wazuh-indexer-plugins/ecs/stateless/cloud-services/gcp/docs/fields.csv

1	ECS_Version	Indexed	Field_Set	Field	Type	Level	Normalization	Example	Description
2	9.1.0	true	base	@timestamp	date	core		2016-05-23T08:05:34.853Z	Date/time when the event originated.
3	9.1.0	true	base	compliance	nested	custom			Array of compliance objects to support multiple frameworks per event.
4	9.1.0	true	base	message	keyword	core		Hello World	Log message optimized for viewing in a log viewer.
5	9.1.0	true	agent	agent.build.original	keyword	core		metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]	Extended build information for the agent.
6	9.1.0	true	agent	agent.ephemeral_id	keyword	extended		8a4f500f	Ephemeral identifier of this agent.
7	9.1.0	true	agent	agent.groups	keyword	custom	array	["group1", "group2"]	List of groups the agent belongs to.
8	9.1.0	true	agent	agent.host.architecture	keyword	core		x86_64	Operating system architecture.
9	9.1.0	true	agent	agent.host.boot.id	keyword	extended		88a1f0ed-5ae5-41ee-af6b-41921c311872	Linux boot uuid taken from /proc/sys/kernel/random/boot_id
10	9.1.0	true	agent	agent.host.cpu	object	custom		"name": "Intel(R) Core(TM) i7-7700HQ CPU", "cores": 4, "speed": 2800	CPU-related data.
11	9.1.0	true	agent	agent.host.cpu.cores	long	custom		4	Number of CPU cores.
12	9.1.0	true	agent	agent.host.cpu.name	keyword	custom		Intel(R) Core(TM) i7-7700HQ CPU	CPU Model name.
13	9.1.0	true	agent	agent.host.cpu.speed	long	custom		2800	CPU clock speed.
14	9.1.0	true	agent	agent.host.cpu.usage	scaled_float	extended			Percent CPU used, between 0 and 1.
15	9.1.0	true	agent	agent.host.disk.read.bytes	long	extended			The number of bytes read by all disks.
16	9.1.0	true	agent	agent.host.disk.write.bytes	long	extended			The number of bytes written on all disks.
17	9.1.0	true	agent	agent.host.domain	keyword	extended		CONTOSO	Name of the directory the group is a member of.
18	9.1.0	true	agent	agent.host.geo.city_name	keyword	core		Montreal	City name.
19	9.1.0	true	agent	agent.host.geo.continent_code	keyword	core		NA	Continent code.
20	9.1.0	true	agent	agent.host.geo.continent_name	keyword	core		North America	Name of the continent.
21	9.1.0	true	agent	agent.host.geo.country_iso_code	keyword	core		CA	Country ISO code.
22	9.1.0	true	agent	agent.host.geo.country_name	keyword	core		Canada	Country name.
23	9.1.0	true	agent	agent.host.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
24	9.1.0	true	agent	agent.host.geo.name	keyword	extended		boston-dc	User-defined description of a location.
25	9.1.0	true	agent	agent.host.geo.postal_code	keyword	core		94040	Postal code.
26	9.1.0	true	agent	agent.host.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
27	9.1.0	true	agent	agent.host.geo.region_name	keyword	core		Quebec	Region name.
28	9.1.0	true	agent	agent.host.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
29	9.1.0	true	agent	agent.host.hostname	keyword	core			Hostname of the host.
30	9.1.0	true	agent	agent.host.id	keyword	core			Unique host id.
31	9.1.0	true	agent	agent.host.ip	ip	core	array		Host ip addresses.
32	9.1.0	true	agent	agent.host.mac	keyword	core	array	["00-00-5E-00-53-23", "00-00-5E-00-53-24"]	Host MAC addresses.
33	9.1.0	true	agent	agent.host.memory	object	custom		"total": 100000, "free": 90000, "used": {"percentage": 10}	Memory-related data.
34	9.1.0	true	agent	agent.host.memory.free	long	custom		1024	Free memory in MB.
35	9.1.0	true	agent	agent.host.memory.total	long	custom		1024	Total memory in MB.
36	9.1.0	true	agent	agent.host.memory.used	object	custom		"percentage": 10	Used memory-related data.
37	9.1.0	true	agent	agent.host.memory.used.percentage	long	custom		10	Used memory percentage.
38	9.1.0	true	agent	agent.host.name	keyword	core			Name of the host.
39	9.1.0	true	agent	agent.host.network.egress.bytes	long	extended			The number of bytes sent on all network interfaces.
40	9.1.0	true	agent	agent.host.network.egress.drops	long	custom		10	Number of dropped transmitted packets.
41	9.1.0	true	agent	agent.host.network.egress.errors	long	custom		10	Number of transmission errors.
42	9.1.0	true	agent	agent.host.network.egress.packets	long	extended			The number of packets sent on all network interfaces.
43	9.1.0	true	agent	agent.host.network.egress.queue	long	custom		10	Transmit queue length.
44	9.1.0	true	agent	agent.host.network.ingress.bytes	long	extended			The number of bytes received on all network interfaces.
45	9.1.0	true	agent	agent.host.network.ingress.drops	long	custom		10	Number of dropped received packets.
46	9.1.0	true	agent	agent.host.network.ingress.errors	long	custom		10	Number of reception errors.
47	9.1.0	true	agent	agent.host.network.ingress.packets	long	extended			The number of packets received on all network interfaces.
48	9.1.0	true	agent	agent.host.network.ingress.queue	long	custom		10	Receive queue length.
49	9.1.0	true	agent	agent.host.os.family	keyword	extended		debian	OS family (such as redhat, debian, freebsd, windows).
50	9.1.0	true	agent	agent.host.os.full	keyword	extended		Mac OS Mojave	Operating system name, including the version or code name.
51	9.1.0	true	agent	agent.host.os.kernel	keyword	extended		4.4.0-112-generic	Operating system kernel version as a raw string.
52	9.1.0	true	agent	agent.host.os.name	keyword	extended		Mac OS X	Operating system name, without the version.
53	9.1.0	true	agent	agent.host.os.platform	keyword	extended		darwin	Operating system platform (such centos, ubuntu, windows).
54	9.1.0	true	agent	agent.host.os.type	keyword	extended		macos	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
55	9.1.0	true	agent	agent.host.os.version	keyword	extended		10.14.1	Operating system version as a raw string.
56	9.1.0	true	agent	agent.host.pid_ns_ino	keyword	extended		256383	Pid namespace inode
57	9.1.0	true	agent	agent.host.risk.calculated_level	keyword	extended		High	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
58	9.1.0	true	agent	agent.host.risk.calculated_score	float	extended		880.73	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
59	9.1.0	true	agent	agent.host.risk.calculated_score_norm	float	extended		88.73	A normalized risk score calculated by an internal system.
60	9.1.0	true	agent	agent.host.risk.static_level	keyword	extended		High	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
61	9.1.0	true	agent	agent.host.risk.static_score	float	extended		830.0	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
62	9.1.0	true	agent	agent.host.risk.static_score_norm	float	extended		83.0	A normalized risk score calculated by an external system.
63	9.1.0	true	agent	agent.host.type	keyword	core			Type of host.
64	9.1.0	true	agent	agent.host.uptime	long	extended		1325	Seconds the host has been up.
65	9.1.0	true	agent	agent.id	keyword	core		8a4f500d	Unique identifier of this agent.
66	9.1.0	true	agent	agent.name	keyword	core		foo	Custom name of the agent.
67	9.1.0	true	agent	agent.type	keyword	core		filebeat	Type of the agent.
68	9.1.0	true	agent	agent.version	keyword	core		6.0.0-rc2	Version of the agent.
69	9.1.0	true	check	check.compliance	keyword	custom	array	["cis:1.1.1","cis_csc:5.2"]	CIS compliance standard.
70	9.1.0	true	check	check.condition	keyword	custom		all	Relationship between the rules.
71	9.1.0	true	check	check.description	keyword	custom		"The password history setting determines the number of unique new passwords a user must use before an old password can be reused."	Extended description of the check.
72	9.1.0	true	check	check.id	keyword	custom		26000	The ID of the SCA policy check.
73	9.1.0	true	check	check.name	keyword	custom		Ensure 'Enforce password history' is set to '24 or more password(s)'.	The name of the SCA policy check.
74	9.1.0	true	check	check.rationale	keyword	custom		"The longer a user uses the same password, the more likely it is that the password will be compromised."	The reason for the check. Why it is important.
75	9.1.0	true	check	check.reason	keyword	custom		"The password history setting is not set to 24 or more password(s)."	Reason for the check result.
76	9.1.0	true	check	check.references	keyword	custom	array	["https://workbench.cisecurity.org"]	References for the check.
77	9.1.0	true	check	check.remediation	keyword	custom		"To establish the recommended configuration, set the following registry value to 24 or more password(s):"	Actions to take to remediate the check.
78	9.1.0	true	check	check.result	keyword	custom		failed	Result of the check.
79	9.1.0	true	check	check.rules	keyword	custom	array	"[\"c:net.exe accounts -> n:Maximum password age \(days\):\s+(\d+) compare > 0\"," > "\"c:net.exe accounts -> n:Length of password history maintained:\s+(\d+) compare >= 24\"]"	Rules to be evaluated.
80	9.1.0	true	client	client.address	keyword	extended			Client network address.
81	9.1.0	true	client	client.as.number	long	extended		15169	Unique number allocated to the autonomous system.
82	9.1.0	true	client	client.as.organization.name	keyword	extended		Google LLC	Organization name.
83	9.1.0	true	client	client.bytes	long	core		184	Bytes sent from the client to the server.
84	9.1.0	true	client	client.domain	keyword	core		foo.example.com	The domain name of the client.
85	9.1.0	true	client	client.geo.city_name	keyword	core		Montreal	City name.
86	9.1.0	true	client	client.geo.continent_code	keyword	core		NA	Continent code.
87	9.1.0	true	client	client.geo.continent_name	keyword	core		North America	Name of the continent.
88	9.1.0	true	client	client.geo.country_iso_code	keyword	core		CA	Country ISO code.
89	9.1.0	true	client	client.geo.country_name	keyword	core		Canada	Country name.
90	9.1.0	true	client	client.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
91	9.1.0	true	client	client.geo.name	keyword	extended		boston-dc	User-defined description of a location.
92	9.1.0	true	client	client.geo.postal_code	keyword	core		94040	Postal code.
93	9.1.0	true	client	client.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
94	9.1.0	true	client	client.geo.region_name	keyword	core		Quebec	Region name.
95	9.1.0	true	client	client.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
96	9.1.0	true	client	client.ip	ip	core			IP address of the client.
97	9.1.0	true	client	client.mac	keyword	core		00-00-5E-00-53-23	MAC address of the client.
98	9.1.0	true	client	client.nat.ip	ip	extended			Client NAT ip address
99	9.1.0	true	client	client.nat.port	long	extended			Client NAT port
100	9.1.0	true	client	client.packets	long	core		12	Packets sent from the client to the server.
101	9.1.0	true	client	client.port	long	core			Port of the client.
102	9.1.0	true	client	client.registered_domain	keyword	extended		example.com	The highest registered client domain, stripped of the subdomain.
103	9.1.0	true	client	client.subdomain	keyword	extended		east	The subdomain of the domain.
104	9.1.0	true	client	client.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
105	9.1.0	true	client	client.user.domain	keyword	extended			Name of the directory the user is a member of.
106	9.1.0	true	client	client.user.email	keyword	extended			User email address.
107	9.1.0	true	client	client.user.full_name	keyword	extended		Albert Einstein	User's full name, if available.
108	9.1.0	true	client	client.user.group.domain	keyword	extended			Name of the directory the group is a member of.
109	9.1.0	true	client	client.user.group.id	keyword	extended			Unique identifier for the group on the system/platform.
110	9.1.0	true	client	client.user.group.name	keyword	extended			Name of the group.
111	9.1.0	true	client	client.user.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
112	9.1.0	true	client	client.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
113	9.1.0	true	client	client.user.name	keyword	core		a.einstein	Short name or login of the user.
114	9.1.0	true	client	client.user.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
115	9.1.0	true	cloud	cloud.account.id	keyword	extended		666777888999	The cloud account or organization id.
116	9.1.0	true	cloud	cloud.account.name	keyword	extended		elastic-dev	The cloud account name.
117	9.1.0	true	cloud	cloud.availability_zone	keyword	extended		us-east-1c	Availability zone in which this host, resource, or service is located.
118	9.1.0	true	cloud	cloud.instance.id	keyword	extended		i-1234567890abcdef0	Instance ID of the host machine.
119	9.1.0	true	cloud	cloud.instance.name	keyword	extended			Instance name of the host machine.
120	9.1.0	true	cloud	cloud.machine.type	keyword	extended		t2.medium	Machine type of the host machine.
121	9.1.0	true	cloud	cloud.origin.account.id	keyword	extended		666777888999	The cloud account or organization id.
122	9.1.0	true	cloud	cloud.origin.account.name	keyword	extended		elastic-dev	The cloud account name.
123	9.1.0	true	cloud	cloud.origin.availability_zone	keyword	extended		us-east-1c	Availability zone in which this host, resource, or service is located.
124	9.1.0	true	cloud	cloud.origin.instance.id	keyword	extended		i-1234567890abcdef0	Instance ID of the host machine.
125	9.1.0	true	cloud	cloud.origin.instance.name	keyword	extended			Instance name of the host machine.
126	9.1.0	true	cloud	cloud.origin.machine.type	keyword	extended		t2.medium	Machine type of the host machine.
127	9.1.0	true	cloud	cloud.origin.project.id	keyword	extended		my-project	The cloud project id.
128	9.1.0	true	cloud	cloud.origin.project.name	keyword	extended		my project	The cloud project name.
129	9.1.0	true	cloud	cloud.origin.provider	keyword	extended		aws	Name of the cloud provider.
130	9.1.0	true	cloud	cloud.origin.region	keyword	extended		us-east-1	Region in which this host, resource, or service is located.
131	9.1.0	true	cloud	cloud.origin.service.name	keyword	extended		lambda	The cloud service name.
132	9.1.0	true	cloud	cloud.project.id	keyword	extended		my-project	The cloud project id.
133	9.1.0	true	cloud	cloud.project.name	keyword	extended		my project	The cloud project name.
134	9.1.0	true	cloud	cloud.provider	keyword	extended		aws	Name of the cloud provider.
135	9.1.0	true	cloud	cloud.region	keyword	extended		us-east-1	Region in which this host, resource, or service is located.
136	9.1.0	true	cloud	cloud.service.name	keyword	extended		lambda	The cloud service name.
137	9.1.0	true	cloud	cloud.target.account.id	keyword	extended		666777888999	The cloud account or organization id.
138	9.1.0	true	cloud	cloud.target.account.name	keyword	extended		elastic-dev	The cloud account name.
139	9.1.0	true	cloud	cloud.target.availability_zone	keyword	extended		us-east-1c	Availability zone in which this host, resource, or service is located.
140	9.1.0	true	cloud	cloud.target.instance.id	keyword	extended		i-1234567890abcdef0	Instance ID of the host machine.
141	9.1.0	true	cloud	cloud.target.instance.name	keyword	extended			Instance name of the host machine.
142	9.1.0	true	cloud	cloud.target.machine.type	keyword	extended		t2.medium	Machine type of the host machine.
143	9.1.0	true	cloud	cloud.target.project.id	keyword	extended		my-project	The cloud project id.
144	9.1.0	true	cloud	cloud.target.project.name	keyword	extended		my project	The cloud project name.
145	9.1.0	true	cloud	cloud.target.provider	keyword	extended		aws	Name of the cloud provider.
146	9.1.0	true	cloud	cloud.target.region	keyword	extended		us-east-1	Region in which this host, resource, or service is located.
147	9.1.0	true	cloud	cloud.target.service.name	keyword	extended		lambda	The cloud service name.
148	9.1.0	true	compliance	compliance.category	keyword	custom		payment-security	Framework category (payment-security, data-protection, etc.).
149	9.1.0	true	compliance	compliance.name	keyword	custom		PCI DSS	Framework name (PCI DSS, GDPR, NIST 800-53, etc.).
150	9.1.0	true	compliance	compliance.publisher	keyword	custom		PCI Security Standards Council	Organization that published the framework.
151	9.1.0	true	compliance	compliance.requirement.description	match_only_text	custom		The organization must rotate encryption keys every 90 days.	Full requirement description.
152	9.1.0	true	compliance	compliance.requirement.id	keyword	custom		11.5	Requirement identifier (11.5, Article 32, AC-3, etc.).
153	9.1.0	true	compliance	compliance.requirement.title	match_only_text	custom		Rotate cryptographic keys	Human-readable requirement title.
154	9.1.0	true	compliance	compliance.version	keyword	custom		3.2	Framework version (4.0, 2018, 5.1, etc.).
155	9.1.0	true	container	container.cpu.usage	scaled_float	extended			Percent CPU used, between 0 and 1.
156	9.1.0	true	container	container.disk.read.bytes	long	extended			The number of bytes read by all disks.
157	9.1.0	true	container	container.disk.write.bytes	long	extended			The number of bytes written on all disks.
158	9.1.0	true	container	container.id	keyword	core			Unique container id.
159	9.1.0	true	container	container.image.hash.all	keyword	extended	array	[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]	An array of digests of the image the container was built on.
160	9.1.0	true	container	container.image.name	keyword	extended			Name of the image the container was built on.
161	9.1.0	true	container	container.image.tag	keyword	extended	array		Container image tags.
162	9.1.0	true	container	container.labels	object	extended			Image labels.
163	9.1.0	true	container	container.memory.usage	scaled_float	extended			Percent memory used, between 0 and 1.
164	9.1.0	true	container	container.name	keyword	extended			Container name.
165	9.1.0	true	container	container.network.egress.bytes	long	extended			The number of bytes sent on all network interfaces.
166	9.1.0	true	container	container.network.ingress.bytes	long	extended			The number of bytes received on all network interfaces.
167	9.1.0	true	container	container.runtime	keyword	extended		docker	Runtime managing this container.
168	9.1.0	true	container	container.security_context.privileged	boolean	extended			Indicates whether the container is running in privileged mode.
169	9.1.0	true	data_stream	data_stream.dataset	keyword	extended		nginx.access	The field can contain anything that makes sense to signify the source of the data.
170	9.1.0	true	data_stream	data_stream.namespace	keyword	extended		production	A user defined namespace. Namespaces are useful to allow grouping of data.
171	9.1.0	true	data_stream	data_stream.type	keyword	extended		logs	An overarching type for the data stream.
172	9.1.0	true	destination	destination.address	keyword	extended			Destination network address.
173	9.1.0	true	destination	destination.as.number	long	extended		15169	Unique number allocated to the autonomous system.
174	9.1.0	true	destination	destination.as.organization.name	keyword	extended		Google LLC	Organization name.
175	9.1.0	true	destination	destination.bytes	long	core		184	Bytes sent from the destination to the source.
176	9.1.0	true	destination	destination.domain	keyword	core		foo.example.com	The domain name of the destination.
177	9.1.0	true	destination	destination.geo.city_name	keyword	core		Montreal	City name.
178	9.1.0	true	destination	destination.geo.continent_code	keyword	core		NA	Continent code.
179	9.1.0	true	destination	destination.geo.continent_name	keyword	core		North America	Name of the continent.
180	9.1.0	true	destination	destination.geo.country_iso_code	keyword	core		CA	Country ISO code.
181	9.1.0	true	destination	destination.geo.country_name	keyword	core		Canada	Country name.
182	9.1.0	true	destination	destination.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
183	9.1.0	true	destination	destination.geo.name	keyword	extended		boston-dc	User-defined description of a location.
184	9.1.0	true	destination	destination.geo.postal_code	keyword	core		94040	Postal code.
185	9.1.0	true	destination	destination.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
186	9.1.0	true	destination	destination.geo.region_name	keyword	core		Quebec	Region name.
187	9.1.0	true	destination	destination.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
188	9.1.0	true	destination	destination.ip	ip	core			IP address of the destination.
189	9.1.0	true	destination	destination.mac	keyword	core		00-00-5E-00-53-23	MAC address of the destination.
190	9.1.0	true	destination	destination.nat.ip	ip	extended			Destination NAT ip
191	9.1.0	true	destination	destination.nat.port	long	extended			Destination NAT Port
192	9.1.0	true	destination	destination.packets	long	core		12	Packets sent from the destination to the source.
193	9.1.0	true	destination	destination.port	long	core			Port of the destination.
194	9.1.0	true	destination	destination.registered_domain	keyword	extended		example.com	The highest registered destination domain, stripped of the subdomain.
195	9.1.0	true	destination	destination.subdomain	keyword	extended		east	The subdomain of the domain.
196	9.1.0	true	destination	destination.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
197	9.1.0	true	destination	destination.user.domain	keyword	extended			Name of the directory the user is a member of.
198	9.1.0	true	destination	destination.user.email	keyword	extended			User email address.
199	9.1.0	true	destination	destination.user.full_name	keyword	extended		Albert Einstein	User's full name, if available.
200	9.1.0	true	destination	destination.user.group.domain	keyword	extended			Name of the directory the group is a member of.
201	9.1.0	true	destination	destination.user.group.id	keyword	extended			Unique identifier for the group on the system/platform.
202	9.1.0	true	destination	destination.user.group.name	keyword	extended			Name of the group.
203	9.1.0	true	destination	destination.user.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
204	9.1.0	true	destination	destination.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
205	9.1.0	true	destination	destination.user.name	keyword	core		a.einstein	Short name or login of the user.
206	9.1.0	true	destination	destination.user.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
207	9.1.0	true	device	device.id	keyword	extended		00000000-54b3-e7c7-0000-000046bffd97	The unique identifier of a device.
208	9.1.0	true	device	device.manufacturer	keyword	extended		Samsung	The vendor name of the device manufacturer.
209	9.1.0	true	device	device.model.identifier	keyword	extended		SM-G920F	The machine readable identifier of the device model.
210	9.1.0	true	device	device.model.name	keyword	extended		Samsung Galaxy S6	The human readable marketing name of the device model.
211	9.1.0	true	device	device.serial_number	keyword	core		DJGAQS4CW5	Serial Number of the device
212	9.1.0	true	dll	dll.code_signature.digest_algorithm	keyword	extended		sha256	Hashing algorithm used to sign the process.
213	9.1.0	true	dll	dll.code_signature.exists	boolean	core		true	Boolean to capture if a signature is present.
214	9.1.0	true	dll	dll.code_signature.flags	keyword	extended		570522385	Code signing flags of the process
215	9.1.0	true	dll	dll.code_signature.signing_id	keyword	extended		com.apple.xpc.proxy	The identifier used to sign the process.
216	9.1.0	true	dll	dll.code_signature.status	keyword	extended		ERROR_UNTRUSTED_ROOT	Additional information about the certificate status.
217	9.1.0	true	dll	dll.code_signature.subject_name	keyword	core		Microsoft Corporation	Subject name of the code signer
218	9.1.0	true	dll	dll.code_signature.team_id	keyword	extended		EQHXZ8M8AV	The team identifier used to sign the process.
219	9.1.0	true	dll	dll.code_signature.thumbprint_sha256	keyword	extended		c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b	SHA256 hash of the certificate.
220	9.1.0	true	dll	dll.code_signature.timestamp	date	extended		2021-01-01T12:10:30Z	When the signature was generated and signed.
221	9.1.0	true	dll	dll.code_signature.trusted	boolean	extended		true	Stores the trust status of the certificate chain.
222	9.1.0	true	dll	dll.code_signature.valid	boolean	extended		true	Boolean to capture if the digital signature is verified against the binary content.
223	9.1.0	true	dll	dll.hash.cdhash	keyword	extended		3783b4052fd474dbe30676b45c329e7a6d44acd9	The Code Directory (CD) hash of an executable.
224	9.1.0	true	dll	dll.hash.md5	keyword	extended			MD5 hash.
225	9.1.0	true	dll	dll.hash.sha1	keyword	extended			SHA1 hash.
226	9.1.0	true	dll	dll.hash.sha256	keyword	extended			SHA256 hash.
227	9.1.0	true	dll	dll.hash.sha384	keyword	extended			SHA384 hash.
228	9.1.0	true	dll	dll.hash.sha512	keyword	extended			SHA512 hash.
229	9.1.0	true	dll	dll.hash.ssdeep	keyword	extended			SSDEEP hash.
230	9.1.0	true	dll	dll.hash.tlsh	keyword	extended			TLSH hash.
231	9.1.0	true	dll	dll.name	keyword	core		kernel32.dll	Name of the library.
232	9.1.0	true	dll	dll.origin_referrer_url	keyword	extended		http://example.com/article1.html	The URL of the webpage that linked to the dll file.
233	9.1.0	true	dll	dll.origin_url	keyword	extended		http://example.com/files/example.dll	The URL where the dll file is hosted.
234	9.1.0	true	dll	dll.path	keyword	extended		C:\Windows\System32\kernel32.dll	Full file path of the library.
235	9.1.0	true	dll	dll.pe.architecture	keyword	extended		x64	CPU architecture target for the file.
236	9.1.0	true	dll	dll.pe.company	keyword	extended		Microsoft Corporation	Internal company name of the file, provided at compile-time.
237	9.1.0	true	dll	dll.pe.description	keyword	extended		Paint	Internal description of the file, provided at compile-time.
238	9.1.0	true	dll	dll.pe.file_version	keyword	extended		6.3.9600.17415	Process name.
239	9.1.0	true	dll	dll.pe.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a PE file.
240	9.1.0	true	dll	dll.pe.go_imports	flat_object	extended			List of imported Go language element names and types.
241	9.1.0	true	dll	dll.pe.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
242	9.1.0	true	dll	dll.pe.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
243	9.1.0	true	dll	dll.pe.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
244	9.1.0	true	dll	dll.pe.imphash	keyword	extended		0c6803c4e922103c4dca5963aad36ddf	A hash of the imports in a PE file.
245	9.1.0	true	dll	dll.pe.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a PE file.
246	9.1.0	true	dll	dll.pe.imports	flat_object	extended	array		List of imported element names and types.
247	9.1.0	true	dll	dll.pe.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
248	9.1.0	true	dll	dll.pe.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
249	9.1.0	true	dll	dll.pe.original_file_name	keyword	extended		MSPAINT.EXE	Internal name of the file, provided at compile-time.
250	9.1.0	true	dll	dll.pe.pehash	keyword	extended		73ff189b63cd6be375a7ff25179a38d347651975	A hash of the PE header and data from one or more PE sections.
251	9.1.0	true	dll	dll.pe.product	keyword	extended		Microsoft® Windows® Operating System	Internal product name of the file, provided at compile-time.
252	9.1.0	true	dll	dll.pe.sections	nested	extended	array		Section information of the PE file.
253	9.1.0	true	dll	dll.pe.sections.entropy	long	extended			Shannon entropy calculation from the section.
254	9.1.0	true	dll	dll.pe.sections.name	keyword	extended			PE Section List name.
255	9.1.0	true	dll	dll.pe.sections.physical_size	long	extended			PE Section List physical size.
256	9.1.0	true	dll	dll.pe.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
257	9.1.0	true	dll	dll.pe.sections.virtual_size	long	extended			PE Section List virtual size. This is always the same as `physical_size`.
258	9.1.0	true	dns	dns.answers	object	extended	array		Array of DNS answers.
259	9.1.0	true	dns	dns.answers.class	keyword	extended		IN	The class of DNS data contained in this resource record.
260	9.1.0	true	dns	dns.answers.data	keyword	extended		10.10.10.10	The data describing the resource.
261	9.1.0	true	dns	dns.answers.name	keyword	extended		www.example.com	The domain name to which this resource record pertains.
262	9.1.0	true	dns	dns.answers.ttl	long	extended		180	The time interval in seconds that this resource record may be cached before it should be discarded.
263	9.1.0	true	dns	dns.answers.type	keyword	extended		CNAME	The type of data contained in this resource record.
264	9.1.0	true	dns	dns.header_flags	keyword	extended	array	["RD", "RA"]	Array of DNS header flags.
265	9.1.0	true	dns	dns.id	keyword	extended		62111	The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.
266	9.1.0	true	dns	dns.op_code	keyword	extended		QUERY	The DNS operation code that specifies the kind of query in the message.
267	9.1.0	true	dns	dns.question.class	keyword	extended		IN	The class of records being queried.
268	9.1.0	true	dns	dns.question.name	keyword	extended		www.example.com	The name being queried.
269	9.1.0	true	dns	dns.question.registered_domain	keyword	extended		example.com	The highest registered domain, stripped of the subdomain.
270	9.1.0	true	dns	dns.question.subdomain	keyword	extended		www	The subdomain of the domain.
271	9.1.0	true	dns	dns.question.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
272	9.1.0	true	dns	dns.question.type	keyword	extended		AAAA	The type of record being queried.
273	9.1.0	true	dns	dns.resolved_ip	ip	extended	array	["10.10.10.10", "10.10.10.11"]	Array containing all IPs seen in answers.data
274	9.1.0	true	dns	dns.response_code	keyword	extended		NOERROR	The DNS response code.
275	9.1.0	true	dns	dns.type	keyword	extended		answer	The type of DNS event captured, query or answer.
276	9.1.0	true	email	email.attachments	nested	extended	array		List of objects describing the attachments.
277	9.1.0	true	email	email.attachments.file.extension	keyword	extended		txt	Attachment file extension.
278	9.1.0	true	email	email.attachments.file.hash.cdhash	keyword	extended		3783b4052fd474dbe30676b45c329e7a6d44acd9	The Code Directory (CD) hash of an executable.
279	9.1.0	true	email	email.attachments.file.hash.md5	keyword	extended			MD5 hash.
280	9.1.0	true	email	email.attachments.file.hash.sha1	keyword	extended			SHA1 hash.
281	9.1.0	true	email	email.attachments.file.hash.sha256	keyword	extended			SHA256 hash.
282	9.1.0	true	email	email.attachments.file.hash.sha384	keyword	extended			SHA384 hash.
283	9.1.0	true	email	email.attachments.file.hash.sha512	keyword	extended			SHA512 hash.
284	9.1.0	true	email	email.attachments.file.hash.ssdeep	keyword	extended			SSDEEP hash.
285	9.1.0	true	email	email.attachments.file.hash.tlsh	keyword	extended			TLSH hash.
286	9.1.0	true	email	email.attachments.file.mime_type	keyword	extended		text/plain	MIME type of the attachment file.
287	9.1.0	true	email	email.attachments.file.name	keyword	extended		attachment.txt	Name of the attachment file.
288	9.1.0	true	email	email.attachments.file.size	long	extended		64329	Attachment file size.
289	9.1.0	true	email	email.bcc.address	keyword	extended	array	bcc.user1@example.com	Email address of BCC recipient
290	9.1.0	true	email	email.cc.address	keyword	extended	array	cc.user1@example.com	Email address of CC recipient
291	9.1.0	true	email	email.content_type	keyword	extended		text/plain	MIME type of the email message.
292	9.1.0	true	email	email.delivery_timestamp	date	extended		2020-11-10T22:12:34.8196921Z	Date and time when message was delivered.
293	9.1.0	true	email	email.direction	keyword	extended		inbound	Direction of the message.
294	9.1.0	true	email	email.from.address	keyword	extended	array	sender@example.com	The sender's email address.
295	9.1.0	true	email	email.local_id	keyword	extended		c26dbea0-80d5-463b-b93c-4e8b708219ce	Unique identifier given by the source.
