wazuh-indexer-plugins/ecs/stateless/docs/fields.csv

1	ECS_Version	Indexed	Field_Set	Field	Type	Level	Normalization	Example	Description
2	8.11.0	true	base	@timestamp	date	core		2016-05-23T08:05:34.853Z	Date/time when the event originated.
3	8.11.0	true	base	labels	object	core		{"application": "foo-bar", "env": "production"}	Custom key/value pairs.
4	8.11.0	true	base	message	keyword	core		Hello World	Log message optimized for viewing in a log viewer.
5	8.11.0	true	base	tags	keyword	core	array	["production", "env2"]	List of keywords used to tag each event.
6	8.11.0	true	agent	agent.build.original	keyword	core		metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]	Extended build information for the agent.
7	8.11.0	true	agent	agent.ephemeral_id	keyword	extended		8a4f500f	Ephemeral identifier of this agent.
8	8.11.0	true	agent	agent.groups	keyword	custom	array	["group1", "group2"]	List of groups the agent belongs to.
9	8.11.0	true	agent	agent.host.architecture	keyword	core		x86_64	Operating system architecture.
10	8.11.0	true	agent	agent.host.boot.id	keyword	extended		88a1f0ed-5ae5-41ee-af6b-41921c311872	Linux boot uuid taken from /proc/sys/kernel/random/boot_id
11	8.11.0	true	agent	agent.host.cpu	object	custom		"name": "Intel(R) Core(TM) i7-7700HQ CPU", "cores": 4, "speed": 2800	CPU-related data.
12	8.11.0	true	agent	agent.host.cpu.cores	long	custom		4	Number of CPU cores.
13	8.11.0	true	agent	agent.host.cpu.name	keyword	custom		Intel(R) Core(TM) i7-7700HQ CPU	CPU Model name.
14	8.11.0	true	agent	agent.host.cpu.speed	long	custom		2800	CPU clock speed.
15	8.11.0	true	agent	agent.host.cpu.usage	scaled_float	extended			Percent CPU used, between 0 and 1.
16	8.11.0	true	agent	agent.host.disk.read.bytes	long	extended			The number of bytes read by all disks.
17	8.11.0	true	agent	agent.host.disk.write.bytes	long	extended			The number of bytes written on all disks.
18	8.11.0	true	agent	agent.host.domain	keyword	extended		CONTOSO	Name of the directory the group is a member of.
19	8.11.0	true	agent	agent.host.geo.city_name	keyword	core		Montreal	City name.
20	8.11.0	true	agent	agent.host.geo.continent_code	keyword	core		NA	Continent code.
21	8.11.0	true	agent	agent.host.geo.continent_name	keyword	core		North America	Name of the continent.
22	8.11.0	true	agent	agent.host.geo.country_iso_code	keyword	core		CA	Country ISO code.
23	8.11.0	true	agent	agent.host.geo.country_name	keyword	core		Canada	Country name.
24	8.11.0	true	agent	agent.host.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
25	8.11.0	true	agent	agent.host.geo.name	keyword	extended		boston-dc	User-defined description of a location.
26	8.11.0	true	agent	agent.host.geo.postal_code	keyword	core		94040	Postal code.
27	8.11.0	true	agent	agent.host.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
28	8.11.0	true	agent	agent.host.geo.region_name	keyword	core		Quebec	Region name.
29	8.11.0	true	agent	agent.host.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
30	8.11.0	true	agent	agent.host.hostname	keyword	core			Hostname of the host.
31	8.11.0	true	agent	agent.host.id	keyword	core			Unique host id.
32	8.11.0	true	agent	agent.host.ip	ip	core	array		Host ip addresses.
33	8.11.0	true	agent	agent.host.mac	keyword	core	array	["00-00-5E-00-53-23", "00-00-5E-00-53-24"]	Host MAC addresses.
34	8.11.0	true	agent	agent.host.memory	object	custom		"total": 100000, "free": 90000, "used": {"percentage": 10}	Memory-related data.
35	8.11.0	true	agent	agent.host.memory.free	long	custom		1024	Free memory in MB.
36	8.11.0	true	agent	agent.host.memory.total	long	custom		1024	Total memory in MB.
37	8.11.0	true	agent	agent.host.memory.used	object	custom		"percentage": 10	Used memory-related data.
38	8.11.0	true	agent	agent.host.memory.used.percentage	long	custom		10	Used memory percentage.
39	8.11.0	true	agent	agent.host.name	keyword	core			Name of the host.
40	8.11.0	true	agent	agent.host.network.egress.bytes	long	extended			The number of bytes sent on all network interfaces.
41	8.11.0	true	agent	agent.host.network.egress.drops	long	custom		10	Number of dropped transmitted packets.
42	8.11.0	true	agent	agent.host.network.egress.errors	long	custom		10	Number of transmission errors.
43	8.11.0	true	agent	agent.host.network.egress.packets	long	extended			The number of packets sent on all network interfaces.
44	8.11.0	true	agent	agent.host.network.egress.queue	long	custom		10	Transmit queue length.
45	8.11.0	true	agent	agent.host.network.ingress.bytes	long	extended			The number of bytes received on all network interfaces.
46	8.11.0	true	agent	agent.host.network.ingress.drops	long	custom		10	Number of dropped received packets.
47	8.11.0	true	agent	agent.host.network.ingress.errors	long	custom		10	Number of reception errors.
48	8.11.0	true	agent	agent.host.network.ingress.packets	long	extended			The number of packets received on all network interfaces.
49	8.11.0	true	agent	agent.host.network.ingress.queue	long	custom		10	Receive queue length.
50	8.11.0	true	agent	agent.host.os.family	keyword	extended		debian	OS family (such as redhat, debian, freebsd, windows).
51	8.11.0	true	agent	agent.host.os.full	keyword	extended		Mac OS Mojave	Operating system name, including the version or code name.
52	8.11.0	true	agent	agent.host.os.full.text	keyword	extended		Mac OS Mojave	Operating system name, including the version or code name.
53	8.11.0	true	agent	agent.host.os.kernel	keyword	extended		4.4.0-112-generic	Operating system kernel version as a raw string.
54	8.11.0	true	agent	agent.host.os.name	keyword	extended		Mac OS X	Operating system name, without the version.
55	8.11.0	true	agent	agent.host.os.name.text	keyword	extended		Mac OS X	Operating system name, without the version.
56	8.11.0	true	agent	agent.host.os.platform	keyword	extended		darwin	Operating system platform (such centos, ubuntu, windows).
57	8.11.0	true	agent	agent.host.os.type	keyword	extended		macos	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
58	8.11.0	true	agent	agent.host.os.version	keyword	extended		10.14.1	Operating system version as a raw string.
59	8.11.0	true	agent	agent.host.pid_ns_ino	keyword	extended		256383	Pid namespace inode
60	8.11.0	true	agent	agent.host.risk.calculated_level	keyword	extended		High	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
61	8.11.0	true	agent	agent.host.risk.calculated_score	float	extended		880.73	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
62	8.11.0	true	agent	agent.host.risk.calculated_score_norm	float	extended		88.73	A normalized risk score calculated by an internal system.
63	8.11.0	true	agent	agent.host.risk.static_level	keyword	extended		High	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
64	8.11.0	true	agent	agent.host.risk.static_score	float	extended		830.0	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
65	8.11.0	true	agent	agent.host.risk.static_score_norm	float	extended		83.0	A normalized risk score calculated by an external system.
66	8.11.0	true	agent	agent.host.type	keyword	core			Type of host.
67	8.11.0	true	agent	agent.host.uptime	long	extended		1325	Seconds the host has been up.
68	8.11.0	true	agent	agent.id	keyword	core		8a4f500d	Unique identifier of this agent.
69	8.11.0	true	agent	agent.name	keyword	core		foo	Custom name of the agent.
70	8.11.0	true	agent	agent.type	keyword	core		filebeat	Type of the agent.
71	8.11.0	true	agent	agent.version	keyword	core		6.0.0-rc2	Version of the agent.
72	8.11.0	true	check	check.compliance	keyword	custom	array	["cis:1.1.1","cis_csc:5.2"]	CIS compliance standard.
73	8.11.0	true	check	check.condition	keyword	custom		all	Relationship between the rules.
74	8.11.0	true	check	check.description	keyword	custom		"The password history setting determines the number of unique new passwords a user must use before an old password can be reused."	Extended description of the check.
75	8.11.0	true	check	check.id	keyword	custom		26000	The ID of the SCA policy check.
76	8.11.0	true	check	check.name	keyword	custom		Ensure 'Enforce password history' is set to '24 or more password(s)'.	The name of the SCA policy check.
77	8.11.0	true	check	check.rationale	keyword	custom		"The longer a user uses the same password, the more likely it is that the password will be compromised."	The reason for the check. Why it is important.
78	8.11.0	true	check	check.reason	keyword	custom		"The password history setting is not set to 24 or more password(s)."	Reason for the check result.
79	8.11.0	true	check	check.references	keyword	custom	array	["https://workbench.cisecurity.org"]	References for the check.
80	8.11.0	true	check	check.remediation	keyword	custom		"To establish the recommended configuration, set the following registry value to 24 or more password(s):"	Actions to take to remediate the check.
81	8.11.0	true	check	check.result	keyword	custom		failed	Result of the check.
82	8.11.0	true	check	check.rules	keyword	custom	array	"[\"c:net.exe accounts -> n:Maximum password age \(days\):\s+(\d+) compare > 0\"," > "\"c:net.exe accounts -> n:Length of password history maintained:\s+(\d+) compare >= 24\"]"	Rules to be evaluated.
83	8.11.0	true	client	client.address	keyword	extended			Client network address.
84	8.11.0	true	client	client.as.number	long	extended		15169	Unique number allocated to the autonomous system.
85	8.11.0	true	client	client.as.organization.name	keyword	extended		Google LLC	Organization name.
86	8.11.0	true	client	client.as.organization.name.text	keyword	extended		Google LLC	Organization name.
87	8.11.0	true	client	client.bytes	long	core		184	Bytes sent from the client to the server.
88	8.11.0	true	client	client.domain	keyword	core		foo.example.com	The domain name of the client.
89	8.11.0	true	client	client.geo.city_name	keyword	core		Montreal	City name.
90	8.11.0	true	client	client.geo.continent_code	keyword	core		NA	Continent code.
91	8.11.0	true	client	client.geo.continent_name	keyword	core		North America	Name of the continent.
92	8.11.0	true	client	client.geo.country_iso_code	keyword	core		CA	Country ISO code.
93	8.11.0	true	client	client.geo.country_name	keyword	core		Canada	Country name.
94	8.11.0	true	client	client.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
95	8.11.0	true	client	client.geo.name	keyword	extended		boston-dc	User-defined description of a location.
96	8.11.0	true	client	client.geo.postal_code	keyword	core		94040	Postal code.
97	8.11.0	true	client	client.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
98	8.11.0	true	client	client.geo.region_name	keyword	core		Quebec	Region name.
99	8.11.0	true	client	client.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
100	8.11.0	true	client	client.ip	ip	core			IP address of the client.
101	8.11.0	true	client	client.mac	keyword	core		00-00-5E-00-53-23	MAC address of the client.
102	8.11.0	true	client	client.nat.ip	ip	extended			Client NAT ip address
103	8.11.0	true	client	client.nat.port	long	extended			Client NAT port
104	8.11.0	true	client	client.packets	long	core		12	Packets sent from the client to the server.
105	8.11.0	true	client	client.port	long	core			Port of the client.
106	8.11.0	true	client	client.registered_domain	keyword	extended		example.com	The highest registered client domain, stripped of the subdomain.
107	8.11.0	true	client	client.subdomain	keyword	extended		east	The subdomain of the domain.
108	8.11.0	true	client	client.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
109	8.11.0	true	client	client.user.domain	keyword	extended			Name of the directory the user is a member of.
110	8.11.0	true	client	client.user.email	keyword	extended			User email address.
111	8.11.0	true	client	client.user.full_name	keyword	extended		Albert Einstein	User's full name, if available.
112	8.11.0	true	client	client.user.full_name.text	keyword	extended		Albert Einstein	User's full name, if available.
113	8.11.0	true	client	client.user.group.domain	keyword	extended			Name of the directory the group is a member of.
114	8.11.0	true	client	client.user.group.id	keyword	extended			Unique identifier for the group on the system/platform.
115	8.11.0	true	client	client.user.group.name	keyword	extended			Name of the group.
116	8.11.0	true	client	client.user.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
117	8.11.0	true	client	client.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
118	8.11.0	true	client	client.user.name	keyword	core		a.einstein	Short name or login of the user.
119	8.11.0	true	client	client.user.name.text	keyword	core		a.einstein	Short name or login of the user.
120	8.11.0	true	client	client.user.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
121	8.11.0	true	cloud	cloud.account.id	keyword	extended		666777888999	The cloud account or organization id.
122	8.11.0	true	cloud	cloud.account.name	keyword	extended		elastic-dev	The cloud account name.
123	8.11.0	true	cloud	cloud.availability_zone	keyword	extended		us-east-1c	Availability zone in which this host, resource, or service is located.
124	8.11.0	true	cloud	cloud.instance.id	keyword	extended		i-1234567890abcdef0	Instance ID of the host machine.
125	8.11.0	true	cloud	cloud.instance.name	keyword	extended			Instance name of the host machine.
126	8.11.0	true	cloud	cloud.machine.type	keyword	extended		t2.medium	Machine type of the host machine.
127	8.11.0	true	cloud	cloud.origin.account.id	keyword	extended		666777888999	The cloud account or organization id.
128	8.11.0	true	cloud	cloud.origin.account.name	keyword	extended		elastic-dev	The cloud account name.
129	8.11.0	true	cloud	cloud.origin.availability_zone	keyword	extended		us-east-1c	Availability zone in which this host, resource, or service is located.
130	8.11.0	true	cloud	cloud.origin.instance.id	keyword	extended		i-1234567890abcdef0	Instance ID of the host machine.
131	8.11.0	true	cloud	cloud.origin.instance.name	keyword	extended			Instance name of the host machine.
132	8.11.0	true	cloud	cloud.origin.machine.type	keyword	extended		t2.medium	Machine type of the host machine.
133	8.11.0	true	cloud	cloud.origin.project.id	keyword	extended		my-project	The cloud project id.
134	8.11.0	true	cloud	cloud.origin.project.name	keyword	extended		my project	The cloud project name.
135	8.11.0	true	cloud	cloud.origin.provider	keyword	extended		aws	Name of the cloud provider.
136	8.11.0	true	cloud	cloud.origin.region	keyword	extended		us-east-1	Region in which this host, resource, or service is located.
137	8.11.0	true	cloud	cloud.origin.service.name	keyword	extended		lambda	The cloud service name.
138	8.11.0	true	cloud	cloud.project.id	keyword	extended		my-project	The cloud project id.
139	8.11.0	true	cloud	cloud.project.name	keyword	extended		my project	The cloud project name.
140	8.11.0	true	cloud	cloud.provider	keyword	extended		aws	Name of the cloud provider.
141	8.11.0	true	cloud	cloud.region	keyword	extended		us-east-1	Region in which this host, resource, or service is located.
142	8.11.0	true	cloud	cloud.service.name	keyword	extended		lambda	The cloud service name.
143	8.11.0	true	cloud	cloud.target.account.id	keyword	extended		666777888999	The cloud account or organization id.
144	8.11.0	true	cloud	cloud.target.account.name	keyword	extended		elastic-dev	The cloud account name.
145	8.11.0	true	cloud	cloud.target.availability_zone	keyword	extended		us-east-1c	Availability zone in which this host, resource, or service is located.
146	8.11.0	true	cloud	cloud.target.instance.id	keyword	extended		i-1234567890abcdef0	Instance ID of the host machine.
147	8.11.0	true	cloud	cloud.target.instance.name	keyword	extended			Instance name of the host machine.
148	8.11.0	true	cloud	cloud.target.machine.type	keyword	extended		t2.medium	Machine type of the host machine.
149	8.11.0	true	cloud	cloud.target.project.id	keyword	extended		my-project	The cloud project id.
150	8.11.0	true	cloud	cloud.target.project.name	keyword	extended		my project	The cloud project name.
151	8.11.0	true	cloud	cloud.target.provider	keyword	extended		aws	Name of the cloud provider.
152	8.11.0	true	cloud	cloud.target.region	keyword	extended		us-east-1	Region in which this host, resource, or service is located.
153	8.11.0	true	cloud	cloud.target.service.name	keyword	extended		lambda	The cloud service name.
154	8.11.0	true	container	container.cpu.usage	scaled_float	extended			Percent CPU used, between 0 and 1.
155	8.11.0	true	container	container.disk.read.bytes	long	extended			The number of bytes read by all disks.
156	8.11.0	true	container	container.disk.write.bytes	long	extended			The number of bytes written on all disks.
157	8.11.0	true	container	container.id	keyword	core			Unique container id.
158	8.11.0	true	container	container.image.hash.all	keyword	extended	array	[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]	An array of digests of the image the container was built on.
159	8.11.0	true	container	container.image.name	keyword	extended			Name of the image the container was built on.
160	8.11.0	true	container	container.image.tag	keyword	extended	array		Container image tags.
161	8.11.0	true	container	container.labels	object	extended			Image labels.
162	8.11.0	true	container	container.memory.usage	scaled_float	extended			Percent memory used, between 0 and 1.
163	8.11.0	true	container	container.name	keyword	extended			Container name.
164	8.11.0	true	container	container.network.egress.bytes	long	extended			The number of bytes sent on all network interfaces.
165	8.11.0	true	container	container.network.ingress.bytes	long	extended			The number of bytes received on all network interfaces.
166	8.11.0	true	container	container.runtime	keyword	extended		docker	Runtime managing this container.
167	8.11.0	true	container	container.security_context.privileged	boolean	extended			Indicates whether the container is running in privileged mode.
168	8.11.0	true	data_stream	data_stream.dataset	keyword	extended		nginx.access	The field can contain anything that makes sense to signify the source of the data.
169	8.11.0	true	data_stream	data_stream.namespace	keyword	extended		production	A user defined namespace. Namespaces are useful to allow grouping of data.
170	8.11.0	true	data_stream	data_stream.type	keyword	extended		logs	An overarching type for the data stream.
171	8.11.0	true	destination	destination.address	keyword	extended			Destination network address.
172	8.11.0	true	destination	destination.as.number	long	extended		15169	Unique number allocated to the autonomous system.
173	8.11.0	true	destination	destination.as.organization.name	keyword	extended		Google LLC	Organization name.
174	8.11.0	true	destination	destination.as.organization.name.text	keyword	extended		Google LLC	Organization name.
175	8.11.0	true	destination	destination.bytes	long	core		184	Bytes sent from the destination to the source.
176	8.11.0	true	destination	destination.domain	keyword	core		foo.example.com	The domain name of the destination.
177	8.11.0	true	destination	destination.geo.city_name	keyword	core		Montreal	City name.
178	8.11.0	true	destination	destination.geo.continent_code	keyword	core		NA	Continent code.
179	8.11.0	true	destination	destination.geo.continent_name	keyword	core		North America	Name of the continent.
180	8.11.0	true	destination	destination.geo.country_iso_code	keyword	core		CA	Country ISO code.
181	8.11.0	true	destination	destination.geo.country_name	keyword	core		Canada	Country name.
182	8.11.0	true	destination	destination.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
183	8.11.0	true	destination	destination.geo.name	keyword	extended		boston-dc	User-defined description of a location.
184	8.11.0	true	destination	destination.geo.postal_code	keyword	core		94040	Postal code.
185	8.11.0	true	destination	destination.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
186	8.11.0	true	destination	destination.geo.region_name	keyword	core		Quebec	Region name.
187	8.11.0	true	destination	destination.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
188	8.11.0	true	destination	destination.ip	ip	core			IP address of the destination.
189	8.11.0	true	destination	destination.mac	keyword	core		00-00-5E-00-53-23	MAC address of the destination.
190	8.11.0	true	destination	destination.nat.ip	ip	extended			Destination NAT ip
191	8.11.0	true	destination	destination.nat.port	long	extended			Destination NAT Port
192	8.11.0	true	destination	destination.packets	long	core		12	Packets sent from the destination to the source.
193	8.11.0	true	destination	destination.port	long	core			Port of the destination.
194	8.11.0	true	destination	destination.registered_domain	keyword	extended		example.com	The highest registered destination domain, stripped of the subdomain.
195	8.11.0	true	destination	destination.subdomain	keyword	extended		east	The subdomain of the domain.
196	8.11.0	true	destination	destination.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
197	8.11.0	true	destination	destination.user.domain	keyword	extended			Name of the directory the user is a member of.
198	8.11.0	true	destination	destination.user.email	keyword	extended			User email address.
199	8.11.0	true	destination	destination.user.full_name	keyword	extended		Albert Einstein	User's full name, if available.
200	8.11.0	true	destination	destination.user.full_name.text	keyword	extended		Albert Einstein	User's full name, if available.
201	8.11.0	true	destination	destination.user.group.domain	keyword	extended			Name of the directory the group is a member of.
202	8.11.0	true	destination	destination.user.group.id	keyword	extended			Unique identifier for the group on the system/platform.
203	8.11.0	true	destination	destination.user.group.name	keyword	extended			Name of the group.
204	8.11.0	true	destination	destination.user.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
205	8.11.0	true	destination	destination.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
206	8.11.0	true	destination	destination.user.name	keyword	core		a.einstein	Short name or login of the user.
207	8.11.0	true	destination	destination.user.name.text	keyword	core		a.einstein	Short name or login of the user.
208	8.11.0	true	destination	destination.user.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
209	8.11.0	true	device	device.id	keyword	extended		00000000-54b3-e7c7-0000-000046bffd97	The unique identifier of a device.
210	8.11.0	true	device	device.manufacturer	keyword	extended		Samsung	The vendor name of the device manufacturer.
211	8.11.0	true	device	device.model.identifier	keyword	extended		SM-G920F	The machine readable identifier of the device model.
212	8.11.0	true	device	device.model.name	keyword	extended		Samsung Galaxy S6	The human readable marketing name of the device model.
213	8.11.0	true	dll	dll.code_signature.digest_algorithm	keyword	extended		sha256	Hashing algorithm used to sign the process.
214	8.11.0	true	dll	dll.code_signature.exists	boolean	core		true	Boolean to capture if a signature is present.
215	8.11.0	true	dll	dll.code_signature.signing_id	keyword	extended		com.apple.xpc.proxy	The identifier used to sign the process.
216	8.11.0	true	dll	dll.code_signature.status	keyword	extended		ERROR_UNTRUSTED_ROOT	Additional information about the certificate status.
217	8.11.0	true	dll	dll.code_signature.subject_name	keyword	core		Microsoft Corporation	Subject name of the code signer
218	8.11.0	true	dll	dll.code_signature.team_id	keyword	extended		EQHXZ8M8AV	The team identifier used to sign the process.
219	8.11.0	true	dll	dll.code_signature.timestamp	date	extended		2021-01-01T12:10:30Z	When the signature was generated and signed.
220	8.11.0	true	dll	dll.code_signature.trusted	boolean	extended		true	Stores the trust status of the certificate chain.
221	8.11.0	true	dll	dll.code_signature.valid	boolean	extended		true	Boolean to capture if the digital signature is verified against the binary content.
222	8.11.0	true	dll	dll.hash.md5	keyword	extended			MD5 hash.
223	8.11.0	true	dll	dll.hash.sha1	keyword	extended			SHA1 hash.
224	8.11.0	true	dll	dll.hash.sha256	keyword	extended			SHA256 hash.
225	8.11.0	true	dll	dll.hash.sha384	keyword	extended			SHA384 hash.
226	8.11.0	true	dll	dll.hash.sha512	keyword	extended			SHA512 hash.
227	8.11.0	true	dll	dll.hash.ssdeep	keyword	extended			SSDEEP hash.
228	8.11.0	true	dll	dll.hash.tlsh	keyword	extended			TLSH hash.
229	8.11.0	true	dll	dll.name	keyword	core		kernel32.dll	Name of the library.
230	8.11.0	true	dll	dll.path	keyword	extended		C:\Windows\System32\kernel32.dll	Full file path of the library.
231	8.11.0	true	dll	dll.pe.architecture	keyword	extended		x64	CPU architecture target for the file.
232	8.11.0	true	dll	dll.pe.company	keyword	extended		Microsoft Corporation	Internal company name of the file, provided at compile-time.
233	8.11.0	true	dll	dll.pe.description	keyword	extended		Paint	Internal description of the file, provided at compile-time.
234	8.11.0	true	dll	dll.pe.file_version	keyword	extended		6.3.9600.17415	Process name.
235	8.11.0	true	dll	dll.pe.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a PE file.
236	8.11.0	true	dll	dll.pe.go_imports	flat_object	extended			List of imported Go language element names and types.
237	8.11.0	true	dll	dll.pe.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
238	8.11.0	true	dll	dll.pe.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
239	8.11.0	true	dll	dll.pe.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
240	8.11.0	true	dll	dll.pe.imphash	keyword	extended		0c6803c4e922103c4dca5963aad36ddf	A hash of the imports in a PE file.
241	8.11.0	true	dll	dll.pe.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a PE file.
242	8.11.0	true	dll	dll.pe.imports	flat_object	extended	array		List of imported element names and types.
243	8.11.0	true	dll	dll.pe.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
244	8.11.0	true	dll	dll.pe.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
245	8.11.0	true	dll	dll.pe.original_file_name	keyword	extended		MSPAINT.EXE	Internal name of the file, provided at compile-time.
246	8.11.0	true	dll	dll.pe.pehash	keyword	extended		73ff189b63cd6be375a7ff25179a38d347651975	A hash of the PE header and data from one or more PE sections.
