Linux

Version 1.0

Please check back often. These tables are updated regularly to accommodate new fields as provided by vendors.

Field Names	Data Type	Length
agent.type	text	32
auditd.	text	64
auditd.	text	32
auditd.	text	32
auditd.	text	32
destination.address	ip
destination.as.organization.name	text	128
destination.geo.city_name	text	32
destination.geo.continent_code	text	6
destination.geo.country_code	text	6
destination.geo.country_name	text	32
destination.geo.location.lat	geopoint
destination.geo.location.lon	geopoint
destination.geo.region_name	text	64
destination.locality	text	16
event.action	text	16
event.category	array	50
event.created	date
event.dataset	text	50
event.id	text	128
event.kind	text	16
event.module	text	16
event.original
event.outcome	text	16
event.reason	text	128
event.severity	text	16
event.type	array	32
file.name	int	128
host.architecture	text	32
log.type	text	32
message	text	1024
observer.type	text	32
organisation.id	text	8
process.	text	256
process.	text	128
process.	text	32
process.	int	16
process.	int	16
process.	text	256
process.arg_count	int	16
process.args	text	128
process.name	text	128
process.parent.pid	int	16
related.hash	array	128
related.hosts	array	128
related.ip	array	128
related.user	array	128
sensor.id	text	10
source.address	ip
source.as.number	text	16
source.as.organization.name	text	128
source.geo.city_name	text	32
source.geo.continent_code	text	6
source.geo.country_code	text	6
source.geo.country_name	text	32
source.geo.location.lat	geopoint
source.geo.location.lon	geopoint
source.geo.region_name	text	64
source.locality	text	16
threatintel.days	int	16
threatintel.entity	text	16
threatintel.event_data	text	512
threatintel.lookup	text	16
threatintel.malware.malware	text	512
threatintel.malware.timestamp	date/time
threatintel.severity	text	16
threatintel.tags	text	256
threatintel.white_list	text	32
user.audit.group.id	text	32
user.audit.id	text	32
user.effective.group.id	text	32
user.effective.id	text	32
user.filesystem.group.id	text	32
user.filesystem.id	text	32
user.group.id	text	32
user.id	text	128
user.name	text	128
user.owner.group.id	text	32
user.owner.id	text	32
user.saved.group.id	text	32
user.saved.id	text	32
user.terminal	text	128
uuid	text	36