296	9.1.0	true	email	email.message_id	keyword	extended		81ce15$8r2j59@mail01.example.com	Value from the Message-ID header.
297	9.1.0	true	email	email.origination_timestamp	date	extended		2020-11-10T22:12:34.8196921Z	Date and time the email was composed.
298	9.1.0	true	email	email.reply_to.address	keyword	extended	array	reply.here@example.com	Address replies should be delivered to.
299	9.1.0	true	email	email.sender.address	keyword	extended			Address of the message sender.
300	9.1.0	true	email	email.subject	keyword	extended		Please see this important message.	The subject of the email message.
301	9.1.0	true	email	email.to.address	keyword	extended	array	user1@example.com	Email address of recipient
302	9.1.0	true	email	email.x_mailer	keyword	extended		Spambot v2.5	Application that drafted email.
303	9.1.0	true	error	error.code	keyword	core			Error code describing the error.
304	9.1.0	true	error	error.id	keyword	core			Unique identifier for the error.
305	9.1.0	true	error	error.message	keyword	core			Error message.
306	9.1.0	true	error	error.stack_trace	keyword	extended			The stack trace of this error in plain text.
307	9.1.0	true	error	error.type	keyword	extended		java.lang.NullPointerException	The type of the error, for example the class name of the exception.
308	9.1.0	true	event	event.action	keyword	core		user-password-change	The action captured by the event.
309	9.1.0	true	event	event.agent_id_status	keyword	extended		verified	Validation status of the event's agent.id field.
310	9.1.0	true	event	event.category	keyword	core	array	authentication	Event category. The second categorization field in the hierarchy.
311	9.1.0	true	event	event.changed_fields	keyword	custom	array	["foo", "bar"]	Fields that were updated since last scan.
312	9.1.0	true	event	event.code	keyword	extended		4648	Identification code for this event.
313	9.1.0	true	event	event.collector	keyword	custom		file	Collector used to retrieve the event.
314	9.1.0	true	event	event.created	date	core		2016-05-23T08:05:34.857Z	Time when the event was first read by an agent or by your pipeline.
315	9.1.0	true	event	event.dataset	keyword	core		apache.access	Name of the dataset.
316	9.1.0	true	event	event.duration	long	core			Duration of the event in nanoseconds.
317	9.1.0	true	event	event.end	date	extended			`event.end` contains the date when the event ended or when the activity was last observed.
318	9.1.0	true	event	event.hash	keyword	extended		123456789012345678901234567890ABCD	Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.
319	9.1.0	true	event	event.id	keyword	core		8a4f500d	Unique ID to describe the event.
320	9.1.0	true	event	event.ingested	date	core		2016-05-23T08:05:35.101Z	Timestamp when an event arrived in the central data store.
321	9.1.0	true	event	event.kind	keyword	core		alert	The kind of the event. The highest categorization field in the hierarchy.
322	9.1.0	true	event	event.module	keyword	core		apache	Name of the module this data is coming from.
323	9.1.0	false	event	event.original	keyword	core		Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232	Raw text message of entire event.
324	9.1.0	true	event	event.outcome	keyword	core		success	The outcome of the event. The lowest level categorization field in the hierarchy.
325	9.1.0	true	event	event.provider	keyword	extended		kernel	Source of the event.
326	9.1.0	true	event	event.reason	keyword	extended		Terminated an unexpected process	Reason why this event happened, according to the source
327	9.1.0	true	event	event.reference	keyword	extended		https://system.example.com/event/#0001234	Event reference URL
328	9.1.0	true	event	event.risk_score	float	core			Risk score or priority of the event (e.g. security solutions). Use your system's original value here.
329	9.1.0	true	event	event.risk_score_norm	float	extended			Normalized risk score or priority of the event (0-100).
330	9.1.0	true	event	event.sequence	long	extended			Sequence number of the event.
331	9.1.0	true	event	event.severity	long	core		7	Numeric severity of the event.
332	9.1.0	true	event	event.start	date	extended			`event.start` contains the date when the event started or when the activity was first observed.
333	9.1.0	true	event	event.timezone	keyword	extended			Event time zone.
334	9.1.0	true	event	event.type	keyword	core	array		Event type. The third categorization field in the hierarchy.
335	9.1.0	true	event	event.url	keyword	extended		https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe	Event investigation URL
336	9.1.0	true	faas	faas.coldstart	boolean	extended			Boolean value indicating a cold start of a function.
337	9.1.0	true	faas	faas.execution	keyword	extended		af9d5aa4-a685-4c5f-a22b-444f80b3cc28	The execution ID of the current function execution.
338	9.1.0	true	faas	faas.id	keyword	extended		arn:aws:lambda:us-west-2:123456789012:function:my-function	The unique identifier of a serverless function.
339	9.1.0	true	faas	faas.name	keyword	extended		my-function	The name of a serverless function.
340	9.1.0	true	faas	faas.trigger.request_id	keyword	extended		123456789	The ID of the trigger request , message, event, etc.
341	9.1.0	true	faas	faas.trigger.type	keyword	extended		http	The trigger for the function execution.
342	9.1.0	true	faas	faas.version	keyword	extended		123	The version of a serverless function.
343	9.1.0	true	file	file.accessed	date	extended			Last time the file was accessed.
344	9.1.0	true	file	file.attributes	keyword	extended	array	["readonly", "system"]	Array of file attributes.
345	9.1.0	true	file	file.code_signature.digest_algorithm	keyword	extended		sha256	Hashing algorithm used to sign the process.
346	9.1.0	true	file	file.code_signature.exists	boolean	core		true	Boolean to capture if a signature is present.
347	9.1.0	true	file	file.code_signature.flags	keyword	extended		570522385	Code signing flags of the process
348	9.1.0	true	file	file.code_signature.signing_id	keyword	extended		com.apple.xpc.proxy	The identifier used to sign the process.
349	9.1.0	true	file	file.code_signature.status	keyword	extended		ERROR_UNTRUSTED_ROOT	Additional information about the certificate status.
350	9.1.0	true	file	file.code_signature.subject_name	keyword	core		Microsoft Corporation	Subject name of the code signer
351	9.1.0	true	file	file.code_signature.team_id	keyword	extended		EQHXZ8M8AV	The team identifier used to sign the process.
352	9.1.0	true	file	file.code_signature.thumbprint_sha256	keyword	extended		c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b	SHA256 hash of the certificate.
353	9.1.0	true	file	file.code_signature.timestamp	date	extended		2021-01-01T12:10:30Z	When the signature was generated and signed.
354	9.1.0	true	file	file.code_signature.trusted	boolean	extended		true	Stores the trust status of the certificate chain.
355	9.1.0	true	file	file.code_signature.valid	boolean	extended		true	Boolean to capture if the digital signature is verified against the binary content.
356	9.1.0	true	file	file.created	date	extended			File creation time.
357	9.1.0	true	file	file.ctime	date	extended			Last time the file attributes or metadata changed.
358	9.1.0	true	file	file.device	keyword	extended		sda	Device that is the source of the file.
359	9.1.0	true	file	file.directory	keyword	extended		/home/alice	Directory where the file is located.
360	9.1.0	true	file	file.drive_letter	keyword	extended		C	Drive letter where the file is located.
361	9.1.0	true	file	file.elf.architecture	keyword	extended		x86-64	Machine architecture of the ELF file.
362	9.1.0	true	file	file.elf.byte_order	keyword	extended		Little Endian	Byte sequence of ELF file.
363	9.1.0	true	file	file.elf.cpu_type	keyword	extended		Intel	CPU type of the ELF file.
364	9.1.0	true	file	file.elf.creation_date	date	extended			Build or compile date.
365	9.1.0	true	file	file.elf.exports	flat_object	extended	array		List of exported element names and types.
366	9.1.0	true	file	file.elf.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in an ELF file.
367	9.1.0	true	file	file.elf.go_imports	flat_object	extended			List of imported Go language element names and types.
368	9.1.0	true	file	file.elf.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
369	9.1.0	true	file	file.elf.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
370	9.1.0	true	file	file.elf.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
371	9.1.0	true	file	file.elf.header.abi_version	keyword	extended			Version of the ELF Application Binary Interface (ABI).
372	9.1.0	true	file	file.elf.header.class	keyword	extended			Header class of the ELF file.
373	9.1.0	true	file	file.elf.header.data	keyword	extended			Data table of the ELF header.
374	9.1.0	true	file	file.elf.header.entrypoint	long	extended			Header entrypoint of the ELF file.
375	9.1.0	true	file	file.elf.header.object_version	keyword	extended			"0x1" for original ELF files.
376	9.1.0	true	file	file.elf.header.os_abi	keyword	extended			Application Binary Interface (ABI) of the Linux OS.
377	9.1.0	true	file	file.elf.header.type	keyword	extended			Header type of the ELF file.
378	9.1.0	true	file	file.elf.header.version	keyword	extended			Version of the ELF header.
379	9.1.0	true	file	file.elf.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in an ELF file.
380	9.1.0	true	file	file.elf.imports	flat_object	extended	array		List of imported element names and types.
381	9.1.0	true	file	file.elf.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
382	9.1.0	true	file	file.elf.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
383	9.1.0	true	file	file.elf.sections	nested	extended	array		Section information of the ELF file.
384	9.1.0	true	file	file.elf.sections.chi2	long	extended			Chi-square probability distribution of the section.
385	9.1.0	true	file	file.elf.sections.entropy	long	extended			Shannon entropy calculation from the section.
386	9.1.0	true	file	file.elf.sections.flags	keyword	extended			ELF Section List flags.
387	9.1.0	true	file	file.elf.sections.name	keyword	extended			ELF Section List name.
388	9.1.0	true	file	file.elf.sections.physical_offset	keyword	extended			ELF Section List offset.
389	9.1.0	true	file	file.elf.sections.physical_size	long	extended			ELF Section List physical size.
390	9.1.0	true	file	file.elf.sections.type	keyword	extended			ELF Section List type.
391	9.1.0	true	file	file.elf.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
392	9.1.0	true	file	file.elf.sections.virtual_address	long	extended			ELF Section List virtual address.
393	9.1.0	true	file	file.elf.sections.virtual_size	long	extended			ELF Section List virtual size.
394	9.1.0	true	file	file.elf.segments	nested	extended	array		ELF object segment list.
395	9.1.0	true	file	file.elf.segments.sections	keyword	extended			ELF object segment sections.
396	9.1.0	true	file	file.elf.segments.type	keyword	extended			ELF object segment type.
397	9.1.0	true	file	file.elf.shared_libraries	keyword	extended	array		List of shared libraries used by this ELF object.
398	9.1.0	true	file	file.elf.telfhash	keyword	extended			telfhash hash for ELF file.
399	9.1.0	true	file	file.extension	keyword	extended		png	File extension, excluding the leading dot.
400	9.1.0	true	file	file.fork_name	keyword	extended		Zone.Identifer	A fork is additional data associated with a filesystem object.
401	9.1.0	true	file	file.gid	keyword	extended		1001	Primary group ID (GID) of the file.
402	9.1.0	true	file	file.group	keyword	extended		alice	Primary group name of the file.
403	9.1.0	true	file	file.hash.cdhash	keyword	extended		3783b4052fd474dbe30676b45c329e7a6d44acd9	The Code Directory (CD) hash of an executable.
404	9.1.0	true	file	file.hash.md5	keyword	extended			MD5 hash.
405	9.1.0	true	file	file.hash.sha1	keyword	extended			SHA1 hash.
406	9.1.0	true	file	file.hash.sha256	keyword	extended			SHA256 hash.
407	9.1.0	true	file	file.hash.sha384	keyword	extended			SHA384 hash.
408	9.1.0	true	file	file.hash.sha512	keyword	extended			SHA512 hash.
409	9.1.0	true	file	file.hash.ssdeep	keyword	extended			SSDEEP hash.
410	9.1.0	true	file	file.hash.tlsh	keyword	extended			TLSH hash.
411	9.1.0	true	file	file.inode	keyword	extended		256383	Inode representing the file in the filesystem.
412	9.1.0	true	file	file.macho.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a Mach-O file.
413	9.1.0	true	file	file.macho.go_imports	flat_object	extended			List of imported Go language element names and types.
414	9.1.0	true	file	file.macho.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
415	9.1.0	true	file	file.macho.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
416	9.1.0	true	file	file.macho.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
417	9.1.0	true	file	file.macho.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a Mach-O file.
418	9.1.0	true	file	file.macho.imports	flat_object	extended	array		List of imported element names and types.
419	9.1.0	true	file	file.macho.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
420	9.1.0	true	file	file.macho.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
421	9.1.0	true	file	file.macho.sections	nested	extended	array		Section information of the Mach-O file.
422	9.1.0	true	file	file.macho.sections.entropy	long	extended			Shannon entropy calculation from the section.
423	9.1.0	true	file	file.macho.sections.name	keyword	extended			Mach-O Section List name.
424	9.1.0	true	file	file.macho.sections.physical_size	long	extended			Mach-O Section List physical size.
425	9.1.0	true	file	file.macho.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
426	9.1.0	true	file	file.macho.sections.virtual_size	long	extended			Mach-O Section List virtual size. This is always the same as `physical_size`.
427	9.1.0	true	file	file.macho.symhash	keyword	extended		d3ccf195b62a9279c3c19af1080497ec	A hash of the imports in a Mach-O file.
428	9.1.0	true	file	file.mime_type	keyword	extended			Media type of file, document, or arrangement of bytes.
429	9.1.0	true	file	file.mode	keyword	extended		0640	Mode of the file in octal representation.
430	9.1.0	true	file	file.mtime	date	extended			Last time the file content was modified.
431	9.1.0	true	file	file.name	keyword	extended		example.png	Name of the file including the extension, without the directory.
432	9.1.0	true	file	file.origin_referrer_url	keyword	extended		http://example.com/article1.html	The URL of the webpage that linked to the file.
433	9.1.0	true	file	file.origin_url	keyword	extended		http://example.com/imgs/article1_img1.jpg	The URL where the file is hosted.
434	9.1.0	true	file	file.owner	keyword	extended		alice	File owner's username.
435	9.1.0	true	file	file.path	keyword	extended		/home/alice/example.png	Full path to the file, including the file name.
436	9.1.0	true	file	file.pe.architecture	keyword	extended		x64	CPU architecture target for the file.
437	9.1.0	true	file	file.pe.company	keyword	extended		Microsoft Corporation	Internal company name of the file, provided at compile-time.
438	9.1.0	true	file	file.pe.description	keyword	extended		Paint	Internal description of the file, provided at compile-time.
439	9.1.0	true	file	file.pe.file_version	keyword	extended		6.3.9600.17415	Process name.
440	9.1.0	true	file	file.pe.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a PE file.
441	9.1.0	true	file	file.pe.go_imports	flat_object	extended			List of imported Go language element names and types.
442	9.1.0	true	file	file.pe.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
443	9.1.0	true	file	file.pe.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
444	9.1.0	true	file	file.pe.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
445	9.1.0	true	file	file.pe.imphash	keyword	extended		0c6803c4e922103c4dca5963aad36ddf	A hash of the imports in a PE file.
446	9.1.0	true	file	file.pe.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a PE file.
447	9.1.0	true	file	file.pe.imports	flat_object	extended	array		List of imported element names and types.
448	9.1.0	true	file	file.pe.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
449	9.1.0	true	file	file.pe.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
450	9.1.0	true	file	file.pe.original_file_name	keyword	extended		MSPAINT.EXE	Internal name of the file, provided at compile-time.
451	9.1.0	true	file	file.pe.pehash	keyword	extended		73ff189b63cd6be375a7ff25179a38d347651975	A hash of the PE header and data from one or more PE sections.
452	9.1.0	true	file	file.pe.product	keyword	extended		Microsoft® Windows® Operating System	Internal product name of the file, provided at compile-time.
453	9.1.0	true	file	file.pe.sections	nested	extended	array		Section information of the PE file.
454	9.1.0	true	file	file.pe.sections.entropy	long	extended			Shannon entropy calculation from the section.
455	9.1.0	true	file	file.pe.sections.name	keyword	extended			PE Section List name.
456	9.1.0	true	file	file.pe.sections.physical_size	long	extended			PE Section List physical size.
457	9.1.0	true	file	file.pe.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
458	9.1.0	true	file	file.pe.sections.virtual_size	long	extended			PE Section List virtual size. This is always the same as `physical_size`.
459	9.1.0	true	file	file.size	long	extended		16384	File size in bytes.
460	9.1.0	true	file	file.target_path	keyword	extended			Target path for symlinks.
461	9.1.0	true	file	file.type	keyword	extended		file	File type (file, dir, or symlink).
462	9.1.0	true	file	file.uid	keyword	extended		1001	The user ID (UID) or security identifier (SID) of the file owner.
463	9.1.0	true	file	file.x509.alternative_names	keyword	extended	array	*.elastic.co	List of subject alternative names (SAN).
464	9.1.0	true	file	file.x509.issuer.common_name	keyword	extended	array	Example SHA2 High Assurance Server CA	List of common name (CN) of issuing certificate authority.
465	9.1.0	true	file	file.x509.issuer.country	keyword	extended	array	US	List of country \(C) codes
466	9.1.0	true	file	file.x509.issuer.distinguished_name	keyword	extended		C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA	Distinguished name (DN) of issuing certificate authority.
467	9.1.0	true	file	file.x509.issuer.locality	keyword	extended	array	Mountain View	List of locality names (L)
468	9.1.0	true	file	file.x509.issuer.organization	keyword	extended	array	Example Inc	List of organizations (O) of issuing certificate authority.
469	9.1.0	true	file	file.x509.issuer.organizational_unit	keyword	extended	array	www.example.com	List of organizational units (OU) of issuing certificate authority.
470	9.1.0	true	file	file.x509.issuer.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
471	9.1.0	true	file	file.x509.not_after	date	extended		2020-07-16T03:15:39Z	Time at which the certificate is no longer considered valid.
472	9.1.0	true	file	file.x509.not_before	date	extended		2019-08-16T01:40:25Z	Time at which the certificate is first considered valid.
473	9.1.0	true	file	file.x509.public_key_algorithm	keyword	extended		RSA	Algorithm used to generate the public key.
474	9.1.0	true	file	file.x509.public_key_curve	keyword	extended		nistp521	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
475	9.1.0	false	file	file.x509.public_key_exponent	long	extended		65537	Exponent used to derive the public key. This is algorithm specific.
476	9.1.0	true	file	file.x509.public_key_size	long	extended		2048	The size of the public key space in bits.
477	9.1.0	true	file	file.x509.serial_number	keyword	extended		55FBB9C7DEBF09809D12CCAA	Unique serial number issued by the certificate authority.
478	9.1.0	true	file	file.x509.signature_algorithm	keyword	extended		SHA256-RSA	Identifier for certificate signature algorithm.
479	9.1.0	true	file	file.x509.subject.common_name	keyword	extended	array	shared.global.example.net	List of common names (CN) of subject.
480	9.1.0	true	file	file.x509.subject.country	keyword	extended	array	US	List of country \(C) code
481	9.1.0	true	file	file.x509.subject.distinguished_name	keyword	extended		C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net	Distinguished name (DN) of the certificate subject entity.
482	9.1.0	true	file	file.x509.subject.locality	keyword	extended	array	San Francisco	List of locality names (L)
483	9.1.0	true	file	file.x509.subject.organization	keyword	extended	array	Example, Inc.	List of organizations (O) of subject.
484	9.1.0	true	file	file.x509.subject.organizational_unit	keyword	extended	array		List of organizational units (OU) of subject.
485	9.1.0	true	file	file.x509.subject.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
486	9.1.0	true	file	file.x509.version_number	keyword	extended		3	Version of x509 format.
487	9.1.0	true	gcp_audit	gcp_audit.actor.entity_id	nested	custom			The unique identifier of the entity that performed the audited action
488	9.1.0	true	gcp_audit	gcp_audit.authenticationinfo.principalsubject	keyword	custom		example-principalsubject	The purpose of this field needs to be defined
489	9.1.0	true	gcp_audit	gcp_audit.authenticationinfo.serviceaccountdelegationinfo	nested	custom	array		The service account delegatio information
490	9.1.0	true	gcp_audit	gcp_audit.authenticationinfo.serviceaccountkeyname	keyword	custom		example-serviceaccountkeyname	This field captures authentication details whenever an API call or action is performed in GCP
491	9.1.0	true	gcp_audit	gcp_audit.authorizationinfo	nested	custom	array		The gcp audit log authorization information
492	9.1.0	true	gcp_audit	gcp_audit.event_provider	keyword	custom		example-event_provider	The provider of the audit event
493	9.1.0	true	gcp_audit	gcp_audit.labels	object	custom			The GCP audit labels information
494	9.1.0	true	gcp_audit	gcp_audit.metadata.@type	keyword	custom		example-@type	The type of GCP audit metadata
495	9.1.0	true	gcp_audit	gcp_audit.metadata.accessLevels	keyword	custom	array	example-accessLevels	The access levels in the gcp audit metadata
496	9.1.0	true	gcp_audit	gcp_audit.metadata.identityDelegationChain	keyword	custom	array	example-identityDelegationChain	The identity delegation chain in the gcp audit metadata
497	9.1.0	true	gcp_audit	gcp_audit.metadata.ingressViolations	nested	custom	array		The GCP audit metadata ingress violations information
498	9.1.0	true	gcp_audit	gcp_audit.metadata.operationType	keyword	custom		example-operationType	The operation type in the GCP audit metadata
499	9.1.0	true	gcp_audit	gcp_audit.metadata.resourceNames	keyword	custom	array	example-resourceNames	The resource names in the GCP audit metadata
500	9.1.0	true	gcp_audit	gcp_audit.metadata.securityPolicyInfo.organizationId	keyword	custom		example-organizationId	The organization identifier in the security policy information
501	9.1.0	true	gcp_audit	gcp_audit.metadata.securityPolicyInfo.servicePerimeterName	keyword	custom		example-servicePerimeterName	The service perimeter in the security policy information
502	9.1.0	true	gcp_audit	gcp_audit.metadata.usedResources.attachedDisks	nested	custom	array		The attached disks in the used resources
503	9.1.0	true	gcp_audit	gcp_audit.metadata.violationReason	keyword	custom		example-violationReason	The violation reason information stored in the metadata
504	9.1.0	true	gcp_audit	gcp_audit.metadata.vpcServiceControlsUniqueId	keyword	custom		example-vpcServiceControlsUniqueId	The VPC service controls unique identifier in the metadata
505	9.1.0	true	gcp_audit	gcp_audit.numresponseitems	long	custom		12345	Number of items returned in the response
506	9.1.0	true	gcp_audit	gcp_audit.operation.id	keyword	custom		example-id	An identifier for the audit log operation
507	9.1.0	true	gcp_audit	gcp_audit.orgpolicyviolationinfo.payload.key1	keyword	custom		example-key1	The key in the payload policy violatio information
508	9.1.0	true	gcp_audit	gcp_audit.orgpolicyviolationinfo.payload.key2	keyword	custom		example-key2	The key in the payload policy violatio information
509	9.1.0	true	gcp_audit	gcp_audit.orgpolicyviolationinfo.resourcetags.instance_id	keyword	custom		example-instance_id	The insance ID present in the resource tags in the policy violation information
510	9.1.0	true	gcp_audit	gcp_audit.orgpolicyviolationinfo.resourcetags.zone	keyword	custom		example-zone	The zone present in the resource tags in the policy violation information
511	9.1.0	true	gcp_audit	gcp_audit.related.entity	nested	custom			Information about related entities connected to the audited operation
512	9.1.0	true	gcp_audit	gcp_audit.request.@type	keyword	custom		example-@type	The message type of the request payload
513	9.1.0	true	gcp_audit	gcp_audit.request.apiVersion	keyword	custom		example-apiVersion	The version of the API used in the request
514	9.1.0	true	gcp_audit	gcp_audit.request.disks	keyword	custom	array	example-disks	The details of the disks in the request information
515	9.1.0	true	gcp_audit	gcp_audit.request.family	keyword	custom		example-family	Indicates the resource family or category associated with the audit request
516	9.1.0	true	gcp_audit	gcp_audit.request.guestOsFeatures	nested	custom	array		Specifies the operating system features requested for a guest VM instance
517	9.1.0	true	gcp_audit	gcp_audit.request.kind	keyword	custom		example-kind	Identifies the type of API resource or operation object in the request
518	9.1.0	true	gcp_audit	gcp_audit.request.machineType	keyword	custom		example-machineType	The Compute Engine machine type (CPU/memory configuration) requested for a VM
519	9.1.0	true	gcp_audit	gcp_audit.request.metadata.creationTimestamp	date	custom		2023-01-01T00:00:00.000Z	The timestamp indicating when the resource was created
520	9.1.0	true	gcp_audit	gcp_audit.request.name	keyword	custom		example-name	The name assigned to the resource being created or modified
521	9.1.0	true	gcp_audit	gcp_audit.request.networkInterfaces	nested	custom	array		The list of network interfaces attached to a VM (e.g., IPs, subnets, VPCs)
522	9.1.0	true	gcp_audit	gcp_audit.request.pageSize	keyword	custom		example-pageSize	The maximum number of items to return in a paginated API response
523	9.1.0	true	gcp_audit	gcp_audit.request.page_token	keyword	custom		example-page_token	A continuation token to fetch the next page of results in paginated requests
524	9.1.0	true	gcp_audit	gcp_audit.request.policy.bindings	nested	custom	array		The IAM role-to-member mappings defined in a policy
525	9.1.0	true	gcp_audit	gcp_audit.request.policy.etag	keyword	custom		example-etag	A unique identifier used for concurrency control when updating an IAM policy
526	9.1.0	true	gcp_audit	gcp_audit.request.policyvalue	keyword	custom		example-policyvalue	The full IAM policy object or value applied to a resource
527	9.1.0	true	gcp_audit	gcp_audit.request.rawDisk.source	keyword	custom		example-source	The source disk or image used when creating a new raw disk
528	9.1.0	true	gcp_audit	gcp_audit.request.resource	keyword	custom		example-resource	Specifies the type or specification of the resource targeted in the request
529	9.1.0	true	gcp_audit	gcp_audit.request.resourceName	keyword	custom		example-resourceName	The fully qualified name of the resource on which the action is performed
530	9.1.0	true	gcp_audit	gcp_audit.request.serviceAccounts	nested	custom	array		Lists the service accounts associated with the resource (e.g., attached to a VM)
531	9.1.0	true	gcp_audit	gcp_audit.request.sourceType	keyword	custom		example-sourceType	Indicates the origin type of the resource or workload (e.g., image, snapshot, or template)
532	9.1.0	true	gcp_audit	gcp_audit.request.spec.group	nested	custom	array		Represents the API group of the resource specification, commonly used in Kubernetes-style APIs
533	9.1.0	true	gcp_audit	gcp_audit.request.spec.nonResourceAttributes.path	keyword	custom		example-path	The API path accessed when the request does not target a specific resource (e.g., /healthz)
534	9.1.0	true	gcp_audit	gcp_audit.request.spec.nonResourceAttributes.verb	keyword	custom		example-verb	The HTTP verb or action used in the non-resource request (e.g., get, list, create)
535	9.1.0	true	gcp_audit	gcp_audit.request.spec.strategy.$retainKeys	keyword	custom		example-$retainKeys	Indicates which keys should be retained when applying a strategy-based resource update.
536	9.1.0	true	gcp_audit	gcp_audit.request.spec.template.spec	object	custom			Contains the detailed specification template for the resource (e.g., pod spec in GKE).
537	9.1.0	true	gcp_audit	gcp_audit.request.spec.user	keyword	custom		example-user	The user identity specified in the resource configuration or request
538	9.1.0	true	gcp_audit	gcp_audit.request.status.allowed	boolean	custom		True	Indicates whether the requested action was authorized (true) or denied (false)
539	9.1.0	true	gcp_audit	gcp_audit.resourcelocation.currentlocation	nested	custom	array		Specifies the geographic location or region where the resource currently resides
540	9.1.0	true	gcp_audit	gcp_audit.resourcename	keyword	custom		example-resourcename	The name of the resource that was accessed or modified in the audit event
541	9.1.0	true	gcp_audit	gcp_audit.response.@type	keyword	custom		example-@type	The message type of the response payload
542	9.1.0	true	gcp_audit	gcp_audit.response.apiVersion	keyword	custom		example-apiVersion	Specifies the API version used in the response.
543	9.1.0	true	gcp_audit	gcp_audit.response.bindings	nested	custom	array		Defines role bindings that associate users or groups with roles.
544	9.1.0	true	gcp_audit	gcp_audit.response.details.group	keyword	custom		example-group	Indicates the group of the resource in the response details.
545	9.1.0	true	gcp_audit	gcp_audit.response.details.kind	keyword	custom		example-kind	Specifies the kind of the resource in the response details.
546	9.1.0	true	gcp_audit	gcp_audit.response.details.name	keyword	custom		example-name	Provides the name of the resource in the response details.
547	9.1.0	true	gcp_audit	gcp_audit.response.details.uid	keyword	custom		example-uid	Represents the unique identifier (UID) of the resource.
548	9.1.0	true	gcp_audit	gcp_audit.response.etag	keyword	custom		example-etag	ETag value used for optimistic concurrency control.
549	9.1.0	true	gcp_audit	gcp_audit.response.id	keyword	custom		example-id	Unique identifier of the resource in the response.
550	9.1.0	true	gcp_audit	gcp_audit.response.insertTime	keyword	custom		example-insertTime	Timestamp when the resource was inserted.
551	9.1.0	true	gcp_audit	gcp_audit.response.kind	keyword	custom		example-kind	Specifies the type or category of the resource.
552	9.1.0	true	gcp_audit	gcp_audit.response.metadata.annotations	object	custom			Annotations metadata associated with the resource.
553	9.1.0	true	gcp_audit	gcp_audit.response.metadata.creationTimestamp	date	custom		2023-01-01T00:00:00.000Z	Timestamp of when the resource was created.
554	9.1.0	true	gcp_audit	gcp_audit.response.metadata.generation	keyword	custom		example-generation	Version number or generation of the resource.
555	9.1.0	true	gcp_audit	gcp_audit.response.metadata.labels	object	custom			Labels metadata assigned to the resource.
556	9.1.0	true	gcp_audit	gcp_audit.response.metadata.managedFields	nested	custom	array		Managed fields metadata describing changes to the resource.
557	9.1.0	true	gcp_audit	gcp_audit.response.metadata.name	keyword	custom		example-name	Name of the resource in the metadata section.
558	9.1.0	true	gcp_audit	gcp_audit.response.metadata.namespace	keyword	custom		example-namespace	Namespace associated with the resource.
559	9.1.0	true	gcp_audit	gcp_audit.response.metadata.resourceVersion	keyword	custom		example-resourceVersion	Resource version used for concurrency control.
560	9.1.0	true	gcp_audit	gcp_audit.response.metadata.uid	keyword	custom		example-uid	Unique identifier (UID) of the resource in metadata.
561	9.1.0	true	gcp_audit	gcp_audit.response.name	keyword	custom		example-name	Name of the resource defined in the response.
562	9.1.0	true	gcp_audit	gcp_audit.response.operationType	keyword	custom		example-operationType	Specifies the type of operation performed.
563	9.1.0	true	gcp_audit	gcp_audit.response.progress	keyword	custom		example-progress	Indicates progress of the requested operation.