247	8.11.0	true	dll	dll.pe.product	keyword	extended		Microsoft® Windows® Operating System	Internal product name of the file, provided at compile-time.
248	8.11.0	true	dll	dll.pe.sections	nested	extended	array		Section information of the PE file.
249	8.11.0	true	dll	dll.pe.sections.entropy	long	extended			Shannon entropy calculation from the section.
250	8.11.0	true	dll	dll.pe.sections.name	keyword	extended			PE Section List name.
251	8.11.0	true	dll	dll.pe.sections.physical_size	long	extended			PE Section List physical size.
252	8.11.0	true	dll	dll.pe.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
253	8.11.0	true	dll	dll.pe.sections.virtual_size	long	extended			PE Section List virtual size. This is always the same as `physical_size`.
254	8.11.0	true	dns	dns.answers	object	extended	array		Array of DNS answers.
255	8.11.0	true	dns	dns.answers.class	keyword	extended		IN	The class of DNS data contained in this resource record.
256	8.11.0	true	dns	dns.answers.data	keyword	extended		10.10.10.10	The data describing the resource.
257	8.11.0	true	dns	dns.answers.name	keyword	extended		www.example.com	The domain name to which this resource record pertains.
258	8.11.0	true	dns	dns.answers.ttl	long	extended		180	The time interval in seconds that this resource record may be cached before it should be discarded.
259	8.11.0	true	dns	dns.answers.type	keyword	extended		CNAME	The type of data contained in this resource record.
260	8.11.0	true	dns	dns.header_flags	keyword	extended	array	["RD", "RA"]	Array of DNS header flags.
261	8.11.0	true	dns	dns.id	keyword	extended		62111	The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.
262	8.11.0	true	dns	dns.op_code	keyword	extended		QUERY	The DNS operation code that specifies the kind of query in the message.
263	8.11.0	true	dns	dns.question.class	keyword	extended		IN	The class of records being queried.
264	8.11.0	true	dns	dns.question.name	keyword	extended		www.example.com	The name being queried.
265	8.11.0	true	dns	dns.question.registered_domain	keyword	extended		example.com	The highest registered domain, stripped of the subdomain.
266	8.11.0	true	dns	dns.question.subdomain	keyword	extended		www	The subdomain of the domain.
267	8.11.0	true	dns	dns.question.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
268	8.11.0	true	dns	dns.question.type	keyword	extended		AAAA	The type of record being queried.
269	8.11.0	true	dns	dns.resolved_ip	ip	extended	array	["10.10.10.10", "10.10.10.11"]	Array containing all IPs seen in answers.data
270	8.11.0	true	dns	dns.response_code	keyword	extended		NOERROR	The DNS response code.
271	8.11.0	true	dns	dns.type	keyword	extended		answer	The type of DNS event captured, query or answer.
272	8.11.0	true	ecs	ecs.version	keyword	core		1.0.0	ECS version this event conforms to.
273	8.11.0	true	email	email.attachments	nested	extended	array		List of objects describing the attachments.
274	8.11.0	true	email	email.attachments.file.extension	keyword	extended		txt	Attachment file extension.
275	8.11.0	true	email	email.attachments.file.hash.md5	keyword	extended			MD5 hash.
276	8.11.0	true	email	email.attachments.file.hash.sha1	keyword	extended			SHA1 hash.
277	8.11.0	true	email	email.attachments.file.hash.sha256	keyword	extended			SHA256 hash.
278	8.11.0	true	email	email.attachments.file.hash.sha384	keyword	extended			SHA384 hash.
279	8.11.0	true	email	email.attachments.file.hash.sha512	keyword	extended			SHA512 hash.
280	8.11.0	true	email	email.attachments.file.hash.ssdeep	keyword	extended			SSDEEP hash.
281	8.11.0	true	email	email.attachments.file.hash.tlsh	keyword	extended			TLSH hash.
282	8.11.0	true	email	email.attachments.file.mime_type	keyword	extended		text/plain	MIME type of the attachment file.
283	8.11.0	true	email	email.attachments.file.name	keyword	extended		attachment.txt	Name of the attachment file.
284	8.11.0	true	email	email.attachments.file.size	long	extended		64329	Attachment file size.
285	8.11.0	true	email	email.bcc.address	keyword	extended	array	bcc.user1@example.com	Email address of BCC recipient
286	8.11.0	true	email	email.cc.address	keyword	extended	array	cc.user1@example.com	Email address of CC recipient
287	8.11.0	true	email	email.content_type	keyword	extended		text/plain	MIME type of the email message.
288	8.11.0	true	email	email.delivery_timestamp	date	extended		2020-11-10T22:12:34.8196921Z	Date and time when message was delivered.
289	8.11.0	true	email	email.direction	keyword	extended		inbound	Direction of the message.
290	8.11.0	true	email	email.from.address	keyword	extended	array	sender@example.com	The sender's email address.
291	8.11.0	true	email	email.local_id	keyword	extended		c26dbea0-80d5-463b-b93c-4e8b708219ce	Unique identifier given by the source.
292	8.11.0	true	email	email.message_id	keyword	extended		81ce15$8r2j59@mail01.example.com	Value from the Message-ID header.
293	8.11.0	true	email	email.origination_timestamp	date	extended		2020-11-10T22:12:34.8196921Z	Date and time the email was composed.
294	8.11.0	true	email	email.reply_to.address	keyword	extended	array	reply.here@example.com	Address replies should be delivered to.
295	8.11.0	true	email	email.sender.address	keyword	extended			Address of the message sender.
296	8.11.0	true	email	email.subject	keyword	extended		Please see this important message.	The subject of the email message.
297	8.11.0	true	email	email.subject.text	keyword	extended		Please see this important message.	The subject of the email message.
298	8.11.0	true	email	email.to.address	keyword	extended	array	user1@example.com	Email address of recipient
299	8.11.0	true	email	email.x_mailer	keyword	extended		Spambot v2.5	Application that drafted email.
300	8.11.0	true	error	error.code	keyword	core			Error code describing the error.
301	8.11.0	true	error	error.id	keyword	core			Unique identifier for the error.
302	8.11.0	true	error	error.message	keyword	core			Error message.
303	8.11.0	true	error	error.stack_trace	keyword	extended			The stack trace of this error in plain text.
304	8.11.0	true	error	error.stack_trace.text	keyword	extended			The stack trace of this error in plain text.
305	8.11.0	true	error	error.type	keyword	extended		java.lang.NullPointerException	The type of the error, for example the class name of the exception.
306	8.11.0	true	event	event.action	keyword	core		user-password-change	The action captured by the event.
307	8.11.0	true	event	event.agent_id_status	keyword	extended		verified	Validation status of the event's agent.id field.
308	8.11.0	true	event	event.category	keyword	core	array	authentication	Event category. The second categorization field in the hierarchy.
309	8.11.0	true	event	event.changed_fields	keyword	custom	array	["foo", "bar"]	Fields that were updated since last scan.
310	8.11.0	true	event	event.code	keyword	extended		4648	Identification code for this event.
311	8.11.0	true	event	event.collector	keyword	custom		file	Collector used to retrieve the event.
312	8.11.0	true	event	event.created	date	core		2016-05-23T08:05:34.857Z	Time when the event was first read by an agent or by your pipeline.
313	8.11.0	true	event	event.dataset	keyword	core		apache.access	Name of the dataset.
314	8.11.0	true	event	event.duration	long	core			Duration of the event in nanoseconds.
315	8.11.0	true	event	event.end	date	extended			`event.end` contains the date when the event ended or when the activity was last observed.
316	8.11.0	true	event	event.hash	keyword	extended		123456789012345678901234567890ABCD	Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.
317	8.11.0	true	event	event.id	keyword	core		8a4f500d	Unique ID to describe the event.
318	8.11.0	true	event	event.ingested	date	core		2016-05-23T08:05:35.101Z	Timestamp when an event arrived in the central data store.
319	8.11.0	true	event	event.kind	keyword	core		alert	The kind of the event. The highest categorization field in the hierarchy.
320	8.11.0	true	event	event.module	keyword	core		apache	Name of the module this data is coming from.
321	8.11.0	false	event	event.original	keyword	core		Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232	Raw text message of entire event.
322	8.11.0	true	event	event.outcome	keyword	core		success	The outcome of the event. The lowest level categorization field in the hierarchy.
323	8.11.0	true	event	event.provider	keyword	extended		kernel	Source of the event.
324	8.11.0	true	event	event.reason	keyword	extended		Terminated an unexpected process	Reason why this event happened, according to the source
325	8.11.0	true	event	event.reference	keyword	extended		https://system.example.com/event/#0001234	Event reference URL
326	8.11.0	true	event	event.risk_score	float	core			Risk score or priority of the event (e.g. security solutions). Use your system's original value here.
327	8.11.0	true	event	event.risk_score_norm	float	extended			Normalized risk score or priority of the event (0-100).
328	8.11.0	true	event	event.sequence	long	extended			Sequence number of the event.
329	8.11.0	true	event	event.severity	long	core		7	Numeric severity of the event.
330	8.11.0	true	event	event.start	date	extended			`event.start` contains the date when the event started or when the activity was first observed.
331	8.11.0	true	event	event.timezone	keyword	extended			Event time zone.
332	8.11.0	true	event	event.type	keyword	core	array		Event type. The third categorization field in the hierarchy.
333	8.11.0	true	event	event.url	keyword	extended		https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe	Event investigation URL
334	8.11.0	true	faas	faas.coldstart	boolean	extended			Boolean value indicating a cold start of a function.
335	8.11.0	true	faas	faas.execution	keyword	extended		af9d5aa4-a685-4c5f-a22b-444f80b3cc28	The execution ID of the current function execution.
336	8.11.0	true	faas	faas.id	keyword	extended		arn:aws:lambda:us-west-2:123456789012:function:my-function	The unique identifier of a serverless function.
337	8.11.0	true	faas	faas.name	keyword	extended		my-function	The name of a serverless function.
338	8.11.0	true	faas	faas.trigger.request_id	keyword	extended		123456789	The ID of the trigger request , message, event, etc.
339	8.11.0	true	faas	faas.trigger.type	keyword	extended		http	The trigger for the function execution.
340	8.11.0	true	faas	faas.version	keyword	extended		123	The version of a serverless function.
341	8.11.0	true	file	file.accessed	date	extended			Last time the file was accessed.
342	8.11.0	true	file	file.attributes	keyword	extended	array	["readonly", "system"]	Array of file attributes.
343	8.11.0	true	file	file.code_signature.digest_algorithm	keyword	extended		sha256	Hashing algorithm used to sign the process.
344	8.11.0	true	file	file.code_signature.exists	boolean	core		true	Boolean to capture if a signature is present.
345	8.11.0	true	file	file.code_signature.signing_id	keyword	extended		com.apple.xpc.proxy	The identifier used to sign the process.
346	8.11.0	true	file	file.code_signature.status	keyword	extended		ERROR_UNTRUSTED_ROOT	Additional information about the certificate status.
347	8.11.0	true	file	file.code_signature.subject_name	keyword	core		Microsoft Corporation	Subject name of the code signer
348	8.11.0	true	file	file.code_signature.team_id	keyword	extended		EQHXZ8M8AV	The team identifier used to sign the process.
349	8.11.0	true	file	file.code_signature.timestamp	date	extended		2021-01-01T12:10:30Z	When the signature was generated and signed.
350	8.11.0	true	file	file.code_signature.trusted	boolean	extended		true	Stores the trust status of the certificate chain.
351	8.11.0	true	file	file.code_signature.valid	boolean	extended		true	Boolean to capture if the digital signature is verified against the binary content.
352	8.11.0	true	file	file.created	date	extended			File creation time.
353	8.11.0	true	file	file.ctime	date	extended			Last time the file attributes or metadata changed.
354	8.11.0	true	file	file.device	keyword	extended		sda	Device that is the source of the file.
355	8.11.0	true	file	file.directory	keyword	extended		/home/alice	Directory where the file is located.
356	8.11.0	true	file	file.drive_letter	keyword	extended		C	Drive letter where the file is located.
357	8.11.0	true	file	file.elf.architecture	keyword	extended		x86-64	Machine architecture of the ELF file.
358	8.11.0	true	file	file.elf.byte_order	keyword	extended		Little Endian	Byte sequence of ELF file.
359	8.11.0	true	file	file.elf.cpu_type	keyword	extended		Intel	CPU type of the ELF file.
360	8.11.0	true	file	file.elf.creation_date	date	extended			Build or compile date.
361	8.11.0	true	file	file.elf.exports	flat_object	extended	array		List of exported element names and types.
362	8.11.0	true	file	file.elf.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in an ELF file.
363	8.11.0	true	file	file.elf.go_imports	flat_object	extended			List of imported Go language element names and types.
364	8.11.0	true	file	file.elf.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
365	8.11.0	true	file	file.elf.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
366	8.11.0	true	file	file.elf.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
367	8.11.0	true	file	file.elf.header.abi_version	keyword	extended			Version of the ELF Application Binary Interface (ABI).
368	8.11.0	true	file	file.elf.header.class	keyword	extended			Header class of the ELF file.
369	8.11.0	true	file	file.elf.header.data	keyword	extended			Data table of the ELF header.
370	8.11.0	true	file	file.elf.header.entrypoint	long	extended			Header entrypoint of the ELF file.
371	8.11.0	true	file	file.elf.header.object_version	keyword	extended			"0x1" for original ELF files.
372	8.11.0	true	file	file.elf.header.os_abi	keyword	extended			Application Binary Interface (ABI) of the Linux OS.
373	8.11.0	true	file	file.elf.header.type	keyword	extended			Header type of the ELF file.
374	8.11.0	true	file	file.elf.header.version	keyword	extended			Version of the ELF header.
375	8.11.0	true	file	file.elf.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in an ELF file.
376	8.11.0	true	file	file.elf.imports	flat_object	extended	array		List of imported element names and types.
377	8.11.0	true	file	file.elf.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
378	8.11.0	true	file	file.elf.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
379	8.11.0	true	file	file.elf.sections	nested	extended	array		Section information of the ELF file.
380	8.11.0	true	file	file.elf.sections.chi2	long	extended			Chi-square probability distribution of the section.
381	8.11.0	true	file	file.elf.sections.entropy	long	extended			Shannon entropy calculation from the section.
382	8.11.0	true	file	file.elf.sections.flags	keyword	extended			ELF Section List flags.
383	8.11.0	true	file	file.elf.sections.name	keyword	extended			ELF Section List name.
384	8.11.0	true	file	file.elf.sections.physical_offset	keyword	extended			ELF Section List offset.
385	8.11.0	true	file	file.elf.sections.physical_size	long	extended			ELF Section List physical size.
386	8.11.0	true	file	file.elf.sections.type	keyword	extended			ELF Section List type.
387	8.11.0	true	file	file.elf.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
388	8.11.0	true	file	file.elf.sections.virtual_address	long	extended			ELF Section List virtual address.
389	8.11.0	true	file	file.elf.sections.virtual_size	long	extended			ELF Section List virtual size.
390	8.11.0	true	file	file.elf.segments	nested	extended	array		ELF object segment list.
391	8.11.0	true	file	file.elf.segments.sections	keyword	extended			ELF object segment sections.
392	8.11.0	true	file	file.elf.segments.type	keyword	extended			ELF object segment type.
393	8.11.0	true	file	file.elf.shared_libraries	keyword	extended	array		List of shared libraries used by this ELF object.
394	8.11.0	true	file	file.elf.telfhash	keyword	extended			telfhash hash for ELF file.
395	8.11.0	true	file	file.extension	keyword	extended		png	File extension, excluding the leading dot.
396	8.11.0	true	file	file.fork_name	keyword	extended		Zone.Identifer	A fork is additional data associated with a filesystem object.
397	8.11.0	true	file	file.gid	keyword	extended		1001	Primary group ID (GID) of the file.
398	8.11.0	true	file	file.group	keyword	extended		alice	Primary group name of the file.
399	8.11.0	true	file	file.hash.md5	keyword	extended			MD5 hash.
400	8.11.0	true	file	file.hash.sha1	keyword	extended			SHA1 hash.
401	8.11.0	true	file	file.hash.sha256	keyword	extended			SHA256 hash.
402	8.11.0	true	file	file.hash.sha384	keyword	extended			SHA384 hash.
403	8.11.0	true	file	file.hash.sha512	keyword	extended			SHA512 hash.
404	8.11.0	true	file	file.hash.ssdeep	keyword	extended			SSDEEP hash.
405	8.11.0	true	file	file.hash.tlsh	keyword	extended			TLSH hash.
406	8.11.0	true	file	file.inode	keyword	extended		256383	Inode representing the file in the filesystem.
407	8.11.0	true	file	file.macho.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a Mach-O file.
408	8.11.0	true	file	file.macho.go_imports	flat_object	extended			List of imported Go language element names and types.
409	8.11.0	true	file	file.macho.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
410	8.11.0	true	file	file.macho.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
411	8.11.0	true	file	file.macho.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
412	8.11.0	true	file	file.macho.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a Mach-O file.
413	8.11.0	true	file	file.macho.imports	flat_object	extended	array		List of imported element names and types.
414	8.11.0	true	file	file.macho.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
415	8.11.0	true	file	file.macho.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
416	8.11.0	true	file	file.macho.sections	nested	extended	array		Section information of the Mach-O file.
417	8.11.0	true	file	file.macho.sections.entropy	long	extended			Shannon entropy calculation from the section.
418	8.11.0	true	file	file.macho.sections.name	keyword	extended			Mach-O Section List name.
419	8.11.0	true	file	file.macho.sections.physical_size	long	extended			Mach-O Section List physical size.
420	8.11.0	true	file	file.macho.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
421	8.11.0	true	file	file.macho.sections.virtual_size	long	extended			Mach-O Section List virtual size. This is always the same as `physical_size`.
422	8.11.0	true	file	file.macho.symhash	keyword	extended		d3ccf195b62a9279c3c19af1080497ec	A hash of the imports in a Mach-O file.
423	8.11.0	true	file	file.mime_type	keyword	extended			Media type of file, document, or arrangement of bytes.
424	8.11.0	true	file	file.mode	keyword	extended		0640	Mode of the file in octal representation.
425	8.11.0	true	file	file.mtime	date	extended			Last time the file content was modified.
426	8.11.0	true	file	file.name	keyword	extended		example.png	Name of the file including the extension, without the directory.
427	8.11.0	true	file	file.owner	keyword	extended		alice	File owner's username.
428	8.11.0	true	file	file.path	keyword	extended		/home/alice/example.png	Full path to the file, including the file name.
429	8.11.0	true	file	file.path.text	keyword	extended		/home/alice/example.png	Full path to the file, including the file name.
430	8.11.0	true	file	file.pe.architecture	keyword	extended		x64	CPU architecture target for the file.
431	8.11.0	true	file	file.pe.company	keyword	extended		Microsoft Corporation	Internal company name of the file, provided at compile-time.
432	8.11.0	true	file	file.pe.description	keyword	extended		Paint	Internal description of the file, provided at compile-time.
433	8.11.0	true	file	file.pe.file_version	keyword	extended		6.3.9600.17415	Process name.
434	8.11.0	true	file	file.pe.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a PE file.
435	8.11.0	true	file	file.pe.go_imports	flat_object	extended			List of imported Go language element names and types.
436	8.11.0	true	file	file.pe.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
437	8.11.0	true	file	file.pe.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
438	8.11.0	true	file	file.pe.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
439	8.11.0	true	file	file.pe.imphash	keyword	extended		0c6803c4e922103c4dca5963aad36ddf	A hash of the imports in a PE file.
440	8.11.0	true	file	file.pe.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a PE file.
441	8.11.0	true	file	file.pe.imports	flat_object	extended	array		List of imported element names and types.
442	8.11.0	true	file	file.pe.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
443	8.11.0	true	file	file.pe.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
444	8.11.0	true	file	file.pe.original_file_name	keyword	extended		MSPAINT.EXE	Internal name of the file, provided at compile-time.
445	8.11.0	true	file	file.pe.pehash	keyword	extended		73ff189b63cd6be375a7ff25179a38d347651975	A hash of the PE header and data from one or more PE sections.
446	8.11.0	true	file	file.pe.product	keyword	extended		Microsoft® Windows® Operating System	Internal product name of the file, provided at compile-time.
447	8.11.0	true	file	file.pe.sections	nested	extended	array		Section information of the PE file.
448	8.11.0	true	file	file.pe.sections.entropy	long	extended			Shannon entropy calculation from the section.
449	8.11.0	true	file	file.pe.sections.name	keyword	extended			PE Section List name.
450	8.11.0	true	file	file.pe.sections.physical_size	long	extended			PE Section List physical size.
451	8.11.0	true	file	file.pe.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
452	8.11.0	true	file	file.pe.sections.virtual_size	long	extended			PE Section List virtual size. This is always the same as `physical_size`.
453	8.11.0	true	file	file.size	long	extended		16384	File size in bytes.
454	8.11.0	true	file	file.target_path	keyword	extended			Target path for symlinks.
455	8.11.0	true	file	file.target_path.text	keyword	extended			Target path for symlinks.
456	8.11.0	true	file	file.type	keyword	extended		file	File type (file, dir, or symlink).
457	8.11.0	true	file	file.uid	keyword	extended		1001	The user ID (UID) or security identifier (SID) of the file owner.
458	8.11.0	true	file	file.x509.alternative_names	keyword	extended	array	*.elastic.co	List of subject alternative names (SAN).
459	8.11.0	true	file	file.x509.issuer.common_name	keyword	extended	array	Example SHA2 High Assurance Server CA	List of common name (CN) of issuing certificate authority.
460	8.11.0	true	file	file.x509.issuer.country	keyword	extended	array	US	List of country \(C) codes
461	8.11.0	true	file	file.x509.issuer.distinguished_name	keyword	extended		C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA	Distinguished name (DN) of issuing certificate authority.
462	8.11.0	true	file	file.x509.issuer.locality	keyword	extended	array	Mountain View	List of locality names (L)
463	8.11.0	true	file	file.x509.issuer.organization	keyword	extended	array	Example Inc	List of organizations (O) of issuing certificate authority.
464	8.11.0	true	file	file.x509.issuer.organizational_unit	keyword	extended	array	www.example.com	List of organizational units (OU) of issuing certificate authority.
465	8.11.0	true	file	file.x509.issuer.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
466	8.11.0	true	file	file.x509.not_after	date	extended		2020-07-16T03:15:39Z	Time at which the certificate is no longer considered valid.
467	8.11.0	true	file	file.x509.not_before	date	extended		2019-08-16T01:40:25Z	Time at which the certificate is first considered valid.
468	8.11.0	true	file	file.x509.public_key_algorithm	keyword	extended		RSA	Algorithm used to generate the public key.
469	8.11.0	true	file	file.x509.public_key_curve	keyword	extended		nistp521	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
470	8.11.0	false	file	file.x509.public_key_exponent	long	extended		65537	Exponent used to derive the public key. This is algorithm specific.
471	8.11.0	true	file	file.x509.public_key_size	long	extended		2048	The size of the public key space in bits.
472	8.11.0	true	file	file.x509.serial_number	keyword	extended		55FBB9C7DEBF09809D12CCAA	Unique serial number issued by the certificate authority.
473	8.11.0	true	file	file.x509.signature_algorithm	keyword	extended		SHA256-RSA	Identifier for certificate signature algorithm.
474	8.11.0	true	file	file.x509.subject.common_name	keyword	extended	array	shared.global.example.net	List of common names (CN) of subject.
475	8.11.0	true	file	file.x509.subject.country	keyword	extended	array	US	List of country \(C) code
476	8.11.0	true	file	file.x509.subject.distinguished_name	keyword	extended		C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net	Distinguished name (DN) of the certificate subject entity.
477	8.11.0	true	file	file.x509.subject.locality	keyword	extended	array	San Francisco	List of locality names (L)
478	8.11.0	true	file	file.x509.subject.organization	keyword	extended	array	Example, Inc.	List of organizations (O) of subject.
479	8.11.0	true	file	file.x509.subject.organizational_unit	keyword	extended	array		List of organizational units (OU) of subject.
480	8.11.0	true	file	file.x509.subject.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
481	8.11.0	true	file	file.x509.version_number	keyword	extended		3	Version of x509 format.
482	8.11.0	true	group	group.domain	keyword	extended			Name of the directory the group is a member of.
483	8.11.0	true	group	group.id	keyword	extended			Unique identifier for the group on the system/platform.
484	8.11.0	true	group	group.name	keyword	extended			Name of the group.
485	8.11.0	true	host	host.architecture	keyword	core		x86_64	Operating system architecture.
486	8.11.0	true	host	host.boot.id	keyword	extended		88a1f0ed-5ae5-41ee-af6b-41921c311872	Linux boot uuid taken from /proc/sys/kernel/random/boot_id
487	8.11.0	true	host	host.cpu	object	custom		"name": "Intel(R) Core(TM) i7-7700HQ CPU", "cores": 4, "speed": 2800	CPU-related data.
488	8.11.0	true	host	host.cpu.cores	long	custom		4	Number of CPU cores.
489	8.11.0	true	host	host.cpu.name	keyword	custom		Intel(R) Core(TM) i7-7700HQ CPU	CPU Model name.
490	8.11.0	true	host	host.cpu.speed	long	custom		2800	CPU clock speed.
491	8.11.0	true	host	host.cpu.usage	scaled_float	extended			Percent CPU used, between 0 and 1.
492	8.11.0	true	host	host.disk.read.bytes	long	extended			The number of bytes read by all disks.
493	8.11.0	true	host	host.disk.write.bytes	long	extended			The number of bytes written on all disks.
494	8.11.0	true	host	host.domain	keyword	extended		CONTOSO	Name of the directory the group is a member of.
495	8.11.0	true	host	host.geo.city_name	keyword	core		Montreal	City name.
