Endpoint Protection
Version 1.2
Please check back often. These tables are updated regularly to accommodate new fields as provided by vendors.
Field Name
Data Type
agent.type
text
agent.type
text
destination.address
ip
destination.as.organization.name
text
destination.domain
text
destination.geo.city_name
text
destination.geo.continent_code
text
destination.geo.country_code
text
destination.geo.country_name
text
destination.geo.location.lat
geopoint
destination.geo.location.lon
geopoint
destination.geo.region_name
text
destination.locality
text
destination.mac
text
destination.port
int
event.action
text
event.category
array
event.count
int
event.created
date
event.dataset
text
event.id
text
event.kind
text
event.module
text
event.original
text
event.outcome
text
event.reason
text
event.severity
text
event.type
array
file.hash.sha1
text
file.hash.sha1
text
file.hash.sha256
text
file.hash.sha256
text
file.name
text
file.path
text
file.path
text
file.pe.company
text
file.pe.file_version
text
file.pe.product
text
file.size
text
host.hostname
text
host.hostname
text
host.ip
ip
host.name
text
log.type
text
log.type
text
message
message
network.direction
text
network.transport
text
observer.ip
ip
observer.name
text
observer.product
text
observer.type
text
observer.type
text
observer.vendor
text
organisation.id
text
os.name
text
process.args
text
process.command_line
text
process.command_line
text
process.end
date/time
process.executable
text
process.hash.md5
text
process.hash.sha256
text
process.name
text
process.parent.args
text
process.parent.command_line
text
process.parent.executable
text
process.parent.pid
int
process.parent.pid
int
process.parent.start
date/time
process.pid
int
process.pid
int
process.start
date/time
process.start
date/time
related.hash
array
related.hash
text
related.hosts
array
related.hosts
text
related.ip
array
related.ip
text
related.user
array
related.user
text
rule.author
text
rule.category
text
rule.description
text
rule.description
text
rule.id
text
rule.id
text
rule.name
text
rule.name
text
rule.ruleset
text
rule.uuid
text
sensor.id
text
source.address
ip
source.as.number
text
source.as.organization.name
text
source.domain
text
source.geo.city_name
text
source.geo.continent_code
text
source.geo.country_code
text
source.geo.country_name
text
source.geo.location.lat
geopoint
source.geo.location.lon
geopoint
source.geo.region_name
text
source.hostname
text
source.ip
ip
source.locality
text
source.mac
text
source.port
int
threat.framework
text
threat.tactic.id
text
threat.tactic.name
text
threat.technique.id
text
threat.technique.name
text
threat.technique.name
text
threat.technique.name.text
text
threatintel.days
int
threatintel.days
int
threatintel.entity
text
threatintel.event_data
text
threatintel.event_data
text
threatintel.lookup
text
threatintel.malware.malware
text
threatintel.malware.malware
text
threatintel.malware.timestamp
date/time
threatintel.malware.timestamp
date/time
threatintel.severity
text
threatintel.severity
text
threatintel.tags
text
threatintel.tags
text
threatintel.white_list
text
threatintel.white_list
text
url.full
text
url.original
text
user.domain
text
user.name
text
user.name
text
user.role
text
uuid
text