564	9.1.0	true	gcp_audit	gcp_audit.response.selfLink	keyword	custom		example-selfLink	Self-link URL for accessing the resource.
565	9.1.0	true	gcp_audit	gcp_audit.response.selfLinkWithId	keyword	custom		example-selfLinkWithId	Self-link URL including the resource identifier.
566	9.1.0	true	gcp_audit	gcp_audit.response.spec.group	nested	custom	array		Defines a group specification for the resource.
567	9.1.0	true	gcp_audit	gcp_audit.response.spec.nonResourceAttributes.path	keyword	custom		example-path	Path value for non-resource attribute specifications.
568	9.1.0	true	gcp_audit	gcp_audit.response.spec.nonResourceAttributes.verb	keyword	custom		example-verb	HTTP verb associated with the non-resource attribute.
569	9.1.0	true	gcp_audit	gcp_audit.response.spec.progressDeadlineSeconds	keyword	custom		example-progressDeadlineSeconds	Deadline in seconds for operation progress.
570	9.1.0	true	gcp_audit	gcp_audit.response.spec.replicas	keyword	custom		example-replicas	Number of replicas defined for the resource.
571	9.1.0	true	gcp_audit	gcp_audit.response.spec.revisionHistoryLimit	keyword	custom		example-revisionHistoryLimit	Number of revisions to retain for rollback.
572	9.1.0	true	gcp_audit	gcp_audit.response.spec.selector.matchLabels.k8s-app	keyword	custom		example-k8s-app	Match label used to identify Kubernetes apps.
573	9.1.0	true	gcp_audit	gcp_audit.response.spec.strategy.rollingUpdate.maxSurge	keyword	custom		example-maxSurge	Maximum number of pods that can be scheduled above desired replicas during update.
574	9.1.0	true	gcp_audit	gcp_audit.response.spec.strategy.rollingUpdate.maxUnavailable	keyword	custom		example-maxUnavailable	Maximum number of pods that can be unavailable during update.
575	9.1.0	true	gcp_audit	gcp_audit.response.spec.strategy.type	keyword	custom		example-type	Strategy type used for rolling updates.
576	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.metadata.annotations	object	custom			Annotations in the pod template metadata.
577	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.metadata.creationTimestamp	date	custom		2023-01-01T00:00:00.000Z	Creation timestamp of the pod template.
578	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.metadata.labels.k8s-app	keyword	custom		example-k8s-app	Labels in the pod template metadata.
579	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.containers	nested	custom			List of containers defined in the pod specification.
580	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.dnsPolicy	keyword	custom		example-dnsPolicy	DNS policy applied to the pod specification.
581	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.nodeSelector	object	custom			Node selector used to schedule the pod.
582	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.priorityClassName	keyword	custom		example-priorityClassName	Priority class name assigned to the pod.
583	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.restartPolicy	keyword	custom		example-restartPolicy	Restart policy applied to the pod.
584	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.schedulerName	keyword	custom		example-schedulerName	Scheduler name used for the pod scheduling.
585	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.securityContext.fsGroup	keyword	custom		example-fsGroup	File system group ID in the pod security context.
586	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.securityContext.runAsGroup	keyword	custom		example-runAsGroup	Run-as group ID in the pod security context.
587	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.securityContext.runAsUser	keyword	custom		example-runAsUser	Run-as user ID in the pod security context.
588	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.serviceAccount	keyword	custom		example-serviceAccount	Service account associated with the pod.
589	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.serviceAccountName	keyword	custom		example-serviceAccountName	Name of the service account assigned to the pod.
590	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.terminationGracePeriodSeconds	keyword	custom		example-terminationGracePeriodSeconds	Time in seconds before terminating the pod.
591	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.tolerations	nested	custom	array		Tolerations applied to the pod specification.
592	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.topologySpreadConstraints	nested	custom	array		Topology spread constraints for distributing pods.
593	9.1.0	true	gcp_audit	gcp_audit.response.spec.template.spec.volumes	nested	custom	array		Volumes defined in the pod specification.
594	9.1.0	true	gcp_audit	gcp_audit.response.spec.user	keyword	custom		example-user	User associated with the resource specification.
595	9.1.0	true	gcp_audit	gcp_audit.response.startTime	keyword	custom		example-startTime	Start time of the operation or process.
596	9.1.0	true	gcp_audit	gcp_audit.response.status.allowed	boolean	custom		True	Indicates whether the request or action was allowed.
597	9.1.0	true	gcp_audit	gcp_audit.response.status.availableReplicas	keyword	custom		example-availableReplicas	Number of replicas available at the time of the response.
598	9.1.0	true	gcp_audit	gcp_audit.response.status.conditions	nested	custom	array		Conditions describing the current status of the resource.
599	9.1.0	true	gcp_audit	gcp_audit.response.status.observedGeneration	keyword	custom		example-observedGeneration	Most recent observed generation of the resource.
600	9.1.0	true	gcp_audit	gcp_audit.response.status.readyReplicas	keyword	custom		example-readyReplicas	Number of replicas ready for service.
601	9.1.0	true	gcp_audit	gcp_audit.response.status.reason	keyword	custom		example-reason	Reason for the current status of the resource.
602	9.1.0	true	gcp_audit	gcp_audit.response.status.replicas	keyword	custom		example-replicas	Total number of replicas of the resource.
603	9.1.0	true	gcp_audit	gcp_audit.response.status.updatedReplicas	keyword	custom		example-updatedReplicas	Number of replicas updated to the latest version.
604	9.1.0	true	gcp_audit	gcp_audit.response.statusvalue	keyword	custom		example-statusvalue	Current status value of the resource.
605	9.1.0	true	gcp_audit	gcp_audit.response.targetId	keyword	custom		example-targetId	Identifier of the target resource.
606	9.1.0	true	gcp_audit	gcp_audit.response.targetLink	keyword	custom		example-targetLink	Target link URL of the resource.
607	9.1.0	true	gcp_audit	gcp_audit.response.user	keyword	custom		example-user	User who initiated the request or operation.
608	9.1.0	true	gcp_audit	gcp_audit.response.zone	keyword	custom		example-zone	Zone in which the resource resides.
609	9.1.0	true	gcp_audit	gcp_audit.servicename	keyword	custom		example-servicename	The name of the Google Cloud service that processed the request
610	9.1.0	true	gcp_audit	gcp_audit.status.code	long	custom		12345	Numeric status code representing the outcome of the request
611	9.1.0	true	gcp_audit	gcp_audit.status.details	nested	custom	array		The purpose of this field needs to be defined
612	9.1.0	true	gcp_audit	gcp_audit.status.message	keyword	custom		example-message	A human-readable description of the status code
613	9.1.0	true	gcp_audit	gcp_audit.target.entity_id	nested	custom			The unique identifier of the target entity involved in the audited operation
614	9.1.0	true	gcp_audit	gcp_audit.type	keyword	custom		example-type	The type classification of the audit event
615	9.1.0	true	gcp_compute	gcp_compute.event_module	keyword	custom		example-event_module	The GCP compute log event module name
616	9.1.0	true	gcp_compute	gcp_compute.labels.user.goog-gke-node	keyword	custom		example-goog-gke-node	A custom label that identifies the Google Kubernetes Engine node associated with the instance
617	9.1.0	true	gcp_compute	gcp_compute.metrics.firewall.dropped.bytes	long	custom		12345	Represents the number of bytes dropped by the firewall as recorded by GCP Compute metrics
618	9.1.0	true	gcp_compute	gcp_compute.metrics.firewall.dropped_packets_count.value	long	custom		12345	Represents the count of packets dropped by the firewall as measured in GCP Compute metrics
619	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.cpu.reserved_cores.value	long	custom		12345	Indicates the number of CPU cores reserved for the instance specific to GCP Compute metrics
620	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.cpu.usage.pct	float	custom			Shows the CPU usage percentage for the instance according to GCP Compute metrics
621	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.cpu.usage_time.sec	float	custom			Represents the total CPU usage time in seconds for the instance
622	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.disk.read.bytes	long	custom		12345	Total number of bytes read from the instance's disks
623	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.disk.read_ops_count.value	long	custom		12345	The count of disk read operations performed on the instance
624	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.disk.write.bytes	long	custom		12345	Total number of bytes written to the instance's disks
625	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.disk.write_ops_count.value	long	custom		12345	The count of disk write operations performed on the instance
626	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.memory.balloon.ram_size.value	long	custom		12345	The total RAM size reported via memory ballooning for the instance
627	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.memory.balloon.ram_used.value	long	custom		12345	The amount of RAM used as reported by the memory ballooning metrics
628	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.memory.balloon.swap_in.bytes	long	custom		12345	The number of bytes swapped into memory for the instance
629	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.memory.balloon.swap_out.bytes	long	custom		12345	The number of bytes swapped out of memory for the instance
630	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.network.egress.bytes	long	custom		12345	Total outgoing network traffic in bytes for the instance
631	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.network.egress.packets.count	long	custom		12345	The count of outgoing network packets for the instance
632	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.network.ingress.bytes	long	custom		12345	Total incoming network traffic in bytes for the instance
633	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.network.ingress.packets.count	long	custom		12345	The count of incoming network packets for the instance
634	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.uptime.sec	float	custom			The instance uptime in seconds
635	9.1.0	true	gcp_compute	gcp_compute.metrics.instance.uptime_total.sec	keyword	custom		example-sec	The total accumulated uptime of the instance in seconds
636	9.1.0	true	gcp_dns	gcp_dns.authanswer	boolean	custom		True	Indicates whether the DNS query was authenticated based on the authAnswer flag
637	9.1.0	true	gcp_dns	gcp_dns.destinationIP	keyword	custom		example-destinationIP	Contains the destination IP address for the DNS query
638	9.1.0	true	gcp_dns	gcp_dns.egresserror	keyword	custom		example-egresserror	Captures any error information related to the egress process for the DNS query
639	9.1.0	true	gcp_dns	gcp_dns.protocol	keyword	custom		example-protocol	Indicates the network protocol (e.g. TCP UDP) used for the DNS query
640	9.1.0	true	gcp_dns	gcp_dns.queryname	keyword	custom		example-queryname	Represents the fully qualified domain name (FQDN) that was queried
641	9.1.0	true	gcp_dns	gcp_dns.querytype	keyword	custom		example-querytype	Specifies the type of DNS record being queried
642	9.1.0	true	gcp_dns	gcp_dns.rdata	keyword	custom		example-rdata	Contains the raw resource record data returned in the DNS response
643	9.1.0	true	gcp_dns	gcp_dns.responsecode	keyword	custom		example-responsecode	Indicates the DNS response code such as "NOERROR"
644	9.1.0	true	gcp_dns	gcp_dns.serverlatency	long	custom		12345	Measures the latency of the DNS server's response
645	9.1.0	true	gcp_dns	gcp_dns.source_type	keyword	custom		example-source_type	Classifies the type of source resource for the DNS query
646	9.1.0	true	gcp_dns	gcp_dns.sourceip	keyword	custom		example-sourceip	Contains the IP address from which the DNS query was initiated
647	9.1.0	true	gcp_dns	gcp_dns.sourcenetwork	keyword	custom		example-sourcenetwork	Represents the network segment or identifier associated with the query's source
648	9.1.0	true	gcp_dns	gcp_dns.target_type	keyword	custom		example-target_type	Denotes the type of target resource involved in the DNS query
649	9.1.0	true	gcp_dns	gcp_dns.vminstanceid	keyword	custom		example-vminstanceid	Holds the unique identifier of the virtual machine instance that generated the DNS query
650	9.1.0	true	gcp_dns	gcp_dns.vminstancename	keyword	custom		example-vminstancename	Contains the original virtual machine instance name prior to any normalization
651	9.1.0	true	gcp_dns	gcp_dns.vmprojectid	keyword	custom		example-vmprojectid	Identifies the project associated with the virtual machine instance that issued the DNS query
652	9.1.0	true	gcp_dns	gcp_dns.vmzonename	keyword	custom		example-vmzonename	Specifies the availability zone of the virtual machine instance
653	9.1.0	true	gcp_firewall	gcp_firewall.destinationinstance.project_id	keyword	custom		example-project_id	The project identifier for the destination instance from the GCP firewall logs
654	9.1.0	true	gcp_firewall	gcp_firewall.destinationinstance.region	keyword	custom		example-region	The region where the destination instance is located
655	9.1.0	true	gcp_firewall	gcp_firewall.destinationinstance.vm_name	keyword	custom		example-vm_name	The name of the destination instance as reported in the firewall log
656	9.1.0	true	gcp_firewall	gcp_firewall.destinationinstance.zone	keyword	custom		example-zone	The availability zone of the destination instance
657	9.1.0	true	gcp_firewall	gcp_firewall.destinationvpc.project_id	keyword	custom		example-project_id	The project identifier associated with the destination VPC
658	9.1.0	true	gcp_firewall	gcp_firewall.destinationvpc.subnetwork_name	keyword	custom		example-subnetwork_name	The name of the subnetwork in the destination VPC
659	9.1.0	true	gcp_firewall	gcp_firewall.destinationvpc.vpc_name	keyword	custom		example-vpc_name	The name of the destination VPC
660	9.1.0	true	gcp_firewall	gcp_firewall.rule_details.action	keyword	custom		example-action	The action (e.g. DENY ALLOW) taken as specified in the firewall rule
661	9.1.0	true	gcp_firewall	gcp_firewall.rule_details.direction	keyword	custom		example-direction	The traffic direction (INGRESS or EGRESS) defined in the firewall rule
662	9.1.0	true	gcp_firewall	gcp_firewall.rule_details.ip_port_info	nested	custom	array		The IP protocol specified in the firewall rule
663	9.1.0	true	gcp_firewall	gcp_firewall.rule_details.reference	keyword	custom		example-reference	A reference identifier for the firewall rule
664	9.1.0	true	gcp_firewall	gcp_firewall.rule_details.source_range	keyword	custom	array	example-source_range	An array of source IP ranges specified in the firewall rule
665	9.1.0	true	gcp_firewall	gcp_firewall.rule_details.target_tag	keyword	custom	array	example-target_tag	An array of target tags defined in the firewall rule
666	9.1.0	true	gcp_firewall	gcp_firewall.rule_name	keyword	custom		example-rule_name	The firewall rul name triggered in the GCP firewall allow/block action
667	9.1.0	true	gcp_loadbalancer	gcp_loadbalancer.backend_service_name	keyword	custom		example-backend_service_name	The backend service name used by the load balancer
668	9.1.0	true	gcp_loadbalancer	gcp_loadbalancer.cacheHit	boolean	custom		True	Indicates whether the load balancer served the response from cache
669	9.1.0	true	gcp_loadbalancer	gcp_loadbalancer.cacheId	keyword	custom		example-cacheId	The cache identifier used by the load balancer
670	9.1.0	true	gcp_loadbalancer	gcp_loadbalancer.cacheLookup	boolean	custom		True	Indicates whether a cache lookup was performed by the load balancer
671	9.1.0	true	gcp_loadbalancer	gcp_loadbalancer.forwarding_rule_name	keyword	custom		example-forwarding_rule_name	The name of the forwarding rule associated with the load balancer
672	9.1.0	true	gcp_loadbalancer	gcp_loadbalancer.statusDetails	keyword	custom		example-statusDetails	Additional status details provided by the load balancer
673	9.1.0	true	gcp_loadbalancer	gcp_loadbalancer.target_proxy_name	keyword	custom		example-target_proxy_name	The target proxy name configured for the load balancer
674	9.1.0	true	gcp_loadbalancer	gcp_loadbalancer.url_map_name	keyword	custom		example-url_map_name	The URL map name used by the load balancer
675	9.1.0	true	gcp_vpcflow	gcp_vpcflow.dest_instance.project_id	keyword	custom		example-project_id	The project ID that owns the destination VM instance receiving the traffic
676	9.1.0	true	gcp_vpcflow	gcp_vpcflow.dest_instance.region	keyword	custom		example-region	Region in which the destination instance is deployed useful for analyzing cross-region traffic
677	9.1.0	true	gcp_vpcflow	gcp_vpcflow.dest_instance.vm_name	keyword	custom		example-vm_name	The name of the destination virtual machine used to determine which instance received the traffic
678	9.1.0	true	gcp_vpcflow	gcp_vpcflow.dest_instance.zone	keyword	custom		example-zone	Zone of the destination VM providing a more granular location than region
679	9.1.0	true	gcp_vpcflow	gcp_vpcflow.dest_vpc.project_id	keyword	custom		example-project_id	Project ID associated with the destination VPC network
680	9.1.0	true	gcp_vpcflow	gcp_vpcflow.dest_vpc.subnetwork_name	keyword	custom		example-subnetwork_name	The name of the subnetwork within the destination VPC
681	9.1.0	true	gcp_vpcflow	gcp_vpcflow.dest_vpc.vpc_name	keyword	custom		example-vpc_name	Name of the destination Virtual Private Cloud network where traffic is received
682	9.1.0	true	gcp_vpcflow	gcp_vpcflow.reporter	keyword	custom		example-reporter	Indicates which side (source or destination) of the network connection reported the flow. Values can be "SRC" or "DEST"
683	9.1.0	true	gcp_vpcflow	gcp_vpcflow.rtt_msec	long	custom		12345	Round-trip time in milliseconds for the connection represented in the log
684	9.1.0	true	gcp_vpcflow	gcp_vpcflow.src_instance.project_id	keyword	custom		example-project_id	GCP project ID where source instance resides. Identifies which project owns the VM that initiated the traffic.
685	9.1.0	true	gcp_vpcflow	gcp_vpcflow.src_instance.region	keyword	custom		example-region	The geographical region of the source VM instance. Helps in mapping network flows across geographic locations
686	9.1.0	true	gcp_vpcflow	gcp_vpcflow.src_instance.vm_name	keyword	custom		example-vm_name	Name of virtual machine that originated the traffic. Useful for correlating flow data with VM-level logs or events.
687	9.1.0	true	gcp_vpcflow	gcp_vpcflow.src_instance.zone	keyword	custom		example-zone	The specific GCP zone (within a region) where the source VM is located
688	9.1.0	true	gcp_vpcflow	gcp_vpcflow.src_vpc.project_id	keyword	custom		example-project_id	Project ID associated with the source VPC network. Useful for identifying VPC ownership in multi-project environments
689	9.1.0	true	gcp_vpcflow	gcp_vpcflow.src_vpc.subnetwork_name	keyword	custom		example-subnetwork_name	The name of the subnetwork (subnet) within the VPC where the source VM resides
690	9.1.0	true	gcp_vpcflow	gcp_vpcflow.src_vpc.vpc_name	keyword	custom		example-vpc_name	The name of the source Virtual Private Cloud network used to send the traffic
691	9.1.0	false	gen_ai	gen_ai.agent.description	keyword	extended		Helps with math problems; Generates fiction stories	Free-form description of the GenAI agent provided by the application.
692	9.1.0	true	gen_ai	gen_ai.agent.id	keyword	extended		asst_5j66UpCpwteGg4YSxUnt7lPY	The unique identifier of the GenAI agent.
693	9.1.0	true	gen_ai	gen_ai.agent.name	keyword	extended		Math Tutor; Fiction Writer	Human-readable name of the GenAI agent provided by the application.
694	9.1.0	true	gen_ai	gen_ai.operation.name	keyword	extended		chat; text_completion; embeddings	The name of the operation being performed.
695	9.1.0	true	gen_ai	gen_ai.output.type	keyword	extended		text; json; image	Represents the content type requested by the client.
696	9.1.0	true	gen_ai	gen_ai.request.choice.count	integer	extended		3	The target number of candidate completions to return.
697	9.1.0	true	gen_ai	gen_ai.request.encoding_formats	keyword	extended		["float", "binary"]	The encoding formats requested in an embeddings operation, if specified.
698	9.1.0	true	gen_ai	gen_ai.request.frequency_penalty	double	extended		0.1	The frequency penalty setting for the GenAI request.
699	9.1.0	true	gen_ai	gen_ai.request.max_tokens	integer	extended		100	The maximum number of tokens the model generates for a request.
700	9.1.0	true	gen_ai	gen_ai.request.model	keyword	extended		gpt-4	The name of the GenAI model a request is being made to.
701	9.1.0	true	gen_ai	gen_ai.request.presence_penalty	double	extended		0.1	The presence penalty setting for the GenAI request.
702	9.1.0	true	gen_ai	gen_ai.request.seed	integer	extended		100	Requests with same seed value more likely to return same result.
703	9.1.0	true	gen_ai	gen_ai.request.stop_sequences	keyword	extended		["forest", "lived"]	List of sequences that the model will use to stop generating further tokens.
704	9.1.0	true	gen_ai	gen_ai.request.temperature	double	extended		0.0	The temperature setting for the GenAI request.
705	9.1.0	true	gen_ai	gen_ai.request.top_k	double	extended		1.0	The top_k sampling setting for the GenAI request.
706	9.1.0	true	gen_ai	gen_ai.request.top_p	double	extended		1.0	The top_p sampling setting for the GenAI request.
707	9.1.0	true	gen_ai	gen_ai.response.finish_reasons	keyword	extended		["stop", "length"]	Array of reasons the model stopped generating tokens, corresponding to each generation received.
708	9.1.0	true	gen_ai	gen_ai.response.id	keyword	extended		chatcmpl-123	The unique identifier for the completion.
709	9.1.0	true	gen_ai	gen_ai.response.model	keyword	extended		gpt-4-0613	The name of the model that generated the response.
710	9.1.0	true	gen_ai	gen_ai.system	keyword	extended		openai	The Generative AI product as identified by the client or server instrumentation.
711	9.1.0	true	gen_ai	gen_ai.token.type	keyword	extended		input; output	The type of token being counted.
712	9.1.0	true	gen_ai	gen_ai.tool.call.id	keyword	extended		call_mszuSIzqtI65i1wAUOE8w5H4	The tool call identifier.
713	9.1.0	true	gen_ai	gen_ai.tool.name	keyword	extended		Flights	Name of the tool utilized by the agent.
714	9.1.0	true	gen_ai	gen_ai.tool.type	keyword	extended		function; extension; datastore	Type of the tool utilized by the agent
715	9.1.0	true	gen_ai	gen_ai.usage.input_tokens	integer	extended		100	The number of tokens used in the GenAI input (prompt).
716	9.1.0	true	gen_ai	gen_ai.usage.output_tokens	integer	extended		180	The number of tokens used in the GenAI response (completion).
717	9.1.0	true	google_scc	google_scc.asset.access_policy.create_time	date	custom		2023-01-01T00:00:00.000Z	The timestamp when the AccessPolicy was created
718	9.1.0	true	google_scc	google_scc.asset.access_policy.etag	keyword	custom		example-etag	An opaque identifier for the current version of the AccessPolicy
719	9.1.0	true	google_scc	google_scc.asset.access_policy.name	keyword	custom		example-name	The full resource name of the AccessPolicy in VPC Service Controls
720	9.1.0	true	google_scc	google_scc.asset.access_policy.parent	keyword	custom		example-parent	The parent resource of this AccessPolicy in the Cloud Resource Hierarchy
721	9.1.0	true	google_scc	google_scc.asset.access_policy.title	keyword	custom		example-title	A human-readable title for the AccessPolicy
722	9.1.0	true	google_scc	google_scc.asset.access_policy.update_time	date	custom		2023-01-01T00:00:00.000Z	The timestamp when the AccessPolicy was last updated
723	9.1.0	true	google_scc	google_scc.asset.ancestors	nested	custom			The complete ancestry path of the asset in the Google Cloud resource hierarchy
724	9.1.0	true	google_scc	google_scc.asset.asset_type	keyword	custom		example-asset_type	The type of the Google Cloud resource as defined in the Cloud Asset Inventory
725	9.1.0	true	google_scc	google_scc.asset.iam_policy.bindings	nested	custom			The collection of IAM policy bindings that associate members to roles
726	9.1.0	true	google_scc	google_scc.asset.iam_policy.etag	keyword	custom		example-etag	A hash value used to perform optimistic concurrency control
727	9.1.0	true	google_scc	google_scc.asset.iam_policy.version	long	custom		12345	The version number that specifies the format of the IAM policy
728	9.1.0	true	google_scc	google_scc.asset.name	keyword	custom		example-name	The full name of the asset following Google Cloud resource naming conventions
729	9.1.0	true	google_scc	google_scc.asset.org_policy	nested	custom			Organization policy constraints applied to this asset
730	9.1.0	true	google_scc	google_scc.asset.os_inventory.items	nested	custom			Detailed inventory items related to the VM including installed packages
731	9.1.0	true	google_scc	google_scc.asset.os_inventory.name	keyword	custom		example-name	The full resource name of the OS inventory data
732	9.1.0	true	google_scc	google_scc.asset.os_inventory.os_info.architecture	keyword	custom		example-architecture	The system architecture of the operating system
733	9.1.0	true	google_scc	google_scc.asset.os_inventory.os_info.hostname	keyword	custom		example-hostname	The hostname of the virtual machine as reported by the operating system
734	9.1.0	true	google_scc	google_scc.asset.os_inventory.os_info.kernel_release	keyword	custom		example-kernel_release	The release identifier of the operating system kernel
735	9.1.0	true	google_scc	google_scc.asset.os_inventory.os_info.kernel_version	keyword	custom		example-kernel_version	The version of the operating system kernel
736	9.1.0	true	google_scc	google_scc.asset.os_inventory.os_info.long_name	keyword	custom		example-long_name	The complete descriptive name of the operating system
737	9.1.0	true	google_scc	google_scc.asset.os_inventory.os_info.osconfigagent_version	keyword	custom		example-osconfigagent_version	The version of the Google Cloud OS Config agent
738	9.1.0	true	google_scc	google_scc.asset.os_inventory.os_info.short_name	keyword	custom		example-short_name	The abbreviated name of the operating system family
739	9.1.0	true	google_scc	google_scc.asset.os_inventory.os_info.version	keyword	custom		example-version	The version number or identifier of the operating system
740	9.1.0	true	google_scc	google_scc.asset.os_inventory.update_time	date	custom		2023-01-01T00:00:00.000Z	The timestamp when the OS inventory information was last collected
741	9.1.0	true	google_scc	google_scc.asset.prior.ancestors	nested	custom			The ancestry path of the asset in its previous state
742	9.1.0	true	google_scc	google_scc.asset.prior.name	keyword	custom		example-name	The full name of the asset in its previous state
743	9.1.0	true	google_scc	google_scc.asset.prior.resource.data.analyticsEnabled	boolean	custom		True	Boolean indicating whether analytics features were enabled in previous state
744	9.1.0	true	google_scc	google_scc.asset.prior.resource.data.description	keyword	custom		example-description	The description of the resource in its previous state
745	9.1.0	true	google_scc	google_scc.asset.prior.resource.data.lifecycleState	keyword	custom		example-lifecycleState	The lifecycle state of the resource in its previous state
746	9.1.0	true	google_scc	google_scc.asset.prior.resource.data.name	keyword	custom		example-name	The name of the resource data in its previous state
747	9.1.0	true	google_scc	google_scc.asset.prior.resource.data.retentionDays	long	custom		12345	The number of retention days configured for the resource in its previous state
748	9.1.0	true	google_scc	google_scc.asset.prior.resource.discovery.document_uri	keyword	custom		example-document_uri	The URI of the discovery document for the resource in its previous state
749	9.1.0	true	google_scc	google_scc.asset.prior.resource.discovery.name	keyword	custom		example-name	The discovery name of the resource in its previous state
750	9.1.0	true	google_scc	google_scc.asset.prior.resource.location	keyword	custom		example-location	The geographic location of the resource in its previous state
751	9.1.0	true	google_scc	google_scc.asset.prior.resource.parent	keyword	custom		example-parent	The parent resource of the asset in its previous state
752	9.1.0	true	google_scc	google_scc.asset.prior.resource.version	keyword	custom		example-version	The API version of the resource schema in its previous state
753	9.1.0	true	google_scc	google_scc.asset.prior.type	keyword	custom		example-type	The asset type in its previous state before the current change
754	9.1.0	true	google_scc	google_scc.asset.prior.update_time	date	custom		2023-01-01T00:00:00.000Z	The timestamp when the asset was last updated before the current change
755	9.1.0	true	google_scc	google_scc.asset.prior_asset_state	keyword	custom		example-prior_asset_state	The overall state of the asset before the current change
756	9.1.0	true	google_scc	google_scc.asset.related_asset.ancestors	nested	custom			The ancestry path of related assets
757	9.1.0	true	google_scc	google_scc.asset.related_asset.name	keyword	custom		example-name	The full name of assets that are related to this asset
758	9.1.0	true	google_scc	google_scc.asset.related_asset.relationship_type	keyword	custom		example-relationship_type	The type of relationship between this asset and related assets
759	9.1.0	true	google_scc	google_scc.asset.related_asset.type	keyword	custom		example-type	The asset type of related assets that have a relationship with this asset
760	9.1.0	true	google_scc	google_scc.asset.resource.data	text	custom			The complete content and configuration of the resource
761	9.1.0	true	google_scc	google_scc.asset.resource.discovery.document_uri	keyword	custom		example-document_uri	The URI of the discovery document containing the JSON schema for the current resource
762	9.1.0	true	google_scc	google_scc.asset.resource.discovery.name	keyword	custom		example-name	The discovery name of the current resource
763	9.1.0	true	google_scc	google_scc.asset.resource.discovery_document_uri	keyword	custom		example-discovery_document_uri	The URL of the discovery document containing the JSON schema definition
764	9.1.0	true	google_scc	google_scc.asset.resource.discovery_name	keyword	custom		example-discovery_name	The JSON schema name listed in the discovery document
765	9.1.0	true	google_scc	google_scc.asset.resource.location	keyword	custom		example-location	The geographic location or region where the resource is hosted
766	9.1.0	true	google_scc	google_scc.asset.resource.parent	keyword	custom		example-parent	The full name of the immediate parent resource in the Google Cloud resource hierarchy
767	9.1.0	true	google_scc	google_scc.asset.resource.version	keyword	custom		example-version	The API version of the resource schema used to represent this asset
768	9.1.0	true	google_scc	google_scc.asset.type	keyword	custom		example-type	The type of the asset in Google Cloud Asset Inventory
769	9.1.0	true	google_scc	google_scc.asset.update_time	date	custom		2023-01-01T00:00:00.000Z	The timestamp when the asset was last updated
770	9.1.0	true	google_scc	google_scc.asset.window.start_time	date	custom		2023-01-01T00:00:00.000Z	The start time of the time window for asset change detection
771	9.1.0	true	google_scc	google_scc.finding.access.caller_ip	ip	custom		192.168.1.1	The IP address of the entity that triggered the security finding
772	9.1.0	true	google_scc	google_scc.finding.access.caller_ip_geo.region_code	keyword	custom		example-region_code	The geographic region code associated with the caller IP address
773	9.1.0	true	google_scc	google_scc.finding.access.method_name	keyword	custom		example-method_name	The API method or service operation that was accessed when the security event occurred
774	9.1.0	true	google_scc	google_scc.finding.access.principal.email	keyword	custom		example-email	The email address of the authenticated user or service account
775	9.1.0	true	google_scc	google_scc.finding.access.principal.subject	keyword	custom		example-subject	String representation of the identity of the requesting party
776	9.1.0	true	google_scc	google_scc.finding.access.service_account.key_name	keyword	custom		example-key_name	The name of the service account key that was used for authentication
777	9.1.0	true	google_scc	google_scc.finding.access.service_name	keyword	custom		example-service_name	The name of the Google Cloud service that was accessed
778	9.1.0	true	google_scc	google_scc.finding.access.user_agent	keyword	custom		example-user_agent	The user agent string provided by the client that triggered the security finding
779	9.1.0	true	google_scc	google_scc.finding.access.user_name	keyword	custom		example-user_name	The username of the entity involved in the security event
780	9.1.0	true	google_scc	google_scc.finding.canonical_name	keyword	custom		example-canonical_name	The canonical name of the finding in Security Command Center
781	9.1.0	true	google_scc	google_scc.finding.category	keyword	custom		example-category	The additional taxonomy group within findings from a given source
782	9.1.0	true	google_scc	google_scc.finding.class	keyword	custom		example-class	The class of the finding which can be THREAT VULNERABILITY or MISCONFIGURATION
783	9.1.0	true	google_scc	google_scc.finding.compliances	nested	custom			Compliance framework mappings showing how this finding relates to security standards
784	9.1.0	true	google_scc	google_scc.finding.contacts	object	custom			Contact information for individuals or teams responsible for addressing this finding
785	9.1.0	true	google_scc	google_scc.finding.create_time	date	custom		2023-01-01T00:00:00.000Z	The timestamp when the finding was first created in Security Command Center
786	9.1.0	true	google_scc	google_scc.finding.description	keyword	custom		example-description	Contains detailed information about the finding including what was detected
787	9.1.0	true	google_scc	google_scc.finding.event_time	date	custom		2023-01-01T00:00:00.000Z	The timestamp when the underlying security event took place
788	9.1.0	true	google_scc	google_scc.finding.external_systems	object	custom			Information about external security systems that have processed this finding
789	9.1.0	true	google_scc	google_scc.finding.external_uri	keyword	custom		example-external_uri	The URI that points to a web page outside of Security Command Center with additional information
790	9.1.0	true	google_scc	google_scc.finding.kubernetes	object	custom			Kubernetes-specific information for findings related to container workloads
791	9.1.0	true	google_scc	google_scc.finding.log_entries	nested	custom			Related log entries and audit trail information
792	9.1.0	true	google_scc	google_scc.finding.mitre_attack	object	custom			MITRE ATT&CK framework tactics techniques and procedures associated with this finding
793	9.1.0	true	google_scc	google_scc.finding.mute.initiator	keyword	custom		example-initiator	The email address of the user who performed the most recent mute or unmute action
794	9.1.0	true	google_scc	google_scc.finding.mute.state	keyword	custom		example-state	The current mute state of the finding
795	9.1.0	true	google_scc	google_scc.finding.mute.update_time	date	custom		2023-01-01T00:00:00.000Z	The timestamp when the finding was most recently muted or unmuted
796	9.1.0	true	google_scc	google_scc.finding.mute_info	object	custom			Additional structured information about mute operations performed on this finding
797	9.1.0	true	google_scc	google_scc.finding.name	keyword	custom		example-name	The relative resource name of this finding
798	9.1.0	true	google_scc	google_scc.finding.next_steps	keyword	custom		example-next_steps	Recommended steps to address and remediate the finding
799	9.1.0	true	google_scc	google_scc.finding.parent	keyword	custom		example-parent	The relative resource name of the source the finding belongs to
800	9.1.0	true	google_scc	google_scc.finding.parent_display_name	keyword	custom		example-parent_display_name	The human readable display name of the finding source
801	9.1.0	true	google_scc	google_scc.finding.resource	object	custom			Detailed information about the Google Cloud resource associated with this finding
802	9.1.0	true	google_scc	google_scc.finding.resource_name	keyword	custom		example-resource_name	The full resource name of the Google Cloud resource this finding is associated with
803	9.1.0	true	google_scc	google_scc.finding.security_marks	object	custom			User-defined security marks and labels applied to the finding
804	9.1.0	true	google_scc	google_scc.finding.severity	keyword	custom		example-severity	The severity of the finding ranging from LOW to CRITICAL
805	9.1.0	true	google_scc	google_scc.finding.source_id	keyword	custom		example-source_id	The unique identifier of the security source that generated this finding
806	9.1.0	true	google_scc	google_scc.finding.source_properties	object	custom			Source-specific properties and metadata managed by the security source
807	9.1.0	true	google_scc	google_scc.finding.state	keyword	custom		example-state	The state of the finding which can be ACTIVE or INACTIVE
808	9.1.0	true	google_scc	google_scc.finding.vulnerability	object	custom			Detailed vulnerability information including CVE identifiers and CVSS scores
809	9.1.0	true	google_scc	google_scc.source.canonical_name	keyword	custom		example-canonical_name	The canonical name of the Security Command Center source
810	9.1.0	true	google_scc	google_scc.source.description	keyword	custom		example-description	A detailed description of the security source
811	9.1.0	true	google_scc	google_scc.source.display_name	keyword	custom		example-display_name	The human-readable display name of the security source
812	9.1.0	true	google_scc	google_scc.source.id	keyword	custom		example-id	The unique numeric identifier of the security source
813	9.1.0	true	google_scc	google_scc.source.name	keyword	custom		example-name	The full relative resource name of this security source
814	9.1.0	true	group	group.domain	keyword	extended			Name of the directory the group is a member of.