496	8.11.0	true	host	host.geo.continent_code	keyword	core		NA	Continent code.
497	8.11.0	true	host	host.geo.continent_name	keyword	core		North America	Name of the continent.
498	8.11.0	true	host	host.geo.country_iso_code	keyword	core		CA	Country ISO code.
499	8.11.0	true	host	host.geo.country_name	keyword	core		Canada	Country name.
500	8.11.0	true	host	host.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
501	8.11.0	true	host	host.geo.name	keyword	extended		boston-dc	User-defined description of a location.
502	8.11.0	true	host	host.geo.postal_code	keyword	core		94040	Postal code.
503	8.11.0	true	host	host.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
504	8.11.0	true	host	host.geo.region_name	keyword	core		Quebec	Region name.
505	8.11.0	true	host	host.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
506	8.11.0	true	host	host.hostname	keyword	core			Hostname of the host.
507	8.11.0	true	host	host.id	keyword	core			Unique host id.
508	8.11.0	true	host	host.ip	ip	core	array		Host ip addresses.
509	8.11.0	true	host	host.mac	keyword	core	array	["00-00-5E-00-53-23", "00-00-5E-00-53-24"]	Host MAC addresses.
510	8.11.0	true	host	host.memory	object	custom		"total": 100000, "free": 90000, "used": {"percentage": 10}	Memory-related data.
511	8.11.0	true	host	host.memory.free	long	custom		1024	Free memory in MB.
512	8.11.0	true	host	host.memory.total	long	custom		1024	Total memory in MB.
513	8.11.0	true	host	host.memory.used	object	custom		"percentage": 10	Used memory-related data.
514	8.11.0	true	host	host.memory.used.percentage	long	custom		10	Used memory percentage.
515	8.11.0	true	host	host.name	keyword	core			Name of the host.
516	8.11.0	true	host	host.network.egress.bytes	long	extended			The number of bytes sent on all network interfaces.
517	8.11.0	true	host	host.network.egress.drops	long	custom		10	Number of dropped transmitted packets.
518	8.11.0	true	host	host.network.egress.errors	long	custom		10	Number of transmission errors.
519	8.11.0	true	host	host.network.egress.packets	long	extended			The number of packets sent on all network interfaces.
520	8.11.0	true	host	host.network.egress.queue	long	custom		10	Transmit queue length.
521	8.11.0	true	host	host.network.ingress.bytes	long	extended			The number of bytes received on all network interfaces.
522	8.11.0	true	host	host.network.ingress.drops	long	custom		10	Number of dropped received packets.
523	8.11.0	true	host	host.network.ingress.errors	long	custom		10	Number of reception errors.
524	8.11.0	true	host	host.network.ingress.packets	long	extended			The number of packets received on all network interfaces.
525	8.11.0	true	host	host.network.ingress.queue	long	custom		10	Receive queue length.
526	8.11.0	true	host	host.os.family	keyword	extended		debian	OS family (such as redhat, debian, freebsd, windows).
527	8.11.0	true	host	host.os.full	keyword	extended		Mac OS Mojave	Operating system name, including the version or code name.
528	8.11.0	true	host	host.os.full.text	keyword	extended		Mac OS Mojave	Operating system name, including the version or code name.
529	8.11.0	true	host	host.os.kernel	keyword	extended		4.4.0-112-generic	Operating system kernel version as a raw string.
530	8.11.0	true	host	host.os.name	keyword	extended		Mac OS X	Operating system name, without the version.
531	8.11.0	true	host	host.os.name.text	keyword	extended		Mac OS X	Operating system name, without the version.
532	8.11.0	true	host	host.os.platform	keyword	extended		darwin	Operating system platform (such centos, ubuntu, windows).
533	8.11.0	true	host	host.os.type	keyword	extended		macos	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
534	8.11.0	true	host	host.os.version	keyword	extended		10.14.1	Operating system version as a raw string.
535	8.11.0	true	host	host.pid_ns_ino	keyword	extended		256383	Pid namespace inode
536	8.11.0	true	host	host.risk.calculated_level	keyword	extended		High	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
537	8.11.0	true	host	host.risk.calculated_score	float	extended		880.73	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
538	8.11.0	true	host	host.risk.calculated_score_norm	float	extended		88.73	A normalized risk score calculated by an internal system.
539	8.11.0	true	host	host.risk.static_level	keyword	extended		High	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
540	8.11.0	true	host	host.risk.static_score	float	extended		830.0	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
541	8.11.0	true	host	host.risk.static_score_norm	float	extended		83.0	A normalized risk score calculated by an external system.
542	8.11.0	true	host	host.type	keyword	core			Type of host.
543	8.11.0	true	host	host.uptime	long	extended		1325	Seconds the host has been up.
544	8.11.0	true	http	http.request.body.bytes	long	extended		887	Size in bytes of the request body.
545	8.11.0	true	http	http.request.body.content	keyword	extended		Hello world	The full HTTP request body.
546	8.11.0	true	http	http.request.body.content.text	keyword	extended		Hello world	The full HTTP request body.
547	8.11.0	true	http	http.request.bytes	long	extended		1437	Total size in bytes of the request (body and headers).
548	8.11.0	true	http	http.request.id	keyword	extended		123e4567-e89b-12d3-a456-426614174000	HTTP request ID.
549	8.11.0	true	http	http.request.method	keyword	extended		POST	HTTP request method.
550	8.11.0	true	http	http.request.mime_type	keyword	extended		image/gif	Mime type of the body of the request.
551	8.11.0	true	http	http.request.referrer	keyword	extended		https://blog.example.com/	Referrer for this HTTP request.
552	8.11.0	true	http	http.response.body.bytes	long	extended		887	Size in bytes of the response body.
553	8.11.0	true	http	http.response.body.content	keyword	extended		Hello world	The full HTTP response body.
554	8.11.0	true	http	http.response.body.content.text	keyword	extended		Hello world	The full HTTP response body.
555	8.11.0	true	http	http.response.bytes	long	extended		1437	Total size in bytes of the response (body and headers).
556	8.11.0	true	http	http.response.mime_type	keyword	extended		image/gif	Mime type of the body of the response.
557	8.11.0	true	http	http.response.status_code	long	extended		404	HTTP response status code.
558	8.11.0	true	http	http.version	keyword	extended		1.1	HTTP version.
559	8.11.0	true	interface	interface.alias	keyword	extended		outside	Interface alias
560	8.11.0	true	interface	interface.id	keyword	extended		10	Interface ID
561	8.11.0	true	interface	interface.mtu	long	custom		1500	Maximum transmission unit size.
562	8.11.0	true	interface	interface.name	keyword	extended		eth0	Interface name
563	8.11.0	true	interface	interface.state	keyword	custom		up	State of the network interface.
564	8.11.0	true	interface	interface.type	keyword	custom		ethernet	Interface type.
565	8.11.0	true	log	log.file.path	keyword	extended		/var/log/fun-times.log	Full path to the log file this event came from.
566	8.11.0	true	log	log.level	keyword	core		error	Log level of the log event.
567	8.11.0	true	log	log.logger	keyword	core		org.elasticsearch.bootstrap.Bootstrap	Name of the logger.
568	8.11.0	true	log	log.origin.file.line	long	extended		42	The line number of the file which originated the log event.
569	8.11.0	true	log	log.origin.file.name	keyword	extended		Bootstrap.java	The code file which originated the log event.
570	8.11.0	true	log	log.origin.function	keyword	extended		init	The function which originated the log event.
571	8.11.0	true	log	log.syslog	object	extended			Syslog metadata
572	8.11.0	true	log	log.syslog.appname	keyword	extended		sshd	The device or application that originated the Syslog message.
573	8.11.0	true	log	log.syslog.facility.code	long	extended		23	Syslog numeric facility of the event.
574	8.11.0	true	log	log.syslog.facility.name	keyword	extended		local7	Syslog text-based facility of the event.
575	8.11.0	true	log	log.syslog.hostname	keyword	extended		example-host	The host that originated the Syslog message.
576	8.11.0	true	log	log.syslog.msgid	keyword	extended		ID47	An identifier for the type of Syslog message.
577	8.11.0	true	log	log.syslog.priority	long	extended		135	Syslog priority of the event.
578	8.11.0	true	log	log.syslog.procid	keyword	extended		12345	The process name or ID that originated the Syslog message.
579	8.11.0	true	log	log.syslog.severity.code	long	extended		3	Syslog numeric severity of the event.
580	8.11.0	true	log	log.syslog.severity.name	keyword	extended		Error	Syslog text-based severity of the event.
581	8.11.0	true	log	log.syslog.structured_data	flat_object	extended			Structured data expressed in RFC 5424 messages.
582	8.11.0	true	log	log.syslog.version	keyword	extended		1	Syslog protocol version.
583	8.11.0	true	network	network.application	keyword	extended		aim	Application level protocol name.
584	8.11.0	true	network	network.broadcast	ip	custom		192.168.0.255	Broadcast address.
585	8.11.0	true	network	network.bytes	long	core		368	Total bytes transferred in both directions.
586	8.11.0	true	network	network.community_id	keyword	extended		1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=	A hash of source and destination IPs and ports.
587	8.11.0	true	network	network.dhcp	keyword	custom		enabled	DHCP status (enabled, disabled, unknown, BOOTP).
588	8.11.0	true	network	network.direction	keyword	core		inbound	Direction of the network traffic.
589	8.11.0	true	network	network.forwarded_ip	ip	core		192.1.1.2	Host IP address when the source IP address is the proxy.
590	8.11.0	true	network	network.gateway	ip	custom		192.168.0.1	Gateway address.
591	8.11.0	true	network	network.iana_number	keyword	extended		6	IANA Protocol Number.
592	8.11.0	true	network	network.inner	object	extended			Inner VLAN tag information
593	8.11.0	true	network	network.inner.vlan.id	keyword	extended		10	VLAN ID as reported by the observer.
594	8.11.0	true	network	network.inner.vlan.name	keyword	extended		outside	Optional VLAN name as reported by the observer.
595	8.11.0	true	network	network.metric	long	custom		15	Metric of the network protocol.
596	8.11.0	true	network	network.name	keyword	extended		Guest Wifi	Name given by operators to sections of their network.
597	8.11.0	true	network	network.netmask	ip	custom		255.255.255.0	Network mask
598	8.11.0	true	network	network.packets	long	core		24	Total packets transferred in both directions.
599	8.11.0	true	network	network.protocol	keyword	core		http	Application protocol name.
600	8.11.0	true	network	network.transport	keyword	core		tcp	Protocol Name corresponding to the field `iana_number`.
601	8.11.0	true	network	network.type	keyword	core		ipv4	In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
602	8.11.0	true	network	network.vlan.id	keyword	extended		10	VLAN ID as reported by the observer.
603	8.11.0	true	network	network.vlan.name	keyword	extended		outside	Optional VLAN name as reported by the observer.
604	8.11.0	true	observer	observer.egress	object	extended			Object field for egress information
605	8.11.0	true	observer	observer.egress.interface.alias	keyword	extended		outside	Interface alias
606	8.11.0	true	observer	observer.egress.interface.id	keyword	extended		10	Interface ID
607	8.11.0	true	observer	observer.egress.interface.mtu	long	custom		1500	Maximum transmission unit size.
608	8.11.0	true	observer	observer.egress.interface.name	keyword	extended		eth0	Interface name
609	8.11.0	true	observer	observer.egress.interface.observer.ingress.interface.alias	keyword	extended		outside	Interface alias
610	8.11.0	true	observer	observer.egress.interface.observer.ingress.interface.id	keyword	extended		10	Interface ID
611	8.11.0	true	observer	observer.egress.interface.observer.ingress.interface.mtu	long	custom		1500	Maximum transmission unit size.
612	8.11.0	true	observer	observer.egress.interface.observer.ingress.interface.name	keyword	extended		eth0	Interface name
613	8.11.0	true	observer	observer.egress.interface.observer.ingress.interface.state	keyword	custom		up	State of the network interface.
614	8.11.0	true	observer	observer.egress.interface.observer.ingress.interface.type	keyword	custom		ethernet	Interface type.
615	8.11.0	true	observer	observer.egress.interface.state	keyword	custom		up	State of the network interface.
616	8.11.0	true	observer	observer.egress.interface.type	keyword	custom		ethernet	Interface type.
617	8.11.0	true	observer	observer.egress.vlan.id	keyword	extended		10	VLAN ID as reported by the observer.
618	8.11.0	true	observer	observer.egress.vlan.name	keyword	extended		outside	Optional VLAN name as reported by the observer.
619	8.11.0	true	observer	observer.egress.zone	keyword	extended		Public_Internet	Observer Egress zone
620	8.11.0	true	observer	observer.geo.city_name	keyword	core		Montreal	City name.
621	8.11.0	true	observer	observer.geo.continent_code	keyword	core		NA	Continent code.
622	8.11.0	true	observer	observer.geo.continent_name	keyword	core		North America	Name of the continent.
623	8.11.0	true	observer	observer.geo.country_iso_code	keyword	core		CA	Country ISO code.
624	8.11.0	true	observer	observer.geo.country_name	keyword	core		Canada	Country name.
625	8.11.0	true	observer	observer.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
626	8.11.0	true	observer	observer.geo.name	keyword	extended		boston-dc	User-defined description of a location.
627	8.11.0	true	observer	observer.geo.postal_code	keyword	core		94040	Postal code.
628	8.11.0	true	observer	observer.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
629	8.11.0	true	observer	observer.geo.region_name	keyword	core		Quebec	Region name.
630	8.11.0	true	observer	observer.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
631	8.11.0	true	observer	observer.hostname	keyword	core			Hostname of the observer.
632	8.11.0	true	observer	observer.ingress	object	extended			Object field for ingress information
633	8.11.0	true	observer	observer.ingress.interface.alias	keyword	extended		outside	Interface alias
634	8.11.0	true	observer	observer.ingress.interface.id	keyword	extended		10	Interface ID
635	8.11.0	true	observer	observer.ingress.interface.mtu	long	custom		1500	Maximum transmission unit size.
636	8.11.0	true	observer	observer.ingress.interface.name	keyword	extended		eth0	Interface name
637	8.11.0	true	observer	observer.ingress.interface.state	keyword	custom		up	State of the network interface.
638	8.11.0	true	observer	observer.ingress.interface.type	keyword	custom		ethernet	Interface type.
639	8.11.0	true	observer	observer.ingress.vlan.id	keyword	extended		10	VLAN ID as reported by the observer.
640	8.11.0	true	observer	observer.ingress.vlan.name	keyword	extended		outside	Optional VLAN name as reported by the observer.
641	8.11.0	true	observer	observer.ingress.zone	keyword	extended		DMZ	Observer ingress zone
642	8.11.0	true	observer	observer.ip	ip	core	array		IP addresses of the observer.
643	8.11.0	true	observer	observer.mac	keyword	core	array	["00-00-5E-00-53-23", "00-00-5E-00-53-24"]	MAC addresses of the observer.
644	8.11.0	true	observer	observer.name	keyword	extended		1_proxySG	Custom name of the observer.
645	8.11.0	true	observer	observer.os.family	keyword	extended		debian	OS family (such as redhat, debian, freebsd, windows).
646	8.11.0	true	observer	observer.os.full	keyword	extended		Mac OS Mojave	Operating system name, including the version or code name.
647	8.11.0	true	observer	observer.os.full.text	keyword	extended		Mac OS Mojave	Operating system name, including the version or code name.
648	8.11.0	true	observer	observer.os.kernel	keyword	extended		4.4.0-112-generic	Operating system kernel version as a raw string.
649	8.11.0	true	observer	observer.os.name	keyword	extended		Mac OS X	Operating system name, without the version.
650	8.11.0	true	observer	observer.os.name.text	keyword	extended		Mac OS X	Operating system name, without the version.
651	8.11.0	true	observer	observer.os.platform	keyword	extended		darwin	Operating system platform (such centos, ubuntu, windows).
652	8.11.0	true	observer	observer.os.type	keyword	extended		macos	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
653	8.11.0	true	observer	observer.os.version	keyword	extended		10.14.1	Operating system version as a raw string.
654	8.11.0	true	observer	observer.product	keyword	extended		s200	The product name of the observer.
655	8.11.0	true	observer	observer.serial_number	keyword	extended			Observer serial number.
656	8.11.0	true	observer	observer.type	keyword	core		firewall	The type of the observer the data is coming from.
657	8.11.0	true	observer	observer.vendor	keyword	core		Symantec	Vendor name of the observer.
658	8.11.0	true	observer	observer.version	keyword	core			Observer version.
659	8.11.0	true	orchestrator	orchestrator.api_version	keyword	extended		v1beta1	API version being used to carry out the action
660	8.11.0	true	orchestrator	orchestrator.cluster.id	keyword	extended			Unique ID of the cluster.
661	8.11.0	true	orchestrator	orchestrator.cluster.name	keyword	extended			Name of the cluster.
662	8.11.0	true	orchestrator	orchestrator.cluster.url	keyword	extended			URL of the API used to manage the cluster.
663	8.11.0	true	orchestrator	orchestrator.cluster.version	keyword	extended			The version of the cluster.
664	8.11.0	true	orchestrator	orchestrator.namespace	keyword	extended		kube-system	Namespace in which the action is taking place.
665	8.11.0	true	orchestrator	orchestrator.organization	keyword	extended		elastic	Organization affected by the event (for multi-tenant orchestrator setups).
666	8.11.0	true	orchestrator	orchestrator.resource.annotation	keyword	extended	array	['key1:value1', 'key2:value2', 'key3:value3']	The list of annotations added to the resource.
667	8.11.0	true	orchestrator	orchestrator.resource.id	keyword	extended			Unique ID of the resource being acted upon.
668	8.11.0	true	orchestrator	orchestrator.resource.ip	ip	extended	array		IP address assigned to the resource associated with the event being observed.
669	8.11.0	true	orchestrator	orchestrator.resource.label	keyword	extended	array	['key1:value1', 'key2:value2', 'key3:value3']	The list of labels added to the resource.
670	8.11.0	true	orchestrator	orchestrator.resource.name	keyword	extended		test-pod-cdcws	Name of the resource being acted upon.
671	8.11.0	true	orchestrator	orchestrator.resource.parent.type	keyword	extended		DaemonSet	Type or kind of the parent resource associated with the event being observed.
672	8.11.0	true	orchestrator	orchestrator.resource.type	keyword	extended		service	Type of resource being acted upon.
673	8.11.0	true	orchestrator	orchestrator.type	keyword	extended		kubernetes	Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).
674	8.11.0	true	organization	organization.id	keyword	extended			Unique identifier for the organization.
675	8.11.0	true	organization	organization.name	keyword	extended			Organization name.
676	8.11.0	true	organization	organization.name.text	keyword	extended			Organization name.
677	8.11.0	true	package	package.architecture	keyword	extended		x86_64	Package architecture.
678	8.11.0	true	package	package.build_version	keyword	extended		36f4f7e89dd61b0988b12ee000b98966867710cd	Build version information
679	8.11.0	true	package	package.checksum	keyword	extended		68b329da9893e34099c7d8ad5cb9c940	Checksum of the installed package for verification.
680	8.11.0	true	package	package.description	keyword	extended		Open source programming language to build simple/reliable/efficient software.	Description of the package.
681	8.11.0	true	package	package.install_scope	keyword	extended		global	Indicating how the package was installed, e.g. user-local, global.
682	8.11.0	true	package	package.installed	date	extended			Time when package was installed.
683	8.11.0	true	package	package.license	keyword	extended		Apache License 2.0	Package license
684	8.11.0	true	package	package.name	keyword	extended		go	Package name
685	8.11.0	true	package	package.path	keyword	extended		/usr/local/Cellar/go/1.12.9/	Path where the package is installed.
686	8.11.0	true	package	package.reference	keyword	extended		https://golang.org	Package home page or reference URL
687	8.11.0	true	package	package.size	long	extended		62231	Package size in bytes.
688	8.11.0	true	package	package.type	keyword	extended		rpm	Package type
689	8.11.0	true	package	package.version	keyword	extended		1.12.9	Package version
690	8.11.0	true	policy	policy.description	keyword	custom		"The CIS Microsoft Windows 11 Enterprise Benchmark v1.0.0 is a comprehensive security configuration guide that provides prescriptive guidance for establishing a secure baseline configuration for Microsoft Windows 11 Enterprise."	Extended description of the policy.
691	8.11.0	true	policy	policy.file	keyword	custom		cis_win11_enterprise.yml	The file name of the SCA policy.
692	8.11.0	true	policy	policy.id	keyword	custom		cis_win11_enterprise_21H2	The ID of the SCA policy.
693	8.11.0	true	policy	policy.name	keyword	custom		CIS Microsoft Windows 11 Enterprise Benchmark v1.0.0	The name of the SCA policy.
694	8.11.0	true	policy	policy.references	keyword	custom	array	["https://www.cisecurity.org/cis-benchmarks/"]	References for the policy.
695	8.11.0	true	process	process.args	keyword	extended	array	["/usr/bin/ssh", "-l", "user", "10.0.0.16"]	Array of process arguments.
696	8.11.0	true	process	process.args_count	long	extended		4	Length of the process.args array.
697	8.11.0	true	process	process.code_signature.digest_algorithm	keyword	extended		sha256	Hashing algorithm used to sign the process.
698	8.11.0	true	process	process.code_signature.exists	boolean	core		true	Boolean to capture if a signature is present.
699	8.11.0	true	process	process.code_signature.signing_id	keyword	extended		com.apple.xpc.proxy	The identifier used to sign the process.
700	8.11.0	true	process	process.code_signature.status	keyword	extended		ERROR_UNTRUSTED_ROOT	Additional information about the certificate status.
701	8.11.0	true	process	process.code_signature.subject_name	keyword	core		Microsoft Corporation	Subject name of the code signer
702	8.11.0	true	process	process.code_signature.team_id	keyword	extended		EQHXZ8M8AV	The team identifier used to sign the process.
703	8.11.0	true	process	process.code_signature.timestamp	date	extended		2021-01-01T12:10:30Z	When the signature was generated and signed.
704	8.11.0	true	process	process.code_signature.trusted	boolean	extended		true	Stores the trust status of the certificate chain.
705	8.11.0	true	process	process.code_signature.valid	boolean	extended		true	Boolean to capture if the digital signature is verified against the binary content.
706	8.11.0	true	process	process.command_line	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
707	8.11.0	true	process	process.command_line.text	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
708	8.11.0	true	process	process.elf.architecture	keyword	extended		x86-64	Machine architecture of the ELF file.
709	8.11.0	true	process	process.elf.byte_order	keyword	extended		Little Endian	Byte sequence of ELF file.
710	8.11.0	true	process	process.elf.cpu_type	keyword	extended		Intel	CPU type of the ELF file.
711	8.11.0	true	process	process.elf.creation_date	date	extended			Build or compile date.
712	8.11.0	true	process	process.elf.exports	flat_object	extended	array		List of exported element names and types.
713	8.11.0	true	process	process.elf.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in an ELF file.
714	8.11.0	true	process	process.elf.go_imports	flat_object	extended			List of imported Go language element names and types.
715	8.11.0	true	process	process.elf.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
716	8.11.0	true	process	process.elf.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
717	8.11.0	true	process	process.elf.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
718	8.11.0	true	process	process.elf.header.abi_version	keyword	extended			Version of the ELF Application Binary Interface (ABI).
719	8.11.0	true	process	process.elf.header.class	keyword	extended			Header class of the ELF file.
720	8.11.0	true	process	process.elf.header.data	keyword	extended			Data table of the ELF header.
721	8.11.0	true	process	process.elf.header.entrypoint	long	extended			Header entrypoint of the ELF file.
722	8.11.0	true	process	process.elf.header.object_version	keyword	extended			"0x1" for original ELF files.
723	8.11.0	true	process	process.elf.header.os_abi	keyword	extended			Application Binary Interface (ABI) of the Linux OS.
724	8.11.0	true	process	process.elf.header.type	keyword	extended			Header type of the ELF file.
725	8.11.0	true	process	process.elf.header.version	keyword	extended			Version of the ELF header.
726	8.11.0	true	process	process.elf.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in an ELF file.
727	8.11.0	true	process	process.elf.imports	flat_object	extended	array		List of imported element names and types.
728	8.11.0	true	process	process.elf.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
729	8.11.0	true	process	process.elf.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
730	8.11.0	true	process	process.elf.sections	nested	extended	array		Section information of the ELF file.
731	8.11.0	true	process	process.elf.sections.chi2	long	extended			Chi-square probability distribution of the section.
732	8.11.0	true	process	process.elf.sections.entropy	long	extended			Shannon entropy calculation from the section.
733	8.11.0	true	process	process.elf.sections.flags	keyword	extended			ELF Section List flags.
734	8.11.0	true	process	process.elf.sections.name	keyword	extended			ELF Section List name.
735	8.11.0	true	process	process.elf.sections.physical_offset	keyword	extended			ELF Section List offset.
736	8.11.0	true	process	process.elf.sections.physical_size	long	extended			ELF Section List physical size.
737	8.11.0	true	process	process.elf.sections.type	keyword	extended			ELF Section List type.
738	8.11.0	true	process	process.elf.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
739	8.11.0	true	process	process.elf.sections.virtual_address	long	extended			ELF Section List virtual address.
740	8.11.0	true	process	process.elf.sections.virtual_size	long	extended			ELF Section List virtual size.
741	8.11.0	true	process	process.elf.segments	nested	extended	array		ELF object segment list.
742	8.11.0	true	process	process.elf.segments.sections	keyword	extended			ELF object segment sections.
743	8.11.0	true	process	process.elf.segments.type	keyword	extended			ELF object segment type.
744	8.11.0	true	process	process.elf.shared_libraries	keyword	extended	array		List of shared libraries used by this ELF object.
