# Network Access Control

Version 1.01

\
Please check back often. These tables are updated regularly to accommodate new fields as provided by vendors.

| **Field Name**                   | **Data Type** | **Length** |
| -------------------------------- | ------------- | ---------- |
| agent.type                       | text          | 32         |
| client.ip                        | ip            | 16         |
| client.port                      | int           | 65535      |
| client.user.name                 | text          | 128        |
| destination.as.organization.name | text          | 128        |
| destination.geo.city\_name       | text          | 32         |
| destination.geo.continent\_code  | text          | 6          |
| destination.geo.country\_code    | text          | 6          |
| destination.geo.country\_name    | text          | 32         |
| destination.geo.location.lat     | geopoint      |            |
| destination.geo.location.lon     | geopoint      |            |
| destination.geo.region\_name     | text          | 64         |
| destination.ip                   | ip            |            |
| destination.locality             | text          | 16         |
| destination.port                 | int           | 65535      |
| event.action                     | text          | 16         |
| event.category                   | array         | 50         |
| event.created                    | date          |            |
| event.dataset                    | text          | 50         |
| event.id                         | text          | 128        |
| event.kind                       | text          | 16         |
| event.module                     | text          | 16         |
| event.original                   |               |            |
| event.outcome                    | text          | 16         |
| event.reason                     | text          | 128        |
| event.severity                   | text          | 16         |
| event.type                       | array         | 32         |
| log.type                         | text          | 32         |
| Message                          | text          | 1028       |
| network.protocol                 | text          | 8          |
| observer.type                    | text          | 32         |
| organisation.id                  | text          | 8          |
| related.hash                     | array         | 128        |
| related.hosts                    | array         | 128        |
| related.ip                       | array         | 128        |
| related.user                     | array         | 128        |
| sensor.id                        | text          | 10         |
| source.as.number                 | text          | 16         |
| source.as.organization.name      | text          | 128        |
| source.geo.city\_name            | text          | 32         |
| source.geo.continent\_code       | text          | 6          |
| source.geo.country\_code         | text          | 6          |
| source.geo.country\_name         | text          | 32         |
| source.geo.location.lat          | geopoint      |            |
| source.geo.location.lon          | geopoint      |            |
| source.geo.region\_name          | text          | 64         |
| source.ip                        | ip            |            |
| source.locality                  | text          | 16         |
| source.port                      | int           | 65535      |
| threatintel.days                 | int           | 16         |
| threatintel.entity               | text          | 16         |
| threatintel.event\_data          | text          | 512        |
| threatintel.lookup               | text          | 16         |
| threatintel.malware.malware      | text          | 512        |
| threatintel.malware.timestamp    | date/time     |            |
| threatintel.severity             | text          | 16         |
| threatintel.tags                 | text          | 256        |
| threatintel.white\_list          | text          | 32         |
| user.full\_name                  | text          | 128        |
| user.name                        | text          | 128        |
| uuid                             | text          | 36         |