815	9.1.0	true	group	group.id	keyword	extended			Unique identifier for the group on the system/platform.
816	9.1.0	true	group	group.name	keyword	extended			Name of the group.
817	9.1.0	true	host	host.architecture	keyword	core		x86_64	Operating system architecture.
818	9.1.0	true	host	host.boot.id	keyword	extended		88a1f0ed-5ae5-41ee-af6b-41921c311872	Linux boot uuid taken from /proc/sys/kernel/random/boot_id
819	9.1.0	true	host	host.cpu	object	custom		"name": "Intel(R) Core(TM) i7-7700HQ CPU", "cores": 4, "speed": 2800	CPU-related data.
820	9.1.0	true	host	host.cpu.cores	long	custom		4	Number of CPU cores.
821	9.1.0	true	host	host.cpu.name	keyword	custom		Intel(R) Core(TM) i7-7700HQ CPU	CPU Model name.
822	9.1.0	true	host	host.cpu.speed	long	custom		2800	CPU clock speed.
823	9.1.0	true	host	host.cpu.usage	scaled_float	extended			Percent CPU used, between 0 and 1.
824	9.1.0	true	host	host.disk.read.bytes	long	extended			The number of bytes read by all disks.
825	9.1.0	true	host	host.disk.write.bytes	long	extended			The number of bytes written on all disks.
826	9.1.0	true	host	host.domain	keyword	extended		CONTOSO	Name of the directory the group is a member of.
827	9.1.0	true	host	host.geo.city_name	keyword	core		Montreal	City name.
828	9.1.0	true	host	host.geo.continent_code	keyword	core		NA	Continent code.
829	9.1.0	true	host	host.geo.continent_name	keyword	core		North America	Name of the continent.
830	9.1.0	true	host	host.geo.country_iso_code	keyword	core		CA	Country ISO code.
831	9.1.0	true	host	host.geo.country_name	keyword	core		Canada	Country name.
832	9.1.0	true	host	host.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
833	9.1.0	true	host	host.geo.name	keyword	extended		boston-dc	User-defined description of a location.
834	9.1.0	true	host	host.geo.postal_code	keyword	core		94040	Postal code.
835	9.1.0	true	host	host.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
836	9.1.0	true	host	host.geo.region_name	keyword	core		Quebec	Region name.
837	9.1.0	true	host	host.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
838	9.1.0	true	host	host.hostname	keyword	core			Hostname of the host.
839	9.1.0	true	host	host.id	keyword	core			Unique host id.
840	9.1.0	true	host	host.ip	ip	core	array		Host ip addresses.
841	9.1.0	true	host	host.mac	keyword	core	array	["00-00-5E-00-53-23", "00-00-5E-00-53-24"]	Host MAC addresses.
842	9.1.0	true	host	host.memory	object	custom		"total": 100000, "free": 90000, "used": {"percentage": 10}	Memory-related data.
843	9.1.0	true	host	host.memory.free	long	custom		1024	Free memory in MB.
844	9.1.0	true	host	host.memory.total	long	custom		1024	Total memory in MB.
845	9.1.0	true	host	host.memory.used	object	custom		"percentage": 10	Used memory-related data.
846	9.1.0	true	host	host.memory.used.percentage	long	custom		10	Used memory percentage.
847	9.1.0	true	host	host.name	keyword	core			Name of the host.
848	9.1.0	true	host	host.network.egress.bytes	long	extended			The number of bytes sent on all network interfaces.
849	9.1.0	true	host	host.network.egress.drops	long	custom		10	Number of dropped transmitted packets.
850	9.1.0	true	host	host.network.egress.errors	long	custom		10	Number of transmission errors.
851	9.1.0	true	host	host.network.egress.packets	long	extended			The number of packets sent on all network interfaces.
852	9.1.0	true	host	host.network.egress.queue	long	custom		10	Transmit queue length.
853	9.1.0	true	host	host.network.ingress.bytes	long	extended			The number of bytes received on all network interfaces.
854	9.1.0	true	host	host.network.ingress.drops	long	custom		10	Number of dropped received packets.
855	9.1.0	true	host	host.network.ingress.errors	long	custom		10	Number of reception errors.
856	9.1.0	true	host	host.network.ingress.packets	long	extended			The number of packets received on all network interfaces.
857	9.1.0	true	host	host.network.ingress.queue	long	custom		10	Receive queue length.
858	9.1.0	true	host	host.os.family	keyword	extended		debian	OS family (such as redhat, debian, freebsd, windows).
859	9.1.0	true	host	host.os.full	keyword	extended		Mac OS Mojave	Operating system name, including the version or code name.
860	9.1.0	true	host	host.os.kernel	keyword	extended		4.4.0-112-generic	Operating system kernel version as a raw string.
861	9.1.0	true	host	host.os.name	keyword	extended		Mac OS X	Operating system name, without the version.
862	9.1.0	true	host	host.os.platform	keyword	extended		darwin	Operating system platform (such centos, ubuntu, windows).
863	9.1.0	true	host	host.os.type	keyword	extended		macos	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
864	9.1.0	true	host	host.os.version	keyword	extended		10.14.1	Operating system version as a raw string.
865	9.1.0	true	host	host.pid_ns_ino	keyword	extended		256383	Pid namespace inode
866	9.1.0	true	host	host.risk.calculated_level	keyword	extended		High	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
867	9.1.0	true	host	host.risk.calculated_score	float	extended		880.73	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
868	9.1.0	true	host	host.risk.calculated_score_norm	float	extended		88.73	A normalized risk score calculated by an internal system.
869	9.1.0	true	host	host.risk.static_level	keyword	extended		High	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
870	9.1.0	true	host	host.risk.static_score	float	extended		830.0	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
871	9.1.0	true	host	host.risk.static_score_norm	float	extended		83.0	A normalized risk score calculated by an external system.
872	9.1.0	true	host	host.type	keyword	core			Type of host.
873	9.1.0	true	host	host.uptime	long	extended		1325	Seconds the host has been up.
874	9.1.0	true	http	http.request.body.bytes	long	extended		887	Size in bytes of the request body.
875	9.1.0	true	http	http.request.body.content	keyword	extended		Hello world	The full HTTP request body.
876	9.1.0	true	http	http.request.bytes	long	extended		1437	Total size in bytes of the request (body and headers).
877	9.1.0	true	http	http.request.id	keyword	extended		123e4567-e89b-12d3-a456-426614174000	HTTP request ID.
878	9.1.0	true	http	http.request.method	keyword	extended		POST	HTTP request method.
879	9.1.0	true	http	http.request.mime_type	keyword	extended		image/gif	Mime type of the body of the request.
880	9.1.0	true	http	http.request.referrer	keyword	extended		https://blog.example.com/	Referrer for this HTTP request.
881	9.1.0	true	http	http.response.body.bytes	long	extended		887	Size in bytes of the response body.
882	9.1.0	true	http	http.response.body.content	keyword	extended		Hello world	The full HTTP response body.
883	9.1.0	true	http	http.response.bytes	long	extended		1437	Total size in bytes of the response (body and headers).
884	9.1.0	true	http	http.response.mime_type	keyword	extended		image/gif	Mime type of the body of the response.
885	9.1.0	true	http	http.response.status_code	long	extended		404	HTTP response status code.
886	9.1.0	true	http	http.version	keyword	extended		1.1	HTTP version.
887	9.1.0	true	interface	interface.alias	keyword	extended		outside	Interface alias
888	9.1.0	true	interface	interface.id	keyword	extended		10	Interface ID
889	9.1.0	true	interface	interface.mtu	long	custom		1500	Maximum transmission unit size.
890	9.1.0	true	interface	interface.name	keyword	extended		eth0	Interface name
891	9.1.0	true	interface	interface.state	keyword	custom		up	State of the network interface.
892	9.1.0	true	interface	interface.type	keyword	custom		ethernet	Interface type.
893	9.1.0	true	log	log.file.path	keyword	extended		/var/log/fun-times.log	Full path to the log file this event came from.
894	9.1.0	true	log	log.level	keyword	core		error	Log level of the log event.
895	9.1.0	true	log	log.logger	keyword	core		org.elasticsearch.bootstrap.Bootstrap	Name of the logger.
896	9.1.0	true	log	log.origin.file.line	long	extended		42	The line number of the file which originated the log event.
897	9.1.0	true	log	log.origin.file.name	keyword	extended		Bootstrap.java	The code file which originated the log event.
898	9.1.0	true	log	log.origin.function	keyword	extended		init	The function which originated the log event.
899	9.1.0	true	log	log.syslog	object	extended			Syslog metadata
900	9.1.0	true	log	log.syslog.appname	keyword	extended		sshd	The device or application that originated the Syslog message.
901	9.1.0	true	log	log.syslog.facility.code	long	extended		23	Syslog numeric facility of the event.
902	9.1.0	true	log	log.syslog.facility.name	keyword	extended		local7	Syslog text-based facility of the event.
903	9.1.0	true	log	log.syslog.hostname	keyword	extended		example-host	The host that originated the Syslog message.
904	9.1.0	true	log	log.syslog.msgid	keyword	extended		ID47	An identifier for the type of Syslog message.
905	9.1.0	true	log	log.syslog.priority	long	extended		135	Syslog priority of the event.
906	9.1.0	true	log	log.syslog.procid	keyword	extended		12345	The process name or ID that originated the Syslog message.
907	9.1.0	true	log	log.syslog.severity.code	long	extended		3	Syslog numeric severity of the event.
908	9.1.0	true	log	log.syslog.severity.name	keyword	extended		Error	Syslog text-based severity of the event.
909	9.1.0	true	log	log.syslog.structured_data	flat_object	extended			Structured data expressed in RFC 5424 messages.
910	9.1.0	true	log	log.syslog.version	keyword	extended		1	Syslog protocol version.
911	9.1.0	true	metricset	metricset.name	keyword	custom		example-name	Specifies the name of the metric set in the GCP log
912	9.1.0	true	metricset	metricset.period	long	custom		12345	Indicates the period in milliseconds at which metrics are collected
913	9.1.0	true	network	network.application	keyword	extended		aim	Application level protocol name.
914	9.1.0	true	network	network.broadcast	ip	custom		192.168.0.255	Broadcast address.
915	9.1.0	true	network	network.bytes	long	core		368	Total bytes transferred in both directions.
916	9.1.0	true	network	network.community_id	keyword	extended		1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=	A hash of source and destination IPs and ports.
917	9.1.0	true	network	network.dhcp	keyword	custom		enabled	DHCP status (enabled, disabled, unknown, BOOTP).
918	9.1.0	true	network	network.direction	keyword	core		inbound	Direction of the network traffic.
919	9.1.0	true	network	network.forwarded_ip	ip	core		192.1.1.2	Host IP address when the source IP address is the proxy.
920	9.1.0	true	network	network.gateway	ip	custom		192.168.0.1	Gateway address.
921	9.1.0	true	network	network.iana_number	keyword	extended		6	IANA Protocol Number.
922	9.1.0	true	network	network.inner	object	extended			Inner VLAN tag information
923	9.1.0	true	network	network.inner.vlan.id	keyword	extended		10	VLAN ID as reported by the observer.
924	9.1.0	true	network	network.inner.vlan.name	keyword	extended		outside	Optional VLAN name as reported by the observer.
925	9.1.0	true	network	network.metric	long	custom		15	Metric of the network protocol.
926	9.1.0	true	network	network.name	keyword	extended		Guest Wifi	Name given by operators to sections of their network.
927	9.1.0	true	network	network.netmask	ip	custom		255.255.255.0	Network mask
928	9.1.0	true	network	network.packets	long	core		24	Total packets transferred in both directions.
929	9.1.0	true	network	network.protocol	keyword	core		http	Application protocol name.
930	9.1.0	true	network	network.transport	keyword	core		tcp	Protocol Name corresponding to the field `iana_number`.
931	9.1.0	true	network	network.type	keyword	core		ipv4	In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
932	9.1.0	true	network	network.vlan.id	keyword	extended		10	VLAN ID as reported by the observer.
933	9.1.0	true	network	network.vlan.name	keyword	extended		outside	Optional VLAN name as reported by the observer.
934	9.1.0	true	observer	observer.egress	object	extended			Object field for egress information
935	9.1.0	true	observer	observer.egress.interface.alias	keyword	extended		outside	Interface alias
936	9.1.0	true	observer	observer.egress.interface.id	keyword	extended		10	Interface ID
937	9.1.0	true	observer	observer.egress.interface.mtu	long	custom		1500	Maximum transmission unit size.
938	9.1.0	true	observer	observer.egress.interface.name	keyword	extended		eth0	Interface name
939	9.1.0	true	observer	observer.egress.interface.observer.ingress.interface.alias	keyword	extended		outside	Interface alias
940	9.1.0	true	observer	observer.egress.interface.observer.ingress.interface.id	keyword	extended		10	Interface ID
941	9.1.0	true	observer	observer.egress.interface.observer.ingress.interface.mtu	long	custom		1500	Maximum transmission unit size.
942	9.1.0	true	observer	observer.egress.interface.observer.ingress.interface.name	keyword	extended		eth0	Interface name
943	9.1.0	true	observer	observer.egress.interface.observer.ingress.interface.state	keyword	custom		up	State of the network interface.
944	9.1.0	true	observer	observer.egress.interface.observer.ingress.interface.type	keyword	custom		ethernet	Interface type.
945	9.1.0	true	observer	observer.egress.interface.state	keyword	custom		up	State of the network interface.
946	9.1.0	true	observer	observer.egress.interface.type	keyword	custom		ethernet	Interface type.
947	9.1.0	true	observer	observer.egress.vlan.id	keyword	extended		10	VLAN ID as reported by the observer.
948	9.1.0	true	observer	observer.egress.vlan.name	keyword	extended		outside	Optional VLAN name as reported by the observer.
949	9.1.0	true	observer	observer.egress.zone	keyword	extended		Public_Internet	Observer Egress zone
950	9.1.0	true	observer	observer.geo.city_name	keyword	core		Montreal	City name.
951	9.1.0	true	observer	observer.geo.continent_code	keyword	core		NA	Continent code.
952	9.1.0	true	observer	observer.geo.continent_name	keyword	core		North America	Name of the continent.
953	9.1.0	true	observer	observer.geo.country_iso_code	keyword	core		CA	Country ISO code.
954	9.1.0	true	observer	observer.geo.country_name	keyword	core		Canada	Country name.
955	9.1.0	true	observer	observer.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
956	9.1.0	true	observer	observer.geo.name	keyword	extended		boston-dc	User-defined description of a location.
957	9.1.0	true	observer	observer.geo.postal_code	keyword	core		94040	Postal code.
958	9.1.0	true	observer	observer.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
959	9.1.0	true	observer	observer.geo.region_name	keyword	core		Quebec	Region name.
960	9.1.0	true	observer	observer.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
961	9.1.0	true	observer	observer.hostname	keyword	core			Hostname of the observer.
962	9.1.0	true	observer	observer.ingress	object	extended			Object field for ingress information
963	9.1.0	true	observer	observer.ingress.interface.alias	keyword	extended		outside	Interface alias
964	9.1.0	true	observer	observer.ingress.interface.id	keyword	extended		10	Interface ID
965	9.1.0	true	observer	observer.ingress.interface.mtu	long	custom		1500	Maximum transmission unit size.
966	9.1.0	true	observer	observer.ingress.interface.name	keyword	extended		eth0	Interface name
967	9.1.0	true	observer	observer.ingress.interface.state	keyword	custom		up	State of the network interface.
968	9.1.0	true	observer	observer.ingress.interface.type	keyword	custom		ethernet	Interface type.
969	9.1.0	true	observer	observer.ingress.vlan.id	keyword	extended		10	VLAN ID as reported by the observer.
970	9.1.0	true	observer	observer.ingress.vlan.name	keyword	extended		outside	Optional VLAN name as reported by the observer.
971	9.1.0	true	observer	observer.ingress.zone	keyword	extended		DMZ	Observer ingress zone
972	9.1.0	true	observer	observer.ip	ip	core	array		IP addresses of the observer.
973	9.1.0	true	observer	observer.mac	keyword	core	array	["00-00-5E-00-53-23", "00-00-5E-00-53-24"]	MAC addresses of the observer.
974	9.1.0	true	observer	observer.name	keyword	extended		1_proxySG	Custom name of the observer.
975	9.1.0	true	observer	observer.os.family	keyword	extended		debian	OS family (such as redhat, debian, freebsd, windows).
976	9.1.0	true	observer	observer.os.full	keyword	extended		Mac OS Mojave	Operating system name, including the version or code name.
977	9.1.0	true	observer	observer.os.kernel	keyword	extended		4.4.0-112-generic	Operating system kernel version as a raw string.
978	9.1.0	true	observer	observer.os.name	keyword	extended		Mac OS X	Operating system name, without the version.
979	9.1.0	true	observer	observer.os.platform	keyword	extended		darwin	Operating system platform (such centos, ubuntu, windows).
980	9.1.0	true	observer	observer.os.type	keyword	extended		macos	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
981	9.1.0	true	observer	observer.os.version	keyword	extended		10.14.1	Operating system version as a raw string.
982	9.1.0	true	observer	observer.product	keyword	extended		s200	The product name of the observer.
983	9.1.0	true	observer	observer.serial_number	keyword	extended			Observer serial number.
984	9.1.0	true	observer	observer.type	keyword	core		firewall	The type of the observer the data is coming from.
985	9.1.0	true	observer	observer.vendor	keyword	core		Symantec	Vendor name of the observer.
986	9.1.0	true	observer	observer.version	keyword	core			Observer version.
987	9.1.0	true	orchestrator	orchestrator.api_version	keyword	extended		v1beta1	API version being used to carry out the action
988	9.1.0	true	orchestrator	orchestrator.cluster.id	keyword	extended			Unique ID of the cluster.
989	9.1.0	true	orchestrator	orchestrator.cluster.name	keyword	extended			Name of the cluster.
990	9.1.0	true	orchestrator	orchestrator.cluster.url	keyword	extended			URL of the API used to manage the cluster.
991	9.1.0	true	orchestrator	orchestrator.cluster.version	keyword	extended			The version of the cluster.
992	9.1.0	true	orchestrator	orchestrator.namespace	keyword	extended		kube-system	Namespace in which the action is taking place.
993	9.1.0	true	orchestrator	orchestrator.organization	keyword	extended		elastic	Organization affected by the event (for multi-tenant orchestrator setups).
994	9.1.0	true	orchestrator	orchestrator.resource.annotation	keyword	extended	array	['key1:value1', 'key2:value2', 'key3:value3']	The list of annotations added to the resource.
995	9.1.0	true	orchestrator	orchestrator.resource.id	keyword	extended			Unique ID of the resource being acted upon.
996	9.1.0	true	orchestrator	orchestrator.resource.ip	ip	extended	array		IP address assigned to the resource associated with the event being observed.
997	9.1.0	true	orchestrator	orchestrator.resource.label	keyword	extended	array	['key1:value1', 'key2:value2', 'key3:value3']	The list of labels added to the resource.
998	9.1.0	true	orchestrator	orchestrator.resource.name	keyword	extended		test-pod-cdcws	Name of the resource being acted upon.
999	9.1.0	true	orchestrator	orchestrator.resource.parent.type	keyword	extended		DaemonSet	Type or kind of the parent resource associated with the event being observed.
1000	9.1.0	true	orchestrator	orchestrator.resource.type	keyword	extended		service	Type of resource being acted upon.
1001	9.1.0	true	orchestrator	orchestrator.type	keyword	extended		kubernetes	Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).
1002	9.1.0	true	organization	organization.id	keyword	extended			Unique identifier for the organization.
1003	9.1.0	true	organization	organization.name	keyword	extended			Organization name.
1004	9.1.0	true	package	package.architecture	keyword	extended		x86_64	Package architecture.
1005	9.1.0	true	package	package.build_version	keyword	extended		36f4f7e89dd61b0988b12ee000b98966867710cd	Build version information
1006	9.1.0	true	package	package.checksum	keyword	extended		68b329da9893e34099c7d8ad5cb9c940	Checksum of the installed package for verification.
1007	9.1.0	true	package	package.description	keyword	extended		Open source programming language to build simple/reliable/efficient software.	Description of the package.
1008	9.1.0	true	package	package.install_scope	keyword	extended		global	Indicating how the package was installed, e.g. user-local, global.
1009	9.1.0	true	package	package.installed	date	extended			Time when package was installed.
1010	9.1.0	true	package	package.license	keyword	extended		Apache License 2.0	Package license
1011	9.1.0	true	package	package.name	keyword	extended		go	Package name
1012	9.1.0	true	package	package.path	keyword	extended		/usr/local/Cellar/go/1.12.9/	Path where the package is installed.
1013	9.1.0	true	package	package.reference	keyword	extended		https://golang.org	Package home page or reference URL
1014	9.1.0	true	package	package.size	long	extended		62231	Package size in bytes.
1015	9.1.0	true	package	package.type	keyword	extended		rpm	Package type
1016	9.1.0	true	package	package.version	keyword	extended		1.12.9	Package version
1017	9.1.0	true	policy	policy.description	keyword	custom		"The CIS Microsoft Windows 11 Enterprise Benchmark v1.0.0 is a comprehensive security configuration guide that provides prescriptive guidance for establishing a secure baseline configuration for Microsoft Windows 11 Enterprise."	Extended description of the policy.
1018	9.1.0	true	policy	policy.file	keyword	custom		cis_win11_enterprise.yml	The file name of the SCA policy.
1019	9.1.0	true	policy	policy.id	keyword	custom		cis_win11_enterprise_21H2	The ID of the SCA policy.
1020	9.1.0	true	policy	policy.name	keyword	custom		CIS Microsoft Windows 11 Enterprise Benchmark v1.0.0	The name of the SCA policy.
1021	9.1.0	true	policy	policy.references	keyword	custom	array	["https://www.cisecurity.org/cis-benchmarks/"]	References for the policy.
1022	9.1.0	true	process	process.args	keyword	extended	array	["/usr/bin/ssh", "-l", "user", "10.0.0.16"]	Array of process arguments.
1023	9.1.0	true	process	process.args_count	long	extended		4	Length of the process.args array.
1024	9.1.0	true	process	process.code_signature.digest_algorithm	keyword	extended		sha256	Hashing algorithm used to sign the process.
1025	9.1.0	true	process	process.code_signature.exists	boolean	core		true	Boolean to capture if a signature is present.
1026	9.1.0	true	process	process.code_signature.flags	keyword	extended		570522385	Code signing flags of the process
1027	9.1.0	true	process	process.code_signature.signing_id	keyword	extended		com.apple.xpc.proxy	The identifier used to sign the process.
1028	9.1.0	true	process	process.code_signature.status	keyword	extended		ERROR_UNTRUSTED_ROOT	Additional information about the certificate status.
1029	9.1.0	true	process	process.code_signature.subject_name	keyword	core		Microsoft Corporation	Subject name of the code signer
1030	9.1.0	true	process	process.code_signature.team_id	keyword	extended		EQHXZ8M8AV	The team identifier used to sign the process.
1031	9.1.0	true	process	process.code_signature.thumbprint_sha256	keyword	extended		c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b	SHA256 hash of the certificate.
1032	9.1.0	true	process	process.code_signature.timestamp	date	extended		2021-01-01T12:10:30Z	When the signature was generated and signed.
1033	9.1.0	true	process	process.code_signature.trusted	boolean	extended		true	Stores the trust status of the certificate chain.
1034	9.1.0	true	process	process.code_signature.valid	boolean	extended		true	Boolean to capture if the digital signature is verified against the binary content.
1035	9.1.0	true	process	process.command_line	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
1036	9.1.0	true	process	process.elf.architecture	keyword	extended		x86-64	Machine architecture of the ELF file.
1037	9.1.0	true	process	process.elf.byte_order	keyword	extended		Little Endian	Byte sequence of ELF file.
1038	9.1.0	true	process	process.elf.cpu_type	keyword	extended		Intel	CPU type of the ELF file.
1039	9.1.0	true	process	process.elf.creation_date	date	extended			Build or compile date.
1040	9.1.0	true	process	process.elf.exports	flat_object	extended	array		List of exported element names and types.
1041	9.1.0	true	process	process.elf.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in an ELF file.
1042	9.1.0	true	process	process.elf.go_imports	flat_object	extended			List of imported Go language element names and types.
1043	9.1.0	true	process	process.elf.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1044	9.1.0	true	process	process.elf.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1045	9.1.0	true	process	process.elf.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1046	9.1.0	true	process	process.elf.header.abi_version	keyword	extended			Version of the ELF Application Binary Interface (ABI).
1047	9.1.0	true	process	process.elf.header.class	keyword	extended			Header class of the ELF file.
1048	9.1.0	true	process	process.elf.header.data	keyword	extended			Data table of the ELF header.
1049	9.1.0	true	process	process.elf.header.entrypoint	long	extended			Header entrypoint of the ELF file.
1050	9.1.0	true	process	process.elf.header.object_version	keyword	extended			"0x1" for original ELF files.
1051	9.1.0	true	process	process.elf.header.os_abi	keyword	extended			Application Binary Interface (ABI) of the Linux OS.
1052	9.1.0	true	process	process.elf.header.type	keyword	extended			Header type of the ELF file.
1053	9.1.0	true	process	process.elf.header.version	keyword	extended			Version of the ELF header.
1054	9.1.0	true	process	process.elf.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in an ELF file.
1055	9.1.0	true	process	process.elf.imports	flat_object	extended	array		List of imported element names and types.
1056	9.1.0	true	process	process.elf.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1057	9.1.0	true	process	process.elf.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1058	9.1.0	true	process	process.elf.sections	nested	extended	array		Section information of the ELF file.
1059	9.1.0	true	process	process.elf.sections.chi2	long	extended			Chi-square probability distribution of the section.
1060	9.1.0	true	process	process.elf.sections.entropy	long	extended			Shannon entropy calculation from the section.
1061	9.1.0	true	process	process.elf.sections.flags	keyword	extended			ELF Section List flags.
1062	9.1.0	true	process	process.elf.sections.name	keyword	extended			ELF Section List name.
1063	9.1.0	true	process	process.elf.sections.physical_offset	keyword	extended			ELF Section List offset.
1064	9.1.0	true	process	process.elf.sections.physical_size	long	extended			ELF Section List physical size.
1065	9.1.0	true	process	process.elf.sections.type	keyword	extended			ELF Section List type.