745	8.11.0	true	process	process.elf.telfhash	keyword	extended			telfhash hash for ELF file.
746	8.11.0	true	process	process.end	date	extended		2016-05-23T08:05:34.853Z	The time the process ended.
747	8.11.0	true	process	process.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
748	8.11.0	true	process	process.entry_leader.args	keyword	extended	array	["/usr/bin/ssh", "-l", "user", "10.0.0.16"]	Array of process arguments.
749	8.11.0	true	process	process.entry_leader.args_count	long	extended		4	Length of the process.args array.
750	8.11.0	true	process	process.entry_leader.attested_groups.name	keyword	extended			Name of the group.
751	8.11.0	true	process	process.entry_leader.attested_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
752	8.11.0	true	process	process.entry_leader.attested_user.name	keyword	core		a.einstein	Short name or login of the user.
753	8.11.0	true	process	process.entry_leader.attested_user.name.text	keyword	core		a.einstein	Short name or login of the user.
754	8.11.0	true	process	process.entry_leader.command_line	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
755	8.11.0	true	process	process.entry_leader.command_line.text	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
756	8.11.0	true	process	process.entry_leader.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
757	8.11.0	true	process	process.entry_leader.entry_meta.source.ip	ip	core			IP address of the source.
758	8.11.0	true	process	process.entry_leader.entry_meta.type	keyword	extended			The entry type for the entry session leader.
759	8.11.0	true	process	process.entry_leader.executable	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
760	8.11.0	true	process	process.entry_leader.executable.text	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
761	8.11.0	true	process	process.entry_leader.group.id	keyword	extended			Unique identifier for the group on the system/platform.
762	8.11.0	true	process	process.entry_leader.group.name	keyword	extended			Name of the group.
763	8.11.0	true	process	process.entry_leader.interactive	boolean	extended		True	Whether the process is connected to an interactive shell.
764	8.11.0	true	process	process.entry_leader.name	keyword	extended		ssh	Process name.
765	8.11.0	true	process	process.entry_leader.name.text	keyword	extended		ssh	Process name.
766	8.11.0	true	process	process.entry_leader.parent.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
767	8.11.0	true	process	process.entry_leader.parent.pid	long	core		4242	Process id.
768	8.11.0	true	process	process.entry_leader.parent.session_leader.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
769	8.11.0	true	process	process.entry_leader.parent.session_leader.pid	long	core		4242	Process id.
770	8.11.0	true	process	process.entry_leader.parent.session_leader.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
771	8.11.0	true	process	process.entry_leader.parent.session_leader.vpid	long	core		4242	Virtual process id.
772	8.11.0	true	process	process.entry_leader.parent.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
773	8.11.0	true	process	process.entry_leader.parent.vpid	long	core		4242	Virtual process id.
774	8.11.0	true	process	process.entry_leader.pid	long	core		4242	Process id.
775	8.11.0	true	process	process.entry_leader.real_group.id	keyword	extended			Unique identifier for the group on the system/platform.
776	8.11.0	true	process	process.entry_leader.real_group.name	keyword	extended			Name of the group.
777	8.11.0	true	process	process.entry_leader.real_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
778	8.11.0	true	process	process.entry_leader.real_user.name	keyword	core		a.einstein	Short name or login of the user.
779	8.11.0	true	process	process.entry_leader.real_user.name.text	keyword	core		a.einstein	Short name or login of the user.
780	8.11.0	true	process	process.entry_leader.same_as_process	boolean	extended		True	This boolean is used to identify if a leader process is the same as the top level process.
781	8.11.0	true	process	process.entry_leader.saved_group.id	keyword	extended			Unique identifier for the group on the system/platform.
782	8.11.0	true	process	process.entry_leader.saved_group.name	keyword	extended			Name of the group.
783	8.11.0	true	process	process.entry_leader.saved_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
784	8.11.0	true	process	process.entry_leader.saved_user.name	keyword	core		a.einstein	Short name or login of the user.
785	8.11.0	true	process	process.entry_leader.saved_user.name.text	keyword	core		a.einstein	Short name or login of the user.
786	8.11.0	true	process	process.entry_leader.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
787	8.11.0	true	process	process.entry_leader.supplemental_groups.id	keyword	extended			Unique identifier for the group on the system/platform.
788	8.11.0	true	process	process.entry_leader.supplemental_groups.name	keyword	extended			Name of the group.
789	8.11.0	true	process	process.entry_leader.tty	object	extended			Information about the controlling TTY device.
790	8.11.0	true	process	process.entry_leader.tty.char_device.major	long	extended		4	The TTY character device's major number.
791	8.11.0	true	process	process.entry_leader.tty.char_device.minor	long	extended		1	The TTY character device's minor number.
792	8.11.0	true	process	process.entry_leader.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
793	8.11.0	true	process	process.entry_leader.user.name	keyword	core		a.einstein	Short name or login of the user.
794	8.11.0	true	process	process.entry_leader.user.name.text	keyword	core		a.einstein	Short name or login of the user.
795	8.11.0	true	process	process.entry_leader.vpid	long	core		4242	Virtual process id.
796	8.11.0	true	process	process.entry_leader.working_directory	keyword	extended		/home/alice	The working directory of the process.
797	8.11.0	true	process	process.entry_leader.working_directory.text	keyword	extended		/home/alice	The working directory of the process.
798	8.11.0	true	process	process.env_vars	keyword	extended	array	["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]	Array of environment variable bindings.
799	8.11.0	true	process	process.executable	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
800	8.11.0	true	process	process.executable.text	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
801	8.11.0	true	process	process.exit_code	long	extended		137	The exit code of the process.
802	8.11.0	true	process	process.group_leader.args	keyword	extended	array	["/usr/bin/ssh", "-l", "user", "10.0.0.16"]	Array of process arguments.
803	8.11.0	true	process	process.group_leader.args_count	long	extended		4	Length of the process.args array.
804	8.11.0	true	process	process.group_leader.command_line	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
805	8.11.0	true	process	process.group_leader.command_line.text	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
806	8.11.0	true	process	process.group_leader.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
807	8.11.0	true	process	process.group_leader.executable	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
808	8.11.0	true	process	process.group_leader.executable.text	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
809	8.11.0	true	process	process.group_leader.group.id	keyword	extended			Unique identifier for the group on the system/platform.
810	8.11.0	true	process	process.group_leader.group.name	keyword	extended			Name of the group.
811	8.11.0	true	process	process.group_leader.interactive	boolean	extended		True	Whether the process is connected to an interactive shell.
812	8.11.0	true	process	process.group_leader.name	keyword	extended		ssh	Process name.
813	8.11.0	true	process	process.group_leader.name.text	keyword	extended		ssh	Process name.
814	8.11.0	true	process	process.group_leader.pid	long	core		4242	Process id.
815	8.11.0	true	process	process.group_leader.real_group.id	keyword	extended			Unique identifier for the group on the system/platform.
816	8.11.0	true	process	process.group_leader.real_group.name	keyword	extended			Name of the group.
817	8.11.0	true	process	process.group_leader.real_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
818	8.11.0	true	process	process.group_leader.real_user.name	keyword	core		a.einstein	Short name or login of the user.
819	8.11.0	true	process	process.group_leader.real_user.name.text	keyword	core		a.einstein	Short name or login of the user.
820	8.11.0	true	process	process.group_leader.same_as_process	boolean	extended		True	This boolean is used to identify if a leader process is the same as the top level process.
821	8.11.0	true	process	process.group_leader.saved_group.id	keyword	extended			Unique identifier for the group on the system/platform.
822	8.11.0	true	process	process.group_leader.saved_group.name	keyword	extended			Name of the group.
823	8.11.0	true	process	process.group_leader.saved_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
824	8.11.0	true	process	process.group_leader.saved_user.name	keyword	core		a.einstein	Short name or login of the user.
825	8.11.0	true	process	process.group_leader.saved_user.name.text	keyword	core		a.einstein	Short name or login of the user.
826	8.11.0	true	process	process.group_leader.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
827	8.11.0	true	process	process.group_leader.supplemental_groups.id	keyword	extended			Unique identifier for the group on the system/platform.
828	8.11.0	true	process	process.group_leader.supplemental_groups.name	keyword	extended			Name of the group.
829	8.11.0	true	process	process.group_leader.tty	object	extended			Information about the controlling TTY device.
830	8.11.0	true	process	process.group_leader.tty.char_device.major	long	extended		4	The TTY character device's major number.
831	8.11.0	true	process	process.group_leader.tty.char_device.minor	long	extended		1	The TTY character device's minor number.
832	8.11.0	true	process	process.group_leader.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
833	8.11.0	true	process	process.group_leader.user.name	keyword	core		a.einstein	Short name or login of the user.
834	8.11.0	true	process	process.group_leader.user.name.text	keyword	core		a.einstein	Short name or login of the user.
835	8.11.0	true	process	process.group_leader.vpid	long	core		4242	Virtual process id.
836	8.11.0	true	process	process.group_leader.working_directory	keyword	extended		/home/alice	The working directory of the process.
837	8.11.0	true	process	process.group_leader.working_directory.text	keyword	extended		/home/alice	The working directory of the process.
838	8.11.0	true	process	process.hash.md5	keyword	extended			MD5 hash.
839	8.11.0	true	process	process.hash.sha1	keyword	extended			SHA1 hash.
840	8.11.0	true	process	process.hash.sha256	keyword	extended			SHA256 hash.
841	8.11.0	true	process	process.hash.sha384	keyword	extended			SHA384 hash.
842	8.11.0	true	process	process.hash.sha512	keyword	extended			SHA512 hash.
843	8.11.0	true	process	process.hash.ssdeep	keyword	extended			SSDEEP hash.
844	8.11.0	true	process	process.hash.tlsh	keyword	extended			TLSH hash.
845	8.11.0	true	process	process.interactive	boolean	extended		True	Whether the process is connected to an interactive shell.
846	8.11.0	true	process	process.io	object	extended			A chunk of input or output (IO) from a single process.
847	8.11.0	true	process	process.io.bytes_skipped	object	extended	array		An array of byte offsets and lengths denoting where IO data has been skipped.
848	8.11.0	true	process	process.io.bytes_skipped.length	long	extended			The length of bytes skipped.
849	8.11.0	true	process	process.io.bytes_skipped.offset	long	extended			The byte offset into this event's io.text (or io.bytes in the future) where length bytes were skipped.
850	8.11.0	true	process	process.io.max_bytes_per_process_exceeded	boolean	extended			If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.
851	8.11.0	true	process	process.io.text	keyword	extended			A chunk of output or input sanitized to UTF-8.
852	8.11.0	true	process	process.io.total_bytes_captured	long	extended			The total number of bytes captured in this event.
853	8.11.0	true	process	process.io.total_bytes_skipped	long	extended			The total number of bytes that were not captured due to implementation restrictions such as buffer size limits.
854	8.11.0	true	process	process.io.type	keyword	extended			The type of object on which the IO action (read or write) was taken.
855	8.11.0	true	process	process.macho.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a Mach-O file.
856	8.11.0	true	process	process.macho.go_imports	flat_object	extended			List of imported Go language element names and types.
857	8.11.0	true	process	process.macho.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
858	8.11.0	true	process	process.macho.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
859	8.11.0	true	process	process.macho.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
860	8.11.0	true	process	process.macho.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a Mach-O file.
861	8.11.0	true	process	process.macho.imports	flat_object	extended	array		List of imported element names and types.
862	8.11.0	true	process	process.macho.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
863	8.11.0	true	process	process.macho.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
864	8.11.0	true	process	process.macho.sections	nested	extended	array		Section information of the Mach-O file.
865	8.11.0	true	process	process.macho.sections.entropy	long	extended			Shannon entropy calculation from the section.
866	8.11.0	true	process	process.macho.sections.name	keyword	extended			Mach-O Section List name.
867	8.11.0	true	process	process.macho.sections.physical_size	long	extended			Mach-O Section List physical size.
868	8.11.0	true	process	process.macho.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
869	8.11.0	true	process	process.macho.sections.virtual_size	long	extended			Mach-O Section List virtual size. This is always the same as `physical_size`.
870	8.11.0	true	process	process.macho.symhash	keyword	extended		d3ccf195b62a9279c3c19af1080497ec	A hash of the imports in a Mach-O file.
871	8.11.0	true	process	process.name	keyword	extended		ssh	Process name.
872	8.11.0	true	process	process.name.text	keyword	extended		ssh	Process name.
873	8.11.0	true	process	process.parent.args	keyword	extended	array	["/usr/bin/ssh", "-l", "user", "10.0.0.16"]	Array of process arguments.
874	8.11.0	true	process	process.parent.args_count	long	extended		4	Length of the process.args array.
875	8.11.0	true	process	process.parent.code_signature.digest_algorithm	keyword	extended		sha256	Hashing algorithm used to sign the process.
876	8.11.0	true	process	process.parent.code_signature.exists	boolean	core		true	Boolean to capture if a signature is present.
877	8.11.0	true	process	process.parent.code_signature.signing_id	keyword	extended		com.apple.xpc.proxy	The identifier used to sign the process.
878	8.11.0	true	process	process.parent.code_signature.status	keyword	extended		ERROR_UNTRUSTED_ROOT	Additional information about the certificate status.
879	8.11.0	true	process	process.parent.code_signature.subject_name	keyword	core		Microsoft Corporation	Subject name of the code signer
880	8.11.0	true	process	process.parent.code_signature.team_id	keyword	extended		EQHXZ8M8AV	The team identifier used to sign the process.
881	8.11.0	true	process	process.parent.code_signature.timestamp	date	extended		2021-01-01T12:10:30Z	When the signature was generated and signed.
882	8.11.0	true	process	process.parent.code_signature.trusted	boolean	extended		true	Stores the trust status of the certificate chain.
883	8.11.0	true	process	process.parent.code_signature.valid	boolean	extended		true	Boolean to capture if the digital signature is verified against the binary content.
884	8.11.0	true	process	process.parent.command_line	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
885	8.11.0	true	process	process.parent.command_line.text	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
886	8.11.0	true	process	process.parent.elf.architecture	keyword	extended		x86-64	Machine architecture of the ELF file.
887	8.11.0	true	process	process.parent.elf.byte_order	keyword	extended		Little Endian	Byte sequence of ELF file.
888	8.11.0	true	process	process.parent.elf.cpu_type	keyword	extended		Intel	CPU type of the ELF file.
889	8.11.0	true	process	process.parent.elf.creation_date	date	extended			Build or compile date.
890	8.11.0	true	process	process.parent.elf.exports	flat_object	extended	array		List of exported element names and types.
891	8.11.0	true	process	process.parent.elf.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in an ELF file.
892	8.11.0	true	process	process.parent.elf.go_imports	flat_object	extended			List of imported Go language element names and types.
893	8.11.0	true	process	process.parent.elf.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
894	8.11.0	true	process	process.parent.elf.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
895	8.11.0	true	process	process.parent.elf.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
896	8.11.0	true	process	process.parent.elf.header.abi_version	keyword	extended			Version of the ELF Application Binary Interface (ABI).
897	8.11.0	true	process	process.parent.elf.header.class	keyword	extended			Header class of the ELF file.
898	8.11.0	true	process	process.parent.elf.header.data	keyword	extended			Data table of the ELF header.
899	8.11.0	true	process	process.parent.elf.header.entrypoint	long	extended			Header entrypoint of the ELF file.
900	8.11.0	true	process	process.parent.elf.header.object_version	keyword	extended			"0x1" for original ELF files.
901	8.11.0	true	process	process.parent.elf.header.os_abi	keyword	extended			Application Binary Interface (ABI) of the Linux OS.
902	8.11.0	true	process	process.parent.elf.header.type	keyword	extended			Header type of the ELF file.
903	8.11.0	true	process	process.parent.elf.header.version	keyword	extended			Version of the ELF header.
904	8.11.0	true	process	process.parent.elf.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in an ELF file.
905	8.11.0	true	process	process.parent.elf.imports	flat_object	extended	array		List of imported element names and types.
906	8.11.0	true	process	process.parent.elf.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
907	8.11.0	true	process	process.parent.elf.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
908	8.11.0	true	process	process.parent.elf.sections	nested	extended	array		Section information of the ELF file.
909	8.11.0	true	process	process.parent.elf.sections.chi2	long	extended			Chi-square probability distribution of the section.
910	8.11.0	true	process	process.parent.elf.sections.entropy	long	extended			Shannon entropy calculation from the section.
911	8.11.0	true	process	process.parent.elf.sections.flags	keyword	extended			ELF Section List flags.
912	8.11.0	true	process	process.parent.elf.sections.name	keyword	extended			ELF Section List name.
913	8.11.0	true	process	process.parent.elf.sections.physical_offset	keyword	extended			ELF Section List offset.
914	8.11.0	true	process	process.parent.elf.sections.physical_size	long	extended			ELF Section List physical size.
915	8.11.0	true	process	process.parent.elf.sections.type	keyword	extended			ELF Section List type.
916	8.11.0	true	process	process.parent.elf.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
917	8.11.0	true	process	process.parent.elf.sections.virtual_address	long	extended			ELF Section List virtual address.
918	8.11.0	true	process	process.parent.elf.sections.virtual_size	long	extended			ELF Section List virtual size.
919	8.11.0	true	process	process.parent.elf.segments	nested	extended	array		ELF object segment list.
920	8.11.0	true	process	process.parent.elf.segments.sections	keyword	extended			ELF object segment sections.
921	8.11.0	true	process	process.parent.elf.segments.type	keyword	extended			ELF object segment type.
922	8.11.0	true	process	process.parent.elf.shared_libraries	keyword	extended	array		List of shared libraries used by this ELF object.
923	8.11.0	true	process	process.parent.elf.telfhash	keyword	extended			telfhash hash for ELF file.
924	8.11.0	true	process	process.parent.end	date	extended		2016-05-23T08:05:34.853Z	The time the process ended.
925	8.11.0	true	process	process.parent.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
926	8.11.0	true	process	process.parent.executable	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
927	8.11.0	true	process	process.parent.executable.text	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
928	8.11.0	true	process	process.parent.exit_code	long	extended		137	The exit code of the process.
929	8.11.0	true	process	process.parent.group.id	keyword	extended			Unique identifier for the group on the system/platform.
930	8.11.0	true	process	process.parent.group.name	keyword	extended			Name of the group.
931	8.11.0	true	process	process.parent.group_leader.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
932	8.11.0	true	process	process.parent.group_leader.pid	long	core		4242	Process id.
933	8.11.0	true	process	process.parent.group_leader.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
934	8.11.0	true	process	process.parent.group_leader.vpid	long	core		4242	Virtual process id.
935	8.11.0	true	process	process.parent.hash.md5	keyword	extended			MD5 hash.
936	8.11.0	true	process	process.parent.hash.sha1	keyword	extended			SHA1 hash.
937	8.11.0	true	process	process.parent.hash.sha256	keyword	extended			SHA256 hash.
938	8.11.0	true	process	process.parent.hash.sha384	keyword	extended			SHA384 hash.
939	8.11.0	true	process	process.parent.hash.sha512	keyword	extended			SHA512 hash.
940	8.11.0	true	process	process.parent.hash.ssdeep	keyword	extended			SSDEEP hash.
941	8.11.0	true	process	process.parent.hash.tlsh	keyword	extended			TLSH hash.
942	8.11.0	true	process	process.parent.interactive	boolean	extended		True	Whether the process is connected to an interactive shell.
943	8.11.0	true	process	process.parent.macho.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a Mach-O file.
944	8.11.0	true	process	process.parent.macho.go_imports	flat_object	extended			List of imported Go language element names and types.
945	8.11.0	true	process	process.parent.macho.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
946	8.11.0	true	process	process.parent.macho.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
947	8.11.0	true	process	process.parent.macho.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
948	8.11.0	true	process	process.parent.macho.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a Mach-O file.
949	8.11.0	true	process	process.parent.macho.imports	flat_object	extended	array		List of imported element names and types.
950	8.11.0	true	process	process.parent.macho.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
951	8.11.0	true	process	process.parent.macho.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
952	8.11.0	true	process	process.parent.macho.sections	nested	extended	array		Section information of the Mach-O file.
953	8.11.0	true	process	process.parent.macho.sections.entropy	long	extended			Shannon entropy calculation from the section.
954	8.11.0	true	process	process.parent.macho.sections.name	keyword	extended			Mach-O Section List name.
955	8.11.0	true	process	process.parent.macho.sections.physical_size	long	extended			Mach-O Section List physical size.
956	8.11.0	true	process	process.parent.macho.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
957	8.11.0	true	process	process.parent.macho.sections.virtual_size	long	extended			Mach-O Section List virtual size. This is always the same as `physical_size`.
958	8.11.0	true	process	process.parent.macho.symhash	keyword	extended		d3ccf195b62a9279c3c19af1080497ec	A hash of the imports in a Mach-O file.
959	8.11.0	true	process	process.parent.name	keyword	extended		ssh	Process name.
960	8.11.0	true	process	process.parent.name.text	keyword	extended		ssh	Process name.
961	8.11.0	true	process	process.parent.pe.architecture	keyword	extended		x64	CPU architecture target for the file.
962	8.11.0	true	process	process.parent.pe.company	keyword	extended		Microsoft Corporation	Internal company name of the file, provided at compile-time.
963	8.11.0	true	process	process.parent.pe.description	keyword	extended		Paint	Internal description of the file, provided at compile-time.
964	8.11.0	true	process	process.parent.pe.file_version	keyword	extended		6.3.9600.17415	Process name.
965	8.11.0	true	process	process.parent.pe.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a PE file.
966	8.11.0	true	process	process.parent.pe.go_imports	flat_object	extended			List of imported Go language element names and types.
967	8.11.0	true	process	process.parent.pe.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
968	8.11.0	true	process	process.parent.pe.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
969	8.11.0	true	process	process.parent.pe.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
970	8.11.0	true	process	process.parent.pe.imphash	keyword	extended		0c6803c4e922103c4dca5963aad36ddf	A hash of the imports in a PE file.
971	8.11.0	true	process	process.parent.pe.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a PE file.
972	8.11.0	true	process	process.parent.pe.imports	flat_object	extended	array		List of imported element names and types.
973	8.11.0	true	process	process.parent.pe.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
974	8.11.0	true	process	process.parent.pe.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
975	8.11.0	true	process	process.parent.pe.original_file_name	keyword	extended		MSPAINT.EXE	Internal name of the file, provided at compile-time.
976	8.11.0	true	process	process.parent.pe.pehash	keyword	extended		73ff189b63cd6be375a7ff25179a38d347651975	A hash of the PE header and data from one or more PE sections.
977	8.11.0	true	process	process.parent.pe.product	keyword	extended		Microsoft® Windows® Operating System	Internal product name of the file, provided at compile-time.
978	8.11.0	true	process	process.parent.pe.sections	nested	extended	array		Section information of the PE file.
979	8.11.0	true	process	process.parent.pe.sections.entropy	long	extended			Shannon entropy calculation from the section.
980	8.11.0	true	process	process.parent.pe.sections.name	keyword	extended			PE Section List name.
981	8.11.0	true	process	process.parent.pe.sections.physical_size	long	extended			PE Section List physical size.
982	8.11.0	true	process	process.parent.pe.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
983	8.11.0	true	process	process.parent.pe.sections.virtual_size	long	extended			PE Section List virtual size. This is always the same as `physical_size`.
984	8.11.0	true	process	process.parent.pgid	long	extended			Deprecated identifier of the group of processes the process belongs to.
985	8.11.0	true	process	process.parent.pid	long	core		4242	Process id.
986	8.11.0	true	process	process.parent.real_group.id	keyword	extended			Unique identifier for the group on the system/platform.
987	8.11.0	true	process	process.parent.real_group.name	keyword	extended			Name of the group.
988	8.11.0	true	process	process.parent.real_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
989	8.11.0	true	process	process.parent.real_user.name	keyword	core		a.einstein	Short name or login of the user.
990	8.11.0	true	process	process.parent.real_user.name.text	keyword	core		a.einstein	Short name or login of the user.
991	8.11.0	true	process	process.parent.saved_group.id	keyword	extended			Unique identifier for the group on the system/platform.
992	8.11.0	true	process	process.parent.saved_group.name	keyword	extended			Name of the group.
993	8.11.0	true	process	process.parent.saved_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
994	8.11.0	true	process	process.parent.saved_user.name	keyword	core		a.einstein	Short name or login of the user.
995	8.11.0	true	process	process.parent.saved_user.name.text	keyword	core		a.einstein	Short name or login of the user.
996	8.11.0	true	process	process.parent.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
997	8.11.0	true	process	process.parent.supplemental_groups.id	keyword	extended			Unique identifier for the group on the system/platform.
998	8.11.0	true	process	process.parent.supplemental_groups.name	keyword	extended			Name of the group.
999	8.11.0	true	process	process.parent.thread.capabilities.effective	keyword	extended	array	["CAP_BPF", "CAP_SYS_ADMIN"]	Array of capabilities used for permission checks.
1000	8.11.0	true	process	process.parent.thread.capabilities.permitted	keyword	extended	array	["CAP_BPF", "CAP_SYS_ADMIN"]	Array of capabilities a thread could assume.
1001	8.11.0	true	process	process.parent.thread.id	long	extended		4242	Thread ID.
1002	8.11.0	true	process	process.parent.thread.name	keyword	extended		thread-0	Thread name.
1003	8.11.0	true	process	process.parent.title	keyword	extended			Process title.
1004	8.11.0	true	process	process.parent.title.text	keyword	extended			Process title.
1005	8.11.0	true	process	process.parent.tty	object	extended			Information about the controlling TTY device.
1006	8.11.0	true	process	process.parent.tty.char_device.major	long	extended		4	The TTY character device's major number.
1007	8.11.0	true	process	process.parent.tty.char_device.minor	long	extended		1	The TTY character device's minor number.
