.
user.id	string	Unique identifier of the user.
user.name	struct	Short name or login of the user.
user.name.text	string	Short name or login of the user.
user.risk	struct
user.risk.calculated_level	string	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
user.risk.calculated_score	double	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
user.risk.calculated_score_norm	double	A normalized risk score calculated by an internal system.
user.risk.static_level	string	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
user.risk.static_score	double	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
user.risk.static_score_norm	double	A normalized risk score calculated by an external system.
user.roles	array(string)	Array of user roles at the time of the event.
user.target	struct
user.target.domain	string	Name of the directory the user is a member of.
user.target.email	string	User email address.
user.target.entity	struct
user.target.entity.attributes	map	A set of static or semi-static attributes of the entity.
user.target.entity.behavior	map	A set of ephemeral characteristics of the entity, derived from observed behaviors during a specific time period.
user.target.entity.display_name	struct	An optional field used when a pretty name is desired for entity-centric operations.
user.target.entity.display_name.text	string	An optional field used when a pretty name is desired for entity-centric operations.
user.target.entity.id	string	Unique identifier for the entity.
user.target.entity.last_seen_timestamp	timestamp	Indicates the date/time when this entity was last "seen."
user.target.entity.lifecycle	map	A set of temporal characteristics of the entity.
user.target.entity.metrics	map	Field set for any fields containing numeric entity metrics.
user.target.entity.name	struct	The name of the entity.
user.target.entity.name.text	string	The name of the entity.
user.target.entity.raw	map	Original, unmodified fields from the source system.
user.target.entity.reference	string	A URI, URL, or other direct reference to access or locate the entity.
user.target.entity.source	string	Source module or integration that provided the entity data.
user.target.entity.sub_type	string	The specific type designation for the entity as defined by its provider or system.
user.target.entity.type	array(string)	Standardized high-level classification of the entity.
user.target.full_name	struct	User's full name, if available.
user.target.full_name.text	string	User's full name, if available.
user.target.group	struct
user.target.group.domain	string	Name of the directory the group is a member of.
user.target.group.id	string	Unique identifier for the group on the system/platform.
user.target.group.name	string	Name of the group.
user.target.hash	string	Unique user hash to correlate information for a user in anonymized form.
user.target.id	string	Unique identifier of the user.
user.target.name	struct	Short name or login of the user.
user.target.name.text	string	Short name or login of the user.
user.target.risk	struct
user.target.risk.calculated_level	string	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
user.target.risk.calculated_score	double	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
user.target.risk.calculated_score_norm	double	A normalized risk score calculated by an internal system.
user.target.risk.static_level	string	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
user.target.risk.static_score	double	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
user.target.risk.static_score_norm	double	A normalized risk score calculated by an external system.
user.target.roles	array(string)	Array of user roles at the time of the event.

user_agent

Field	Type	Description
user_agent	struct
user_agent.device	struct
user_agent.device.name	string	Name of the device.
user_agent.name	string	Name of the user agent.
user_agent.original	struct	Unparsed user_agent string.
user_agent.original.text	string	Unparsed user_agent string.
user_agent.os	struct
user_agent.os.family	string	OS family (such as redhat, debian, freebsd, windows).
user_agent.os.full	struct	Operating system name, including the version or code name.
user_agent.os.full.text	string	Operating system name, including the version or code name.
user_agent.os.kernel	string	Operating system kernel version as a raw string.
user_agent.os.name	struct	Operating system name, without the version.
user_agent.os.name.text	string	Operating system name, without the version.
user_agent.os.platform	string	Operating system platform (such centos, ubuntu, windows).
user_agent.os.type	string	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
user_agent.os.version	string	Operating system version as a raw string.
user_agent.version	string	Version of the user agent.

volume

Field	Type	Description
volume	struct
volume.bus_type	string	Bus type of the device.
volume.default_access	string	Bus type of the device.
volume.device_name	string	Device name of the volume.
volume.device_type	string	Volume device type.
volume.dos_name	string	DOS name of the device.
volume.file_system_type	string	Volume device file system type.
volume.mount_name	string	Mount name of the volume.
volume.nt_name	string	NT name of the device.
volume.product_id	string	ProductID of the device.
volume.product_name	string	Produce name of the volume.
volume.removable	boolean	Indicates if the volume is removable.
volume.serial_number	string	Serial number of the device.
volume.size	int	Size of the volume device in bytes.
volume.vendor_id	string	VendorID of the device.
volume.vendor_name	string	Vendor name of the device.
volume.writable	boolean	Indicates if the volume is writable.

vulnerability

Field	Type	Description
vulnerability	struct
vulnerability.category	array(string)	Category of a vulnerability.
vulnerability.classification	string	Classification of the vulnerability.
vulnerability.description	struct	Description of the vulnerability.
vulnerability.description.text	string	Description of the vulnerability.
vulnerability.enumeration	string	Identifier of the vulnerability.
vulnerability.id	string	ID of the vulnerability.
vulnerability.reference	string	Reference of the vulnerability.
vulnerability.report_id	string	Scan identification number.
vulnerability.scanner	struct
vulnerability.scanner.vendor	string	Name of the scanner vendor.
vulnerability.score	struct
vulnerability.score.base	double	Vulnerability Base score.
vulnerability.score.environmental	double	Vulnerability Environmental score.
vulnerability.score.temporal	double	Vulnerability Temporal score.
vulnerability.score.version	string	CVSS version.
vulnerability.severity	string	Severity of the vulnerability.

Related

• Mappers, the resource that writes these fields.
• Signal schema reference, the fields a detection query writes.
• Event normalization, why Perpetual targets ECS rather than a schema of its own.
• Enrichment, how standing facts about an entity attach to the events that name it.
• Map a source to ECS, how to author, validate, and deploy a mapper against this schema.
• Hamelin, the language that reads and writes these paths.