1066	9.1.0	true	process	process.elf.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1067	9.1.0	true	process	process.elf.sections.virtual_address	long	extended			ELF Section List virtual address.
1068	9.1.0	true	process	process.elf.sections.virtual_size	long	extended			ELF Section List virtual size.
1069	9.1.0	true	process	process.elf.segments	nested	extended	array		ELF object segment list.
1070	9.1.0	true	process	process.elf.segments.sections	keyword	extended			ELF object segment sections.
1071	9.1.0	true	process	process.elf.segments.type	keyword	extended			ELF object segment type.
1072	9.1.0	true	process	process.elf.shared_libraries	keyword	extended	array		List of shared libraries used by this ELF object.
1073	9.1.0	true	process	process.elf.telfhash	keyword	extended			telfhash hash for ELF file.
1074	9.1.0	true	process	process.end	date	extended		2016-05-23T08:05:34.853Z	The time the process ended.
1075	9.1.0	true	process	process.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
1076	9.1.0	true	process	process.entry_leader.args	keyword	extended	array	["/usr/bin/ssh", "-l", "user", "10.0.0.16"]	Array of process arguments.
1077	9.1.0	true	process	process.entry_leader.args_count	long	extended		4	Length of the process.args array.
1078	9.1.0	true	process	process.entry_leader.attested_groups.name	keyword	extended			Name of the group.
1079	9.1.0	true	process	process.entry_leader.attested_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1080	9.1.0	true	process	process.entry_leader.attested_user.name	keyword	core		a.einstein	Short name or login of the user.
1081	9.1.0	true	process	process.entry_leader.command_line	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
1082	9.1.0	true	process	process.entry_leader.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
1083	9.1.0	true	process	process.entry_leader.entry_meta.source.ip	ip	core			IP address of the source.
1084	9.1.0	true	process	process.entry_leader.entry_meta.type	keyword	extended			The entry type for the entry session leader.
1085	9.1.0	true	process	process.entry_leader.executable	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
1086	9.1.0	true	process	process.entry_leader.group.id	keyword	extended			Unique identifier for the group on the system/platform.
1087	9.1.0	true	process	process.entry_leader.group.name	keyword	extended			Name of the group.
1088	9.1.0	true	process	process.entry_leader.interactive	boolean	extended		True	Whether the process is connected to an interactive shell.
1089	9.1.0	true	process	process.entry_leader.name	keyword	extended		ssh	Process name.
1090	9.1.0	true	process	process.entry_leader.parent.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
1091	9.1.0	true	process	process.entry_leader.parent.pid	long	core		4242	Process id.
1092	9.1.0	true	process	process.entry_leader.parent.session_leader.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
1093	9.1.0	true	process	process.entry_leader.parent.session_leader.pid	long	core		4242	Process id.
1094	9.1.0	true	process	process.entry_leader.parent.session_leader.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
1095	9.1.0	true	process	process.entry_leader.parent.session_leader.vpid	long	core		4242	Virtual process id.
1096	9.1.0	true	process	process.entry_leader.parent.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
1097	9.1.0	true	process	process.entry_leader.parent.vpid	long	core		4242	Virtual process id.
1098	9.1.0	true	process	process.entry_leader.pid	long	core		4242	Process id.
1099	9.1.0	true	process	process.entry_leader.real_group.id	keyword	extended			Unique identifier for the group on the system/platform.
1100	9.1.0	true	process	process.entry_leader.real_group.name	keyword	extended			Name of the group.
1101	9.1.0	true	process	process.entry_leader.real_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1102	9.1.0	true	process	process.entry_leader.real_user.name	keyword	core		a.einstein	Short name or login of the user.
1103	9.1.0	true	process	process.entry_leader.same_as_process	boolean	extended		True	This boolean is used to identify if a leader process is the same as the top level process.
1104	9.1.0	true	process	process.entry_leader.saved_group.id	keyword	extended			Unique identifier for the group on the system/platform.
1105	9.1.0	true	process	process.entry_leader.saved_group.name	keyword	extended			Name of the group.
1106	9.1.0	true	process	process.entry_leader.saved_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1107	9.1.0	true	process	process.entry_leader.saved_user.name	keyword	core		a.einstein	Short name or login of the user.
1108	9.1.0	true	process	process.entry_leader.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
1109	9.1.0	true	process	process.entry_leader.supplemental_groups.id	keyword	extended			Unique identifier for the group on the system/platform.
1110	9.1.0	true	process	process.entry_leader.supplemental_groups.name	keyword	extended			Name of the group.
1111	9.1.0	true	process	process.entry_leader.tty	object	extended			Information about the controlling TTY device.
1112	9.1.0	true	process	process.entry_leader.tty.char_device.major	long	extended		4	The TTY character device's major number.
1113	9.1.0	true	process	process.entry_leader.tty.char_device.minor	long	extended		1	The TTY character device's minor number.
1114	9.1.0	true	process	process.entry_leader.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1115	9.1.0	true	process	process.entry_leader.user.name	keyword	core		a.einstein	Short name or login of the user.
1116	9.1.0	true	process	process.entry_leader.vpid	long	core		4242	Virtual process id.
1117	9.1.0	true	process	process.entry_leader.working_directory	keyword	extended		/home/alice	The working directory of the process.
1118	9.1.0	true	process	process.env_vars	keyword	extended	array	["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]	Array of environment variable bindings.
1119	9.1.0	true	process	process.executable	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
1120	9.1.0	true	process	process.exit_code	long	extended		137	The exit code of the process.
1121	9.1.0	true	process	process.group.id	keyword	extended			Unique identifier for the group on the system/platform.
1122	9.1.0	true	process	process.group.name	keyword	extended			Name of the group.
1123	9.1.0	true	process	process.group_leader.args	keyword	extended	array	["/usr/bin/ssh", "-l", "user", "10.0.0.16"]	Array of process arguments.
1124	9.1.0	true	process	process.group_leader.args_count	long	extended		4	Length of the process.args array.
1125	9.1.0	true	process	process.group_leader.command_line	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
1126	9.1.0	true	process	process.group_leader.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
1127	9.1.0	true	process	process.group_leader.executable	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
1128	9.1.0	true	process	process.group_leader.group.id	keyword	extended			Unique identifier for the group on the system/platform.
1129	9.1.0	true	process	process.group_leader.group.name	keyword	extended			Name of the group.
1130	9.1.0	true	process	process.group_leader.interactive	boolean	extended		True	Whether the process is connected to an interactive shell.
1131	9.1.0	true	process	process.group_leader.name	keyword	extended		ssh	Process name.
1132	9.1.0	true	process	process.group_leader.pid	long	core		4242	Process id.
1133	9.1.0	true	process	process.group_leader.real_group.id	keyword	extended			Unique identifier for the group on the system/platform.
1134	9.1.0	true	process	process.group_leader.real_group.name	keyword	extended			Name of the group.
1135	9.1.0	true	process	process.group_leader.real_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1136	9.1.0	true	process	process.group_leader.real_user.name	keyword	core		a.einstein	Short name or login of the user.
1137	9.1.0	true	process	process.group_leader.same_as_process	boolean	extended		True	This boolean is used to identify if a leader process is the same as the top level process.
1138	9.1.0	true	process	process.group_leader.saved_group.id	keyword	extended			Unique identifier for the group on the system/platform.
1139	9.1.0	true	process	process.group_leader.saved_group.name	keyword	extended			Name of the group.
1140	9.1.0	true	process	process.group_leader.saved_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1141	9.1.0	true	process	process.group_leader.saved_user.name	keyword	core		a.einstein	Short name or login of the user.
1142	9.1.0	true	process	process.group_leader.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
1143	9.1.0	true	process	process.group_leader.supplemental_groups.id	keyword	extended			Unique identifier for the group on the system/platform.
1144	9.1.0	true	process	process.group_leader.supplemental_groups.name	keyword	extended			Name of the group.
1145	9.1.0	true	process	process.group_leader.tty	object	extended			Information about the controlling TTY device.
1146	9.1.0	true	process	process.group_leader.tty.char_device.major	long	extended		4	The TTY character device's major number.
1147	9.1.0	true	process	process.group_leader.tty.char_device.minor	long	extended		1	The TTY character device's minor number.
1148	9.1.0	true	process	process.group_leader.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1149	9.1.0	true	process	process.group_leader.user.name	keyword	core		a.einstein	Short name or login of the user.
1150	9.1.0	true	process	process.group_leader.vpid	long	core		4242	Virtual process id.
1151	9.1.0	true	process	process.group_leader.working_directory	keyword	extended		/home/alice	The working directory of the process.
1152	9.1.0	true	process	process.hash.cdhash	keyword	extended		3783b4052fd474dbe30676b45c329e7a6d44acd9	The Code Directory (CD) hash of an executable.
1153	9.1.0	true	process	process.hash.md5	keyword	extended			MD5 hash.
1154	9.1.0	true	process	process.hash.sha1	keyword	extended			SHA1 hash.
1155	9.1.0	true	process	process.hash.sha256	keyword	extended			SHA256 hash.
1156	9.1.0	true	process	process.hash.sha384	keyword	extended			SHA384 hash.
1157	9.1.0	true	process	process.hash.sha512	keyword	extended			SHA512 hash.
1158	9.1.0	true	process	process.hash.ssdeep	keyword	extended			SSDEEP hash.
1159	9.1.0	true	process	process.hash.tlsh	keyword	extended			TLSH hash.
1160	9.1.0	true	process	process.interactive	boolean	extended		True	Whether the process is connected to an interactive shell.
1161	9.1.0	true	process	process.io	object	extended			A chunk of input or output (IO) from a single process.
1162	9.1.0	true	process	process.io.bytes_skipped	object	extended	array		An array of byte offsets and lengths denoting where IO data has been skipped.
1163	9.1.0	true	process	process.io.bytes_skipped.length	long	extended			The length of bytes skipped.
1164	9.1.0	true	process	process.io.bytes_skipped.offset	long	extended			The byte offset into this event's io.text (or io.bytes in the future) where length bytes were skipped.
1165	9.1.0	true	process	process.io.max_bytes_per_process_exceeded	boolean	extended			If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.
1166	9.1.0	true	process	process.io.text	keyword	extended			A chunk of output or input sanitized to UTF-8.
1167	9.1.0	true	process	process.io.total_bytes_captured	long	extended			The total number of bytes captured in this event.
1168	9.1.0	true	process	process.io.total_bytes_skipped	long	extended			The total number of bytes that were not captured due to implementation restrictions such as buffer size limits.
1169	9.1.0	true	process	process.io.type	keyword	extended			The type of object on which the IO action (read or write) was taken.
1170	9.1.0	true	process	process.macho.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a Mach-O file.
1171	9.1.0	true	process	process.macho.go_imports	flat_object	extended			List of imported Go language element names and types.
1172	9.1.0	true	process	process.macho.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1173	9.1.0	true	process	process.macho.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1174	9.1.0	true	process	process.macho.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1175	9.1.0	true	process	process.macho.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a Mach-O file.
1176	9.1.0	true	process	process.macho.imports	flat_object	extended	array		List of imported element names and types.
1177	9.1.0	true	process	process.macho.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1178	9.1.0	true	process	process.macho.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1179	9.1.0	true	process	process.macho.sections	nested	extended	array		Section information of the Mach-O file.
1180	9.1.0	true	process	process.macho.sections.entropy	long	extended			Shannon entropy calculation from the section.
1181	9.1.0	true	process	process.macho.sections.name	keyword	extended			Mach-O Section List name.
1182	9.1.0	true	process	process.macho.sections.physical_size	long	extended			Mach-O Section List physical size.
1183	9.1.0	true	process	process.macho.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1184	9.1.0	true	process	process.macho.sections.virtual_size	long	extended			Mach-O Section List virtual size. This is always the same as `physical_size`.
1185	9.1.0	true	process	process.macho.symhash	keyword	extended		d3ccf195b62a9279c3c19af1080497ec	A hash of the imports in a Mach-O file.
1186	9.1.0	true	process	process.name	keyword	extended		ssh	Process name.
1187	9.1.0	true	process	process.parent.args	keyword	extended	array	["/usr/bin/ssh", "-l", "user", "10.0.0.16"]	Array of process arguments.
1188	9.1.0	true	process	process.parent.args_count	long	extended		4	Length of the process.args array.
1189	9.1.0	true	process	process.parent.code_signature.digest_algorithm	keyword	extended		sha256	Hashing algorithm used to sign the process.
1190	9.1.0	true	process	process.parent.code_signature.exists	boolean	core		true	Boolean to capture if a signature is present.
1191	9.1.0	true	process	process.parent.code_signature.flags	keyword	extended		570522385	Code signing flags of the process
1192	9.1.0	true	process	process.parent.code_signature.signing_id	keyword	extended		com.apple.xpc.proxy	The identifier used to sign the process.
1193	9.1.0	true	process	process.parent.code_signature.status	keyword	extended		ERROR_UNTRUSTED_ROOT	Additional information about the certificate status.
1194	9.1.0	true	process	process.parent.code_signature.subject_name	keyword	core		Microsoft Corporation	Subject name of the code signer
1195	9.1.0	true	process	process.parent.code_signature.team_id	keyword	extended		EQHXZ8M8AV	The team identifier used to sign the process.
1196	9.1.0	true	process	process.parent.code_signature.thumbprint_sha256	keyword	extended		c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b	SHA256 hash of the certificate.
1197	9.1.0	true	process	process.parent.code_signature.timestamp	date	extended		2021-01-01T12:10:30Z	When the signature was generated and signed.
1198	9.1.0	true	process	process.parent.code_signature.trusted	boolean	extended		true	Stores the trust status of the certificate chain.
1199	9.1.0	true	process	process.parent.code_signature.valid	boolean	extended		true	Boolean to capture if the digital signature is verified against the binary content.
1200	9.1.0	true	process	process.parent.command_line	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
1201	9.1.0	true	process	process.parent.elf.architecture	keyword	extended		x86-64	Machine architecture of the ELF file.
1202	9.1.0	true	process	process.parent.elf.byte_order	keyword	extended		Little Endian	Byte sequence of ELF file.
1203	9.1.0	true	process	process.parent.elf.cpu_type	keyword	extended		Intel	CPU type of the ELF file.
1204	9.1.0	true	process	process.parent.elf.creation_date	date	extended			Build or compile date.
1205	9.1.0	true	process	process.parent.elf.exports	flat_object	extended	array		List of exported element names and types.
1206	9.1.0	true	process	process.parent.elf.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in an ELF file.
1207	9.1.0	true	process	process.parent.elf.go_imports	flat_object	extended			List of imported Go language element names and types.
1208	9.1.0	true	process	process.parent.elf.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1209	9.1.0	true	process	process.parent.elf.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1210	9.1.0	true	process	process.parent.elf.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1211	9.1.0	true	process	process.parent.elf.header.abi_version	keyword	extended			Version of the ELF Application Binary Interface (ABI).
1212	9.1.0	true	process	process.parent.elf.header.class	keyword	extended			Header class of the ELF file.
1213	9.1.0	true	process	process.parent.elf.header.data	keyword	extended			Data table of the ELF header.
1214	9.1.0	true	process	process.parent.elf.header.entrypoint	long	extended			Header entrypoint of the ELF file.
1215	9.1.0	true	process	process.parent.elf.header.object_version	keyword	extended			"0x1" for original ELF files.
1216	9.1.0	true	process	process.parent.elf.header.os_abi	keyword	extended			Application Binary Interface (ABI) of the Linux OS.
1217	9.1.0	true	process	process.parent.elf.header.type	keyword	extended			Header type of the ELF file.
1218	9.1.0	true	process	process.parent.elf.header.version	keyword	extended			Version of the ELF header.
1219	9.1.0	true	process	process.parent.elf.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in an ELF file.
1220	9.1.0	true	process	process.parent.elf.imports	flat_object	extended	array		List of imported element names and types.
1221	9.1.0	true	process	process.parent.elf.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1222	9.1.0	true	process	process.parent.elf.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1223	9.1.0	true	process	process.parent.elf.sections	nested	extended	array		Section information of the ELF file.
1224	9.1.0	true	process	process.parent.elf.sections.chi2	long	extended			Chi-square probability distribution of the section.
1225	9.1.0	true	process	process.parent.elf.sections.entropy	long	extended			Shannon entropy calculation from the section.
1226	9.1.0	true	process	process.parent.elf.sections.flags	keyword	extended			ELF Section List flags.
1227	9.1.0	true	process	process.parent.elf.sections.name	keyword	extended			ELF Section List name.
1228	9.1.0	true	process	process.parent.elf.sections.physical_offset	keyword	extended			ELF Section List offset.
1229	9.1.0	true	process	process.parent.elf.sections.physical_size	long	extended			ELF Section List physical size.
1230	9.1.0	true	process	process.parent.elf.sections.type	keyword	extended			ELF Section List type.
1231	9.1.0	true	process	process.parent.elf.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1232	9.1.0	true	process	process.parent.elf.sections.virtual_address	long	extended			ELF Section List virtual address.
1233	9.1.0	true	process	process.parent.elf.sections.virtual_size	long	extended			ELF Section List virtual size.
1234	9.1.0	true	process	process.parent.elf.segments	nested	extended	array		ELF object segment list.
1235	9.1.0	true	process	process.parent.elf.segments.sections	keyword	extended			ELF object segment sections.
1236	9.1.0	true	process	process.parent.elf.segments.type	keyword	extended			ELF object segment type.
1237	9.1.0	true	process	process.parent.elf.shared_libraries	keyword	extended	array		List of shared libraries used by this ELF object.
1238	9.1.0	true	process	process.parent.elf.telfhash	keyword	extended			telfhash hash for ELF file.
1239	9.1.0	true	process	process.parent.end	date	extended		2016-05-23T08:05:34.853Z	The time the process ended.
1240	9.1.0	true	process	process.parent.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
1241	9.1.0	true	process	process.parent.executable	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
1242	9.1.0	true	process	process.parent.exit_code	long	extended		137	The exit code of the process.
1243	9.1.0	true	process	process.parent.group.id	keyword	extended			Unique identifier for the group on the system/platform.
1244	9.1.0	true	process	process.parent.group.name	keyword	extended			Name of the group.
1245	9.1.0	true	process	process.parent.group_leader.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
1246	9.1.0	true	process	process.parent.group_leader.pid	long	core		4242	Process id.
1247	9.1.0	true	process	process.parent.group_leader.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
1248	9.1.0	true	process	process.parent.group_leader.vpid	long	core		4242	Virtual process id.
1249	9.1.0	true	process	process.parent.hash.cdhash	keyword	extended		3783b4052fd474dbe30676b45c329e7a6d44acd9	The Code Directory (CD) hash of an executable.
1250	9.1.0	true	process	process.parent.hash.md5	keyword	extended			MD5 hash.
1251	9.1.0	true	process	process.parent.hash.sha1	keyword	extended			SHA1 hash.
1252	9.1.0	true	process	process.parent.hash.sha256	keyword	extended			SHA256 hash.
1253	9.1.0	true	process	process.parent.hash.sha384	keyword	extended			SHA384 hash.
1254	9.1.0	true	process	process.parent.hash.sha512	keyword	extended			SHA512 hash.
1255	9.1.0	true	process	process.parent.hash.ssdeep	keyword	extended			SSDEEP hash.
1256	9.1.0	true	process	process.parent.hash.tlsh	keyword	extended			TLSH hash.
1257	9.1.0	true	process	process.parent.interactive	boolean	extended		True	Whether the process is connected to an interactive shell.
1258	9.1.0	true	process	process.parent.macho.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a Mach-O file.
1259	9.1.0	true	process	process.parent.macho.go_imports	flat_object	extended			List of imported Go language element names and types.
1260	9.1.0	true	process	process.parent.macho.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1261	9.1.0	true	process	process.parent.macho.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1262	9.1.0	true	process	process.parent.macho.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1263	9.1.0	true	process	process.parent.macho.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a Mach-O file.
1264	9.1.0	true	process	process.parent.macho.imports	flat_object	extended	array		List of imported element names and types.
1265	9.1.0	true	process	process.parent.macho.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1266	9.1.0	true	process	process.parent.macho.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1267	9.1.0	true	process	process.parent.macho.sections	nested	extended	array		Section information of the Mach-O file.
1268	9.1.0	true	process	process.parent.macho.sections.entropy	long	extended			Shannon entropy calculation from the section.
1269	9.1.0	true	process	process.parent.macho.sections.name	keyword	extended			Mach-O Section List name.
1270	9.1.0	true	process	process.parent.macho.sections.physical_size	long	extended			Mach-O Section List physical size.
1271	9.1.0	true	process	process.parent.macho.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1272	9.1.0	true	process	process.parent.macho.sections.virtual_size	long	extended			Mach-O Section List virtual size. This is always the same as `physical_size`.
1273	9.1.0	true	process	process.parent.macho.symhash	keyword	extended		d3ccf195b62a9279c3c19af1080497ec	A hash of the imports in a Mach-O file.
1274	9.1.0	true	process	process.parent.name	keyword	extended		ssh	Process name.
1275	9.1.0	true	process	process.parent.pe.architecture	keyword	extended		x64	CPU architecture target for the file.
1276	9.1.0	true	process	process.parent.pe.company	keyword	extended		Microsoft Corporation	Internal company name of the file, provided at compile-time.
1277	9.1.0	true	process	process.parent.pe.description	keyword	extended		Paint	Internal description of the file, provided at compile-time.
1278	9.1.0	true	process	process.parent.pe.file_version	keyword	extended		6.3.9600.17415	Process name.
1279	9.1.0	true	process	process.parent.pe.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a PE file.
1280	9.1.0	true	process	process.parent.pe.go_imports	flat_object	extended			List of imported Go language element names and types.
1281	9.1.0	true	process	process.parent.pe.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1282	9.1.0	true	process	process.parent.pe.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1283	9.1.0	true	process	process.parent.pe.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1284	9.1.0	true	process	process.parent.pe.imphash	keyword	extended		0c6803c4e922103c4dca5963aad36ddf	A hash of the imports in a PE file.
1285	9.1.0	true	process	process.parent.pe.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a PE file.
1286	9.1.0	true	process	process.parent.pe.imports	flat_object	extended	array		List of imported element names and types.
1287	9.1.0	true	process	process.parent.pe.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1288	9.1.0	true	process	process.parent.pe.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1289	9.1.0	true	process	process.parent.pe.original_file_name	keyword	extended		MSPAINT.EXE	Internal name of the file, provided at compile-time.
1290	9.1.0	true	process	process.parent.pe.pehash	keyword	extended		73ff189b63cd6be375a7ff25179a38d347651975	A hash of the PE header and data from one or more PE sections.
1291	9.1.0	true	process	process.parent.pe.product	keyword	extended		Microsoft® Windows® Operating System	Internal product name of the file, provided at compile-time.
1292	9.1.0	true	process	process.parent.pe.sections	nested	extended	array		Section information of the PE file.
1293	9.1.0	true	process	process.parent.pe.sections.entropy	long	extended			Shannon entropy calculation from the section.
1294	9.1.0	true	process	process.parent.pe.sections.name	keyword	extended			PE Section List name.
1295	9.1.0	true	process	process.parent.pe.sections.physical_size	long	extended			PE Section List physical size.
1296	9.1.0	true	process	process.parent.pe.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1297	9.1.0	true	process	process.parent.pe.sections.virtual_size	long	extended			PE Section List virtual size. This is always the same as `physical_size`.
1298	9.1.0	true	process	process.parent.pid	long	core		4242	Process id.
1299	9.1.0	true	process	process.parent.real_group.id	keyword	extended			Unique identifier for the group on the system/platform.
1300	9.1.0	true	process	process.parent.real_group.name	keyword	extended			Name of the group.
1301	9.1.0	true	process	process.parent.real_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1302	9.1.0	true	process	process.parent.real_user.name	keyword	core		a.einstein	Short name or login of the user.
1303	9.1.0	true	process	process.parent.saved_group.id	keyword	extended			Unique identifier for the group on the system/platform.
1304	9.1.0	true	process	process.parent.saved_group.name	keyword	extended			Name of the group.
1305	9.1.0	true	process	process.parent.saved_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1306	9.1.0	true	process	process.parent.saved_user.name	keyword	core		a.einstein	Short name or login of the user.
1307	9.1.0	true	process	process.parent.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
1308	9.1.0	true	process	process.parent.supplemental_groups.id	keyword	extended			Unique identifier for the group on the system/platform.
1309	9.1.0	true	process	process.parent.supplemental_groups.name	keyword	extended			Name of the group.
1310	9.1.0	true	process	process.parent.thread.capabilities.effective	keyword	extended	array	["CAP_BPF", "CAP_SYS_ADMIN"]	Array of capabilities used for permission checks.
1311	9.1.0	true	process	process.parent.thread.capabilities.permitted	keyword	extended	array	["CAP_BPF", "CAP_SYS_ADMIN"]	Array of capabilities a thread could assume.
1312	9.1.0	true	process	process.parent.thread.id	long	extended		4242	Thread ID.
1313	9.1.0	true	process	process.parent.thread.name	keyword	extended		thread-0	Thread name.
1314	9.1.0	true	process	process.parent.title	keyword	extended			Process title.
1315	9.1.0	true	process	process.parent.tty	object	extended			Information about the controlling TTY device.
1316	9.1.0	true	process	process.parent.tty.char_device.major	long	extended		4	The TTY character device's major number.
1317	9.1.0	true	process	process.parent.tty.char_device.minor	long	extended		1	The TTY character device's minor number.
1318	9.1.0	true	process	process.parent.uptime	long	extended		1325	Seconds the process has been up.
1319	9.1.0	true	process	process.parent.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1320	9.1.0	true	process	process.parent.user.name	keyword	core		a.einstein	Short name or login of the user.
1321	9.1.0	true	process	process.parent.vpid	long	core		4242	Virtual process id.
1322	9.1.0	true	process	process.parent.working_directory	keyword	extended		/home/alice	The working directory of the process.
1323	9.1.0	true	process	process.pe.architecture	keyword	extended		x64	CPU architecture target for the file.
1324	9.1.0	true	process	process.pe.company	keyword	extended		Microsoft Corporation	Internal company name of the file, provided at compile-time.
1325	9.1.0	true	process	process.pe.description	keyword	extended		Paint	Internal description of the file, provided at compile-time.
1326	9.1.0	true	process	process.pe.file_version	keyword	extended		6.3.9600.17415	Process name.
1327	9.1.0	true	process	process.pe.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a PE file.
1328	9.1.0	true	process	process.pe.go_imports	flat_object	extended			List of imported Go language element names and types.
1329	9.1.0	true	process	process.pe.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1330	9.1.0	true	process	process.pe.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1331	9.1.0	true	process	process.pe.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1332	9.1.0	true	process	process.pe.imphash	keyword	extended		0c6803c4e922103c4dca5963aad36ddf	A hash of the imports in a PE file.
1333	9.1.0	true	process	process.pe.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a PE file.
1334	9.1.0	true	process	process.pe.imports	flat_object	extended	array		List of imported element names and types.
1335	9.1.0	true	process	process.pe.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1336	9.1.0	true	process	process.pe.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1337	9.1.0	true	process	process.pe.original_file_name	keyword	extended		MSPAINT.EXE	Internal name of the file, provided at compile-time.
1338	9.1.0	true	process	process.pe.pehash	keyword	extended		73ff189b63cd6be375a7ff25179a38d347651975	A hash of the PE header and data from one or more PE sections.
1339	9.1.0	true	process	process.pe.product	keyword	extended		Microsoft® Windows® Operating System	Internal product name of the file, provided at compile-time.
1340	9.1.0	true	process	process.pe.sections	nested	extended	array		Section information of the PE file.
1341	9.1.0	true	process	process.pe.sections.entropy	long	extended			Shannon entropy calculation from the section.
1342	9.1.0	true	process	process.pe.sections.name	keyword	extended			PE Section List name.
1343	9.1.0	true	process	process.pe.sections.physical_size	long	extended			PE Section List physical size.
1344	9.1.0	true	process	process.pe.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1345	9.1.0	true	process	process.pe.sections.virtual_size	long	extended			PE Section List virtual size. This is always the same as `physical_size`.
1346	9.1.0	true	process	process.pid	long	core		4242	Process id.
1347	9.1.0	true	process	process.previous.args	keyword	extended	array	["/usr/bin/ssh", "-l", "user", "10.0.0.16"]	Array of process arguments.
1348	9.1.0	true	process	process.previous.args_count	long	extended		4	Length of the process.args array.
1349	9.1.0	true	process	process.previous.executable	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
1350	9.1.0	true	process	process.real_group.id	keyword	extended			Unique identifier for the group on the system/platform.
1351	9.1.0	true	process	process.real_group.name	keyword	extended			Name of the group.
1352	9.1.0	true	process	process.real_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1353	9.1.0	true	process	process.real_user.name	keyword	core		a.einstein	Short name or login of the user.
1354	9.1.0	true	process	process.saved_group.id	keyword	extended			Unique identifier for the group on the system/platform.
1355	9.1.0	true	process	process.saved_group.name	keyword	extended			Name of the group.
1356	9.1.0	true	process	process.saved_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1357	9.1.0	true	process	process.saved_user.name	keyword	core		a.einstein	Short name or login of the user.
1358	9.1.0	true	process	process.session_leader.args	keyword	extended	array	["/usr/bin/ssh", "-l", "user", "10.0.0.16"]	Array of process arguments.
1359	9.1.0	true	process	process.session_leader.args_count	long	extended		4	Length of the process.args array.
1360	9.1.0	true	process	process.session_leader.command_line	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
1361	9.1.0	true	process	process.session_leader.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
1362	9.1.0	true	process	process.session_leader.executable	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
1363	9.1.0	true	process	process.session_leader.group.id	keyword	extended			Unique identifier for the group on the system/platform.
1364	9.1.0	true	process	process.session_leader.group.name	keyword	extended			Name of the group.
1365	9.1.0	true	process	process.session_leader.interactive	boolean	extended		True	Whether the process is connected to an interactive shell.
1366	9.1.0	true	process	process.session_leader.name	keyword	extended		ssh	Process name.
1367	9.1.0	true	process	process.session_leader.parent.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
1368	9.1.0	true	process	process.session_leader.parent.pid	long	core		4242	Process id.
1369	9.1.0	true	process	process.session_leader.parent.session_leader.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
1370	9.1.0	true	process	process.session_leader.parent.session_leader.pid	long	core		4242	Process id.
1371	9.1.0	true	process	process.session_leader.parent.session_leader.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
1372	9.1.0	true	process	process.session_leader.parent.session_leader.vpid	long	core		4242	Virtual process id.
1373	9.1.0	true	process	process.session_leader.parent.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
1374	9.1.0	true	process	process.session_leader.parent.vpid	long	core		4242	Virtual process id.
1375	9.1.0	true	process	process.session_leader.pid	long	core		4242	Process id.
1376	9.1.0	true	process	process.session_leader.real_group.id	keyword	extended			Unique identifier for the group on the system/platform.
1377	9.1.0	true	process	process.session_leader.real_group.name	keyword	extended			Name of the group.
1378	9.1.0	true	process	process.session_leader.real_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1379	9.1.0	true	process	process.session_leader.real_user.name	keyword	core		a.einstein	Short name or login of the user.
1380	9.1.0	true	process	process.session_leader.same_as_process	boolean	extended		True	This boolean is used to identify if a leader process is the same as the top level process.