1008	8.11.0	true	process	process.parent.uptime	long	extended		1325	Seconds the process has been up.
1009	8.11.0	true	process	process.parent.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1010	8.11.0	true	process	process.parent.user.name	keyword	core		a.einstein	Short name or login of the user.
1011	8.11.0	true	process	process.parent.user.name.text	keyword	core		a.einstein	Short name or login of the user.
1012	8.11.0	true	process	process.parent.vpid	long	core		4242	Virtual process id.
1013	8.11.0	true	process	process.parent.working_directory	keyword	extended		/home/alice	The working directory of the process.
1014	8.11.0	true	process	process.parent.working_directory.text	keyword	extended		/home/alice	The working directory of the process.
1015	8.11.0	true	process	process.pe.architecture	keyword	extended		x64	CPU architecture target for the file.
1016	8.11.0	true	process	process.pe.company	keyword	extended		Microsoft Corporation	Internal company name of the file, provided at compile-time.
1017	8.11.0	true	process	process.pe.description	keyword	extended		Paint	Internal description of the file, provided at compile-time.
1018	8.11.0	true	process	process.pe.file_version	keyword	extended		6.3.9600.17415	Process name.
1019	8.11.0	true	process	process.pe.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a PE file.
1020	8.11.0	true	process	process.pe.go_imports	flat_object	extended			List of imported Go language element names and types.
1021	8.11.0	true	process	process.pe.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1022	8.11.0	true	process	process.pe.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1023	8.11.0	true	process	process.pe.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1024	8.11.0	true	process	process.pe.imphash	keyword	extended		0c6803c4e922103c4dca5963aad36ddf	A hash of the imports in a PE file.
1025	8.11.0	true	process	process.pe.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a PE file.
1026	8.11.0	true	process	process.pe.imports	flat_object	extended	array		List of imported element names and types.
1027	8.11.0	true	process	process.pe.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1028	8.11.0	true	process	process.pe.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1029	8.11.0	true	process	process.pe.original_file_name	keyword	extended		MSPAINT.EXE	Internal name of the file, provided at compile-time.
1030	8.11.0	true	process	process.pe.pehash	keyword	extended		73ff189b63cd6be375a7ff25179a38d347651975	A hash of the PE header and data from one or more PE sections.
1031	8.11.0	true	process	process.pe.product	keyword	extended		Microsoft® Windows® Operating System	Internal product name of the file, provided at compile-time.
1032	8.11.0	true	process	process.pe.sections	nested	extended	array		Section information of the PE file.
1033	8.11.0	true	process	process.pe.sections.entropy	long	extended			Shannon entropy calculation from the section.
1034	8.11.0	true	process	process.pe.sections.name	keyword	extended			PE Section List name.
1035	8.11.0	true	process	process.pe.sections.physical_size	long	extended			PE Section List physical size.
1036	8.11.0	true	process	process.pe.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1037	8.11.0	true	process	process.pe.sections.virtual_size	long	extended			PE Section List virtual size. This is always the same as `physical_size`.
1038	8.11.0	true	process	process.pgid	long	extended			Deprecated identifier of the group of processes the process belongs to.
1039	8.11.0	true	process	process.pid	long	core		4242	Process id.
1040	8.11.0	true	process	process.previous.args	keyword	extended	array	["/usr/bin/ssh", "-l", "user", "10.0.0.16"]	Array of process arguments.
1041	8.11.0	true	process	process.previous.args_count	long	extended		4	Length of the process.args array.
1042	8.11.0	true	process	process.previous.executable	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
1043	8.11.0	true	process	process.previous.executable.text	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
1044	8.11.0	true	process	process.real_group.id	keyword	extended			Unique identifier for the group on the system/platform.
1045	8.11.0	true	process	process.real_group.name	keyword	extended			Name of the group.
1046	8.11.0	true	process	process.real_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1047	8.11.0	true	process	process.real_user.name	keyword	core		a.einstein	Short name or login of the user.
1048	8.11.0	true	process	process.real_user.name.text	keyword	core		a.einstein	Short name or login of the user.
1049	8.11.0	true	process	process.saved_group.id	keyword	extended			Unique identifier for the group on the system/platform.
1050	8.11.0	true	process	process.saved_group.name	keyword	extended			Name of the group.
1051	8.11.0	true	process	process.saved_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1052	8.11.0	true	process	process.saved_user.name	keyword	core		a.einstein	Short name or login of the user.
1053	8.11.0	true	process	process.saved_user.name.text	keyword	core		a.einstein	Short name or login of the user.
1054	8.11.0	true	process	process.session_leader.args	keyword	extended	array	["/usr/bin/ssh", "-l", "user", "10.0.0.16"]	Array of process arguments.
1055	8.11.0	true	process	process.session_leader.args_count	long	extended		4	Length of the process.args array.
1056	8.11.0	true	process	process.session_leader.command_line	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
1057	8.11.0	true	process	process.session_leader.command_line.text	keyword	extended		/usr/bin/ssh -l user 10.0.0.16	Full command line that started the process.
1058	8.11.0	true	process	process.session_leader.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
1059	8.11.0	true	process	process.session_leader.executable	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
1060	8.11.0	true	process	process.session_leader.executable.text	keyword	extended		/usr/bin/ssh	Absolute path to the process executable.
1061	8.11.0	true	process	process.session_leader.group.id	keyword	extended			Unique identifier for the group on the system/platform.
1062	8.11.0	true	process	process.session_leader.group.name	keyword	extended			Name of the group.
1063	8.11.0	true	process	process.session_leader.interactive	boolean	extended		True	Whether the process is connected to an interactive shell.
1064	8.11.0	true	process	process.session_leader.name	keyword	extended		ssh	Process name.
1065	8.11.0	true	process	process.session_leader.name.text	keyword	extended		ssh	Process name.
1066	8.11.0	true	process	process.session_leader.parent.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
1067	8.11.0	true	process	process.session_leader.parent.pid	long	core		4242	Process id.
1068	8.11.0	true	process	process.session_leader.parent.session_leader.entity_id	keyword	extended		c2c455d9f99375d	Unique identifier for the process.
1069	8.11.0	true	process	process.session_leader.parent.session_leader.pid	long	core		4242	Process id.
1070	8.11.0	true	process	process.session_leader.parent.session_leader.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
1071	8.11.0	true	process	process.session_leader.parent.session_leader.vpid	long	core		4242	Virtual process id.
1072	8.11.0	true	process	process.session_leader.parent.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
1073	8.11.0	true	process	process.session_leader.parent.vpid	long	core		4242	Virtual process id.
1074	8.11.0	true	process	process.session_leader.pid	long	core		4242	Process id.
1075	8.11.0	true	process	process.session_leader.real_group.id	keyword	extended			Unique identifier for the group on the system/platform.
1076	8.11.0	true	process	process.session_leader.real_group.name	keyword	extended			Name of the group.
1077	8.11.0	true	process	process.session_leader.real_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1078	8.11.0	true	process	process.session_leader.real_user.name	keyword	core		a.einstein	Short name or login of the user.
1079	8.11.0	true	process	process.session_leader.real_user.name.text	keyword	core		a.einstein	Short name or login of the user.
1080	8.11.0	true	process	process.session_leader.same_as_process	boolean	extended		True	This boolean is used to identify if a leader process is the same as the top level process.
1081	8.11.0	true	process	process.session_leader.saved_group.id	keyword	extended			Unique identifier for the group on the system/platform.
1082	8.11.0	true	process	process.session_leader.saved_group.name	keyword	extended			Name of the group.
1083	8.11.0	true	process	process.session_leader.saved_user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1084	8.11.0	true	process	process.session_leader.saved_user.name	keyword	core		a.einstein	Short name or login of the user.
1085	8.11.0	true	process	process.session_leader.saved_user.name.text	keyword	core		a.einstein	Short name or login of the user.
1086	8.11.0	true	process	process.session_leader.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
1087	8.11.0	true	process	process.session_leader.supplemental_groups.id	keyword	extended			Unique identifier for the group on the system/platform.
1088	8.11.0	true	process	process.session_leader.supplemental_groups.name	keyword	extended			Name of the group.
1089	8.11.0	true	process	process.session_leader.tty	object	extended			Information about the controlling TTY device.
1090	8.11.0	true	process	process.session_leader.tty.char_device.major	long	extended		4	The TTY character device's major number.
1091	8.11.0	true	process	process.session_leader.tty.char_device.minor	long	extended		1	The TTY character device's minor number.
1092	8.11.0	true	process	process.session_leader.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1093	8.11.0	true	process	process.session_leader.user.name	keyword	core		a.einstein	Short name or login of the user.
1094	8.11.0	true	process	process.session_leader.user.name.text	keyword	core		a.einstein	Short name or login of the user.
1095	8.11.0	true	process	process.session_leader.vpid	long	core		4242	Virtual process id.
1096	8.11.0	true	process	process.session_leader.working_directory	keyword	extended		/home/alice	The working directory of the process.
1097	8.11.0	true	process	process.session_leader.working_directory.text	keyword	extended		/home/alice	The working directory of the process.
1098	8.11.0	true	process	process.start	date	extended		2016-05-23T08:05:34.853Z	The time the process started.
1099	8.11.0	true	process	process.supplemental_groups.id	keyword	extended			Unique identifier for the group on the system/platform.
1100	8.11.0	true	process	process.supplemental_groups.name	keyword	extended			Name of the group.
1101	8.11.0	true	process	process.thread.capabilities.effective	keyword	extended	array	["CAP_BPF", "CAP_SYS_ADMIN"]	Array of capabilities used for permission checks.
1102	8.11.0	true	process	process.thread.capabilities.permitted	keyword	extended	array	["CAP_BPF", "CAP_SYS_ADMIN"]	Array of capabilities a thread could assume.
1103	8.11.0	true	process	process.thread.id	long	extended		4242	Thread ID.
1104	8.11.0	true	process	process.thread.name	keyword	extended		thread-0	Thread name.
1105	8.11.0	true	process	process.title	keyword	extended			Process title.
1106	8.11.0	true	process	process.title.text	keyword	extended			Process title.
1107	8.11.0	true	process	process.tty	object	extended			Information about the controlling TTY device.
1108	8.11.0	true	process	process.tty.char_device.major	long	extended		4	The TTY character device's major number.
1109	8.11.0	true	process	process.tty.char_device.minor	long	extended		1	The TTY character device's minor number.
1110	8.11.0	true	process	process.tty.columns	long	extended		80	The number of character columns per line. e.g terminal width
1111	8.11.0	true	process	process.tty.rows	long	extended		24	The number of character rows in the terminal. e.g terminal height
1112	8.11.0	true	process	process.uptime	long	extended		1325	Seconds the process has been up.
1113	8.11.0	true	process	process.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1114	8.11.0	true	process	process.user.name	keyword	core		a.einstein	Short name or login of the user.
1115	8.11.0	true	process	process.user.name.text	keyword	core		a.einstein	Short name or login of the user.
1116	8.11.0	true	process	process.vpid	long	core		4242	Virtual process id.
1117	8.11.0	true	process	process.working_directory	keyword	extended		/home/alice	The working directory of the process.
1118	8.11.0	true	process	process.working_directory.text	keyword	extended		/home/alice	The working directory of the process.
1119	8.11.0	true	registry	registry.data.bytes	keyword	extended		ZQBuAC0AVQBTAAAAZQBuAAAAAAA=	Original bytes written with base64 encoding.
1120	8.11.0	true	registry	registry.data.strings	keyword	core	array	["C:\rta\red_ttp\bin\myapp.exe"]	List of strings representing what was written to the registry.
1121	8.11.0	true	registry	registry.data.type	keyword	core		REG_SZ	Standard registry type for encoding contents
1122	8.11.0	true	registry	registry.hive	keyword	core		HKLM	Abbreviated name for the hive.
1123	8.11.0	true	registry	registry.key	keyword	core		SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	Hive-relative path of keys.
1124	8.11.0	true	registry	registry.path	keyword	core		HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger	Full path, including hive, key and value
1125	8.11.0	true	registry	registry.value	keyword	core		Debugger	Name of the value written.
1126	8.11.0	true	related	related.hash	keyword	extended	array		All the hashes seen on your event.
1127	8.11.0	true	related	related.hosts	keyword	extended	array		All the host identifiers seen on your event.
1128	8.11.0	true	related	related.ip	ip	extended	array		All of the IPs seen on your event.
1129	8.11.0	true	related	related.user	keyword	extended	array		All the user names or other user identifiers seen on the event.
1130	8.11.0	true	rule	rule.author	keyword	extended	array	["Star-Lord"]	Rule author
1131	8.11.0	true	rule	rule.category	keyword	extended		Attempted Information Leak	Rule category
1132	8.11.0	true	rule	rule.description	keyword	extended		Block requests to public DNS over HTTPS / TLS protocols	Rule description
1133	8.11.0	true	rule	rule.id	keyword	extended		101	Rule ID
1134	8.11.0	true	rule	rule.license	keyword	extended		Apache 2.0	Rule license
1135	8.11.0	true	rule	rule.name	keyword	extended		BLOCK_DNS_over_TLS	Rule name
1136	8.11.0	true	rule	rule.reference	keyword	extended		https://en.wikipedia.org/wiki/DNS_over_TLS	Rule reference URL
1137	8.11.0	true	rule	rule.ruleset	keyword	extended		Standard_Protocol_Filters	Rule ruleset
1138	8.11.0	true	rule	rule.uuid	keyword	extended		1100110011	Rule UUID
1139	8.11.0	true	rule	rule.version	keyword	extended		1.1	Rule version
1140	8.11.0	true	server	server.address	keyword	extended			Server network address.
1141	8.11.0	true	server	server.as.number	long	extended		15169	Unique number allocated to the autonomous system.
1142	8.11.0	true	server	server.as.organization.name	keyword	extended		Google LLC	Organization name.
1143	8.11.0	true	server	server.as.organization.name.text	keyword	extended		Google LLC	Organization name.
1144	8.11.0	true	server	server.bytes	long	core		184	Bytes sent from the server to the client.
1145	8.11.0	true	server	server.domain	keyword	core		foo.example.com	The domain name of the server.
1146	8.11.0	true	server	server.geo.city_name	keyword	core		Montreal	City name.
1147	8.11.0	true	server	server.geo.continent_code	keyword	core		NA	Continent code.
1148	8.11.0	true	server	server.geo.continent_name	keyword	core		North America	Name of the continent.
1149	8.11.0	true	server	server.geo.country_iso_code	keyword	core		CA	Country ISO code.
1150	8.11.0	true	server	server.geo.country_name	keyword	core		Canada	Country name.
1151	8.11.0	true	server	server.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
1152	8.11.0	true	server	server.geo.name	keyword	extended		boston-dc	User-defined description of a location.
1153	8.11.0	true	server	server.geo.postal_code	keyword	core		94040	Postal code.
1154	8.11.0	true	server	server.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
1155	8.11.0	true	server	server.geo.region_name	keyword	core		Quebec	Region name.
1156	8.11.0	true	server	server.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
1157	8.11.0	true	server	server.ip	ip	core			IP address of the server.
1158	8.11.0	true	server	server.mac	keyword	core		00-00-5E-00-53-23	MAC address of the server.
1159	8.11.0	true	server	server.nat.ip	ip	extended			Server NAT ip
1160	8.11.0	true	server	server.nat.port	long	extended			Server NAT port
1161	8.11.0	true	server	server.packets	long	core		12	Packets sent from the server to the client.
1162	8.11.0	true	server	server.port	long	core			Port of the server.
1163	8.11.0	true	server	server.registered_domain	keyword	extended		example.com	The highest registered server domain, stripped of the subdomain.
1164	8.11.0	true	server	server.subdomain	keyword	extended		east	The subdomain of the domain.
1165	8.11.0	true	server	server.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
1166	8.11.0	true	server	server.user.domain	keyword	extended			Name of the directory the user is a member of.
1167	8.11.0	true	server	server.user.email	keyword	extended			User email address.
1168	8.11.0	true	server	server.user.full_name	keyword	extended		Albert Einstein	User's full name, if available.
1169	8.11.0	true	server	server.user.full_name.text	keyword	extended		Albert Einstein	User's full name, if available.
1170	8.11.0	true	server	server.user.group.domain	keyword	extended			Name of the directory the group is a member of.
1171	8.11.0	true	server	server.user.group.id	keyword	extended			Unique identifier for the group on the system/platform.
1172	8.11.0	true	server	server.user.group.name	keyword	extended			Name of the group.
1173	8.11.0	true	server	server.user.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
1174	8.11.0	true	server	server.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1175	8.11.0	true	server	server.user.name	keyword	core		a.einstein	Short name or login of the user.
1176	8.11.0	true	server	server.user.name.text	keyword	core		a.einstein	Short name or login of the user.
1177	8.11.0	true	server	server.user.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
1178	8.11.0	true	service	service.address	keyword	extended		172.26.0.2:5432	Address of this service.
1179	8.11.0	true	service	service.environment	keyword	extended		production	Environment of the service.
1180	8.11.0	true	service	service.ephemeral_id	keyword	extended		8a4f500f	Ephemeral identifier of this service.
1181	8.11.0	true	service	service.id	keyword	core		d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6	Unique identifier of the running service.
1182	8.11.0	true	service	service.name	keyword	core		elasticsearch-metrics	Name of the service.
1183	8.11.0	true	service	service.node.name	keyword	extended		instance-0000000016	Name of the service node.
1184	8.11.0	true	service	service.node.role	keyword	extended		background_tasks	Deprecated role (singular) of the service node.
1185	8.11.0	true	service	service.node.roles	keyword	extended	array	["ui", "background_tasks"]	Roles of the service node.
1186	8.11.0	true	service	service.origin.address	keyword	extended		172.26.0.2:5432	Address of this service.
1187	8.11.0	true	service	service.origin.environment	keyword	extended		production	Environment of the service.
1188	8.11.0	true	service	service.origin.ephemeral_id	keyword	extended		8a4f500f	Ephemeral identifier of this service.
1189	8.11.0	true	service	service.origin.id	keyword	core		d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6	Unique identifier of the running service.
1190	8.11.0	true	service	service.origin.name	keyword	core		elasticsearch-metrics	Name of the service.
1191	8.11.0	true	service	service.origin.node.name	keyword	extended		instance-0000000016	Name of the service node.
1192	8.11.0	true	service	service.origin.node.role	keyword	extended		background_tasks	Deprecated role (singular) of the service node.
1193	8.11.0	true	service	service.origin.node.roles	keyword	extended	array	["ui", "background_tasks"]	Roles of the service node.
1194	8.11.0	true	service	service.origin.state	keyword	core			Current state of the service.
1195	8.11.0	true	service	service.origin.type	keyword	core		elasticsearch	The type of the service.
1196	8.11.0	true	service	service.origin.version	keyword	core		3.2.4	Version of the service.
1197	8.11.0	true	service	service.state	keyword	core			Current state of the service.
1198	8.11.0	true	service	service.target.address	keyword	extended		172.26.0.2:5432	Address of this service.
1199	8.11.0	true	service	service.target.environment	keyword	extended		production	Environment of the service.
1200	8.11.0	true	service	service.target.ephemeral_id	keyword	extended		8a4f500f	Ephemeral identifier of this service.
1201	8.11.0	true	service	service.target.id	keyword	core		d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6	Unique identifier of the running service.
1202	8.11.0	true	service	service.target.name	keyword	core		elasticsearch-metrics	Name of the service.
1203	8.11.0	true	service	service.target.node.name	keyword	extended		instance-0000000016	Name of the service node.
1204	8.11.0	true	service	service.target.node.role	keyword	extended		background_tasks	Deprecated role (singular) of the service node.
1205	8.11.0	true	service	service.target.node.roles	keyword	extended	array	["ui", "background_tasks"]	Roles of the service node.
1206	8.11.0	true	service	service.target.state	keyword	core			Current state of the service.
1207	8.11.0	true	service	service.target.type	keyword	core		elasticsearch	The type of the service.
1208	8.11.0	true	service	service.target.version	keyword	core		3.2.4	Version of the service.
1209	8.11.0	true	service	service.type	keyword	core		elasticsearch	The type of the service.
1210	8.11.0	true	service	service.version	keyword	core		3.2.4	Version of the service.
1211	8.11.0	true	source	source.address	keyword	extended			Source network address.
1212	8.11.0	true	source	source.as.number	long	extended		15169	Unique number allocated to the autonomous system.
1213	8.11.0	true	source	source.as.organization.name	keyword	extended		Google LLC	Organization name.
1214	8.11.0	true	source	source.as.organization.name.text	keyword	extended		Google LLC	Organization name.
1215	8.11.0	true	source	source.bytes	long	core		184	Bytes sent from the source to the destination.
1216	8.11.0	true	source	source.domain	keyword	core		foo.example.com	The domain name of the source.
1217	8.11.0	true	source	source.geo.city_name	keyword	core		Montreal	City name.
1218	8.11.0	true	source	source.geo.continent_code	keyword	core		NA	Continent code.
1219	8.11.0	true	source	source.geo.continent_name	keyword	core		North America	Name of the continent.
1220	8.11.0	true	source	source.geo.country_iso_code	keyword	core		CA	Country ISO code.
1221	8.11.0	true	source	source.geo.country_name	keyword	core		Canada	Country name.
1222	8.11.0	true	source	source.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
1223	8.11.0	true	source	source.geo.name	keyword	extended		boston-dc	User-defined description of a location.
1224	8.11.0	true	source	source.geo.postal_code	keyword	core		94040	Postal code.
1225	8.11.0	true	source	source.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
1226	8.11.0	true	source	source.geo.region_name	keyword	core		Quebec	Region name.
1227	8.11.0	true	source	source.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
1228	8.11.0	true	source	source.ip	ip	core			IP address of the source.
1229	8.11.0	true	source	source.mac	keyword	core		00-00-5E-00-53-23	MAC address of the source.
1230	8.11.0	true	source	source.nat.ip	ip	extended			Source NAT ip
1231	8.11.0	true	source	source.nat.port	long	extended			Source NAT port
1232	8.11.0	true	source	source.packets	long	core		12	Packets sent from the source to the destination.
1233	8.11.0	true	source	source.port	long	core			Port of the source.
1234	8.11.0	true	source	source.registered_domain	keyword	extended		example.com	The highest registered source domain, stripped of the subdomain.
1235	8.11.0	true	source	source.subdomain	keyword	extended		east	The subdomain of the domain.
1236	8.11.0	true	source	source.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
1237	8.11.0	true	source	source.user.domain	keyword	extended			Name of the directory the user is a member of.
1238	8.11.0	true	source	source.user.email	keyword	extended			User email address.
1239	8.11.0	true	source	source.user.full_name	keyword	extended		Albert Einstein	User's full name, if available.
1240	8.11.0	true	source	source.user.full_name.text	keyword	extended		Albert Einstein	User's full name, if available.
1241	8.11.0	true	source	source.user.group.domain	keyword	extended			Name of the directory the group is a member of.
1242	8.11.0	true	source	source.user.group.id	keyword	extended			Unique identifier for the group on the system/platform.
1243	8.11.0	true	source	source.user.group.name	keyword	extended			Name of the group.
1244	8.11.0	true	source	source.user.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
1245	8.11.0	true	source	source.user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1246	8.11.0	true	source	source.user.name	keyword	core		a.einstein	Short name or login of the user.
1247	8.11.0	true	source	source.user.name.text	keyword	core		a.einstein	Short name or login of the user.
1248	8.11.0	true	source	source.user.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
1249	8.11.0	true	span	span.id	keyword	extended		3ff9a8981b7ccd5a	Unique identifier of the span within the scope of its trace.
1250	8.11.0	true	threat	threat.enrichments	nested	extended	array		List of objects containing indicators enriching the event.
1251	8.11.0	true	threat	threat.enrichments.indicator	object	extended			Object containing indicators enriching the event.
1252	8.11.0	true	threat	threat.enrichments.indicator.as.number	long	extended		15169	Unique number allocated to the autonomous system.
1253	8.11.0	true	threat	threat.enrichments.indicator.as.organization.name	keyword	extended		Google LLC	Organization name.
1254	8.11.0	true	threat	threat.enrichments.indicator.as.organization.name.text	keyword	extended		Google LLC	Organization name.
1255	8.11.0	true	threat	threat.enrichments.indicator.confidence	keyword	extended		Medium	Indicator confidence rating
1256	8.11.0	true	threat	threat.enrichments.indicator.description	keyword	extended		IP x.x.x.x was observed delivering the Angler EK.	Indicator description
1257	8.11.0	true	threat	threat.enrichments.indicator.email.address	keyword	extended		phish@example.com	Indicator email address
1258	8.11.0	true	threat	threat.enrichments.indicator.file.accessed	date	extended			Last time the file was accessed.
1259	8.11.0	true	threat	threat.enrichments.indicator.file.attributes	keyword	extended	array	["readonly", "system"]	Array of file attributes.
1260	8.11.0	true	threat	threat.enrichments.indicator.file.code_signature.digest_algorithm	keyword	extended		sha256	Hashing algorithm used to sign the process.
1261	8.11.0	true	threat	threat.enrichments.indicator.file.code_signature.exists	boolean	core		true	Boolean to capture if a signature is present.
1262	8.11.0	true	threat	threat.enrichments.indicator.file.code_signature.signing_id	keyword	extended		com.apple.xpc.proxy	The identifier used to sign the process.
1263	8.11.0	true	threat	threat.enrichments.indicator.file.code_signature.status	keyword	extended		ERROR_UNTRUSTED_ROOT	Additional information about the certificate status.
1264	8.11.0	true	threat	threat.enrichments.indicator.file.code_signature.subject_name	keyword	core		Microsoft Corporation	Subject name of the code signer
1265	8.11.0	true	threat	threat.enrichments.indicator.file.code_signature.team_id	keyword	extended		EQHXZ8M8AV	The team identifier used to sign the process.
