Endpoint Protection
Version 1.2
Please check back often. These tables are updated regularly to accommodate new fields as provided by vendors.
Field Name | Data Type |
agent.type | text |
agent.type | text |
destination.address | ip |
destination.as.organization.name | text |
destination.domain | text |
destination.geo.city_name | text |
destination.geo.continent_code | text |
destination.geo.country_code | text |
destination.geo.country_name | text |
destination.geo.location.lat | geopoint |
destination.geo.location.lon | geopoint |
destination.geo.region_name | text |
destination.locality | text |
destination.mac | text |
destination.port | int |
event.action | text |
event.category | array |
event.count | int |
event.created | date |
event.dataset | text |
event.id | text |
event.kind | text |
event.module | text |
event.original | text |
event.outcome | text |
event.reason | text |
event.severity | text |
event.type | array |
file.hash.sha1 | text |
file.hash.sha1 | text |
file.hash.sha256 | text |
file.hash.sha256 | text |
file.name | text |
file.path | text |
file.path | text |
file.pe.company | text |
file.pe.file_version | text |
file.pe.product | text |
file.size | text |
host.hostname | text |
host.hostname | text |
host.ip | ip |
host.name | text |
log.type | text |
log.type | text |
message | |
message | |
network.direction | text |
network.transport | text |
observer.ip | ip |
observer.name | text |
observer.product | text |
observer.type | text |
observer.type | text |
observer.vendor | text |
organisation.id | text |
os.name | text |
process.args | text |
process.command_line | text |
process.command_line | text |
process.end | date/time |
process.executable | text |
process.hash.md5 | text |
process.hash.sha256 | text |
process.name | text |
process.parent.args | text |
process.parent.command_line | text |
process.parent.executable | text |
process.parent.pid | int |
process.parent.pid | int |
process.parent.start | date/time |
process.pid | int |
process.pid | int |
process.start | date/time |
process.start | date/time |
related.hash | array |
related.hash | text |
related.hosts | array |
related.hosts | text |
related.ip | array |
related.ip | text |
related.user | array |
related.user | text |
rule.author | text |
rule.category | text |
rule.description | text |
rule.description | text |
rule.id | text |
rule.id | text |
rule.name | text |
rule.name | text |
rule.ruleset | text |
rule.uuid | text |
sensor.id | text |
source.address | ip |
source.as.number | text |
source.as.organization.name | text |
source.domain | text |
source.geo.city_name | text |
source.geo.continent_code | text |
source.geo.country_code | text |
source.geo.country_name | text |
source.geo.location.lat | geopoint |
source.geo.location.lon | geopoint |
source.geo.region_name | text |
source.hostname | text |
source.ip | ip |
source.locality | text |
source.mac | text |
source.port | int |
threat.framework | text |
threat.tactic.id | text |
threat.tactic.name | text |
threat.technique.id | text |
threat.technique.name | text |
threat.technique.name | text |
threat.technique.name.text | text |
threatintel.days | int |
threatintel.days | int |
threatintel.entity | text |
threatintel.event_data | text |
threatintel.event_data | text |
threatintel.lookup | text |
threatintel.malware.malware | text |
threatintel.malware.malware | text |
threatintel.malware.timestamp | date/time |
threatintel.malware.timestamp | date/time |
threatintel.severity | text |
threatintel.severity | text |
threatintel.tags | text |
threatintel.tags | text |
threatintel.white_list | text |
threatintel.white_list | text |
url.full | text |
url.original | text |
user.domain | text |
user.name | text |
user.name | text |
user.role | text |
uuid | text |