1381	9.1.0	true	process	process.session_leader.saved_group.id	keyword	extended			Unique identifier for the group on the system/platform.
1382	9.1.0	true	process	process.session_leader.saved_group.name	keyword	extended			Name of the group.
1383	9.1.0	true	process	process.session_leader.saved_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1384	9.1.0	true	process	process.session_leader.saved_user.name	keyword	core		a.einstein	Short name or login of the user.
1385	9.1.0	true	process	process.session_leader.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
1386	9.1.0	true	process	process.session_leader.supplemental_groups.id	keyword	extended			Unique identifier for the group on the system/platform.
1387	9.1.0	true	process	process.session_leader.supplemental_groups.name	keyword	extended			Name of the group.
1388	9.1.0	true	process	process.session_leader.tty	object	extended			Information about the controlling TTY device.
1389	9.1.0	true	process	process.session_leader.tty.char_device.major	long	extended		4	The TTY character device's major number.
1390	9.1.0	true	process	process.session_leader.tty.char_device.minor	long	extended		1	The TTY character device's minor number.
1391	9.1.0	true	process	process.session_leader.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1392	9.1.0	true	process	process.session_leader.user.name	keyword	core		a.einstein	Short name or login of the user.
1393	9.1.0	true	process	process.session_leader.vpid	long	core		4242	Virtual process id.
1394	9.1.0	true	process	process.session_leader.working_directory	keyword	extended		/home/alice	The working directory of the process.
1395	9.1.0	true	process	process.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
1396	9.1.0	true	process	process.supplemental_groups.id	keyword	extended			Unique identifier for the group on the system/platform.
1397	9.1.0	true	process	process.supplemental_groups.name	keyword	extended			Name of the group.
1398	9.1.0	true	process	process.thread.capabilities.effective	keyword	extended	array	["CAP_BPF", "CAP_SYS_ADMIN"]	Array of capabilities used for permission checks.
1399	9.1.0	true	process	process.thread.capabilities.permitted	keyword	extended	array	["CAP_BPF", "CAP_SYS_ADMIN"]	Array of capabilities a thread could assume.
1400	9.1.0	true	process	process.thread.id	long	extended		4242	Thread ID.
1401	9.1.0	true	process	process.thread.name	keyword	extended		thread-0	Thread name.
1402	9.1.0	true	process	process.title	keyword	extended			Process title.
1403	9.1.0	true	process	process.tty	object	extended			Information about the controlling TTY device.
1404	9.1.0	true	process	process.tty.char_device.major	long	extended		4	The TTY character device's major number.
1405	9.1.0	true	process	process.tty.char_device.minor	long	extended		1	The TTY character device's minor number.
1406	9.1.0	true	process	process.tty.columns	long	extended		80	The number of character columns per line. e.g terminal width
1407	9.1.0	true	process	process.tty.rows	long	extended		24	The number of character rows in the terminal. e.g terminal height
1408	9.1.0	true	process	process.uptime	long	extended		1325	Seconds the process has been up.
1409	9.1.0	true	process	process.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1410	9.1.0	true	process	process.user.name	keyword	core		a.einstein	Short name or login of the user.
1411	9.1.0	true	process	process.vpid	long	core		4242	Virtual process id.
1412	9.1.0	true	process	process.working_directory	keyword	extended		/home/alice	The working directory of the process.
1413	9.1.0	true	registry	registry.data.bytes	keyword	extended		ZQBuAC0AVQBTAAAAZQBuAAAAAAA=	Original bytes written with base64 encoding.
1414	9.1.0	true	registry	registry.data.strings	keyword	core	array	["C:\rta\red_ttp\bin\myapp.exe"]	List of strings representing what was written to the registry.
1415	9.1.0	true	registry	registry.data.type	keyword	core		REG_SZ	Standard registry type for encoding contents
1416	9.1.0	true	registry	registry.hive	keyword	core		HKLM	Abbreviated name for the hive.
1417	9.1.0	true	registry	registry.key	keyword	core		SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	Hive-relative path of keys.
1418	9.1.0	true	registry	registry.path	keyword	core		HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger	Full path, including hive, key and value
1419	9.1.0	true	registry	registry.value	keyword	core		Debugger	Name of the value written.
1420	9.1.0	true	related	related.hash	keyword	extended	array		All the hashes seen on your event.
1421	9.1.0	true	related	related.hosts	keyword	extended	array		All the host identifiers seen on your event.
1422	9.1.0	true	related	related.ip	ip	extended	array		All of the IPs seen on your event.
1423	9.1.0	true	related	related.user	keyword	extended	array		All the user names or other user identifiers seen on the event.
1424	9.1.0	true	resource	resource.id	keyword	custom		example-id	The unique identifier of the Google Cloud resource
1425	9.1.0	true	resource	resource.name	keyword	custom		example-name	The human-readable name of the Google Cloud resource
1426	9.1.0	true	resource	resource.type	keyword	custom		example-type	The type of Google Cloud resource
1427	9.1.0	true	result	result.evaluation	keyword	custom		example-evaluation	The result of evaluating a security policy or compliance check
1428	9.1.0	true	rule	rule.author	keyword	extended	array	["Star-Lord"]	Rule author
1429	9.1.0	true	rule	rule.category	keyword	extended		Attempted Information Leak	Rule category
1430	9.1.0	true	rule	rule.description	keyword	extended		Block requests to public DNS over HTTPS / TLS protocols	Rule description
1431	9.1.0	true	rule	rule.id	keyword	extended		101	Rule ID
1432	9.1.0	true	rule	rule.license	keyword	extended		Apache 2.0	Rule license
1433	9.1.0	true	rule	rule.name	keyword	extended		BLOCK_DNS_over_TLS	Rule name
1434	9.1.0	true	rule	rule.reference	keyword	extended		https://en.wikipedia.org/wiki/DNS_over_TLS	Rule reference URL
1435	9.1.0	true	rule	rule.ruleset	keyword	extended		Standard_Protocol_Filters	Rule ruleset
1436	9.1.0	true	rule	rule.uuid	keyword	extended		1100110011	Rule UUID
1437	9.1.0	true	rule	rule.version	keyword	extended		1.1	Rule version
1438	9.1.0	true	server	server.address	keyword	extended			Server network address.
1439	9.1.0	true	server	server.as.number	long	extended		15169	Unique number allocated to the autonomous system.
1440	9.1.0	true	server	server.as.organization.name	keyword	extended		Google LLC	Organization name.
1441	9.1.0	true	server	server.bytes	long	core		184	Bytes sent from the server to the client.
1442	9.1.0	true	server	server.domain	keyword	core		foo.example.com	The domain name of the server.
1443	9.1.0	true	server	server.geo.city_name	keyword	core		Montreal	City name.
1444	9.1.0	true	server	server.geo.continent_code	keyword	core		NA	Continent code.
1445	9.1.0	true	server	server.geo.continent_name	keyword	core		North America	Name of the continent.
1446	9.1.0	true	server	server.geo.country_iso_code	keyword	core		CA	Country ISO code.
1447	9.1.0	true	server	server.geo.country_name	keyword	core		Canada	Country name.
1448	9.1.0	true	server	server.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
1449	9.1.0	true	server	server.geo.name	keyword	extended		boston-dc	User-defined description of a location.
1450	9.1.0	true	server	server.geo.postal_code	keyword	core		94040	Postal code.
1451	9.1.0	true	server	server.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
1452	9.1.0	true	server	server.geo.region_name	keyword	core		Quebec	Region name.
1453	9.1.0	true	server	server.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
1454	9.1.0	true	server	server.ip	ip	core			IP address of the server.
1455	9.1.0	true	server	server.mac	keyword	core		00-00-5E-00-53-23	MAC address of the server.
1456	9.1.0	true	server	server.nat.ip	ip	extended			Server NAT ip
1457	9.1.0	true	server	server.nat.port	long	extended			Server NAT port
1458	9.1.0	true	server	server.packets	long	core		12	Packets sent from the server to the client.
1459	9.1.0	true	server	server.port	long	core			Port of the server.
1460	9.1.0	true	server	server.registered_domain	keyword	extended		example.com	The highest registered server domain, stripped of the subdomain.
1461	9.1.0	true	server	server.subdomain	keyword	extended		east	The subdomain of the domain.
1462	9.1.0	true	server	server.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
1463	9.1.0	true	server	server.user.domain	keyword	extended			Name of the directory the user is a member of.
1464	9.1.0	true	server	server.user.email	keyword	extended			User email address.
1465	9.1.0	true	server	server.user.full_name	keyword	extended		Albert Einstein	User's full name, if available.
1466	9.1.0	true	server	server.user.group.domain	keyword	extended			Name of the directory the group is a member of.
1467	9.1.0	true	server	server.user.group.id	keyword	extended			Unique identifier for the group on the system/platform.
1468	9.1.0	true	server	server.user.group.name	keyword	extended			Name of the group.
1469	9.1.0	true	server	server.user.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
1470	9.1.0	true	server	server.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1471	9.1.0	true	server	server.user.name	keyword	core		a.einstein	Short name or login of the user.
1472	9.1.0	true	server	server.user.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
1473	9.1.0	true	service	service.address	keyword	extended		172.26.0.2:5432	Address of this service.
1474	9.1.0	true	service	service.environment	keyword	extended		production	Environment of the service.
1475	9.1.0	true	service	service.ephemeral_id	keyword	extended		8a4f500f	Ephemeral identifier of this service.
1476	9.1.0	true	service	service.id	keyword	core		d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6	Unique identifier of the running service.
1477	9.1.0	true	service	service.name	keyword	core		elasticsearch-metrics	Name of the service.
1478	9.1.0	true	service	service.node.name	keyword	extended		instance-0000000016	Name of the service node.
1479	9.1.0	true	service	service.node.role	keyword	extended		background_tasks	Deprecated role (singular) of the service node.
1480	9.1.0	true	service	service.node.roles	keyword	extended	array	["ui", "background_tasks"]	Roles of the service node.
1481	9.1.0	true	service	service.origin.address	keyword	extended		172.26.0.2:5432	Address of this service.
1482	9.1.0	true	service	service.origin.environment	keyword	extended		production	Environment of the service.
1483	9.1.0	true	service	service.origin.ephemeral_id	keyword	extended		8a4f500f	Ephemeral identifier of this service.
1484	9.1.0	true	service	service.origin.id	keyword	core		d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6	Unique identifier of the running service.
1485	9.1.0	true	service	service.origin.name	keyword	core		elasticsearch-metrics	Name of the service.
1486	9.1.0	true	service	service.origin.node.name	keyword	extended		instance-0000000016	Name of the service node.
1487	9.1.0	true	service	service.origin.node.role	keyword	extended		background_tasks	Deprecated role (singular) of the service node.
1488	9.1.0	true	service	service.origin.node.roles	keyword	extended	array	["ui", "background_tasks"]	Roles of the service node.
1489	9.1.0	true	service	service.origin.state	keyword	core			Current state of the service.
1490	9.1.0	true	service	service.origin.type	keyword	core		elasticsearch	The type of the service.
1491	9.1.0	true	service	service.origin.version	keyword	core		3.2.4	Version of the service.
1492	9.1.0	true	service	service.state	keyword	core			Current state of the service.
1493	9.1.0	true	service	service.target.address	keyword	extended		172.26.0.2:5432	Address of this service.
1494	9.1.0	true	service	service.target.environment	keyword	extended		production	Environment of the service.
1495	9.1.0	true	service	service.target.ephemeral_id	keyword	extended		8a4f500f	Ephemeral identifier of this service.
1496	9.1.0	true	service	service.target.id	keyword	core		d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6	Unique identifier of the running service.
1497	9.1.0	true	service	service.target.name	keyword	core		elasticsearch-metrics	Name of the service.
1498	9.1.0	true	service	service.target.node.name	keyword	extended		instance-0000000016	Name of the service node.
1499	9.1.0	true	service	service.target.node.role	keyword	extended		background_tasks	Deprecated role (singular) of the service node.
1500	9.1.0	true	service	service.target.node.roles	keyword	extended	array	["ui", "background_tasks"]	Roles of the service node.
1501	9.1.0	true	service	service.target.state	keyword	core			Current state of the service.
1502	9.1.0	true	service	service.target.type	keyword	core		elasticsearch	The type of the service.
1503	9.1.0	true	service	service.target.version	keyword	core		3.2.4	Version of the service.
1504	9.1.0	true	service	service.type	keyword	core		elasticsearch	The type of the service.
1505	9.1.0	true	service	service.version	keyword	core		3.2.4	Version of the service.
1506	9.1.0	true	source	source.address	keyword	extended			Source network address.
1507	9.1.0	true	source	source.as.number	long	extended		15169	Unique number allocated to the autonomous system.
1508	9.1.0	true	source	source.as.organization.name	keyword	extended		Google LLC	Organization name.
1509	9.1.0	true	source	source.bytes	long	core		184	Bytes sent from the source to the destination.
1510	9.1.0	true	source	source.domain	keyword	core		foo.example.com	The domain name of the source.
1511	9.1.0	true	source	source.geo.city_name	keyword	core		Montreal	City name.
1512	9.1.0	true	source	source.geo.continent_code	keyword	core		NA	Continent code.
1513	9.1.0	true	source	source.geo.continent_name	keyword	core		North America	Name of the continent.
1514	9.1.0	true	source	source.geo.country_iso_code	keyword	core		CA	Country ISO code.
1515	9.1.0	true	source	source.geo.country_name	keyword	core		Canada	Country name.
1516	9.1.0	true	source	source.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
1517	9.1.0	true	source	source.geo.name	keyword	extended		boston-dc	User-defined description of a location.
1518	9.1.0	true	source	source.geo.postal_code	keyword	core		94040	Postal code.
1519	9.1.0	true	source	source.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
1520	9.1.0	true	source	source.geo.region_name	keyword	core		Quebec	Region name.
1521	9.1.0	true	source	source.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
1522	9.1.0	true	source	source.ip	ip	core			IP address of the source.
1523	9.1.0	true	source	source.mac	keyword	core		00-00-5E-00-53-23	MAC address of the source.
1524	9.1.0	true	source	source.nat.ip	ip	extended			Source NAT ip
1525	9.1.0	true	source	source.nat.port	long	extended			Source NAT port
1526	9.1.0	true	source	source.packets	long	core		12	Packets sent from the source to the destination.
1527	9.1.0	true	source	source.port	long	core			Port of the source.
1528	9.1.0	true	source	source.registered_domain	keyword	extended		example.com	The highest registered source domain, stripped of the subdomain.
1529	9.1.0	true	source	source.subdomain	keyword	extended		east	The subdomain of the domain.
1530	9.1.0	true	source	source.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
1531	9.1.0	true	source	source.user.domain	keyword	extended			Name of the directory the user is a member of.
1532	9.1.0	true	source	source.user.email	keyword	extended			User email address.
1533	9.1.0	true	source	source.user.full_name	keyword	extended		Albert Einstein	User's full name, if available.
1534	9.1.0	true	source	source.user.group.domain	keyword	extended			Name of the directory the group is a member of.
1535	9.1.0	true	source	source.user.group.id	keyword	extended			Unique identifier for the group on the system/platform.
1536	9.1.0	true	source	source.user.group.name	keyword	extended			Name of the group.
1537	9.1.0	true	source	source.user.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
1538	9.1.0	true	source	source.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1539	9.1.0	true	source	source.user.name	keyword	core		a.einstein	Short name or login of the user.
1540	9.1.0	true	source	source.user.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
1541	9.1.0	true	span	span.id	keyword	extended		3ff9a8981b7ccd5a	Unique identifier of the span within the scope of its trace.
1542	9.1.0	true	threat	threat.enrichments	nested	extended	array		List of objects containing indicators enriching the event.
1543	9.1.0	true	threat	threat.enrichments.indicator	object	extended			Object containing indicators enriching the event.
1544	9.1.0	true	threat	threat.enrichments.indicator.as.number	long	extended		15169	Unique number allocated to the autonomous system.
1545	9.1.0	true	threat	threat.enrichments.indicator.as.organization.name	keyword	extended		Google LLC	Organization name.
1546	9.1.0	true	threat	threat.enrichments.indicator.confidence	keyword	extended		Medium	Indicator confidence rating
1547	9.1.0	true	threat	threat.enrichments.indicator.description	keyword	extended		IP x.x.x.x was observed delivering the Angler EK.	Indicator description
1548	9.1.0	true	threat	threat.enrichments.indicator.email.address	keyword	extended		phish@example.com	Indicator email address
1549	9.1.0	true	threat	threat.enrichments.indicator.file.accessed	date	extended			Last time the file was accessed.
1550	9.1.0	true	threat	threat.enrichments.indicator.file.attributes	keyword	extended	array	["readonly", "system"]	Array of file attributes.
1551	9.1.0	true	threat	threat.enrichments.indicator.file.code_signature.digest_algorithm	keyword	extended		sha256	Hashing algorithm used to sign the process.
1552	9.1.0	true	threat	threat.enrichments.indicator.file.code_signature.exists	boolean	core		true	Boolean to capture if a signature is present.
1553	9.1.0	true	threat	threat.enrichments.indicator.file.code_signature.flags	keyword	extended		570522385	Code signing flags of the process
1554	9.1.0	true	threat	threat.enrichments.indicator.file.code_signature.signing_id	keyword	extended		com.apple.xpc.proxy	The identifier used to sign the process.
1555	9.1.0	true	threat	threat.enrichments.indicator.file.code_signature.status	keyword	extended		ERROR_UNTRUSTED_ROOT	Additional information about the certificate status.
1556	9.1.0	true	threat	threat.enrichments.indicator.file.code_signature.subject_name	keyword	core		Microsoft Corporation	Subject name of the code signer
1557	9.1.0	true	threat	threat.enrichments.indicator.file.code_signature.team_id	keyword	extended		EQHXZ8M8AV	The team identifier used to sign the process.
1558	9.1.0	true	threat	threat.enrichments.indicator.file.code_signature.thumbprint_sha256	keyword	extended		c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b	SHA256 hash of the certificate.
1559	9.1.0	true	threat	threat.enrichments.indicator.file.code_signature.timestamp	date	extended		2021-01-01T12:10:30Z	When the signature was generated and signed.
1560	9.1.0	true	threat	threat.enrichments.indicator.file.code_signature.trusted	boolean	extended		true	Stores the trust status of the certificate chain.
1561	9.1.0	true	threat	threat.enrichments.indicator.file.code_signature.valid	boolean	extended		true	Boolean to capture if the digital signature is verified against the binary content.
1562	9.1.0	true	threat	threat.enrichments.indicator.file.created	date	extended			File creation time.
1563	9.1.0	true	threat	threat.enrichments.indicator.file.ctime	date	extended			Last time the file attributes or metadata changed.
1564	9.1.0	true	threat	threat.enrichments.indicator.file.device	keyword	extended		sda	Device that is the source of the file.
1565	9.1.0	true	threat	threat.enrichments.indicator.file.directory	keyword	extended		/home/alice	Directory where the file is located.
1566	9.1.0	true	threat	threat.enrichments.indicator.file.drive_letter	keyword	extended		C	Drive letter where the file is located.
1567	9.1.0	true	threat	threat.enrichments.indicator.file.elf.architecture	keyword	extended		x86-64	Machine architecture of the ELF file.
1568	9.1.0	true	threat	threat.enrichments.indicator.file.elf.byte_order	keyword	extended		Little Endian	Byte sequence of ELF file.
1569	9.1.0	true	threat	threat.enrichments.indicator.file.elf.cpu_type	keyword	extended		Intel	CPU type of the ELF file.
1570	9.1.0	true	threat	threat.enrichments.indicator.file.elf.creation_date	date	extended			Build or compile date.
1571	9.1.0	true	threat	threat.enrichments.indicator.file.elf.exports	flat_object	extended	array		List of exported element names and types.
1572	9.1.0	true	threat	threat.enrichments.indicator.file.elf.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in an ELF file.
1573	9.1.0	true	threat	threat.enrichments.indicator.file.elf.go_imports	flat_object	extended			List of imported Go language element names and types.
1574	9.1.0	true	threat	threat.enrichments.indicator.file.elf.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1575	9.1.0	true	threat	threat.enrichments.indicator.file.elf.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1576	9.1.0	true	threat	threat.enrichments.indicator.file.elf.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1577	9.1.0	true	threat	threat.enrichments.indicator.file.elf.header.abi_version	keyword	extended			Version of the ELF Application Binary Interface (ABI).
1578	9.1.0	true	threat	threat.enrichments.indicator.file.elf.header.class	keyword	extended			Header class of the ELF file.
1579	9.1.0	true	threat	threat.enrichments.indicator.file.elf.header.data	keyword	extended			Data table of the ELF header.
1580	9.1.0	true	threat	threat.enrichments.indicator.file.elf.header.entrypoint	long	extended			Header entrypoint of the ELF file.
1581	9.1.0	true	threat	threat.enrichments.indicator.file.elf.header.object_version	keyword	extended			"0x1" for original ELF files.
1582	9.1.0	true	threat	threat.enrichments.indicator.file.elf.header.os_abi	keyword	extended			Application Binary Interface (ABI) of the Linux OS.
1583	9.1.0	true	threat	threat.enrichments.indicator.file.elf.header.type	keyword	extended			Header type of the ELF file.
1584	9.1.0	true	threat	threat.enrichments.indicator.file.elf.header.version	keyword	extended			Version of the ELF header.
1585	9.1.0	true	threat	threat.enrichments.indicator.file.elf.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in an ELF file.
1586	9.1.0	true	threat	threat.enrichments.indicator.file.elf.imports	flat_object	extended	array		List of imported element names and types.
1587	9.1.0	true	threat	threat.enrichments.indicator.file.elf.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1588	9.1.0	true	threat	threat.enrichments.indicator.file.elf.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1589	9.1.0	true	threat	threat.enrichments.indicator.file.elf.sections	nested	extended	array		Section information of the ELF file.
1590	9.1.0	true	threat	threat.enrichments.indicator.file.elf.sections.chi2	long	extended			Chi-square probability distribution of the section.
1591	9.1.0	true	threat	threat.enrichments.indicator.file.elf.sections.entropy	long	extended			Shannon entropy calculation from the section.
1592	9.1.0	true	threat	threat.enrichments.indicator.file.elf.sections.flags	keyword	extended			ELF Section List flags.
1593	9.1.0	true	threat	threat.enrichments.indicator.file.elf.sections.name	keyword	extended			ELF Section List name.
1594	9.1.0	true	threat	threat.enrichments.indicator.file.elf.sections.physical_offset	keyword	extended			ELF Section List offset.
1595	9.1.0	true	threat	threat.enrichments.indicator.file.elf.sections.physical_size	long	extended			ELF Section List physical size.
1596	9.1.0	true	threat	threat.enrichments.indicator.file.elf.sections.type	keyword	extended			ELF Section List type.
1597	9.1.0	true	threat	threat.enrichments.indicator.file.elf.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1598	9.1.0	true	threat	threat.enrichments.indicator.file.elf.sections.virtual_address	long	extended			ELF Section List virtual address.
1599	9.1.0	true	threat	threat.enrichments.indicator.file.elf.sections.virtual_size	long	extended			ELF Section List virtual size.
1600	9.1.0	true	threat	threat.enrichments.indicator.file.elf.segments	nested	extended	array		ELF object segment list.
1601	9.1.0	true	threat	threat.enrichments.indicator.file.elf.segments.sections	keyword	extended			ELF object segment sections.
1602	9.1.0	true	threat	threat.enrichments.indicator.file.elf.segments.type	keyword	extended			ELF object segment type.
1603	9.1.0	true	threat	threat.enrichments.indicator.file.elf.shared_libraries	keyword	extended	array		List of shared libraries used by this ELF object.
1604	9.1.0	true	threat	threat.enrichments.indicator.file.elf.telfhash	keyword	extended			telfhash hash for ELF file.
1605	9.1.0	true	threat	threat.enrichments.indicator.file.extension	keyword	extended		png	File extension, excluding the leading dot.
1606	9.1.0	true	threat	threat.enrichments.indicator.file.fork_name	keyword	extended		Zone.Identifer	A fork is additional data associated with a filesystem object.
1607	9.1.0	true	threat	threat.enrichments.indicator.file.gid	keyword	extended		1001	Primary group ID (GID) of the file.
1608	9.1.0	true	threat	threat.enrichments.indicator.file.group	keyword	extended		alice	Primary group name of the file.
1609	9.1.0	true	threat	threat.enrichments.indicator.file.hash.cdhash	keyword	extended		3783b4052fd474dbe30676b45c329e7a6d44acd9	The Code Directory (CD) hash of an executable.
1610	9.1.0	true	threat	threat.enrichments.indicator.file.hash.md5	keyword	extended			MD5 hash.
1611	9.1.0	true	threat	threat.enrichments.indicator.file.hash.sha1	keyword	extended			SHA1 hash.
1612	9.1.0	true	threat	threat.enrichments.indicator.file.hash.sha256	keyword	extended			SHA256 hash.
1613	9.1.0	true	threat	threat.enrichments.indicator.file.hash.sha384	keyword	extended			SHA384 hash.
1614	9.1.0	true	threat	threat.enrichments.indicator.file.hash.sha512	keyword	extended			SHA512 hash.
1615	9.1.0	true	threat	threat.enrichments.indicator.file.hash.ssdeep	keyword	extended			SSDEEP hash.
1616	9.1.0	true	threat	threat.enrichments.indicator.file.hash.tlsh	keyword	extended			TLSH hash.
1617	9.1.0	true	threat	threat.enrichments.indicator.file.inode	keyword	extended		256383	Inode representing the file in the filesystem.
1618	9.1.0	true	threat	threat.enrichments.indicator.file.mime_type	keyword	extended			Media type of file, document, or arrangement of bytes.
1619	9.1.0	true	threat	threat.enrichments.indicator.file.mode	keyword	extended		0640	Mode of the file in octal representation.
1620	9.1.0	true	threat	threat.enrichments.indicator.file.mtime	date	extended			Last time the file content was modified.
1621	9.1.0	true	threat	threat.enrichments.indicator.file.name	keyword	extended		example.png	Name of the file including the extension, without the directory.
1622	9.1.0	true	threat	threat.enrichments.indicator.file.origin_referrer_url	keyword	extended		http://example.com/article1.html	The URL of the webpage that linked to the file.
1623	9.1.0	true	threat	threat.enrichments.indicator.file.origin_url	keyword	extended		http://example.com/imgs/article1_img1.jpg	The URL where the file is hosted.
1624	9.1.0	true	threat	threat.enrichments.indicator.file.owner	keyword	extended		alice	File owner's username.
1625	9.1.0	true	threat	threat.enrichments.indicator.file.path	keyword	extended		/home/alice/example.png	Full path to the file, including the file name.
1626	9.1.0	true	threat	threat.enrichments.indicator.file.pe.architecture	keyword	extended		x64	CPU architecture target for the file.
1627	9.1.0	true	threat	threat.enrichments.indicator.file.pe.company	keyword	extended		Microsoft Corporation	Internal company name of the file, provided at compile-time.
1628	9.1.0	true	threat	threat.enrichments.indicator.file.pe.description	keyword	extended		Paint	Internal description of the file, provided at compile-time.
1629	9.1.0	true	threat	threat.enrichments.indicator.file.pe.file_version	keyword	extended		6.3.9600.17415	Process name.
1630	9.1.0	true	threat	threat.enrichments.indicator.file.pe.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a PE file.
1631	9.1.0	true	threat	threat.enrichments.indicator.file.pe.go_imports	flat_object	extended			List of imported Go language element names and types.
1632	9.1.0	true	threat	threat.enrichments.indicator.file.pe.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1633	9.1.0	true	threat	threat.enrichments.indicator.file.pe.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1634	9.1.0	true	threat	threat.enrichments.indicator.file.pe.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1635	9.1.0	true	threat	threat.enrichments.indicator.file.pe.imphash	keyword	extended		0c6803c4e922103c4dca5963aad36ddf	A hash of the imports in a PE file.
1636	9.1.0	true	threat	threat.enrichments.indicator.file.pe.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a PE file.
1637	9.1.0	true	threat	threat.enrichments.indicator.file.pe.imports	flat_object	extended	array		List of imported element names and types.
1638	9.1.0	true	threat	threat.enrichments.indicator.file.pe.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1639	9.1.0	true	threat	threat.enrichments.indicator.file.pe.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1640	9.1.0	true	threat	threat.enrichments.indicator.file.pe.original_file_name	keyword	extended		MSPAINT.EXE	Internal name of the file, provided at compile-time.
1641	9.1.0	true	threat	threat.enrichments.indicator.file.pe.pehash	keyword	extended		73ff189b63cd6be375a7ff25179a38d347651975	A hash of the PE header and data from one or more PE sections.
1642	9.1.0	true	threat	threat.enrichments.indicator.file.pe.product	keyword	extended		Microsoft® Windows® Operating System	Internal product name of the file, provided at compile-time.
1643	9.1.0	true	threat	threat.enrichments.indicator.file.pe.sections	nested	extended	array		Section information of the PE file.
1644	9.1.0	true	threat	threat.enrichments.indicator.file.pe.sections.entropy	long	extended			Shannon entropy calculation from the section.
1645	9.1.0	true	threat	threat.enrichments.indicator.file.pe.sections.name	keyword	extended			PE Section List name.
1646	9.1.0	true	threat	threat.enrichments.indicator.file.pe.sections.physical_size	long	extended			PE Section List physical size.
1647	9.1.0	true	threat	threat.enrichments.indicator.file.pe.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1648	9.1.0	true	threat	threat.enrichments.indicator.file.pe.sections.virtual_size	long	extended			PE Section List virtual size. This is always the same as `physical_size`.
1649	9.1.0	true	threat	threat.enrichments.indicator.file.size	long	extended		16384	File size in bytes.
1650	9.1.0	true	threat	threat.enrichments.indicator.file.target_path	keyword	extended			Target path for symlinks.
1651	9.1.0	true	threat	threat.enrichments.indicator.file.type	keyword	extended		file	File type (file, dir, or symlink).
1652	9.1.0	true	threat	threat.enrichments.indicator.file.uid	keyword	extended		1001	The user ID (UID) or security identifier (SID) of the file owner.
1653	9.1.0	true	threat	threat.enrichments.indicator.file.x509.alternative_names	keyword	extended	array	*.elastic.co	List of subject alternative names (SAN).
1654	9.1.0	true	threat	threat.enrichments.indicator.file.x509.issuer.common_name	keyword	extended	array	Example SHA2 High Assurance Server CA	List of common name (CN) of issuing certificate authority.
1655	9.1.0	true	threat	threat.enrichments.indicator.file.x509.issuer.country	keyword	extended	array	US	List of country \(C) codes
1656	9.1.0	true	threat	threat.enrichments.indicator.file.x509.issuer.distinguished_name	keyword	extended		C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA	Distinguished name (DN) of issuing certificate authority.
1657	9.1.0	true	threat	threat.enrichments.indicator.file.x509.issuer.locality	keyword	extended	array	Mountain View	List of locality names (L)
1658	9.1.0	true	threat	threat.enrichments.indicator.file.x509.issuer.organization	keyword	extended	array	Example Inc	List of organizations (O) of issuing certificate authority.
1659	9.1.0	true	threat	threat.enrichments.indicator.file.x509.issuer.organizational_unit	keyword	extended	array	www.example.com	List of organizational units (OU) of issuing certificate authority.