1266	8.11.0	true	threat	threat.enrichments.indicator.file.code_signature.timestamp	date	extended		2021-01-01T12:10:30Z	When the signature was generated and signed.
1267	8.11.0	true	threat	threat.enrichments.indicator.file.code_signature.trusted	boolean	extended		true	Stores the trust status of the certificate chain.
1268	8.11.0	true	threat	threat.enrichments.indicator.file.code_signature.valid	boolean	extended		true	Boolean to capture if the digital signature is verified against the binary content.
1269	8.11.0	true	threat	threat.enrichments.indicator.file.created	date	extended			File creation time.
1270	8.11.0	true	threat	threat.enrichments.indicator.file.ctime	date	extended			Last time the file attributes or metadata changed.
1271	8.11.0	true	threat	threat.enrichments.indicator.file.device	keyword	extended		sda	Device that is the source of the file.
1272	8.11.0	true	threat	threat.enrichments.indicator.file.directory	keyword	extended		/home/alice	Directory where the file is located.
1273	8.11.0	true	threat	threat.enrichments.indicator.file.drive_letter	keyword	extended		C	Drive letter where the file is located.
1274	8.11.0	true	threat	threat.enrichments.indicator.file.elf.architecture	keyword	extended		x86-64	Machine architecture of the ELF file.
1275	8.11.0	true	threat	threat.enrichments.indicator.file.elf.byte_order	keyword	extended		Little Endian	Byte sequence of ELF file.
1276	8.11.0	true	threat	threat.enrichments.indicator.file.elf.cpu_type	keyword	extended		Intel	CPU type of the ELF file.
1277	8.11.0	true	threat	threat.enrichments.indicator.file.elf.creation_date	date	extended			Build or compile date.
1278	8.11.0	true	threat	threat.enrichments.indicator.file.elf.exports	flat_object	extended	array		List of exported element names and types.
1279	8.11.0	true	threat	threat.enrichments.indicator.file.elf.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in an ELF file.
1280	8.11.0	true	threat	threat.enrichments.indicator.file.elf.go_imports	flat_object	extended			List of imported Go language element names and types.
1281	8.11.0	true	threat	threat.enrichments.indicator.file.elf.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1282	8.11.0	true	threat	threat.enrichments.indicator.file.elf.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1283	8.11.0	true	threat	threat.enrichments.indicator.file.elf.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1284	8.11.0	true	threat	threat.enrichments.indicator.file.elf.header.abi_version	keyword	extended			Version of the ELF Application Binary Interface (ABI).
1285	8.11.0	true	threat	threat.enrichments.indicator.file.elf.header.class	keyword	extended			Header class of the ELF file.
1286	8.11.0	true	threat	threat.enrichments.indicator.file.elf.header.data	keyword	extended			Data table of the ELF header.
1287	8.11.0	true	threat	threat.enrichments.indicator.file.elf.header.entrypoint	long	extended			Header entrypoint of the ELF file.
1288	8.11.0	true	threat	threat.enrichments.indicator.file.elf.header.object_version	keyword	extended			"0x1" for original ELF files.
1289	8.11.0	true	threat	threat.enrichments.indicator.file.elf.header.os_abi	keyword	extended			Application Binary Interface (ABI) of the Linux OS.
1290	8.11.0	true	threat	threat.enrichments.indicator.file.elf.header.type	keyword	extended			Header type of the ELF file.
1291	8.11.0	true	threat	threat.enrichments.indicator.file.elf.header.version	keyword	extended			Version of the ELF header.
1292	8.11.0	true	threat	threat.enrichments.indicator.file.elf.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in an ELF file.
1293	8.11.0	true	threat	threat.enrichments.indicator.file.elf.imports	flat_object	extended	array		List of imported element names and types.
1294	8.11.0	true	threat	threat.enrichments.indicator.file.elf.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1295	8.11.0	true	threat	threat.enrichments.indicator.file.elf.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1296	8.11.0	true	threat	threat.enrichments.indicator.file.elf.sections	nested	extended	array		Section information of the ELF file.
1297	8.11.0	true	threat	threat.enrichments.indicator.file.elf.sections.chi2	long	extended			Chi-square probability distribution of the section.
1298	8.11.0	true	threat	threat.enrichments.indicator.file.elf.sections.entropy	long	extended			Shannon entropy calculation from the section.
1299	8.11.0	true	threat	threat.enrichments.indicator.file.elf.sections.flags	keyword	extended			ELF Section List flags.
1300	8.11.0	true	threat	threat.enrichments.indicator.file.elf.sections.name	keyword	extended			ELF Section List name.
1301	8.11.0	true	threat	threat.enrichments.indicator.file.elf.sections.physical_offset	keyword	extended			ELF Section List offset.
1302	8.11.0	true	threat	threat.enrichments.indicator.file.elf.sections.physical_size	long	extended			ELF Section List physical size.
1303	8.11.0	true	threat	threat.enrichments.indicator.file.elf.sections.type	keyword	extended			ELF Section List type.
1304	8.11.0	true	threat	threat.enrichments.indicator.file.elf.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1305	8.11.0	true	threat	threat.enrichments.indicator.file.elf.sections.virtual_address	long	extended			ELF Section List virtual address.
1306	8.11.0	true	threat	threat.enrichments.indicator.file.elf.sections.virtual_size	long	extended			ELF Section List virtual size.
1307	8.11.0	true	threat	threat.enrichments.indicator.file.elf.segments	nested	extended	array		ELF object segment list.
1308	8.11.0	true	threat	threat.enrichments.indicator.file.elf.segments.sections	keyword	extended			ELF object segment sections.
1309	8.11.0	true	threat	threat.enrichments.indicator.file.elf.segments.type	keyword	extended			ELF object segment type.
1310	8.11.0	true	threat	threat.enrichments.indicator.file.elf.shared_libraries	keyword	extended	array		List of shared libraries used by this ELF object.
1311	8.11.0	true	threat	threat.enrichments.indicator.file.elf.telfhash	keyword	extended			telfhash hash for ELF file.
1312	8.11.0	true	threat	threat.enrichments.indicator.file.extension	keyword	extended		png	File extension, excluding the leading dot.
1313	8.11.0	true	threat	threat.enrichments.indicator.file.fork_name	keyword	extended		Zone.Identifer	A fork is additional data associated with a filesystem object.
1314	8.11.0	true	threat	threat.enrichments.indicator.file.gid	keyword	extended		1001	Primary group ID (GID) of the file.
1315	8.11.0	true	threat	threat.enrichments.indicator.file.group	keyword	extended		alice	Primary group name of the file.
1316	8.11.0	true	threat	threat.enrichments.indicator.file.hash.md5	keyword	extended			MD5 hash.
1317	8.11.0	true	threat	threat.enrichments.indicator.file.hash.sha1	keyword	extended			SHA1 hash.
1318	8.11.0	true	threat	threat.enrichments.indicator.file.hash.sha256	keyword	extended			SHA256 hash.
1319	8.11.0	true	threat	threat.enrichments.indicator.file.hash.sha384	keyword	extended			SHA384 hash.
1320	8.11.0	true	threat	threat.enrichments.indicator.file.hash.sha512	keyword	extended			SHA512 hash.
1321	8.11.0	true	threat	threat.enrichments.indicator.file.hash.ssdeep	keyword	extended			SSDEEP hash.
1322	8.11.0	true	threat	threat.enrichments.indicator.file.hash.tlsh	keyword	extended			TLSH hash.
1323	8.11.0	true	threat	threat.enrichments.indicator.file.inode	keyword	extended		256383	Inode representing the file in the filesystem.
1324	8.11.0	true	threat	threat.enrichments.indicator.file.mime_type	keyword	extended			Media type of file, document, or arrangement of bytes.
1325	8.11.0	true	threat	threat.enrichments.indicator.file.mode	keyword	extended		0640	Mode of the file in octal representation.
1326	8.11.0	true	threat	threat.enrichments.indicator.file.mtime	date	extended			Last time the file content was modified.
1327	8.11.0	true	threat	threat.enrichments.indicator.file.name	keyword	extended		example.png	Name of the file including the extension, without the directory.
1328	8.11.0	true	threat	threat.enrichments.indicator.file.owner	keyword	extended		alice	File owner's username.
1329	8.11.0	true	threat	threat.enrichments.indicator.file.path	keyword	extended		/home/alice/example.png	Full path to the file, including the file name.
1330	8.11.0	true	threat	threat.enrichments.indicator.file.path.text	keyword	extended		/home/alice/example.png	Full path to the file, including the file name.
1331	8.11.0	true	threat	threat.enrichments.indicator.file.pe.architecture	keyword	extended		x64	CPU architecture target for the file.
1332	8.11.0	true	threat	threat.enrichments.indicator.file.pe.company	keyword	extended		Microsoft Corporation	Internal company name of the file, provided at compile-time.
1333	8.11.0	true	threat	threat.enrichments.indicator.file.pe.description	keyword	extended		Paint	Internal description of the file, provided at compile-time.
1334	8.11.0	true	threat	threat.enrichments.indicator.file.pe.file_version	keyword	extended		6.3.9600.17415	Process name.
1335	8.11.0	true	threat	threat.enrichments.indicator.file.pe.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a PE file.
1336	8.11.0	true	threat	threat.enrichments.indicator.file.pe.go_imports	flat_object	extended			List of imported Go language element names and types.
1337	8.11.0	true	threat	threat.enrichments.indicator.file.pe.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1338	8.11.0	true	threat	threat.enrichments.indicator.file.pe.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1339	8.11.0	true	threat	threat.enrichments.indicator.file.pe.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1340	8.11.0	true	threat	threat.enrichments.indicator.file.pe.imphash	keyword	extended		0c6803c4e922103c4dca5963aad36ddf	A hash of the imports in a PE file.
1341	8.11.0	true	threat	threat.enrichments.indicator.file.pe.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a PE file.
1342	8.11.0	true	threat	threat.enrichments.indicator.file.pe.imports	flat_object	extended	array		List of imported element names and types.
1343	8.11.0	true	threat	threat.enrichments.indicator.file.pe.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1344	8.11.0	true	threat	threat.enrichments.indicator.file.pe.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1345	8.11.0	true	threat	threat.enrichments.indicator.file.pe.original_file_name	keyword	extended		MSPAINT.EXE	Internal name of the file, provided at compile-time.
1346	8.11.0	true	threat	threat.enrichments.indicator.file.pe.pehash	keyword	extended		73ff189b63cd6be375a7ff25179a38d347651975	A hash of the PE header and data from one or more PE sections.
1347	8.11.0	true	threat	threat.enrichments.indicator.file.pe.product	keyword	extended		Microsoft® Windows® Operating System	Internal product name of the file, provided at compile-time.
1348	8.11.0	true	threat	threat.enrichments.indicator.file.pe.sections	nested	extended	array		Section information of the PE file.
1349	8.11.0	true	threat	threat.enrichments.indicator.file.pe.sections.entropy	long	extended			Shannon entropy calculation from the section.
1350	8.11.0	true	threat	threat.enrichments.indicator.file.pe.sections.name	keyword	extended			PE Section List name.
1351	8.11.0	true	threat	threat.enrichments.indicator.file.pe.sections.physical_size	long	extended			PE Section List physical size.
1352	8.11.0	true	threat	threat.enrichments.indicator.file.pe.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1353	8.11.0	true	threat	threat.enrichments.indicator.file.pe.sections.virtual_size	long	extended			PE Section List virtual size. This is always the same as `physical_size`.
1354	8.11.0	true	threat	threat.enrichments.indicator.file.size	long	extended		16384	File size in bytes.
1355	8.11.0	true	threat	threat.enrichments.indicator.file.target_path	keyword	extended			Target path for symlinks.
1356	8.11.0	true	threat	threat.enrichments.indicator.file.target_path.text	keyword	extended			Target path for symlinks.
1357	8.11.0	true	threat	threat.enrichments.indicator.file.type	keyword	extended		file	File type (file, dir, or symlink).
1358	8.11.0	true	threat	threat.enrichments.indicator.file.uid	keyword	extended		1001	The user ID (UID) or security identifier (SID) of the file owner.
1359	8.11.0	true	threat	threat.enrichments.indicator.file.x509.alternative_names	keyword	extended	array	*.elastic.co	List of subject alternative names (SAN).
1360	8.11.0	true	threat	threat.enrichments.indicator.file.x509.issuer.common_name	keyword	extended	array	Example SHA2 High Assurance Server CA	List of common name (CN) of issuing certificate authority.
1361	8.11.0	true	threat	threat.enrichments.indicator.file.x509.issuer.country	keyword	extended	array	US	List of country \(C) codes
1362	8.11.0	true	threat	threat.enrichments.indicator.file.x509.issuer.distinguished_name	keyword	extended		C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA	Distinguished name (DN) of issuing certificate authority.
1363	8.11.0	true	threat	threat.enrichments.indicator.file.x509.issuer.locality	keyword	extended	array	Mountain View	List of locality names (L)
1364	8.11.0	true	threat	threat.enrichments.indicator.file.x509.issuer.organization	keyword	extended	array	Example Inc	List of organizations (O) of issuing certificate authority.
1365	8.11.0	true	threat	threat.enrichments.indicator.file.x509.issuer.organizational_unit	keyword	extended	array	www.example.com	List of organizational units (OU) of issuing certificate authority.
1366	8.11.0	true	threat	threat.enrichments.indicator.file.x509.issuer.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1367	8.11.0	true	threat	threat.enrichments.indicator.file.x509.not_after	date	extended		2020-07-16T03:15:39Z	Time at which the certificate is no longer considered valid.
1368	8.11.0	true	threat	threat.enrichments.indicator.file.x509.not_before	date	extended		2019-08-16T01:40:25Z	Time at which the certificate is first considered valid.
1369	8.11.0	true	threat	threat.enrichments.indicator.file.x509.public_key_algorithm	keyword	extended		RSA	Algorithm used to generate the public key.
1370	8.11.0	true	threat	threat.enrichments.indicator.file.x509.public_key_curve	keyword	extended		nistp521	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
1371	8.11.0	false	threat	threat.enrichments.indicator.file.x509.public_key_exponent	long	extended		65537	Exponent used to derive the public key. This is algorithm specific.
1372	8.11.0	true	threat	threat.enrichments.indicator.file.x509.public_key_size	long	extended		2048	The size of the public key space in bits.
1373	8.11.0	true	threat	threat.enrichments.indicator.file.x509.serial_number	keyword	extended		55FBB9C7DEBF09809D12CCAA	Unique serial number issued by the certificate authority.
1374	8.11.0	true	threat	threat.enrichments.indicator.file.x509.signature_algorithm	keyword	extended		SHA256-RSA	Identifier for certificate signature algorithm.
1375	8.11.0	true	threat	threat.enrichments.indicator.file.x509.subject.common_name	keyword	extended	array	shared.global.example.net	List of common names (CN) of subject.
1376	8.11.0	true	threat	threat.enrichments.indicator.file.x509.subject.country	keyword	extended	array	US	List of country \(C) code
1377	8.11.0	true	threat	threat.enrichments.indicator.file.x509.subject.distinguished_name	keyword	extended		C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net	Distinguished name (DN) of the certificate subject entity.
1378	8.11.0	true	threat	threat.enrichments.indicator.file.x509.subject.locality	keyword	extended	array	San Francisco	List of locality names (L)
1379	8.11.0	true	threat	threat.enrichments.indicator.file.x509.subject.organization	keyword	extended	array	Example, Inc.	List of organizations (O) of subject.
1380	8.11.0	true	threat	threat.enrichments.indicator.file.x509.subject.organizational_unit	keyword	extended	array		List of organizational units (OU) of subject.
1381	8.11.0	true	threat	threat.enrichments.indicator.file.x509.subject.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1382	8.11.0	true	threat	threat.enrichments.indicator.file.x509.version_number	keyword	extended		3	Version of x509 format.
1383	8.11.0	true	threat	threat.enrichments.indicator.first_seen	date	extended		2020-11-05T17:25:47.000Z	Date/time indicator was first reported.
1384	8.11.0	true	threat	threat.enrichments.indicator.geo.city_name	keyword	core		Montreal	City name.
1385	8.11.0	true	threat	threat.enrichments.indicator.geo.continent_code	keyword	core		NA	Continent code.
1386	8.11.0	true	threat	threat.enrichments.indicator.geo.continent_name	keyword	core		North America	Name of the continent.
1387	8.11.0	true	threat	threat.enrichments.indicator.geo.country_iso_code	keyword	core		CA	Country ISO code.
1388	8.11.0	true	threat	threat.enrichments.indicator.geo.country_name	keyword	core		Canada	Country name.
1389	8.11.0	true	threat	threat.enrichments.indicator.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
1390	8.11.0	true	threat	threat.enrichments.indicator.geo.name	keyword	extended		boston-dc	User-defined description of a location.
1391	8.11.0	true	threat	threat.enrichments.indicator.geo.postal_code	keyword	core		94040	Postal code.
1392	8.11.0	true	threat	threat.enrichments.indicator.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
1393	8.11.0	true	threat	threat.enrichments.indicator.geo.region_name	keyword	core		Quebec	Region name.
1394	8.11.0	true	threat	threat.enrichments.indicator.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
1395	8.11.0	true	threat	threat.enrichments.indicator.ip	ip	extended		1.2.3.4	Indicator IP address
1396	8.11.0	true	threat	threat.enrichments.indicator.last_seen	date	extended		2020-11-05T17:25:47.000Z	Date/time indicator was last reported.
1397	8.11.0	true	threat	threat.enrichments.indicator.marking.tlp	keyword	extended		CLEAR	Indicator TLP marking
1398	8.11.0	true	threat	threat.enrichments.indicator.marking.tlp_version	keyword	extended		2.0	Indicator TLP version
1399	8.11.0	true	threat	threat.enrichments.indicator.modified_at	date	extended		2020-11-05T17:25:47.000Z	Date/time indicator was last updated.
1400	8.11.0	true	threat	threat.enrichments.indicator.name	keyword	extended		5.2.75.227	Indicator display name
1401	8.11.0	true	threat	threat.enrichments.indicator.port	long	extended		443	Indicator port
1402	8.11.0	true	threat	threat.enrichments.indicator.provider	keyword	extended		lrz_urlhaus	Indicator provider
1403	8.11.0	true	threat	threat.enrichments.indicator.reference	keyword	extended		https://system.example.com/indicator/0001234	Indicator reference URL
1404	8.11.0	true	threat	threat.enrichments.indicator.registry.data.bytes	keyword	extended		ZQBuAC0AVQBTAAAAZQBuAAAAAAA=	Original bytes written with base64 encoding.
1405	8.11.0	true	threat	threat.enrichments.indicator.registry.data.strings	keyword	core	array	["C:\rta\red_ttp\bin\myapp.exe"]	List of strings representing what was written to the registry.
1406	8.11.0	true	threat	threat.enrichments.indicator.registry.data.type	keyword	core		REG_SZ	Standard registry type for encoding contents
1407	8.11.0	true	threat	threat.enrichments.indicator.registry.hive	keyword	core		HKLM	Abbreviated name for the hive.
1408	8.11.0	true	threat	threat.enrichments.indicator.registry.key	keyword	core		SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	Hive-relative path of keys.
1409	8.11.0	true	threat	threat.enrichments.indicator.registry.path	keyword	core		HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger	Full path, including hive, key and value
1410	8.11.0	true	threat	threat.enrichments.indicator.registry.value	keyword	core		Debugger	Name of the value written.
1411	8.11.0	true	threat	threat.enrichments.indicator.scanner_stats	long	extended		4	Scanner statistics
1412	8.11.0	true	threat	threat.enrichments.indicator.sightings	long	extended		20	Number of times indicator observed
1413	8.11.0	true	threat	threat.enrichments.indicator.type	keyword	extended		ipv4-addr	Type of indicator
1414	8.11.0	true	threat	threat.enrichments.indicator.url.domain	keyword	extended		www.elastic.co	Domain of the url.
1415	8.11.0	true	threat	threat.enrichments.indicator.url.extension	keyword	extended		png	File extension from the request url, excluding the leading dot.
1416	8.11.0	true	threat	threat.enrichments.indicator.url.fragment	keyword	extended			Portion of the url after the `#`.
1417	8.11.0	true	threat	threat.enrichments.indicator.url.full	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top	Full unparsed URL.
1418	8.11.0	true	threat	threat.enrichments.indicator.url.full.text	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top	Full unparsed URL.
1419	8.11.0	true	threat	threat.enrichments.indicator.url.original	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch	Unmodified original url as seen in the event source.
1420	8.11.0	true	threat	threat.enrichments.indicator.url.original.text	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch	Unmodified original url as seen in the event source.
1421	8.11.0	true	threat	threat.enrichments.indicator.url.password	keyword	extended			Password of the request.
1422	8.11.0	true	threat	threat.enrichments.indicator.url.path	keyword	extended			Path of the request, such as "/search".
1423	8.11.0	true	threat	threat.enrichments.indicator.url.port	long	extended		443	Port of the request, such as 443.
1424	8.11.0	true	threat	threat.enrichments.indicator.url.query	keyword	extended			Query string of the request.
1425	8.11.0	true	threat	threat.enrichments.indicator.url.registered_domain	keyword	extended		example.com	The highest registered url domain, stripped of the subdomain.
1426	8.11.0	true	threat	threat.enrichments.indicator.url.scheme	keyword	extended		https	Scheme of the url.
1427	8.11.0	true	threat	threat.enrichments.indicator.url.subdomain	keyword	extended		east	The subdomain of the domain.
1428	8.11.0	true	threat	threat.enrichments.indicator.url.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
1429	8.11.0	true	threat	threat.enrichments.indicator.url.username	keyword	extended			Username of the request.
1430	8.11.0	true	threat	threat.enrichments.indicator.x509.alternative_names	keyword	extended	array	*.elastic.co	List of subject alternative names (SAN).
1431	8.11.0	true	threat	threat.enrichments.indicator.x509.issuer.common_name	keyword	extended	array	Example SHA2 High Assurance Server CA	List of common name (CN) of issuing certificate authority.
1432	8.11.0	true	threat	threat.enrichments.indicator.x509.issuer.country	keyword	extended	array	US	List of country \(C) codes
1433	8.11.0	true	threat	threat.enrichments.indicator.x509.issuer.distinguished_name	keyword	extended		C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA	Distinguished name (DN) of issuing certificate authority.
1434	8.11.0	true	threat	threat.enrichments.indicator.x509.issuer.locality	keyword	extended	array	Mountain View	List of locality names (L)
1435	8.11.0	true	threat	threat.enrichments.indicator.x509.issuer.organization	keyword	extended	array	Example Inc	List of organizations (O) of issuing certificate authority.
1436	8.11.0	true	threat	threat.enrichments.indicator.x509.issuer.organizational_unit	keyword	extended	array	www.example.com	List of organizational units (OU) of issuing certificate authority.
1437	8.11.0	true	threat	threat.enrichments.indicator.x509.issuer.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1438	8.11.0	true	threat	threat.enrichments.indicator.x509.not_after	date	extended		2020-07-16T03:15:39Z	Time at which the certificate is no longer considered valid.
1439	8.11.0	true	threat	threat.enrichments.indicator.x509.not_before	date	extended		2019-08-16T01:40:25Z	Time at which the certificate is first considered valid.
1440	8.11.0	true	threat	threat.enrichments.indicator.x509.public_key_algorithm	keyword	extended		RSA	Algorithm used to generate the public key.
1441	8.11.0	true	threat	threat.enrichments.indicator.x509.public_key_curve	keyword	extended		nistp521	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
1442	8.11.0	false	threat	threat.enrichments.indicator.x509.public_key_exponent	long	extended		65537	Exponent used to derive the public key. This is algorithm specific.
1443	8.11.0	true	threat	threat.enrichments.indicator.x509.public_key_size	long	extended		2048	The size of the public key space in bits.
1444	8.11.0	true	threat	threat.enrichments.indicator.x509.serial_number	keyword	extended		55FBB9C7DEBF09809D12CCAA	Unique serial number issued by the certificate authority.
1445	8.11.0	true	threat	threat.enrichments.indicator.x509.signature_algorithm	keyword	extended		SHA256-RSA	Identifier for certificate signature algorithm.
1446	8.11.0	true	threat	threat.enrichments.indicator.x509.subject.common_name	keyword	extended	array	shared.global.example.net	List of common names (CN) of subject.
1447	8.11.0	true	threat	threat.enrichments.indicator.x509.subject.country	keyword	extended	array	US	List of country \(C) code
1448	8.11.0	true	threat	threat.enrichments.indicator.x509.subject.distinguished_name	keyword	extended		C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net	Distinguished name (DN) of the certificate subject entity.
1449	8.11.0	true	threat	threat.enrichments.indicator.x509.subject.locality	keyword	extended	array	San Francisco	List of locality names (L)
1450	8.11.0	true	threat	threat.enrichments.indicator.x509.subject.organization	keyword	extended	array	Example, Inc.	List of organizations (O) of subject.
1451	8.11.0	true	threat	threat.enrichments.indicator.x509.subject.organizational_unit	keyword	extended	array		List of organizational units (OU) of subject.
1452	8.11.0	true	threat	threat.enrichments.indicator.x509.subject.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1453	8.11.0	true	threat	threat.enrichments.indicator.x509.version_number	keyword	extended		3	Version of x509 format.