1660	9.1.0	true	threat	threat.enrichments.indicator.file.x509.issuer.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1661	9.1.0	true	threat	threat.enrichments.indicator.file.x509.not_after	date	extended		2020-07-16T03:15:39Z	Time at which the certificate is no longer considered valid.
1662	9.1.0	true	threat	threat.enrichments.indicator.file.x509.not_before	date	extended		2019-08-16T01:40:25Z	Time at which the certificate is first considered valid.
1663	9.1.0	true	threat	threat.enrichments.indicator.file.x509.public_key_algorithm	keyword	extended		RSA	Algorithm used to generate the public key.
1664	9.1.0	true	threat	threat.enrichments.indicator.file.x509.public_key_curve	keyword	extended		nistp521	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
1665	9.1.0	false	threat	threat.enrichments.indicator.file.x509.public_key_exponent	long	extended		65537	Exponent used to derive the public key. This is algorithm specific.
1666	9.1.0	true	threat	threat.enrichments.indicator.file.x509.public_key_size	long	extended		2048	The size of the public key space in bits.
1667	9.1.0	true	threat	threat.enrichments.indicator.file.x509.serial_number	keyword	extended		55FBB9C7DEBF09809D12CCAA	Unique serial number issued by the certificate authority.
1668	9.1.0	true	threat	threat.enrichments.indicator.file.x509.signature_algorithm	keyword	extended		SHA256-RSA	Identifier for certificate signature algorithm.
1669	9.1.0	true	threat	threat.enrichments.indicator.file.x509.subject.common_name	keyword	extended	array	shared.global.example.net	List of common names (CN) of subject.
1670	9.1.0	true	threat	threat.enrichments.indicator.file.x509.subject.country	keyword	extended	array	US	List of country \(C) code
1671	9.1.0	true	threat	threat.enrichments.indicator.file.x509.subject.distinguished_name	keyword	extended		C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net	Distinguished name (DN) of the certificate subject entity.
1672	9.1.0	true	threat	threat.enrichments.indicator.file.x509.subject.locality	keyword	extended	array	San Francisco	List of locality names (L)
1673	9.1.0	true	threat	threat.enrichments.indicator.file.x509.subject.organization	keyword	extended	array	Example, Inc.	List of organizations (O) of subject.
1674	9.1.0	true	threat	threat.enrichments.indicator.file.x509.subject.organizational_unit	keyword	extended	array		List of organizational units (OU) of subject.
1675	9.1.0	true	threat	threat.enrichments.indicator.file.x509.subject.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1676	9.1.0	true	threat	threat.enrichments.indicator.file.x509.version_number	keyword	extended		3	Version of x509 format.
1677	9.1.0	true	threat	threat.enrichments.indicator.first_seen	date	extended		2020-11-05T17:25:47.000Z	Date/time indicator was first reported.
1678	9.1.0	true	threat	threat.enrichments.indicator.geo.city_name	keyword	core		Montreal	City name.
1679	9.1.0	true	threat	threat.enrichments.indicator.geo.continent_code	keyword	core		NA	Continent code.
1680	9.1.0	true	threat	threat.enrichments.indicator.geo.continent_name	keyword	core		North America	Name of the continent.
1681	9.1.0	true	threat	threat.enrichments.indicator.geo.country_iso_code	keyword	core		CA	Country ISO code.
1682	9.1.0	true	threat	threat.enrichments.indicator.geo.country_name	keyword	core		Canada	Country name.
1683	9.1.0	true	threat	threat.enrichments.indicator.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
1684	9.1.0	true	threat	threat.enrichments.indicator.geo.name	keyword	extended		boston-dc	User-defined description of a location.
1685	9.1.0	true	threat	threat.enrichments.indicator.geo.postal_code	keyword	core		94040	Postal code.
1686	9.1.0	true	threat	threat.enrichments.indicator.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
1687	9.1.0	true	threat	threat.enrichments.indicator.geo.region_name	keyword	core		Quebec	Region name.
1688	9.1.0	true	threat	threat.enrichments.indicator.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
1689	9.1.0	true	threat	threat.enrichments.indicator.ip	ip	extended		1.2.3.4	Indicator IP address
1690	9.1.0	true	threat	threat.enrichments.indicator.last_seen	date	extended		2020-11-05T17:25:47.000Z	Date/time indicator was last reported.
1691	9.1.0	true	threat	threat.enrichments.indicator.marking.tlp	keyword	extended		CLEAR	Indicator TLP marking
1692	9.1.0	true	threat	threat.enrichments.indicator.marking.tlp_version	keyword	extended		2.0	Indicator TLP version
1693	9.1.0	true	threat	threat.enrichments.indicator.modified_at	date	extended		2020-11-05T17:25:47.000Z	Date/time indicator was last updated.
1694	9.1.0	true	threat	threat.enrichments.indicator.name	keyword	extended		5.2.75.227	Indicator display name
1695	9.1.0	true	threat	threat.enrichments.indicator.port	long	extended		443	Indicator port
1696	9.1.0	true	threat	threat.enrichments.indicator.provider	keyword	extended		lrz_urlhaus	Indicator provider
1697	9.1.0	true	threat	threat.enrichments.indicator.reference	keyword	extended		https://system.example.com/indicator/0001234	Indicator reference URL
1698	9.1.0	true	threat	threat.enrichments.indicator.registry.data.bytes	keyword	extended		ZQBuAC0AVQBTAAAAZQBuAAAAAAA=	Original bytes written with base64 encoding.
1699	9.1.0	true	threat	threat.enrichments.indicator.registry.data.strings	keyword	core	array	["C:\rta\red_ttp\bin\myapp.exe"]	List of strings representing what was written to the registry.
1700	9.1.0	true	threat	threat.enrichments.indicator.registry.data.type	keyword	core		REG_SZ	Standard registry type for encoding contents
1701	9.1.0	true	threat	threat.enrichments.indicator.registry.hive	keyword	core		HKLM	Abbreviated name for the hive.
1702	9.1.0	true	threat	threat.enrichments.indicator.registry.key	keyword	core		SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	Hive-relative path of keys.
1703	9.1.0	true	threat	threat.enrichments.indicator.registry.path	keyword	core		HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger	Full path, including hive, key and value
1704	9.1.0	true	threat	threat.enrichments.indicator.registry.value	keyword	core		Debugger	Name of the value written.
1705	9.1.0	true	threat	threat.enrichments.indicator.scanner_stats	long	extended		4	Scanner statistics
1706	9.1.0	true	threat	threat.enrichments.indicator.sightings	long	extended		20	Number of times indicator observed
1707	9.1.0	true	threat	threat.enrichments.indicator.type	keyword	extended		ipv4-addr	Type of indicator
1708	9.1.0	true	threat	threat.enrichments.indicator.url.domain	keyword	extended		www.elastic.co	Domain of the url.
1709	9.1.0	true	threat	threat.enrichments.indicator.url.extension	keyword	extended		png	File extension from the request url, excluding the leading dot.
1710	9.1.0	true	threat	threat.enrichments.indicator.url.fragment	keyword	extended			Portion of the url after the `#`.
1711	9.1.0	true	threat	threat.enrichments.indicator.url.full	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top	Full unparsed URL.
1712	9.1.0	true	threat	threat.enrichments.indicator.url.original	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch	Unmodified original url as seen in the event source.
1713	9.1.0	true	threat	threat.enrichments.indicator.url.password	keyword	extended			Password of the request.
1714	9.1.0	true	threat	threat.enrichments.indicator.url.path	keyword	extended			Path of the request, such as "/search".
1715	9.1.0	true	threat	threat.enrichments.indicator.url.port	long	extended		443	Port of the request, such as 443.
1716	9.1.0	true	threat	threat.enrichments.indicator.url.query	keyword	extended			Query string of the request.
1717	9.1.0	true	threat	threat.enrichments.indicator.url.registered_domain	keyword	extended		example.com	The highest registered url domain, stripped of the subdomain.
1718	9.1.0	true	threat	threat.enrichments.indicator.url.scheme	keyword	extended		https	Scheme of the url.
1719	9.1.0	true	threat	threat.enrichments.indicator.url.subdomain	keyword	extended		east	The subdomain of the domain.
1720	9.1.0	true	threat	threat.enrichments.indicator.url.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
1721	9.1.0	true	threat	threat.enrichments.indicator.url.username	keyword	extended			Username of the request.
1722	9.1.0	true	threat	threat.enrichments.indicator.x509.alternative_names	keyword	extended	array	*.elastic.co	List of subject alternative names (SAN).
1723	9.1.0	true	threat	threat.enrichments.indicator.x509.issuer.common_name	keyword	extended	array	Example SHA2 High Assurance Server CA	List of common name (CN) of issuing certificate authority.
1724	9.1.0	true	threat	threat.enrichments.indicator.x509.issuer.country	keyword	extended	array	US	List of country \(C) codes
1725	9.1.0	true	threat	threat.enrichments.indicator.x509.issuer.distinguished_name	keyword	extended		C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA	Distinguished name (DN) of issuing certificate authority.
1726	9.1.0	true	threat	threat.enrichments.indicator.x509.issuer.locality	keyword	extended	array	Mountain View	List of locality names (L)
1727	9.1.0	true	threat	threat.enrichments.indicator.x509.issuer.organization	keyword	extended	array	Example Inc	List of organizations (O) of issuing certificate authority.
1728	9.1.0	true	threat	threat.enrichments.indicator.x509.issuer.organizational_unit	keyword	extended	array	www.example.com	List of organizational units (OU) of issuing certificate authority.
1729	9.1.0	true	threat	threat.enrichments.indicator.x509.issuer.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1730	9.1.0	true	threat	threat.enrichments.indicator.x509.not_after	date	extended		2020-07-16T03:15:39Z	Time at which the certificate is no longer considered valid.
1731	9.1.0	true	threat	threat.enrichments.indicator.x509.not_before	date	extended		2019-08-16T01:40:25Z	Time at which the certificate is first considered valid.
1732	9.1.0	true	threat	threat.enrichments.indicator.x509.public_key_algorithm	keyword	extended		RSA	Algorithm used to generate the public key.
1733	9.1.0	true	threat	threat.enrichments.indicator.x509.public_key_curve	keyword	extended		nistp521	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
1734	9.1.0	false	threat	threat.enrichments.indicator.x509.public_key_exponent	long	extended		65537	Exponent used to derive the public key. This is algorithm specific.
1735	9.1.0	true	threat	threat.enrichments.indicator.x509.public_key_size	long	extended		2048	The size of the public key space in bits.
1736	9.1.0	true	threat	threat.enrichments.indicator.x509.serial_number	keyword	extended		55FBB9C7DEBF09809D12CCAA	Unique serial number issued by the certificate authority.
1737	9.1.0	true	threat	threat.enrichments.indicator.x509.signature_algorithm	keyword	extended		SHA256-RSA	Identifier for certificate signature algorithm.
1738	9.1.0	true	threat	threat.enrichments.indicator.x509.subject.common_name	keyword	extended	array	shared.global.example.net	List of common names (CN) of subject.
1739	9.1.0	true	threat	threat.enrichments.indicator.x509.subject.country	keyword	extended	array	US	List of country \(C) code
1740	9.1.0	true	threat	threat.enrichments.indicator.x509.subject.distinguished_name	keyword	extended		C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net	Distinguished name (DN) of the certificate subject entity.
1741	9.1.0	true	threat	threat.enrichments.indicator.x509.subject.locality	keyword	extended	array	San Francisco	List of locality names (L)
1742	9.1.0	true	threat	threat.enrichments.indicator.x509.subject.organization	keyword	extended	array	Example, Inc.	List of organizations (O) of subject.
1743	9.1.0	true	threat	threat.enrichments.indicator.x509.subject.organizational_unit	keyword	extended	array		List of organizational units (OU) of subject.
1744	9.1.0	true	threat	threat.enrichments.indicator.x509.subject.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1745	9.1.0	true	threat	threat.enrichments.indicator.x509.version_number	keyword	extended		3	Version of x509 format.
1746	9.1.0	true	threat	threat.enrichments.matched.atomic	keyword	extended		bad-domain.com	Matched indicator value
1747	9.1.0	true	threat	threat.enrichments.matched.field	keyword	extended		file.hash.sha256	Matched indicator field
1748	9.1.0	true	threat	threat.enrichments.matched.id	keyword	extended		ff93aee5-86a1-4a61-b0e6-0cdc313d01b5	Matched indicator identifier
1749	9.1.0	true	threat	threat.enrichments.matched.index	keyword	extended		filebeat-8.0.0-2021.05.23-000011	Matched indicator index
1750	9.1.0	true	threat	threat.enrichments.matched.occurred	date	extended		2021-10-05T17:00:58.326Z	Date of match
1751	9.1.0	true	threat	threat.enrichments.matched.type	keyword	extended		indicator_match_rule	Type of indicator match
1752	9.1.0	true	threat	threat.feed.dashboard_id	keyword	extended		5ba16340-72e6-11eb-a3e3-b3cc7c78a70f	Feed dashboard ID.
1753	9.1.0	true	threat	threat.feed.description	keyword	extended		Threat feed from the AlienVault Open Threat eXchange network.	Description of the threat feed.
1754	9.1.0	true	threat	threat.feed.name	keyword	extended		AlienVault OTX	Name of the threat feed.
1755	9.1.0	true	threat	threat.feed.reference	keyword	extended		https://otx.alienvault.com	Reference for the threat feed.
1756	9.1.0	true	threat	threat.framework	keyword	extended		MITRE ATT&CK	Threat classification framework.
1757	9.1.0	true	threat	threat.group.alias	keyword	extended	array	[ "Magecart Group 6" ]	Alias of the group.
1758	9.1.0	true	threat	threat.group.id	keyword	extended		G0037	ID of the group.
1759	9.1.0	true	threat	threat.group.name	keyword	extended		FIN6	Name of the group.
1760	9.1.0	true	threat	threat.group.reference	keyword	extended		https://attack.mitre.org/groups/G0037/	Reference URL of the group.
1761	9.1.0	true	threat	threat.indicator.as.number	long	extended		15169	Unique number allocated to the autonomous system.
1762	9.1.0	true	threat	threat.indicator.as.organization.name	keyword	extended		Google LLC	Organization name.
1763	9.1.0	true	threat	threat.indicator.confidence	keyword	extended		Medium	Indicator confidence rating
1764	9.1.0	true	threat	threat.indicator.description	keyword	extended		IP x.x.x.x was observed delivering the Angler EK.	Indicator description
1765	9.1.0	true	threat	threat.indicator.email.address	keyword	extended		phish@example.com	Indicator email address
1766	9.1.0	true	threat	threat.indicator.file.accessed	date	extended			Last time the file was accessed.
1767	9.1.0	true	threat	threat.indicator.file.attributes	keyword	extended	array	["readonly", "system"]	Array of file attributes.
1768	9.1.0	true	threat	threat.indicator.file.code_signature.digest_algorithm	keyword	extended		sha256	Hashing algorithm used to sign the process.
1769	9.1.0	true	threat	threat.indicator.file.code_signature.exists	boolean	core		true	Boolean to capture if a signature is present.
1770	9.1.0	true	threat	threat.indicator.file.code_signature.flags	keyword	extended		570522385	Code signing flags of the process
1771	9.1.0	true	threat	threat.indicator.file.code_signature.signing_id	keyword	extended		com.apple.xpc.proxy	The identifier used to sign the process.
1772	9.1.0	true	threat	threat.indicator.file.code_signature.status	keyword	extended		ERROR_UNTRUSTED_ROOT	Additional information about the certificate status.
1773	9.1.0	true	threat	threat.indicator.file.code_signature.subject_name	keyword	core		Microsoft Corporation	Subject name of the code signer
1774	9.1.0	true	threat	threat.indicator.file.code_signature.team_id	keyword	extended		EQHXZ8M8AV	The team identifier used to sign the process.
1775	9.1.0	true	threat	threat.indicator.file.code_signature.thumbprint_sha256	keyword	extended		c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b	SHA256 hash of the certificate.
1776	9.1.0	true	threat	threat.indicator.file.code_signature.timestamp	date	extended		2021-01-01T12:10:30Z	When the signature was generated and signed.
1777	9.1.0	true	threat	threat.indicator.file.code_signature.trusted	boolean	extended		true	Stores the trust status of the certificate chain.
1778	9.1.0	true	threat	threat.indicator.file.code_signature.valid	boolean	extended		true	Boolean to capture if the digital signature is verified against the binary content.
1779	9.1.0	true	threat	threat.indicator.file.created	date	extended			File creation time.
1780	9.1.0	true	threat	threat.indicator.file.ctime	date	extended			Last time the file attributes or metadata changed.
1781	9.1.0	true	threat	threat.indicator.file.device	keyword	extended		sda	Device that is the source of the file.
1782	9.1.0	true	threat	threat.indicator.file.directory	keyword	extended		/home/alice	Directory where the file is located.
1783	9.1.0	true	threat	threat.indicator.file.drive_letter	keyword	extended		C	Drive letter where the file is located.
1784	9.1.0	true	threat	threat.indicator.file.elf.architecture	keyword	extended		x86-64	Machine architecture of the ELF file.
1785	9.1.0	true	threat	threat.indicator.file.elf.byte_order	keyword	extended		Little Endian	Byte sequence of ELF file.
1786	9.1.0	true	threat	threat.indicator.file.elf.cpu_type	keyword	extended		Intel	CPU type of the ELF file.
1787	9.1.0	true	threat	threat.indicator.file.elf.creation_date	date	extended			Build or compile date.
1788	9.1.0	true	threat	threat.indicator.file.elf.exports	flat_object	extended	array		List of exported element names and types.
1789	9.1.0	true	threat	threat.indicator.file.elf.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in an ELF file.
1790	9.1.0	true	threat	threat.indicator.file.elf.go_imports	flat_object	extended			List of imported Go language element names and types.
1791	9.1.0	true	threat	threat.indicator.file.elf.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1792	9.1.0	true	threat	threat.indicator.file.elf.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1793	9.1.0	true	threat	threat.indicator.file.elf.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1794	9.1.0	true	threat	threat.indicator.file.elf.header.abi_version	keyword	extended			Version of the ELF Application Binary Interface (ABI).
1795	9.1.0	true	threat	threat.indicator.file.elf.header.class	keyword	extended			Header class of the ELF file.
1796	9.1.0	true	threat	threat.indicator.file.elf.header.data	keyword	extended			Data table of the ELF header.
1797	9.1.0	true	threat	threat.indicator.file.elf.header.entrypoint	long	extended			Header entrypoint of the ELF file.
1798	9.1.0	true	threat	threat.indicator.file.elf.header.object_version	keyword	extended			"0x1" for original ELF files.
1799	9.1.0	true	threat	threat.indicator.file.elf.header.os_abi	keyword	extended			Application Binary Interface (ABI) of the Linux OS.
1800	9.1.0	true	threat	threat.indicator.file.elf.header.type	keyword	extended			Header type of the ELF file.
1801	9.1.0	true	threat	threat.indicator.file.elf.header.version	keyword	extended			Version of the ELF header.
1802	9.1.0	true	threat	threat.indicator.file.elf.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in an ELF file.
1803	9.1.0	true	threat	threat.indicator.file.elf.imports	flat_object	extended	array		List of imported element names and types.
1804	9.1.0	true	threat	threat.indicator.file.elf.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1805	9.1.0	true	threat	threat.indicator.file.elf.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1806	9.1.0	true	threat	threat.indicator.file.elf.sections	nested	extended	array		Section information of the ELF file.
1807	9.1.0	true	threat	threat.indicator.file.elf.sections.chi2	long	extended			Chi-square probability distribution of the section.
1808	9.1.0	true	threat	threat.indicator.file.elf.sections.entropy	long	extended			Shannon entropy calculation from the section.
1809	9.1.0	true	threat	threat.indicator.file.elf.sections.flags	keyword	extended			ELF Section List flags.
1810	9.1.0	true	threat	threat.indicator.file.elf.sections.name	keyword	extended			ELF Section List name.
1811	9.1.0	true	threat	threat.indicator.file.elf.sections.physical_offset	keyword	extended			ELF Section List offset.
1812	9.1.0	true	threat	threat.indicator.file.elf.sections.physical_size	long	extended			ELF Section List physical size.
1813	9.1.0	true	threat	threat.indicator.file.elf.sections.type	keyword	extended			ELF Section List type.
1814	9.1.0	true	threat	threat.indicator.file.elf.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1815	9.1.0	true	threat	threat.indicator.file.elf.sections.virtual_address	long	extended			ELF Section List virtual address.
1816	9.1.0	true	threat	threat.indicator.file.elf.sections.virtual_size	long	extended			ELF Section List virtual size.
1817	9.1.0	true	threat	threat.indicator.file.elf.segments	nested	extended	array		ELF object segment list.
1818	9.1.0	true	threat	threat.indicator.file.elf.segments.sections	keyword	extended			ELF object segment sections.
1819	9.1.0	true	threat	threat.indicator.file.elf.segments.type	keyword	extended			ELF object segment type.
1820	9.1.0	true	threat	threat.indicator.file.elf.shared_libraries	keyword	extended	array		List of shared libraries used by this ELF object.
1821	9.1.0	true	threat	threat.indicator.file.elf.telfhash	keyword	extended			telfhash hash for ELF file.
1822	9.1.0	true	threat	threat.indicator.file.extension	keyword	extended		png	File extension, excluding the leading dot.
1823	9.1.0	true	threat	threat.indicator.file.fork_name	keyword	extended		Zone.Identifer	A fork is additional data associated with a filesystem object.
1824	9.1.0	true	threat	threat.indicator.file.gid	keyword	extended		1001	Primary group ID (GID) of the file.
1825	9.1.0	true	threat	threat.indicator.file.group	keyword	extended		alice	Primary group name of the file.
1826	9.1.0	true	threat	threat.indicator.file.hash.cdhash	keyword	extended		3783b4052fd474dbe30676b45c329e7a6d44acd9	The Code Directory (CD) hash of an executable.
1827	9.1.0	true	threat	threat.indicator.file.hash.md5	keyword	extended			MD5 hash.
1828	9.1.0	true	threat	threat.indicator.file.hash.sha1	keyword	extended			SHA1 hash.
1829	9.1.0	true	threat	threat.indicator.file.hash.sha256	keyword	extended			SHA256 hash.
1830	9.1.0	true	threat	threat.indicator.file.hash.sha384	keyword	extended			SHA384 hash.
1831	9.1.0	true	threat	threat.indicator.file.hash.sha512	keyword	extended			SHA512 hash.
1832	9.1.0	true	threat	threat.indicator.file.hash.ssdeep	keyword	extended			SSDEEP hash.
1833	9.1.0	true	threat	threat.indicator.file.hash.tlsh	keyword	extended			TLSH hash.
1834	9.1.0	true	threat	threat.indicator.file.inode	keyword	extended		256383	Inode representing the file in the filesystem.
1835	9.1.0	true	threat	threat.indicator.file.mime_type	keyword	extended			Media type of file, document, or arrangement of bytes.
1836	9.1.0	true	threat	threat.indicator.file.mode	keyword	extended		0640	Mode of the file in octal representation.
1837	9.1.0	true	threat	threat.indicator.file.mtime	date	extended			Last time the file content was modified.
1838	9.1.0	true	threat	threat.indicator.file.name	keyword	extended		example.png	Name of the file including the extension, without the directory.
1839	9.1.0	true	threat	threat.indicator.file.origin_referrer_url	keyword	extended		http://example.com/article1.html	The URL of the webpage that linked to the file.
1840	9.1.0	true	threat	threat.indicator.file.origin_url	keyword	extended		http://example.com/imgs/article1_img1.jpg	The URL where the file is hosted.
1841	9.1.0	true	threat	threat.indicator.file.owner	keyword	extended		alice	File owner's username.
1842	9.1.0	true	threat	threat.indicator.file.path	keyword	extended		/home/alice/example.png	Full path to the file, including the file name.
1843	9.1.0	true	threat	threat.indicator.file.pe.architecture	keyword	extended		x64	CPU architecture target for the file.
1844	9.1.0	true	threat	threat.indicator.file.pe.company	keyword	extended		Microsoft Corporation	Internal company name of the file, provided at compile-time.
1845	9.1.0	true	threat	threat.indicator.file.pe.description	keyword	extended		Paint	Internal description of the file, provided at compile-time.
1846	9.1.0	true	threat	threat.indicator.file.pe.file_version	keyword	extended		6.3.9600.17415	Process name.
1847	9.1.0	true	threat	threat.indicator.file.pe.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a PE file.
1848	9.1.0	true	threat	threat.indicator.file.pe.go_imports	flat_object	extended			List of imported Go language element names and types.
1849	9.1.0	true	threat	threat.indicator.file.pe.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1850	9.1.0	true	threat	threat.indicator.file.pe.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1851	9.1.0	true	threat	threat.indicator.file.pe.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1852	9.1.0	true	threat	threat.indicator.file.pe.imphash	keyword	extended		0c6803c4e922103c4dca5963aad36ddf	A hash of the imports in a PE file.
1853	9.1.0	true	threat	threat.indicator.file.pe.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a PE file.
1854	9.1.0	true	threat	threat.indicator.file.pe.imports	flat_object	extended	array		List of imported element names and types.
1855	9.1.0	true	threat	threat.indicator.file.pe.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1856	9.1.0	true	threat	threat.indicator.file.pe.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1857	9.1.0	true	threat	threat.indicator.file.pe.original_file_name	keyword	extended		MSPAINT.EXE	Internal name of the file, provided at compile-time.
1858	9.1.0	true	threat	threat.indicator.file.pe.pehash	keyword	extended		73ff189b63cd6be375a7ff25179a38d347651975	A hash of the PE header and data from one or more PE sections.
1859	9.1.0	true	threat	threat.indicator.file.pe.product	keyword	extended		Microsoft® Windows® Operating System	Internal product name of the file, provided at compile-time.
1860	9.1.0	true	threat	threat.indicator.file.pe.sections	nested	extended	array		Section information of the PE file.
1861	9.1.0	true	threat	threat.indicator.file.pe.sections.entropy	long	extended			Shannon entropy calculation from the section.
1862	9.1.0	true	threat	threat.indicator.file.pe.sections.name	keyword	extended			PE Section List name.
1863	9.1.0	true	threat	threat.indicator.file.pe.sections.physical_size	long	extended			PE Section List physical size.
1864	9.1.0	true	threat	threat.indicator.file.pe.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1865	9.1.0	true	threat	threat.indicator.file.pe.sections.virtual_size	long	extended			PE Section List virtual size. This is always the same as `physical_size`.
1866	9.1.0	true	threat	threat.indicator.file.size	long	extended		16384	File size in bytes.
1867	9.1.0	true	threat	threat.indicator.file.target_path	keyword	extended			Target path for symlinks.
1868	9.1.0	true	threat	threat.indicator.file.type	keyword	extended		file	File type (file, dir, or symlink).
1869	9.1.0	true	threat	threat.indicator.file.uid	keyword	extended		1001	The user ID (UID) or security identifier (SID) of the file owner.
1870	9.1.0	true	threat	threat.indicator.file.x509.alternative_names	keyword	extended	array	*.elastic.co	List of subject alternative names (SAN).
1871	9.1.0	true	threat	threat.indicator.file.x509.issuer.common_name	keyword	extended	array	Example SHA2 High Assurance Server CA	List of common name (CN) of issuing certificate authority.
1872	9.1.0	true	threat	threat.indicator.file.x509.issuer.country	keyword	extended	array	US	List of country \(C) codes
1873	9.1.0	true	threat	threat.indicator.file.x509.issuer.distinguished_name	keyword	extended		C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA	Distinguished name (DN) of issuing certificate authority.
1874	9.1.0	true	threat	threat.indicator.file.x509.issuer.locality	keyword	extended	array	Mountain View	List of locality names (L)
1875	9.1.0	true	threat	threat.indicator.file.x509.issuer.organization	keyword	extended	array	Example Inc	List of organizations (O) of issuing certificate authority.
1876	9.1.0	true	threat	threat.indicator.file.x509.issuer.organizational_unit	keyword	extended	array	www.example.com	List of organizational units (OU) of issuing certificate authority.
1877	9.1.0	true	threat	threat.indicator.file.x509.issuer.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1878	9.1.0	true	threat	threat.indicator.file.x509.not_after	date	extended		2020-07-16T03:15:39Z	Time at which the certificate is no longer considered valid.
1879	9.1.0	true	threat	threat.indicator.file.x509.not_before	date	extended		2019-08-16T01:40:25Z	Time at which the certificate is first considered valid.
1880	9.1.0	true	threat	threat.indicator.file.x509.public_key_algorithm	keyword	extended		RSA	Algorithm used to generate the public key.
1881	9.1.0	true	threat	threat.indicator.file.x509.public_key_curve	keyword	extended		nistp521	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
1882	9.1.0	false	threat	threat.indicator.file.x509.public_key_exponent	long	extended		65537	Exponent used to derive the public key. This is algorithm specific.
1883	9.1.0	true	threat	threat.indicator.file.x509.public_key_size	long	extended		2048	The size of the public key space in bits.
1884	9.1.0	true	threat	threat.indicator.file.x509.serial_number	keyword	extended		55FBB9C7DEBF09809D12CCAA	Unique serial number issued by the certificate authority.
1885	9.1.0	true	threat	threat.indicator.file.x509.signature_algorithm	keyword	extended		SHA256-RSA	Identifier for certificate signature algorithm.
1886	9.1.0	true	threat	threat.indicator.file.x509.subject.common_name	keyword	extended	array	shared.global.example.net	List of common names (CN) of subject.
1887	9.1.0	true	threat	threat.indicator.file.x509.subject.country	keyword	extended	array	US	List of country \(C) code
1888	9.1.0	true	threat	threat.indicator.file.x509.subject.distinguished_name	keyword	extended		C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net	Distinguished name (DN) of the certificate subject entity.
1889	9.1.0	true	threat	threat.indicator.file.x509.subject.locality	keyword	extended	array	San Francisco	List of locality names (L)
1890	9.1.0	true	threat	threat.indicator.file.x509.subject.organization	keyword	extended	array	Example, Inc.	List of organizations (O) of subject.
1891	9.1.0	true	threat	threat.indicator.file.x509.subject.organizational_unit	keyword	extended	array		List of organizational units (OU) of subject.
1892	9.1.0	true	threat	threat.indicator.file.x509.subject.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1893	9.1.0	true	threat	threat.indicator.file.x509.version_number	keyword	extended		3	Version of x509 format.
1894	9.1.0	true	threat	threat.indicator.first_seen	date	extended		2020-11-05T17:25:47.000Z	Date/time indicator was first reported.
1895	9.1.0	true	threat	threat.indicator.geo.city_name	keyword	core		Montreal	City name.
1896	9.1.0	true	threat	threat.indicator.geo.continent_code	keyword	core		NA	Continent code.
1897	9.1.0	true	threat	threat.indicator.geo.continent_name	keyword	core		North America	Name of the continent.
1898	9.1.0	true	threat	threat.indicator.geo.country_iso_code	keyword	core		CA	Country ISO code.
1899	9.1.0	true	threat	threat.indicator.geo.country_name	keyword	core		Canada	Country name.
1900	9.1.0	true	threat	threat.indicator.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
1901	9.1.0	true	threat	threat.indicator.geo.name	keyword	extended		boston-dc	User-defined description of a location.
1902	9.1.0	true	threat	threat.indicator.geo.postal_code	keyword	core		94040	Postal code.
1903	9.1.0	true	threat	threat.indicator.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
1904	9.1.0	true	threat	threat.indicator.geo.region_name	keyword	core		Quebec	Region name.
1905	9.1.0	true	threat	threat.indicator.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
1906	9.1.0	true	threat	threat.indicator.id	keyword	extended	array	[indicator--d7008e06-ab86-415a-9803-3c81ce2d3c37]	ID of the indicator
1907	9.1.0	true	threat	threat.indicator.ip	ip	extended		1.2.3.4	Indicator IP address
1908	9.1.0	true	threat	threat.indicator.last_seen	date	extended		2020-11-05T17:25:47.000Z	Date/time indicator was last reported.
1909	9.1.0	true	threat	threat.indicator.marking.tlp	keyword	extended		CLEAR	Indicator TLP marking
1910	9.1.0	true	threat	threat.indicator.marking.tlp_version	keyword	extended		2.0	Indicator TLP version
1911	9.1.0	true	threat	threat.indicator.modified_at	date	extended		2020-11-05T17:25:47.000Z	Date/time indicator was last updated.
1912	9.1.0	true	threat	threat.indicator.name	keyword	extended		5.2.75.227	Indicator display name
1913	9.1.0	true	threat	threat.indicator.port	long	extended		443	Indicator port
1914	9.1.0	true	threat	threat.indicator.provider	keyword	extended		lrz_urlhaus	Indicator provider
1915	9.1.0	true	threat	threat.indicator.reference	keyword	extended		https://system.example.com/indicator/0001234	Indicator reference URL
1916	9.1.0	true	threat	threat.indicator.registry.data.bytes	keyword	extended		ZQBuAC0AVQBTAAAAZQBuAAAAAAA=	Original bytes written with base64 encoding.
1917	9.1.0	true	threat	threat.indicator.registry.data.strings	keyword	core	array	["C:\rta\red_ttp\bin\myapp.exe"]	List of strings representing what was written to the registry.
1918	9.1.0	true	threat	threat.indicator.registry.data.type	keyword	core		REG_SZ	Standard registry type for encoding contents
1919	9.1.0	true	threat	threat.indicator.registry.hive	keyword	core		HKLM	Abbreviated name for the hive.
1920	9.1.0	true	threat	threat.indicator.registry.key	keyword	core		SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	Hive-relative path of keys.
1921	9.1.0	true	threat	threat.indicator.registry.path	keyword	core		HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger	Full path, including hive, key and value
1922	9.1.0	true	threat	threat.indicator.registry.value	keyword	core		Debugger	Name of the value written.
1923	9.1.0	true	threat	threat.indicator.scanner_stats	long	extended		4	Scanner statistics
1924	9.1.0	true	threat	threat.indicator.sightings	long	extended		20	Number of times indicator observed
1925	9.1.0	true	threat	threat.indicator.type	keyword	extended		ipv4-addr	Type of indicator
1926	9.1.0	true	threat	threat.indicator.url.domain	keyword	extended		www.elastic.co	Domain of the url.
1927	9.1.0	true	threat	threat.indicator.url.extension	keyword	extended		png	File extension from the request url, excluding the leading dot.
1928	9.1.0	true	threat	threat.indicator.url.fragment	keyword	extended			Portion of the url after the `#`.
1929	9.1.0	true	threat	threat.indicator.url.full	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top	Full unparsed URL.
1930	9.1.0	true	threat	threat.indicator.url.original	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch	Unmodified original url as seen in the event source.
1931	9.1.0	true	threat	threat.indicator.url.password	keyword	extended			Password of the request.
1932	9.1.0	true	threat	threat.indicator.url.path	keyword	extended			Path of the request, such as "/search".
1933	9.1.0	true	threat	threat.indicator.url.port	long	extended		443	Port of the request, such as 443.
1934	9.1.0	true	threat	threat.indicator.url.query	keyword	extended			Query string of the request.
1935	9.1.0	true	threat	threat.indicator.url.registered_domain	keyword	extended		example.com	The highest registered url domain, stripped of the subdomain.
1936	9.1.0	true	threat	threat.indicator.url.scheme	keyword	extended		https	Scheme of the url.
1937	9.1.0	true	threat	threat.indicator.url.subdomain	keyword	extended		east	The subdomain of the domain.
1938	9.1.0	true	threat	threat.indicator.url.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
1939	9.1.0	true	threat	threat.indicator.url.username	keyword	extended			Username of the request.
1940	9.1.0	true	threat	threat.indicator.x509.alternative_names	keyword	extended	array	*.elastic.co	List of subject alternative names (SAN).
1941	9.1.0	true	threat	threat.indicator.x509.issuer.common_name	keyword	extended	array	Example SHA2 High Assurance Server CA	List of common name (CN) of issuing certificate authority.
1942	9.1.0	true	threat	threat.indicator.x509.issuer.country	keyword	extended	array	US	List of country \(C) codes
1943	9.1.0	true	threat	threat.indicator.x509.issuer.distinguished_name	keyword	extended		C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA	Distinguished name (DN) of issuing certificate authority.
1944	9.1.0	true	threat	threat.indicator.x509.issuer.locality	keyword	extended	array	Mountain View	List of locality names (L)
1945	9.1.0	true	threat	threat.indicator.x509.issuer.organization	keyword	extended	array	Example Inc	List of organizations (O) of issuing certificate authority.
1946	9.1.0	true	threat	threat.indicator.x509.issuer.organizational_unit	keyword	extended	array	www.example.com	List of organizational units (OU) of issuing certificate authority.
1947	9.1.0	true	threat	threat.indicator.x509.issuer.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1948	9.1.0	true	threat	threat.indicator.x509.not_after	date	extended		2020-07-16T03:15:39Z	Time at which the certificate is no longer considered valid.
1949	9.1.0	true	threat	threat.indicator.x509.not_before	date	extended		2019-08-16T01:40:25Z	Time at which the certificate is first considered valid.
1950	9.1.0	true	threat	threat.indicator.x509.public_key_algorithm	keyword	extended		RSA	Algorithm used to generate the public key.
1951	9.1.0	true	threat	threat.indicator.x509.public_key_curve	keyword	extended		nistp521	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
1952	9.1.0	false	threat	threat.indicator.x509.public_key_exponent	long	extended		65537	Exponent used to derive the public key. This is algorithm specific.
1953	9.1.0	true	threat	threat.indicator.x509.public_key_size	long	extended		2048	The size of the public key space in bits.
1954	9.1.0	true	threat	threat.indicator.x509.serial_number	keyword	extended		55FBB9C7DEBF09809D12CCAA	Unique serial number issued by the certificate authority.
1955	9.1.0	true	threat	threat.indicator.x509.signature_algorithm	keyword	extended		SHA256-RSA	Identifier for certificate signature algorithm.
1956	9.1.0	true	threat	threat.indicator.x509.subject.common_name	keyword	extended	array	shared.global.example.net	List of common names (CN) of subject.
1957	9.1.0	true	threat	threat.indicator.x509.subject.country	keyword	extended	array	US	List of country \(C) code
1958	9.1.0	true	threat	threat.indicator.x509.subject.distinguished_name	keyword	extended		C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net	Distinguished name (DN) of the certificate subject entity.
1959	9.1.0	true	threat	threat.indicator.x509.subject.locality	keyword	extended	array	San Francisco	List of locality names (L)
1960	9.1.0	true	threat	threat.indicator.x509.subject.organization	keyword	extended	array	Example, Inc.	List of organizations (O) of subject.
1961	9.1.0	true	threat	threat.indicator.x509.subject.organizational_unit	keyword	extended	array		List of organizational units (OU) of subject.
1962	9.1.0	true	threat	threat.indicator.x509.subject.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1963	9.1.0	true	threat	threat.indicator.x509.version_number	keyword	extended		3	Version of x509 format.
1964	9.1.0	true	threat	threat.software.alias	keyword	extended	array	[ "X-Agent" ]	Alias of the software
1965	9.1.0	true	threat	threat.software.id	keyword	extended		S0552	ID of the software
1966	9.1.0	true	threat	threat.software.name	keyword	extended		AdFind	Name of the software.
1967	9.1.0	true	threat	threat.software.platforms	keyword	extended	array	[ "Windows" ]	Platforms of the software.
1968	9.1.0	true	threat	threat.software.reference	keyword	extended		https://attack.mitre.org/software/S0552/	Software reference URL.
1969	9.1.0	true	threat	threat.software.type	keyword	extended		Tool	Software type.
1970	9.1.0	true	threat	threat.tactic.id	keyword	extended	array	TA0002	Threat tactic id.
1971	9.1.0	true	threat	threat.tactic.name	keyword	extended	array	Execution	Threat tactic.
1972	9.1.0	true	threat	threat.tactic.reference	keyword	extended	array	https://attack.mitre.org/tactics/TA0002/	Threat tactic URL reference.
1973	9.1.0	true	threat	threat.technique.id	keyword	extended	array	T1059	Threat technique id.
1974	9.1.0	true	threat	threat.technique.name	keyword	extended	array	Command and Scripting Interpreter	Threat technique name.
1975	9.1.0	true	threat	threat.technique.reference	keyword	extended	array	https://attack.mitre.org/techniques/T1059/	Threat technique URL reference.
1976	9.1.0	true	threat	threat.technique.subtechnique.id	keyword	extended	array	T1059.001	Threat subtechnique id.
1977	9.1.0	true	threat	threat.technique.subtechnique.name	keyword	extended	array	PowerShell	Threat subtechnique name.
1978	9.1.0	true	threat	threat.technique.subtechnique.reference	keyword	extended	array	https://attack.mitre.org/techniques/T1059/001/	Threat subtechnique URL reference.
1979	9.1.0	true	tls	tls.cipher	keyword	extended		TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256	String indicating the cipher used during the current connection.
1980	9.1.0	true	tls	tls.client.certificate	keyword	extended		MII...	PEM-encoded stand-alone certificate offered by the client.
1981	9.1.0	true	tls	tls.client.certificate_chain	keyword	extended	array	["MII...", "MII..."]	Array of PEM-encoded certificates that make up the certificate chain offered by the client.
1982	9.1.0	true	tls	tls.client.hash.md5	keyword	extended		0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC	Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client.
1983	9.1.0	true	tls	tls.client.hash.sha1	keyword	extended		9E393D93138888D288266C2D915214D1D1CCEB2A	Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client.
1984	9.1.0	true	tls	tls.client.hash.sha256	keyword	extended		0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0	Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client.
1985	9.1.0	true	tls	tls.client.issuer	keyword	extended		CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com	Distinguished name of subject of the issuer of the x.509 certificate presented by the client.
1986	9.1.0	true	tls	tls.client.ja3	keyword	extended		d4e5b18d6b55c71272893221c96ba240	A hash that identifies clients based on how they perform an SSL/TLS handshake.
1987	9.1.0	true	tls	tls.client.not_after	date	extended		2021-01-01T00:00:00.000Z	Date/Time indicating when client certificate is no longer considered valid.
1988	9.1.0	true	tls	tls.client.not_before	date	extended		1970-01-01T00:00:00.000Z	Date/Time indicating when client certificate is first considered valid.
1989	9.1.0	true	tls	tls.client.server_name	keyword	extended		www.elastic.co	Hostname the client is trying to connect to. Also called the SNI.
1990	9.1.0	true	tls	tls.client.subject	keyword	extended		CN=myclient, OU=Documentation Team, DC=example, DC=com	Distinguished name of subject of the x.509 certificate presented by the client.
1991	9.1.0	true	tls	tls.client.supported_ciphers	keyword	extended	array	["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "..."]	Array of ciphers offered by the client during the client hello.
1992	9.1.0	true	tls	tls.client.x509.alternative_names	keyword	extended	array	*.elastic.co	List of subject alternative names (SAN).
1993	9.1.0	true	tls	tls.client.x509.issuer.common_name	keyword	extended	array	Example SHA2 High Assurance Server CA	List of common name (CN) of issuing certificate authority.
1994	9.1.0	true	tls	tls.client.x509.issuer.country	keyword	extended	array	US	List of country \(C) codes
1995	9.1.0	true	tls	tls.client.x509.issuer.distinguished_name	keyword	extended		C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA	Distinguished name (DN) of issuing certificate authority.
1996	9.1.0	true	tls	tls.client.x509.issuer.locality	keyword	extended	array	Mountain View	List of locality names (L)
1997	9.1.0	true	tls	tls.client.x509.issuer.organization	keyword	extended	array	Example Inc	List of organizations (O) of issuing certificate authority.
1998	9.1.0	true	tls	tls.client.x509.issuer.organizational_unit	keyword	extended	array	www.example.com	List of organizational units (OU) of issuing certificate authority.
1999	9.1.0	true	tls	tls.client.x509.issuer.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
2000	9.1.0	true	tls	tls.client.x509.not_after	date	extended		2020-07-16T03:15:39Z	Time at which the certificate is no longer considered valid.
2001	9.1.0	true	tls	tls.client.x509.not_before	date	extended		2019-08-16T01:40:25Z	Time at which the certificate is first considered valid.
2002	9.1.0	true	tls	tls.client.x509.public_key_algorithm	keyword	extended		RSA	Algorithm used to generate the public key.
2003	9.1.0	true	tls	tls.client.x509.public_key_curve	keyword	extended		nistp521	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
2004	9.1.0	false	tls	tls.client.x509.public_key_exponent	long	extended		65537	Exponent used to derive the public key. This is algorithm specific.
2005	9.1.0	true	tls	tls.client.x509.public_key_size	long	extended		2048	The size of the public key space in bits.
2006	9.1.0	true	tls	tls.client.x509.serial_number	keyword	extended		55FBB9C7DEBF09809D12CCAA	Unique serial number issued by the certificate authority.
2007	9.1.0	true	tls	tls.client.x509.signature_algorithm	keyword	extended		SHA256-RSA	Identifier for certificate signature algorithm.
2008	9.1.0	true	tls	tls.client.x509.subject.common_name	keyword	extended	array	shared.global.example.net	List of common names (CN) of subject.
2009	9.1.0	true	tls	tls.client.x509.subject.country	keyword	extended	array	US	List of country \(C) code
2010	9.1.0	true	tls	tls.client.x509.subject.distinguished_name	keyword	extended		C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net	Distinguished name (DN) of the certificate subject entity.
2011	9.1.0	true	tls	tls.client.x509.subject.locality	keyword	extended	array	San Francisco	List of locality names (L)
2012	9.1.0	true	tls	tls.client.x509.subject.organization	keyword	extended	array	Example, Inc.	List of organizations (O) of subject.
2013	9.1.0	true	tls	tls.client.x509.subject.organizational_unit	keyword	extended	array		List of organizational units (OU) of subject.
2014	9.1.0	true	tls	tls.client.x509.subject.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
2015	9.1.0	true	tls	tls.client.x509.version_number	keyword	extended		3	Version of x509 format.
2016	9.1.0	true	tls	tls.curve	keyword	extended		secp256r1	String indicating the curve used for the given cipher, when applicable.
2017	9.1.0	true	tls	tls.established	boolean	extended			Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel.
2018	9.1.0	true	tls	tls.next_protocol	keyword	extended		http/1.1	String indicating the protocol being tunneled.
2019	9.1.0	true	tls	tls.resumed	boolean	extended			Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation.
2020	9.1.0	true	tls	tls.server.certificate	keyword	extended		MII...	PEM-encoded stand-alone certificate offered by the server.
2021	9.1.0	true	tls	tls.server.certificate_chain	keyword	extended	array	["MII...", "MII..."]	Array of PEM-encoded certificates that make up the certificate chain offered by the server.
2022	9.1.0	true	tls	tls.server.hash.md5	keyword	extended		0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC	Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server.
2023	9.1.0	true	tls	tls.server.hash.sha1	keyword	extended		9E393D93138888D288266C2D915214D1D1CCEB2A	Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server.
2024	9.1.0	true	tls	tls.server.hash.sha256	keyword	extended		0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0	Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server.
2025	9.1.0	true	tls	tls.server.issuer	keyword	extended		CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com	Subject of the issuer of the x.509 certificate presented by the server.
2026	9.1.0	true	tls	tls.server.ja3s	keyword	extended		394441ab65754e2207b1e1b457b3641d	A hash that identifies servers based on how they perform an SSL/TLS handshake.
2027	9.1.0	true	tls	tls.server.not_after	date	extended		2021-01-01T00:00:00.000Z	Timestamp indicating when server certificate is no longer considered valid.
2028	9.1.0	true	tls	tls.server.not_before	date	extended		1970-01-01T00:00:00.000Z	Timestamp indicating when server certificate is first considered valid.
2029	9.1.0	true	tls	tls.server.subject	keyword	extended		CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com	Subject of the x.509 certificate presented by the server.
2030	9.1.0	true	tls	tls.server.x509.alternative_names	keyword	extended	array	*.elastic.co	List of subject alternative names (SAN).
2031	9.1.0	true	tls	tls.server.x509.issuer.common_name	keyword	extended	array	Example SHA2 High Assurance Server CA	List of common name (CN) of issuing certificate authority.
2032	9.1.0	true	tls	tls.server.x509.issuer.country	keyword	extended	array	US	List of country \(C) codes
2033	9.1.0	true	tls	tls.server.x509.issuer.distinguished_name	keyword	extended		C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA	Distinguished name (DN) of issuing certificate authority.
2034	9.1.0	true	tls	tls.server.x509.issuer.locality	keyword	extended	array	Mountain View	List of locality names (L)
2035	9.1.0	true	tls	tls.server.x509.issuer.organization	keyword	extended	array	Example Inc	List of organizations (O) of issuing certificate authority.
2036	9.1.0	true	tls	tls.server.x509.issuer.organizational_unit	keyword	extended	array	www.example.com	List of organizational units (OU) of issuing certificate authority.
2037	9.1.0	true	tls	tls.server.x509.issuer.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
2038	9.1.0	true	tls	tls.server.x509.not_after	date	extended		2020-07-16T03:15:39Z	Time at which the certificate is no longer considered valid.
2039	9.1.0	true	tls	tls.server.x509.not_before	date	extended		2019-08-16T01:40:25Z	Time at which the certificate is first considered valid.
2040	9.1.0	true	tls	tls.server.x509.public_key_algorithm	keyword	extended		RSA	Algorithm used to generate the public key.
2041	9.1.0	true	tls	tls.server.x509.public_key_curve	keyword	extended		nistp521	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
2042	9.1.0	false	tls	tls.server.x509.public_key_exponent	long	extended		65537	Exponent used to derive the public key. This is algorithm specific.
2043	9.1.0	true	tls	tls.server.x509.public_key_size	long	extended		2048	The size of the public key space in bits.
2044	9.1.0	true	tls	tls.server.x509.serial_number	keyword	extended		55FBB9C7DEBF09809D12CCAA	Unique serial number issued by the certificate authority.
2045	9.1.0	true	tls	tls.server.x509.signature_algorithm	keyword	extended		SHA256-RSA	Identifier for certificate signature algorithm.
2046	9.1.0	true	tls	tls.server.x509.subject.common_name	keyword	extended	array	shared.global.example.net	List of common names (CN) of subject.
2047	9.1.0	true	tls	tls.server.x509.subject.country	keyword	extended	array	US	List of country \(C) code
2048	9.1.0	true	tls	tls.server.x509.subject.distinguished_name	keyword	extended		C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net	Distinguished name (DN) of the certificate subject entity.
2049	9.1.0	true	tls	tls.server.x509.subject.locality	keyword	extended	array	San Francisco	List of locality names (L)
2050	9.1.0	true	tls	tls.server.x509.subject.organization	keyword	extended	array	Example, Inc.	List of organizations (O) of subject.
2051	9.1.0	true	tls	tls.server.x509.subject.organizational_unit	keyword	extended	array		List of organizational units (OU) of subject.
2052	9.1.0	true	tls	tls.server.x509.subject.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
2053	9.1.0	true	tls	tls.server.x509.version_number	keyword	extended		3	Version of x509 format.
2054	9.1.0	true	tls	tls.version	keyword	extended		1.2	Numeric part of the version parsed from the original string.
2055	9.1.0	true	tls	tls.version_protocol	keyword	extended		tls	Normalized lowercase protocol name parsed from original string.
2056	9.1.0	true	trace	trace.id	keyword	extended		4bf92f3577b34da6a3ce929d0e0e4736	Unique identifier of the trace.
2057	9.1.0	true	transaction	transaction.id	keyword	extended		00f067aa0ba902b7	Unique identifier of the transaction within the scope of its trace.
2058	9.1.0	true	url	url.domain	keyword	extended		www.elastic.co	Domain of the url.
2059	9.1.0	true	url	url.extension	keyword	extended		png	File extension from the request url, excluding the leading dot.
2060	9.1.0	true	url	url.fragment	keyword	extended			Portion of the url after the `#`.
2061	9.1.0	true	url	url.full	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top	Full unparsed URL.
2062	9.1.0	true	url	url.original	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch	Unmodified original url as seen in the event source.
2063	9.1.0	true	url	url.password	keyword	extended			Password of the request.
2064	9.1.0	true	url	url.path	keyword	extended			Path of the request, such as "/search".
2065	9.1.0	true	url	url.port	long	extended		443	Port of the request, such as 443.
2066	9.1.0	true	url	url.query	keyword	extended			Query string of the request.
2067	9.1.0	true	url	url.registered_domain	keyword	extended		example.com	The highest registered url domain, stripped of the subdomain.
2068	9.1.0	true	url	url.scheme	keyword	extended		https	Scheme of the url.
2069	9.1.0	true	url	url.subdomain	keyword	extended		east	The subdomain of the domain.
2070	9.1.0	true	url	url.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
2071	9.1.0	true	url	url.username	keyword	extended			Username of the request.
2072	9.1.0	true	user	user.changes.domain	keyword	extended			Name of the directory the user is a member of.
2073	9.1.0	true	user	user.changes.email	keyword	extended			User email address.
2074	9.1.0	true	user	user.changes.full_name	keyword	extended		Albert Einstein	User's full name, if available.
2075	9.1.0	true	user	user.changes.group.domain	keyword	extended			Name of the directory the group is a member of.
2076	9.1.0	true	user	user.changes.group.id	keyword	extended			Unique identifier for the group on the system/platform.
2077	9.1.0	true	user	user.changes.group.name	keyword	extended			Name of the group.
2078	9.1.0	true	user	user.changes.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
2079	9.1.0	true	user	user.changes.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
2080	9.1.0	true	user	user.changes.name	keyword	core		a.einstein	Short name or login of the user.
2081	9.1.0	true	user	user.changes.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
2082	9.1.0	true	user	user.domain	keyword	extended			Name of the directory the user is a member of.
2083	9.1.0	true	user	user.effective.domain	keyword	extended			Name of the directory the user is a member of.
2084	9.1.0	true	user	user.effective.email	keyword	extended			User email address.
2085	9.1.0	true	user	user.effective.full_name	keyword	extended		Albert Einstein	User's full name, if available.
2086	9.1.0	true	user	user.effective.group.domain	keyword	extended			Name of the directory the group is a member of.
2087	9.1.0	true	user	user.effective.group.id	keyword	extended			Unique identifier for the group on the system/platform.
2088	9.1.0	true	user	user.effective.group.name	keyword	extended			Name of the group.
2089	9.1.0	true	user	user.effective.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
2090	9.1.0	true	user	user.effective.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
2091	9.1.0	true	user	user.effective.name	keyword	core		a.einstein	Short name or login of the user.
2092	9.1.0	true	user	user.effective.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
2093	9.1.0	true	user	user.email	keyword	extended			User email address.
2094	9.1.0	true	user	user.full_name	keyword	extended		Albert Einstein	User's full name, if available.
2095	9.1.0	true	user	user.group.domain	keyword	extended			Name of the directory the group is a member of.
2096	9.1.0	true	user	user.group.id	keyword	extended			Unique identifier for the group on the system/platform.
2097	9.1.0	true	user	user.group.name	keyword	extended			Name of the group.
2098	9.1.0	true	user	user.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
2099	9.1.0	true	user	user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
2100	9.1.0	true	user	user.name	keyword	core		a.einstein	Short name or login of the user.
2101	9.1.0	true	user	user.risk.calculated_level	keyword	extended		High	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
2102	9.1.0	true	user	user.risk.calculated_score	float	extended		880.73	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
2103	9.1.0	true	user	user.risk.calculated_score_norm	float	extended		88.73	A normalized risk score calculated by an internal system.
2104	9.1.0	true	user	user.risk.static_level	keyword	extended		High	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
2105	9.1.0	true	user	user.risk.static_score	float	extended		830.0	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
2106	9.1.0	true	user	user.risk.static_score_norm	float	extended		83.0	A normalized risk score calculated by an external system.
2107	9.1.0	true	user	user.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
2108	9.1.0	true	user	user.target.domain	keyword	extended			Name of the directory the user is a member of.
2109	9.1.0	true	user	user.target.email	keyword	extended			User email address.
2110	9.1.0	true	user	user.target.full_name	keyword	extended		Albert Einstein	User's full name, if available.
2111	9.1.0	true	user	user.target.group.domain	keyword	extended			Name of the directory the group is a member of.
2112	9.1.0	true	user	user.target.group.id	keyword	extended			Unique identifier for the group on the system/platform.
2113	9.1.0	true	user	user.target.group.name	keyword	extended			Name of the group.
2114	9.1.0	true	user	user.target.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
2115	9.1.0	true	user	user.target.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
2116	9.1.0	true	user	user.target.name	keyword	core		a.einstein	Short name or login of the user.
2117	9.1.0	true	user	user.target.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
2118	9.1.0	true	user_agent	user_agent.device.name	keyword	extended		iPhone	Name of the device.
2119	9.1.0	true	user_agent	user_agent.name	keyword	extended		Safari	Name of the user agent.
2120	9.1.0	true	user_agent	user_agent.original	keyword	extended		Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1	Unparsed user_agent string.
2121	9.1.0	true	user_agent	user_agent.os.family	keyword	extended		debian	OS family (such as redhat, debian, freebsd, windows).
2122	9.1.0	true	user_agent	user_agent.os.full	keyword	extended		Mac OS Mojave	Operating system name, including the version or code name.
2123	9.1.0	true	user_agent	user_agent.os.kernel	keyword	extended		4.4.0-112-generic	Operating system kernel version as a raw string.
2124	9.1.0	true	user_agent	user_agent.os.name	keyword	extended		Mac OS X	Operating system name, without the version.
2125	9.1.0	true	user_agent	user_agent.os.platform	keyword	extended		darwin	Operating system platform (such centos, ubuntu, windows).
2126	9.1.0	true	user_agent	user_agent.os.type	keyword	extended		macos	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
2127	9.1.0	true	user_agent	user_agent.os.version	keyword	extended		10.14.1	Operating system version as a raw string.
2128	9.1.0	true	user_agent	user_agent.version	keyword	extended		12.0	Version of the user agent.
2129	9.1.0	true	volume	volume.bus_type	keyword	extended		FileBackedVirtual	Bus type of the device.
2130	9.1.0	true	volume	volume.default_access	keyword	extended			Bus type of the device.
2131	9.1.0	true	volume	volume.device_name	keyword	extended			Device name of the volume.
2132	9.1.0	true	volume	volume.device_type	keyword	extended		CD-ROM File System	Volume device type.
2133	9.1.0	true	volume	volume.dos_name	keyword	extended		E:	DOS name of the device.
2134	9.1.0	true	volume	volume.file_system_type	keyword	extended			Volume device file system type.
2135	9.1.0	true	volume	volume.mount_name	keyword	extended			Mount name of the volume.
2136	9.1.0	true	volume	volume.nt_name	keyword	extended		\Device\Cdrom1	NT name of the device.
2137	9.1.0	true	volume	volume.product_id	keyword	extended			ProductID of the device.
2138	9.1.0	true	volume	volume.product_name	keyword	extended		Virtual DVD-ROM	Produce name of the volume.
2139	9.1.0	true	volume	volume.removable	boolean	extended			Indicates if the volume is removable.
2140	9.1.0	true	volume	volume.serial_number	keyword	extended			Serial number of the device.
2141	9.1.0	true	volume	volume.size	long	extended			Size of the volume device in bytes.
2142	9.1.0	true	volume	volume.vendor_id	keyword	extended			VendorID of the device.
2143	9.1.0	true	volume	volume.vendor_name	keyword	extended		Msft	Vendor name of the device.
2144	9.1.0	true	volume	volume.writable	boolean	extended			Indicates if the volume is writable.
2145	9.1.0	true	vulnerability	vulnerability.category	keyword	extended	array	["Firewall"]	Category of a vulnerability.
2146	9.1.0	true	vulnerability	vulnerability.classification	keyword	extended		CVSS	Classification of the vulnerability.
2147	9.1.0	true	vulnerability	vulnerability.description	keyword	extended		In macOS before 2.12.6, there is a vulnerability in the RPC...	Description of the vulnerability.
2148	9.1.0	true	vulnerability	vulnerability.enumeration	keyword	extended		CVE	Identifier of the vulnerability.
2149	9.1.0	true	vulnerability	vulnerability.id	keyword	extended		CVE-2019-00001	ID of the vulnerability.
2150	9.1.0	true	vulnerability	vulnerability.reference	keyword	extended		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111	Reference of the vulnerability.
2151	9.1.0	true	vulnerability	vulnerability.report_id	keyword	extended		20191018.0001	Scan identification number.
2152	9.1.0	true	vulnerability	vulnerability.scanner.reference	keyword	custom		https://www.example.com/vulnerability/12345	Scanner's resource that provides additional information, context, and mitigations for the identified vulnerability.
2153	9.1.0	true	vulnerability	vulnerability.scanner.vendor	keyword	extended		Tenable	Name of the scanner vendor.
2154	9.1.0	true	vulnerability	vulnerability.score.base	float	extended		5.5	Vulnerability Base score.
2155	9.1.0	true	vulnerability	vulnerability.score.environmental	float	extended		5.5	Vulnerability Environmental score.
2156	9.1.0	true	vulnerability	vulnerability.score.temporal	float	extended			Vulnerability Temporal score.
2157	9.1.0	true	vulnerability	vulnerability.score.version	keyword	extended		2.0	CVSS version.
2158	9.1.0	true	vulnerability	vulnerability.severity	keyword	extended		Critical	Severity of the vulnerability.
2159	9.1.0	true	wazuh	wazuh.cluster.name	keyword	custom		wazuh-cluster-1	Wazuh cluster name.
2160	9.1.0	true	wazuh	wazuh.cluster.node	keyword	custom		wazuh-cluster-node-1	Wazuh cluster node name.
2161	9.1.0	true	wazuh	wazuh.integration.category	keyword	custom		security	Wazuh integration category.
2162	9.1.0	true	wazuh	wazuh.integration.decoders	keyword	custom	array	["json", "syslog"]	List of Wazuh decoders applied to the event.
2163	9.1.0	true	wazuh	wazuh.integration.name	keyword	custom		Cisco Aironet	Name of the Wazuh integration.
2164	9.1.0	true	wazuh	wazuh.integration.rules	keyword	custom	array	["1002", "2003"]	List of Wazuh rules applied to the event.
2165	9.1.0	true	wazuh	wazuh.protocol.location	keyword	custom		/var/log/auth.log	Source of the log as retrieved by the Wazuh Agent.
2166	9.1.0	true	wazuh	wazuh.protocol.queue	byte	custom		1	Ingestion queue for the log.
2167	9.1.0	true	wazuh	wazuh.schema.version	keyword	custom		1.7.0	Wazuh schema version.