1454	8.11.0	true	threat	threat.enrichments.matched.atomic	keyword	extended		bad-domain.com	Matched indicator value
1455	8.11.0	true	threat	threat.enrichments.matched.field	keyword	extended		file.hash.sha256	Matched indicator field
1456	8.11.0	true	threat	threat.enrichments.matched.id	keyword	extended		ff93aee5-86a1-4a61-b0e6-0cdc313d01b5	Matched indicator identifier
1457	8.11.0	true	threat	threat.enrichments.matched.index	keyword	extended		filebeat-8.0.0-2021.05.23-000011	Matched indicator index
1458	8.11.0	true	threat	threat.enrichments.matched.occurred	date	extended		2021-10-05T17:00:58.326Z	Date of match
1459	8.11.0	true	threat	threat.enrichments.matched.type	keyword	extended		indicator_match_rule	Type of indicator match
1460	8.11.0	true	threat	threat.feed.dashboard_id	keyword	extended		5ba16340-72e6-11eb-a3e3-b3cc7c78a70f	Feed dashboard ID.
1461	8.11.0	true	threat	threat.feed.description	keyword	extended		Threat feed from the AlienVault Open Threat eXchange network.	Description of the threat feed.
1462	8.11.0	true	threat	threat.feed.name	keyword	extended		AlienVault OTX	Name of the threat feed.
1463	8.11.0	true	threat	threat.feed.reference	keyword	extended		https://otx.alienvault.com	Reference for the threat feed.
1464	8.11.0	true	threat	threat.framework	keyword	extended		MITRE ATT&CK	Threat classification framework.
1465	8.11.0	true	threat	threat.group.alias	keyword	extended	array	[ "Magecart Group 6" ]	Alias of the group.
1466	8.11.0	true	threat	threat.group.id	keyword	extended		G0037	ID of the group.
1467	8.11.0	true	threat	threat.group.name	keyword	extended		FIN6	Name of the group.
1468	8.11.0	true	threat	threat.group.reference	keyword	extended		https://attack.mitre.org/groups/G0037/	Reference URL of the group.
1469	8.11.0	true	threat	threat.indicator.as.number	long	extended		15169	Unique number allocated to the autonomous system.
1470	8.11.0	true	threat	threat.indicator.as.organization.name	keyword	extended		Google LLC	Organization name.
1471	8.11.0	true	threat	threat.indicator.as.organization.name.text	keyword	extended		Google LLC	Organization name.
1472	8.11.0	true	threat	threat.indicator.confidence	keyword	extended		Medium	Indicator confidence rating
1473	8.11.0	true	threat	threat.indicator.description	keyword	extended		IP x.x.x.x was observed delivering the Angler EK.	Indicator description
1474	8.11.0	true	threat	threat.indicator.email.address	keyword	extended		phish@example.com	Indicator email address
1475	8.11.0	true	threat	threat.indicator.file.accessed	date	extended			Last time the file was accessed.
1476	8.11.0	true	threat	threat.indicator.file.attributes	keyword	extended	array	["readonly", "system"]	Array of file attributes.
1477	8.11.0	true	threat	threat.indicator.file.code_signature.digest_algorithm	keyword	extended		sha256	Hashing algorithm used to sign the process.
1478	8.11.0	true	threat	threat.indicator.file.code_signature.exists	boolean	core		true	Boolean to capture if a signature is present.
1479	8.11.0	true	threat	threat.indicator.file.code_signature.signing_id	keyword	extended		com.apple.xpc.proxy	The identifier used to sign the process.
1480	8.11.0	true	threat	threat.indicator.file.code_signature.status	keyword	extended		ERROR_UNTRUSTED_ROOT	Additional information about the certificate status.
1481	8.11.0	true	threat	threat.indicator.file.code_signature.subject_name	keyword	core		Microsoft Corporation	Subject name of the code signer
1482	8.11.0	true	threat	threat.indicator.file.code_signature.team_id	keyword	extended		EQHXZ8M8AV	The team identifier used to sign the process.
1483	8.11.0	true	threat	threat.indicator.file.code_signature.timestamp	date	extended		2021-01-01T12:10:30Z	When the signature was generated and signed.
1484	8.11.0	true	threat	threat.indicator.file.code_signature.trusted	boolean	extended		true	Stores the trust status of the certificate chain.
1485	8.11.0	true	threat	threat.indicator.file.code_signature.valid	boolean	extended		true	Boolean to capture if the digital signature is verified against the binary content.
1486	8.11.0	true	threat	threat.indicator.file.created	date	extended			File creation time.
1487	8.11.0	true	threat	threat.indicator.file.ctime	date	extended			Last time the file attributes or metadata changed.
1488	8.11.0	true	threat	threat.indicator.file.device	keyword	extended		sda	Device that is the source of the file.
1489	8.11.0	true	threat	threat.indicator.file.directory	keyword	extended		/home/alice	Directory where the file is located.
1490	8.11.0	true	threat	threat.indicator.file.drive_letter	keyword	extended		C	Drive letter where the file is located.
1491	8.11.0	true	threat	threat.indicator.file.elf.architecture	keyword	extended		x86-64	Machine architecture of the ELF file.
1492	8.11.0	true	threat	threat.indicator.file.elf.byte_order	keyword	extended		Little Endian	Byte sequence of ELF file.
1493	8.11.0	true	threat	threat.indicator.file.elf.cpu_type	keyword	extended		Intel	CPU type of the ELF file.
1494	8.11.0	true	threat	threat.indicator.file.elf.creation_date	date	extended			Build or compile date.
1495	8.11.0	true	threat	threat.indicator.file.elf.exports	flat_object	extended	array		List of exported element names and types.
1496	8.11.0	true	threat	threat.indicator.file.elf.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in an ELF file.
1497	8.11.0	true	threat	threat.indicator.file.elf.go_imports	flat_object	extended			List of imported Go language element names and types.
1498	8.11.0	true	threat	threat.indicator.file.elf.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1499	8.11.0	true	threat	threat.indicator.file.elf.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1500	8.11.0	true	threat	threat.indicator.file.elf.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1501	8.11.0	true	threat	threat.indicator.file.elf.header.abi_version	keyword	extended			Version of the ELF Application Binary Interface (ABI).
1502	8.11.0	true	threat	threat.indicator.file.elf.header.class	keyword	extended			Header class of the ELF file.
1503	8.11.0	true	threat	threat.indicator.file.elf.header.data	keyword	extended			Data table of the ELF header.
1504	8.11.0	true	threat	threat.indicator.file.elf.header.entrypoint	long	extended			Header entrypoint of the ELF file.
1505	8.11.0	true	threat	threat.indicator.file.elf.header.object_version	keyword	extended			"0x1" for original ELF files.
1506	8.11.0	true	threat	threat.indicator.file.elf.header.os_abi	keyword	extended			Application Binary Interface (ABI) of the Linux OS.
1507	8.11.0	true	threat	threat.indicator.file.elf.header.type	keyword	extended			Header type of the ELF file.
1508	8.11.0	true	threat	threat.indicator.file.elf.header.version	keyword	extended			Version of the ELF header.
1509	8.11.0	true	threat	threat.indicator.file.elf.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in an ELF file.
1510	8.11.0	true	threat	threat.indicator.file.elf.imports	flat_object	extended	array		List of imported element names and types.
1511	8.11.0	true	threat	threat.indicator.file.elf.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1512	8.11.0	true	threat	threat.indicator.file.elf.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1513	8.11.0	true	threat	threat.indicator.file.elf.sections	nested	extended	array		Section information of the ELF file.
1514	8.11.0	true	threat	threat.indicator.file.elf.sections.chi2	long	extended			Chi-square probability distribution of the section.
1515	8.11.0	true	threat	threat.indicator.file.elf.sections.entropy	long	extended			Shannon entropy calculation from the section.
1516	8.11.0	true	threat	threat.indicator.file.elf.sections.flags	keyword	extended			ELF Section List flags.
1517	8.11.0	true	threat	threat.indicator.file.elf.sections.name	keyword	extended			ELF Section List name.
1518	8.11.0	true	threat	threat.indicator.file.elf.sections.physical_offset	keyword	extended			ELF Section List offset.
1519	8.11.0	true	threat	threat.indicator.file.elf.sections.physical_size	long	extended			ELF Section List physical size.
1520	8.11.0	true	threat	threat.indicator.file.elf.sections.type	keyword	extended			ELF Section List type.
1521	8.11.0	true	threat	threat.indicator.file.elf.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1522	8.11.0	true	threat	threat.indicator.file.elf.sections.virtual_address	long	extended			ELF Section List virtual address.
1523	8.11.0	true	threat	threat.indicator.file.elf.sections.virtual_size	long	extended			ELF Section List virtual size.
1524	8.11.0	true	threat	threat.indicator.file.elf.segments	nested	extended	array		ELF object segment list.
1525	8.11.0	true	threat	threat.indicator.file.elf.segments.sections	keyword	extended			ELF object segment sections.
1526	8.11.0	true	threat	threat.indicator.file.elf.segments.type	keyword	extended			ELF object segment type.
1527	8.11.0	true	threat	threat.indicator.file.elf.shared_libraries	keyword	extended	array		List of shared libraries used by this ELF object.
1528	8.11.0	true	threat	threat.indicator.file.elf.telfhash	keyword	extended			telfhash hash for ELF file.
1529	8.11.0	true	threat	threat.indicator.file.extension	keyword	extended		png	File extension, excluding the leading dot.
1530	8.11.0	true	threat	threat.indicator.file.fork_name	keyword	extended		Zone.Identifer	A fork is additional data associated with a filesystem object.
1531	8.11.0	true	threat	threat.indicator.file.gid	keyword	extended		1001	Primary group ID (GID) of the file.
1532	8.11.0	true	threat	threat.indicator.file.group	keyword	extended		alice	Primary group name of the file.
1533	8.11.0	true	threat	threat.indicator.file.hash.md5	keyword	extended			MD5 hash.
1534	8.11.0	true	threat	threat.indicator.file.hash.sha1	keyword	extended			SHA1 hash.
1535	8.11.0	true	threat	threat.indicator.file.hash.sha256	keyword	extended			SHA256 hash.
1536	8.11.0	true	threat	threat.indicator.file.hash.sha384	keyword	extended			SHA384 hash.
1537	8.11.0	true	threat	threat.indicator.file.hash.sha512	keyword	extended			SHA512 hash.
1538	8.11.0	true	threat	threat.indicator.file.hash.ssdeep	keyword	extended			SSDEEP hash.
1539	8.11.0	true	threat	threat.indicator.file.hash.tlsh	keyword	extended			TLSH hash.
1540	8.11.0	true	threat	threat.indicator.file.inode	keyword	extended		256383	Inode representing the file in the filesystem.
1541	8.11.0	true	threat	threat.indicator.file.mime_type	keyword	extended			Media type of file, document, or arrangement of bytes.
1542	8.11.0	true	threat	threat.indicator.file.mode	keyword	extended		0640	Mode of the file in octal representation.
1543	8.11.0	true	threat	threat.indicator.file.mtime	date	extended			Last time the file content was modified.
1544	8.11.0	true	threat	threat.indicator.file.name	keyword	extended		example.png	Name of the file including the extension, without the directory.
1545	8.11.0	true	threat	threat.indicator.file.owner	keyword	extended		alice	File owner's username.
1546	8.11.0	true	threat	threat.indicator.file.path	keyword	extended		/home/alice/example.png	Full path to the file, including the file name.
1547	8.11.0	true	threat	threat.indicator.file.path.text	keyword	extended		/home/alice/example.png	Full path to the file, including the file name.
1548	8.11.0	true	threat	threat.indicator.file.pe.architecture	keyword	extended		x64	CPU architecture target for the file.
1549	8.11.0	true	threat	threat.indicator.file.pe.company	keyword	extended		Microsoft Corporation	Internal company name of the file, provided at compile-time.
1550	8.11.0	true	threat	threat.indicator.file.pe.description	keyword	extended		Paint	Internal description of the file, provided at compile-time.
1551	8.11.0	true	threat	threat.indicator.file.pe.file_version	keyword	extended		6.3.9600.17415	Process name.
1552	8.11.0	true	threat	threat.indicator.file.pe.go_import_hash	keyword	extended		10bddcb4cee42080f76c88d9ff964491	A hash of the Go language imports in a PE file.
1553	8.11.0	true	threat	threat.indicator.file.pe.go_imports	flat_object	extended			List of imported Go language element names and types.
1554	8.11.0	true	threat	threat.indicator.file.pe.go_imports_names_entropy	long	extended			Shannon entropy calculation from the list of Go imports.
1555	8.11.0	true	threat	threat.indicator.file.pe.go_imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of Go imports.
1556	8.11.0	true	threat	threat.indicator.file.pe.go_stripped	boolean	extended			Whether the file is a stripped or obfuscated Go executable.
1557	8.11.0	true	threat	threat.indicator.file.pe.imphash	keyword	extended		0c6803c4e922103c4dca5963aad36ddf	A hash of the imports in a PE file.
1558	8.11.0	true	threat	threat.indicator.file.pe.import_hash	keyword	extended		d41d8cd98f00b204e9800998ecf8427e	A hash of the imports in a PE file.
1559	8.11.0	true	threat	threat.indicator.file.pe.imports	flat_object	extended	array		List of imported element names and types.
1560	8.11.0	true	threat	threat.indicator.file.pe.imports_names_entropy	long	extended			Shannon entropy calculation from the list of imported element names and types.
1561	8.11.0	true	threat	threat.indicator.file.pe.imports_names_var_entropy	long	extended			Variance for Shannon entropy calculation from the list of imported element names and types.
1562	8.11.0	true	threat	threat.indicator.file.pe.original_file_name	keyword	extended		MSPAINT.EXE	Internal name of the file, provided at compile-time.
1563	8.11.0	true	threat	threat.indicator.file.pe.pehash	keyword	extended		73ff189b63cd6be375a7ff25179a38d347651975	A hash of the PE header and data from one or more PE sections.
1564	8.11.0	true	threat	threat.indicator.file.pe.product	keyword	extended		Microsoft® Windows® Operating System	Internal product name of the file, provided at compile-time.
1565	8.11.0	true	threat	threat.indicator.file.pe.sections	nested	extended	array		Section information of the PE file.
1566	8.11.0	true	threat	threat.indicator.file.pe.sections.entropy	long	extended			Shannon entropy calculation from the section.
1567	8.11.0	true	threat	threat.indicator.file.pe.sections.name	keyword	extended			PE Section List name.
1568	8.11.0	true	threat	threat.indicator.file.pe.sections.physical_size	long	extended			PE Section List physical size.
1569	8.11.0	true	threat	threat.indicator.file.pe.sections.var_entropy	long	extended			Variance for Shannon entropy calculation from the section.
1570	8.11.0	true	threat	threat.indicator.file.pe.sections.virtual_size	long	extended			PE Section List virtual size. This is always the same as `physical_size`.
1571	8.11.0	true	threat	threat.indicator.file.size	long	extended		16384	File size in bytes.
1572	8.11.0	true	threat	threat.indicator.file.target_path	keyword	extended			Target path for symlinks.
1573	8.11.0	true	threat	threat.indicator.file.target_path.text	keyword	extended			Target path for symlinks.
1574	8.11.0	true	threat	threat.indicator.file.type	keyword	extended		file	File type (file, dir, or symlink).
1575	8.11.0	true	threat	threat.indicator.file.uid	keyword	extended		1001	The user ID (UID) or security identifier (SID) of the file owner.
1576	8.11.0	true	threat	threat.indicator.file.x509.alternative_names	keyword	extended	array	*.elastic.co	List of subject alternative names (SAN).
1577	8.11.0	true	threat	threat.indicator.file.x509.issuer.common_name	keyword	extended	array	Example SHA2 High Assurance Server CA	List of common name (CN) of issuing certificate authority.
1578	8.11.0	true	threat	threat.indicator.file.x509.issuer.country	keyword	extended	array	US	List of country \(C) codes
1579	8.11.0	true	threat	threat.indicator.file.x509.issuer.distinguished_name	keyword	extended		C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA	Distinguished name (DN) of issuing certificate authority.
1580	8.11.0	true	threat	threat.indicator.file.x509.issuer.locality	keyword	extended	array	Mountain View	List of locality names (L)
1581	8.11.0	true	threat	threat.indicator.file.x509.issuer.organization	keyword	extended	array	Example Inc	List of organizations (O) of issuing certificate authority.
1582	8.11.0	true	threat	threat.indicator.file.x509.issuer.organizational_unit	keyword	extended	array	www.example.com	List of organizational units (OU) of issuing certificate authority.
1583	8.11.0	true	threat	threat.indicator.file.x509.issuer.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1584	8.11.0	true	threat	threat.indicator.file.x509.not_after	date	extended		2020-07-16T03:15:39Z	Time at which the certificate is no longer considered valid.
1585	8.11.0	true	threat	threat.indicator.file.x509.not_before	date	extended		2019-08-16T01:40:25Z	Time at which the certificate is first considered valid.
1586	8.11.0	true	threat	threat.indicator.file.x509.public_key_algorithm	keyword	extended		RSA	Algorithm used to generate the public key.
1587	8.11.0	true	threat	threat.indicator.file.x509.public_key_curve	keyword	extended		nistp521	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
1588	8.11.0	false	threat	threat.indicator.file.x509.public_key_exponent	long	extended		65537	Exponent used to derive the public key. This is algorithm specific.
1589	8.11.0	true	threat	threat.indicator.file.x509.public_key_size	long	extended		2048	The size of the public key space in bits.
1590	8.11.0	true	threat	threat.indicator.file.x509.serial_number	keyword	extended		55FBB9C7DEBF09809D12CCAA	Unique serial number issued by the certificate authority.
1591	8.11.0	true	threat	threat.indicator.file.x509.signature_algorithm	keyword	extended		SHA256-RSA	Identifier for certificate signature algorithm.
1592	8.11.0	true	threat	threat.indicator.file.x509.subject.common_name	keyword	extended	array	shared.global.example.net	List of common names (CN) of subject.
1593	8.11.0	true	threat	threat.indicator.file.x509.subject.country	keyword	extended	array	US	List of country \(C) code
1594	8.11.0	true	threat	threat.indicator.file.x509.subject.distinguished_name	keyword	extended		C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net	Distinguished name (DN) of the certificate subject entity.
1595	8.11.0	true	threat	threat.indicator.file.x509.subject.locality	keyword	extended	array	San Francisco	List of locality names (L)
1596	8.11.0	true	threat	threat.indicator.file.x509.subject.organization	keyword	extended	array	Example, Inc.	List of organizations (O) of subject.
1597	8.11.0	true	threat	threat.indicator.file.x509.subject.organizational_unit	keyword	extended	array		List of organizational units (OU) of subject.
1598	8.11.0	true	threat	threat.indicator.file.x509.subject.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1599	8.11.0	true	threat	threat.indicator.file.x509.version_number	keyword	extended		3	Version of x509 format.
1600	8.11.0	true	threat	threat.indicator.first_seen	date	extended		2020-11-05T17:25:47.000Z	Date/time indicator was first reported.
1601	8.11.0	true	threat	threat.indicator.geo.city_name	keyword	core		Montreal	City name.
1602	8.11.0	true	threat	threat.indicator.geo.continent_code	keyword	core		NA	Continent code.
1603	8.11.0	true	threat	threat.indicator.geo.continent_name	keyword	core		North America	Name of the continent.
1604	8.11.0	true	threat	threat.indicator.geo.country_iso_code	keyword	core		CA	Country ISO code.
1605	8.11.0	true	threat	threat.indicator.geo.country_name	keyword	core		Canada	Country name.
1606	8.11.0	true	threat	threat.indicator.geo.location	geo_point	core		{ "lon": -73.614830, "lat": 45.505918 }	Longitude and latitude.
1607	8.11.0	true	threat	threat.indicator.geo.name	keyword	extended		boston-dc	User-defined description of a location.
1608	8.11.0	true	threat	threat.indicator.geo.postal_code	keyword	core		94040	Postal code.
1609	8.11.0	true	threat	threat.indicator.geo.region_iso_code	keyword	core		CA-QC	Region ISO code.
1610	8.11.0	true	threat	threat.indicator.geo.region_name	keyword	core		Quebec	Region name.
1611	8.11.0	true	threat	threat.indicator.geo.timezone	keyword	core		America/Argentina/Buenos_Aires	Time zone.
1612	8.11.0	true	threat	threat.indicator.ip	ip	extended		1.2.3.4	Indicator IP address
1613	8.11.0	true	threat	threat.indicator.last_seen	date	extended		2020-11-05T17:25:47.000Z	Date/time indicator was last reported.
1614	8.11.0	true	threat	threat.indicator.marking.tlp	keyword	extended		CLEAR	Indicator TLP marking
1615	8.11.0	true	threat	threat.indicator.marking.tlp_version	keyword	extended		2.0	Indicator TLP version
1616	8.11.0	true	threat	threat.indicator.modified_at	date	extended		2020-11-05T17:25:47.000Z	Date/time indicator was last updated.
1617	8.11.0	true	threat	threat.indicator.name	keyword	extended		5.2.75.227	Indicator display name
1618	8.11.0	true	threat	threat.indicator.port	long	extended		443	Indicator port
1619	8.11.0	true	threat	threat.indicator.provider	keyword	extended		lrz_urlhaus	Indicator provider
1620	8.11.0	true	threat	threat.indicator.reference	keyword	extended		https://system.example.com/indicator/0001234	Indicator reference URL
1621	8.11.0	true	threat	threat.indicator.registry.data.bytes	keyword	extended		ZQBuAC0AVQBTAAAAZQBuAAAAAAA=	Original bytes written with base64 encoding.
1622	8.11.0	true	threat	threat.indicator.registry.data.strings	keyword	core	array	["C:\rta\red_ttp\bin\myapp.exe"]	List of strings representing what was written to the registry.
1623	8.11.0	true	threat	threat.indicator.registry.data.type	keyword	core		REG_SZ	Standard registry type for encoding contents
1624	8.11.0	true	threat	threat.indicator.registry.hive	keyword	core		HKLM	Abbreviated name for the hive.
1625	8.11.0	true	threat	threat.indicator.registry.key	keyword	core		SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	Hive-relative path of keys.
1626	8.11.0	true	threat	threat.indicator.registry.path	keyword	core		HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger	Full path, including hive, key and value
1627	8.11.0	true	threat	threat.indicator.registry.value	keyword	core		Debugger	Name of the value written.
1628	8.11.0	true	threat	threat.indicator.scanner_stats	long	extended		4	Scanner statistics
1629	8.11.0	true	threat	threat.indicator.sightings	long	extended		20	Number of times indicator observed
1630	8.11.0	true	threat	threat.indicator.type	keyword	extended		ipv4-addr	Type of indicator
1631	8.11.0	true	threat	threat.indicator.url.domain	keyword	extended		www.elastic.co	Domain of the url.
1632	8.11.0	true	threat	threat.indicator.url.extension	keyword	extended		png	File extension from the request url, excluding the leading dot.
1633	8.11.0	true	threat	threat.indicator.url.fragment	keyword	extended			Portion of the url after the `#`.
1634	8.11.0	true	threat	threat.indicator.url.full	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top	Full unparsed URL.
1635	8.11.0	true	threat	threat.indicator.url.full.text	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top	Full unparsed URL.
1636	8.11.0	true	threat	threat.indicator.url.original	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch	Unmodified original url as seen in the event source.
1637	8.11.0	true	threat	threat.indicator.url.original.text	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch	Unmodified original url as seen in the event source.
1638	8.11.0	true	threat	threat.indicator.url.password	keyword	extended			Password of the request.
1639	8.11.0	true	threat	threat.indicator.url.path	keyword	extended			Path of the request, such as "/search".
1640	8.11.0	true	threat	threat.indicator.url.port	long	extended		443	Port of the request, such as 443.
1641	8.11.0	true	threat	threat.indicator.url.query	keyword	extended			Query string of the request.
1642	8.11.0	true	threat	threat.indicator.url.registered_domain	keyword	extended		example.com	The highest registered url domain, stripped of the subdomain.
1643	8.11.0	true	threat	threat.indicator.url.scheme	keyword	extended		https	Scheme of the url.
1644	8.11.0	true	threat	threat.indicator.url.subdomain	keyword	extended		east	The subdomain of the domain.
1645	8.11.0	true	threat	threat.indicator.url.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
1646	8.11.0	true	threat	threat.indicator.url.username	keyword	extended			Username of the request.
1647	8.11.0	true	threat	threat.indicator.x509.alternative_names	keyword	extended	array	*.elastic.co	List of subject alternative names (SAN).
1648	8.11.0	true	threat	threat.indicator.x509.issuer.common_name	keyword	extended	array	Example SHA2 High Assurance Server CA	List of common name (CN) of issuing certificate authority.
1649	8.11.0	true	threat	threat.indicator.x509.issuer.country	keyword	extended	array	US	List of country \(C) codes
1650	8.11.0	true	threat	threat.indicator.x509.issuer.distinguished_name	keyword	extended		C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA	Distinguished name (DN) of issuing certificate authority.
1651	8.11.0	true	threat	threat.indicator.x509.issuer.locality	keyword	extended	array	Mountain View	List of locality names (L)
1652	8.11.0	true	threat	threat.indicator.x509.issuer.organization	keyword	extended	array	Example Inc	List of organizations (O) of issuing certificate authority.
1653	8.11.0	true	threat	threat.indicator.x509.issuer.organizational_unit	keyword	extended	array	www.example.com	List of organizational units (OU) of issuing certificate authority.
1654	8.11.0	true	threat	threat.indicator.x509.issuer.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1655	8.11.0	true	threat	threat.indicator.x509.not_after	date	extended		2020-07-16T03:15:39Z	Time at which the certificate is no longer considered valid.
1656	8.11.0	true	threat	threat.indicator.x509.not_before	date	extended		2019-08-16T01:40:25Z	Time at which the certificate is first considered valid.
1657	8.11.0	true	threat	threat.indicator.x509.public_key_algorithm	keyword	extended		RSA	Algorithm used to generate the public key.
1658	8.11.0	true	threat	threat.indicator.x509.public_key_curve	keyword	extended		nistp521	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
1659	8.11.0	false	threat	threat.indicator.x509.public_key_exponent	long	extended		65537	Exponent used to derive the public key. This is algorithm specific.
1660	8.11.0	true	threat	threat.indicator.x509.public_key_size	long	extended		2048	The size of the public key space in bits.
1661	8.11.0	true	threat	threat.indicator.x509.serial_number	keyword	extended		55FBB9C7DEBF09809D12CCAA	Unique serial number issued by the certificate authority.
1662	8.11.0	true	threat	threat.indicator.x509.signature_algorithm	keyword	extended		SHA256-RSA	Identifier for certificate signature algorithm.
1663	8.11.0	true	threat	threat.indicator.x509.subject.common_name	keyword	extended	array	shared.global.example.net	List of common names (CN) of subject.
1664	8.11.0	true	threat	threat.indicator.x509.subject.country	keyword	extended	array	US	List of country \(C) code
1665	8.11.0	true	threat	threat.indicator.x509.subject.distinguished_name	keyword	extended		C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net	Distinguished name (DN) of the certificate subject entity.
1666	8.11.0	true	threat	threat.indicator.x509.subject.locality	keyword	extended	array	San Francisco	List of locality names (L)
1667	8.11.0	true	threat	threat.indicator.x509.subject.organization	keyword	extended	array	Example, Inc.	List of organizations (O) of subject.
1668	8.11.0	true	threat	threat.indicator.x509.subject.organizational_unit	keyword	extended	array		List of organizational units (OU) of subject.
1669	8.11.0	true	threat	threat.indicator.x509.subject.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1670	8.11.0	true	threat	threat.indicator.x509.version_number	keyword	extended		3	Version of x509 format.
1671	8.11.0	true	threat	threat.software.alias	keyword	extended	array	[ "X-Agent" ]	Alias of the software
1672	8.11.0	true	threat	threat.software.id	keyword	extended		S0552	ID of the software
1673	8.11.0	true	threat	threat.software.name	keyword	extended		AdFind	Name of the software.
1674	8.11.0	true	threat	threat.software.platforms	keyword	extended	array	[ "Windows" ]	Platforms of the software.
1675	8.11.0	true	threat	threat.software.reference	keyword	extended		https://attack.mitre.org/software/S0552/	Software reference URL.
1676	8.11.0	true	threat	threat.software.type	keyword	extended		Tool	Software type.
1677	8.11.0	true	threat	threat.tactic.id	keyword	extended	array	TA0002	Threat tactic id.
1678	8.11.0	true	threat	threat.tactic.name	keyword	extended	array	Execution	Threat tactic.
1679	8.11.0	true	threat	threat.tactic.reference	keyword	extended	array	https://attack.mitre.org/tactics/TA0002/	Threat tactic URL reference.
1680	8.11.0	true	threat	threat.technique.id	keyword	extended	array	T1059	Threat technique id.
1681	8.11.0	true	threat	threat.technique.name	keyword	extended	array	Command and Scripting Interpreter	Threat technique name.
1682	8.11.0	true	threat	threat.technique.name.text	keyword	extended		Command and Scripting Interpreter	Threat technique name.
1683	8.11.0	true	threat	threat.technique.reference	keyword	extended	array	https://attack.mitre.org/techniques/T1059/	Threat technique URL reference.
1684	8.11.0	true	threat	threat.technique.subtechnique.id	keyword	extended	array	T1059.001	Threat subtechnique id.
1685	8.11.0	true	threat	threat.technique.subtechnique.name	keyword	extended	array	PowerShell	Threat subtechnique name.
1686	8.11.0	true	threat	threat.technique.subtechnique.name.text	keyword	extended		PowerShell	Threat subtechnique name.
1687	8.11.0	true	threat	threat.technique.subtechnique.reference	keyword	extended	array	https://attack.mitre.org/techniques/T1059/001/	Threat subtechnique URL reference.
1688	8.11.0	true	tls	tls.cipher	keyword	extended		TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256	String indicating the cipher used during the current connection.
1689	8.11.0	true	tls	tls.client.certificate	keyword	extended		MII...	PEM-encoded stand-alone certificate offered by the client.
1690	8.11.0	true	tls	tls.client.certificate_chain	keyword	extended	array	["MII...", "MII..."]	Array of PEM-encoded certificates that make up the certificate chain offered by the client.
1691	8.11.0	true	tls	tls.client.hash.md5	keyword	extended		0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC	Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client.
1692	8.11.0	true	tls	tls.client.hash.sha1	keyword	extended		9E393D93138888D288266C2D915214D1D1CCEB2A	Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client.
1693	8.11.0	true	tls	tls.client.hash.sha256	keyword	extended		0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0	Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client.
1694	8.11.0	true	tls	tls.client.issuer	keyword	extended		CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com	Distinguished name of subject of the issuer of the x.509 certificate presented by the client.
1695	8.11.0	true	tls	tls.client.ja3	keyword	extended		d4e5b18d6b55c71272893221c96ba240	A hash that identifies clients based on how they perform an SSL/TLS handshake.
1696	8.11.0	true	tls	tls.client.not_after	date	extended		2021-01-01T00:00:00.000Z	Date/Time indicating when client certificate is no longer considered valid.
1697	8.11.0	true	tls	tls.client.not_before	date	extended		1970-01-01T00:00:00.000Z	Date/Time indicating when client certificate is first considered valid.
1698	8.11.0	true	tls	tls.client.server_name	keyword	extended		www.elastic.co	Hostname the client is trying to connect to. Also called the SNI.
1699	8.11.0	true	tls	tls.client.subject	keyword	extended		CN=myclient, OU=Documentation Team, DC=example, DC=com	Distinguished name of subject of the x.509 certificate presented by the client.
1700	8.11.0	true	tls	tls.client.supported_ciphers	keyword	extended	array	["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "..."]	Array of ciphers offered by the client during the client hello.
1701	8.11.0	true	tls	tls.client.x509.alternative_names	keyword	extended	array	*.elastic.co	List of subject alternative names (SAN).
1702	8.11.0	true	tls	tls.client.x509.issuer.common_name	keyword	extended	array	Example SHA2 High Assurance Server CA	List of common name (CN) of issuing certificate authority.
1703	8.11.0	true	tls	tls.client.x509.issuer.country	keyword	extended	array	US	List of country \(C) codes
1704	8.11.0	true	tls	tls.client.x509.issuer.distinguished_name	keyword	extended		C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA	Distinguished name (DN) of issuing certificate authority.
1705	8.11.0	true	tls	tls.client.x509.issuer.locality	keyword	extended	array	Mountain View	List of locality names (L)
1706	8.11.0	true	tls	tls.client.x509.issuer.organization	keyword	extended	array	Example Inc	List of organizations (O) of issuing certificate authority.
1707	8.11.0	true	tls	tls.client.x509.issuer.organizational_unit	keyword	extended	array	www.example.com	List of organizational units (OU) of issuing certificate authority.
1708	8.11.0	true	tls	tls.client.x509.issuer.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1709	8.11.0	true	tls	tls.client.x509.not_after	date	extended		2020-07-16T03:15:39Z	Time at which the certificate is no longer considered valid.
1710	8.11.0	true	tls	tls.client.x509.not_before	date	extended		2019-08-16T01:40:25Z	Time at which the certificate is first considered valid.
1711	8.11.0	true	tls	tls.client.x509.public_key_algorithm	keyword	extended		RSA	Algorithm used to generate the public key.
1712	8.11.0	true	tls	tls.client.x509.public_key_curve	keyword	extended		nistp521	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
1713	8.11.0	false	tls	tls.client.x509.public_key_exponent	long	extended		65537	Exponent used to derive the public key. This is algorithm specific.
1714	8.11.0	true	tls	tls.client.x509.public_key_size	long	extended		2048	The size of the public key space in bits.
1715	8.11.0	true	tls	tls.client.x509.serial_number	keyword	extended		55FBB9C7DEBF09809D12CCAA	Unique serial number issued by the certificate authority.
1716	8.11.0	true	tls	tls.client.x509.signature_algorithm	keyword	extended		SHA256-RSA	Identifier for certificate signature algorithm.
1717	8.11.0	true	tls	tls.client.x509.subject.common_name	keyword	extended	array	shared.global.example.net	List of common names (CN) of subject.
1718	8.11.0	true	tls	tls.client.x509.subject.country	keyword	extended	array	US	List of country \(C) code
1719	8.11.0	true	tls	tls.client.x509.subject.distinguished_name	keyword	extended		C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net	Distinguished name (DN) of the certificate subject entity.
1720	8.11.0	true	tls	tls.client.x509.subject.locality	keyword	extended	array	San Francisco	List of locality names (L)
1721	8.11.0	true	tls	tls.client.x509.subject.organization	keyword	extended	array	Example, Inc.	List of organizations (O) of subject.
1722	8.11.0	true	tls	tls.client.x509.subject.organizational_unit	keyword	extended	array		List of organizational units (OU) of subject.
1723	8.11.0	true	tls	tls.client.x509.subject.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1724	8.11.0	true	tls	tls.client.x509.version_number	keyword	extended		3	Version of x509 format.
1725	8.11.0	true	tls	tls.curve	keyword	extended		secp256r1	String indicating the curve used for the given cipher, when applicable.
1726	8.11.0	true	tls	tls.established	boolean	extended			Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel.
1727	8.11.0	true	tls	tls.next_protocol	keyword	extended		http/1.1	String indicating the protocol being tunneled.
1728	8.11.0	true	tls	tls.resumed	boolean	extended			Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation.
1729	8.11.0	true	tls	tls.server.certificate	keyword	extended		MII...	PEM-encoded stand-alone certificate offered by the server.
1730	8.11.0	true	tls	tls.server.certificate_chain	keyword	extended	array	["MII...", "MII..."]	Array of PEM-encoded certificates that make up the certificate chain offered by the server.
1731	8.11.0	true	tls	tls.server.hash.md5	keyword	extended		0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC	Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server.
1732	8.11.0	true	tls	tls.server.hash.sha1	keyword	extended		9E393D93138888D288266C2D915214D1D1CCEB2A	Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server.
1733	8.11.0	true	tls	tls.server.hash.sha256	keyword	extended		0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0	Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server.
1734	8.11.0	true	tls	tls.server.issuer	keyword	extended		CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com	Subject of the issuer of the x.509 certificate presented by the server.
1735	8.11.0	true	tls	tls.server.ja3s	keyword	extended		394441ab65754e2207b1e1b457b3641d	A hash that identifies servers based on how they perform an SSL/TLS handshake.
1736	8.11.0	true	tls	tls.server.not_after	date	extended		2021-01-01T00:00:00.000Z	Timestamp indicating when server certificate is no longer considered valid.
1737	8.11.0	true	tls	tls.server.not_before	date	extended		1970-01-01T00:00:00.000Z	Timestamp indicating when server certificate is first considered valid.
1738	8.11.0	true	tls	tls.server.subject	keyword	extended		CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com	Subject of the x.509 certificate presented by the server.
1739	8.11.0	true	tls	tls.server.x509.alternative_names	keyword	extended	array	*.elastic.co	List of subject alternative names (SAN).
1740	8.11.0	true	tls	tls.server.x509.issuer.common_name	keyword	extended	array	Example SHA2 High Assurance Server CA	List of common name (CN) of issuing certificate authority.
1741	8.11.0	true	tls	tls.server.x509.issuer.country	keyword	extended	array	US	List of country \(C) codes
1742	8.11.0	true	tls	tls.server.x509.issuer.distinguished_name	keyword	extended		C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA	Distinguished name (DN) of issuing certificate authority.
1743	8.11.0	true	tls	tls.server.x509.issuer.locality	keyword	extended	array	Mountain View	List of locality names (L)
1744	8.11.0	true	tls	tls.server.x509.issuer.organization	keyword	extended	array	Example Inc	List of organizations (O) of issuing certificate authority.
1745	8.11.0	true	tls	tls.server.x509.issuer.organizational_unit	keyword	extended	array	www.example.com	List of organizational units (OU) of issuing certificate authority.
1746	8.11.0	true	tls	tls.server.x509.issuer.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1747	8.11.0	true	tls	tls.server.x509.not_after	date	extended		2020-07-16T03:15:39Z	Time at which the certificate is no longer considered valid.
1748	8.11.0	true	tls	tls.server.x509.not_before	date	extended		2019-08-16T01:40:25Z	Time at which the certificate is first considered valid.
1749	8.11.0	true	tls	tls.server.x509.public_key_algorithm	keyword	extended		RSA	Algorithm used to generate the public key.
1750	8.11.0	true	tls	tls.server.x509.public_key_curve	keyword	extended		nistp521	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
1751	8.11.0	false	tls	tls.server.x509.public_key_exponent	long	extended		65537	Exponent used to derive the public key. This is algorithm specific.
1752	8.11.0	true	tls	tls.server.x509.public_key_size	long	extended		2048	The size of the public key space in bits.
1753	8.11.0	true	tls	tls.server.x509.serial_number	keyword	extended		55FBB9C7DEBF09809D12CCAA	Unique serial number issued by the certificate authority.
1754	8.11.0	true	tls	tls.server.x509.signature_algorithm	keyword	extended		SHA256-RSA	Identifier for certificate signature algorithm.
1755	8.11.0	true	tls	tls.server.x509.subject.common_name	keyword	extended	array	shared.global.example.net	List of common names (CN) of subject.
1756	8.11.0	true	tls	tls.server.x509.subject.country	keyword	extended	array	US	List of country \(C) code
1757	8.11.0	true	tls	tls.server.x509.subject.distinguished_name	keyword	extended		C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net	Distinguished name (DN) of the certificate subject entity.
1758	8.11.0	true	tls	tls.server.x509.subject.locality	keyword	extended	array	San Francisco	List of locality names (L)
1759	8.11.0	true	tls	tls.server.x509.subject.organization	keyword	extended	array	Example, Inc.	List of organizations (O) of subject.
1760	8.11.0	true	tls	tls.server.x509.subject.organizational_unit	keyword	extended	array		List of organizational units (OU) of subject.
1761	8.11.0	true	tls	tls.server.x509.subject.state_or_province	keyword	extended	array	California	List of state or province names (ST, S, or P)
1762	8.11.0	true	tls	tls.server.x509.version_number	keyword	extended		3	Version of x509 format.
1763	8.11.0	true	tls	tls.version	keyword	extended		1.2	Numeric part of the version parsed from the original string.
1764	8.11.0	true	tls	tls.version_protocol	keyword	extended		tls	Normalized lowercase protocol name parsed from original string.
1765	8.11.0	true	trace	trace.id	keyword	extended		4bf92f3577b34da6a3ce929d0e0e4736	Unique identifier of the trace.
1766	8.11.0	true	transaction	transaction.id	keyword	extended		00f067aa0ba902b7	Unique identifier of the transaction within the scope of its trace.
1767	8.11.0	true	url	url.domain	keyword	extended		www.elastic.co	Domain of the url.
1768	8.11.0	true	url	url.extension	keyword	extended		png	File extension from the request url, excluding the leading dot.
1769	8.11.0	true	url	url.fragment	keyword	extended			Portion of the url after the `#`.
1770	8.11.0	true	url	url.full	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top	Full unparsed URL.
1771	8.11.0	true	url	url.full.text	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top	Full unparsed URL.
1772	8.11.0	true	url	url.original	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch	Unmodified original url as seen in the event source.
1773	8.11.0	true	url	url.original.text	keyword	extended		https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch	Unmodified original url as seen in the event source.
1774	8.11.0	true	url	url.password	keyword	extended			Password of the request.
1775	8.11.0	true	url	url.path	keyword	extended			Path of the request, such as "/search".
1776	8.11.0	true	url	url.port	long	extended		443	Port of the request, such as 443.
1777	8.11.0	true	url	url.query	keyword	extended			Query string of the request.
1778	8.11.0	true	url	url.registered_domain	keyword	extended		example.com	The highest registered url domain, stripped of the subdomain.
1779	8.11.0	true	url	url.scheme	keyword	extended		https	Scheme of the url.
1780	8.11.0	true	url	url.subdomain	keyword	extended		east	The subdomain of the domain.
1781	8.11.0	true	url	url.top_level_domain	keyword	extended		co.uk	The effective top level domain (com, org, net, co.uk).
1782	8.11.0	true	url	url.username	keyword	extended			Username of the request.
1783	8.11.0	true	user	user.changes.domain	keyword	extended			Name of the directory the user is a member of.
1784	8.11.0	true	user	user.changes.email	keyword	extended			User email address.
1785	8.11.0	true	user	user.changes.full_name	keyword	extended		Albert Einstein	User's full name, if available.
1786	8.11.0	true	user	user.changes.full_name.text	keyword	extended		Albert Einstein	User's full name, if available.
1787	8.11.0	true	user	user.changes.group.domain	keyword	extended			Name of the directory the group is a member of.
1788	8.11.0	true	user	user.changes.group.id	keyword	extended			Unique identifier for the group on the system/platform.
1789	8.11.0	true	user	user.changes.group.name	keyword	extended			Name of the group.
1790	8.11.0	true	user	user.changes.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
1791	8.11.0	true	user	user.changes.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1792	8.11.0	true	user	user.changes.name	keyword	core		a.einstein	Short name or login of the user.
1793	8.11.0	true	user	user.changes.name.text	keyword	core		a.einstein	Short name or login of the user.
1794	8.11.0	true	user	user.changes.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
1795	8.11.0	true	user	user.domain	keyword	extended			Name of the directory the user is a member of.
1796	8.11.0	true	user	user.effective.domain	keyword	extended			Name of the directory the user is a member of.
1797	8.11.0	true	user	user.effective.email	keyword	extended			User email address.
1798	8.11.0	true	user	user.effective.full_name	keyword	extended		Albert Einstein	User's full name, if available.
1799	8.11.0	true	user	user.effective.full_name.text	keyword	extended		Albert Einstein	User's full name, if available.
1800	8.11.0	true	user	user.effective.group.domain	keyword	extended			Name of the directory the group is a member of.
1801	8.11.0	true	user	user.effective.group.id	keyword	extended			Unique identifier for the group on the system/platform.
1802	8.11.0	true	user	user.effective.group.name	keyword	extended			Name of the group.
1803	8.11.0	true	user	user.effective.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
1804	8.11.0	true	user	user.effective.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1805	8.11.0	true	user	user.effective.name	keyword	core		a.einstein	Short name or login of the user.
1806	8.11.0	true	user	user.effective.name.text	keyword	core		a.einstein	Short name or login of the user.
1807	8.11.0	true	user	user.effective.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
1808	8.11.0	true	user	user.email	keyword	extended			User email address.
1809	8.11.0	true	user	user.full_name	keyword	extended		Albert Einstein	User's full name, if available.
1810	8.11.0	true	user	user.full_name.text	keyword	extended		Albert Einstein	User's full name, if available.
1811	8.11.0	true	user	user.group.domain	keyword	extended			Name of the directory the group is a member of.
1812	8.11.0	true	user	user.group.id	keyword	extended			Unique identifier for the group on the system/platform.
1813	8.11.0	true	user	user.group.name	keyword	extended			Name of the group.
1814	8.11.0	true	user	user.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
1815	8.11.0	true	user	user.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1816	8.11.0	true	user	user.name	keyword	core		a.einstein	Short name or login of the user.
1817	8.11.0	true	user	user.name.text	keyword	core		a.einstein	Short name or login of the user.
1818	8.11.0	true	user	user.risk.calculated_level	keyword	extended		High	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
1819	8.11.0	true	user	user.risk.calculated_score	float	extended		880.73	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
1820	8.11.0	true	user	user.risk.calculated_score_norm	float	extended		88.73	A normalized risk score calculated by an internal system.
1821	8.11.0	true	user	user.risk.static_level	keyword	extended		High	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
1822	8.11.0	true	user	user.risk.static_score	float	extended		830.0	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
1823	8.11.0	true	user	user.risk.static_score_norm	float	extended		83.0	A normalized risk score calculated by an external system.
1824	8.11.0	true	user	user.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
1825	8.11.0	true	user	user.target.domain	keyword	extended			Name of the directory the user is a member of.
1826	8.11.0	true	user	user.target.email	keyword	extended			User email address.
1827	8.11.0	true	user	user.target.full_name	keyword	extended		Albert Einstein	User's full name, if available.
1828	8.11.0	true	user	user.target.full_name.text	keyword	extended		Albert Einstein	User's full name, if available.
1829	8.11.0	true	user	user.target.group.domain	keyword	extended			Name of the directory the group is a member of.
1830	8.11.0	true	user	user.target.group.id	keyword	extended			Unique identifier for the group on the system/platform.
1831	8.11.0	true	user	user.target.group.name	keyword	extended			Name of the group.
1832	8.11.0	true	user	user.target.hash	keyword	extended			Unique user hash to correlate information for a user in anonymized form.
1833	8.11.0	true	user	user.target.id	keyword	core		S-1-5-21-202424912787-2692429404-2351956786-1000	Unique identifier of the user.
1834	8.11.0	true	user	user.target.name	keyword	core		a.einstein	Short name or login of the user.
1835	8.11.0	true	user	user.target.name.text	keyword	core		a.einstein	Short name or login of the user.
1836	8.11.0	true	user	user.target.roles	keyword	extended	array	["kibana_admin", "reporting_user"]	Array of user roles at the time of the event.
1837	8.11.0	true	user_agent	user_agent.device.name	keyword	extended		iPhone	Name of the device.
1838	8.11.0	true	user_agent	user_agent.name	keyword	extended		Safari	Name of the user agent.
1839	8.11.0	true	user_agent	user_agent.original	keyword	extended		Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1	Unparsed user_agent string.
1840	8.11.0	true	user_agent	user_agent.original.text	keyword	extended		Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1	Unparsed user_agent string.
1841	8.11.0	true	user_agent	user_agent.os.family	keyword	extended		debian	OS family (such as redhat, debian, freebsd, windows).
1842	8.11.0	true	user_agent	user_agent.os.full	keyword	extended		Mac OS Mojave	Operating system name, including the version or code name.
1843	8.11.0	true	user_agent	user_agent.os.full.text	keyword	extended		Mac OS Mojave	Operating system name, including the version or code name.
1844	8.11.0	true	user_agent	user_agent.os.kernel	keyword	extended		4.4.0-112-generic	Operating system kernel version as a raw string.
1845	8.11.0	true	user_agent	user_agent.os.name	keyword	extended		Mac OS X	Operating system name, without the version.
1846	8.11.0	true	user_agent	user_agent.os.name.text	keyword	extended		Mac OS X	Operating system name, without the version.
1847	8.11.0	true	user_agent	user_agent.os.platform	keyword	extended		darwin	Operating system platform (such centos, ubuntu, windows).
1848	8.11.0	true	user_agent	user_agent.os.type	keyword	extended		macos	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
1849	8.11.0	true	user_agent	user_agent.os.version	keyword	extended		10.14.1	Operating system version as a raw string.
1850	8.11.0	true	user_agent	user_agent.version	keyword	extended		12.0	Version of the user agent.
1851	8.11.0	true	vulnerability	vulnerability.category	keyword	extended	array	["Firewall"]	Category of a vulnerability.
1852	8.11.0	true	vulnerability	vulnerability.classification	keyword	extended		CVSS	Classification of the vulnerability.
1853	8.11.0	true	vulnerability	vulnerability.description	keyword	extended		In macOS before 2.12.6, there is a vulnerability in the RPC...	Description of the vulnerability.
1854	8.11.0	true	vulnerability	vulnerability.description.text	keyword	extended		In macOS before 2.12.6, there is a vulnerability in the RPC...	Description of the vulnerability.
1855	8.11.0	true	vulnerability	vulnerability.enumeration	keyword	extended		CVE	Identifier of the vulnerability.
1856	8.11.0	true	vulnerability	vulnerability.id	keyword	extended		CVE-2019-00001	ID of the vulnerability.
1857	8.11.0	true	vulnerability	vulnerability.reference	keyword	extended		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111	Reference of the vulnerability.
1858	8.11.0	true	vulnerability	vulnerability.report_id	keyword	extended		20191018.0001	Scan identification number.
1859	8.11.0	true	vulnerability	vulnerability.scanner.reference	keyword	custom		https://www.example.com/vulnerability/12345	Scanner's resource that provides additional information, context, and mitigations for the identified vulnerability.
1860	8.11.0	true	vulnerability	vulnerability.scanner.vendor	keyword	extended		Tenable	Name of the scanner vendor.
1861	8.11.0	true	vulnerability	vulnerability.score.base	float	extended		5.5	Vulnerability Base score.
1862	8.11.0	true	vulnerability	vulnerability.score.environmental	float	extended		5.5	Vulnerability Environmental score.
1863	8.11.0	true	vulnerability	vulnerability.score.temporal	float	extended			Vulnerability Temporal score.
1864	8.11.0	true	vulnerability	vulnerability.score.version	keyword	extended		2.0	CVSS version.
1865	8.11.0	true	vulnerability	vulnerability.severity	keyword	extended		Critical	Severity of the vulnerability.
1866	8.11.0	true	wazuh	wazuh.cluster.name	keyword	custom		wazuh-cluster-1	Wazuh cluster name.
1867	8.11.0	true	wazuh	wazuh.cluster.node	keyword	custom		wazuh-cluster-node-1	Wazuh cluster node name.
1868	8.11.0	true	wazuh	wazuh.decoders	keyword	custom	a, r, r, a, y	[ 'decoder-1', 'decoder-2' ]	Wazuh decoders that matched on this event.
1869	8.11.0	true	wazuh	wazuh.rules	keyword	custom	a, r, r, a, y	[ 'rule-1', 'rule-2' ]	Wazuh rules that matched on this event.
1870	8.11.0	true	wazuh	wazuh.schema.version	keyword	custom		1.7.0	Wazuh schema version.