dgamatch_ocsf
The dgamatch_ocsf lookup table is generated by the Anomali Security Analytics domain generated algorithm (DGA) detection feature and stores DGA detection results in the OCSF schema format. The DGA detection feature correlates domain names appearing in event logs with Anomali DGA intelligence.
See OCSF Schema Overview for more information.
| Field | Value Type | Description | Example |
|---|---|---|---|
| _date | string | Partition key, format YYYY-MM-DD. | 2026-04-28 |
| action | string | Caption of action_id. | Allowed, Blocked |
| action_id | number | Normalized action taken by a control or policy. | 1 |
| activity_id | number | Normalized activity that triggered the event. | 1 |
| activity_name | string | Caption of activity_id. | Create |
| actor | struct | Actor that performed the activity. | {"user": {"name": "john.smith@example.com", "uid": "101234567_15600_a1b2c3d4-5678-90ab-cdef-1234567890ab"}} |
| answers | list | DNS answers. | [{"hostname": "93.184.216.34", "type": "A"}] |
| api | struct | API-call details. | {"operation": "GetObject", "service": {"name": "s3"}} |
| category_name | string | Caption of category_uid. | Application Activity |
| category_uid | number | OCSF category identifier. | 6 |
| class_name | string | Caption of class_uid. | API Activity |
| class_uid | number | OCSF class identifier that describes the attribute shape of the event. | 6003 |
| cloud | struct | Cloud environment where the event originated. | {"provider": "AWS", "region": "us-east-1"} |
| connection_info | struct | Network connection protocol, direction, and related details. | {"protocol": "TCP", "direction": "outbound"} |
| count | number | Number of logically-grouped events in the aggregate. | 23 |
| device | struct | Addressable device or host. | {"hostname": "workstation01", "ip": "192.168.1.10"} |
| dga_prob | double | DGA probability score of the domain. | 0.997 |
| dga_tag | string | Additional comments and context for the DGA detection. | malicious |
| disposition | string | Caption of disposition_id. | Blocked |
| disposition_id | number | Outcome taken by a security control. | 2 |
| dst_endpoint | struct | Destination network endpoint. | {"svc_name": "OneDrive Site Collection a1b2c3d4-e5f6-7890-abcd-ef1234567890"} |
| duration | number | end_time minus start_time in milliseconds. | 1000 |
| struct | Email object. | {"from": "sender@example.com", "subject": "Invoice"} | |
| end_time | number | End of an aggregated event window, in UNIX timestamp milliseconds. | 1705557026030 |
| enrichments | list | External-source enrichments attached to the event. | [{"name": "GeoIP", "value": "US"}] |
| event_seq_id | number | Event sequence identifier. | 79618005142 |
| event_size | number | Event size in bytes. | 6338 |
| event_time | number | Normalized event occurrence time, in UNIX timestamp milliseconds. | 1777386930000 |
| file | struct | Target file object. | {"name": "malware.exe", "path": "C:\\Windows\\Temp"} |
| http_request | struct | HTTP request details. | {"http_headers": null, "http_method": null, "user_agent": "Microsoft SkyDriveSync 25.206.1021.0003 ship; Windows NT 10.0 (26100)"} |
| indexed_time | number | When the event was indexed, in UNIX timestamp milliseconds. | 1777498532359 |
| indicator | string | Value of the DGA indicator (domain). | aksjfhalskdfhalskdjfh.com |
| ioc_status | string | Status assigned to the indicator. | active, inactive, falsepos |
| ioc_type | string | Indicator value type. | domain |
| malware_family | string | Group of applications with similar attack techniques. | Corebot, Gameover_DGA, Gameover_P2P, Hesperbot, MadMax, Necurs, QakBot, Recurs |
| message | string | Event description from the source. | DGA domain detected in DNS query |
| metadata | struct | Event metadata including product, log source, correlation uid, and data classification. | {"correlation_uid": null, "data_classification": {...}, "product": {"name": "Microsoft Defender for Cloud Apps", "vendor_name": "Microsoft"}, "version": "1.1.0"} |
| observables | list | Observables tied to the event. | [{"name": "randomdomain123.com", "type": "Hostname"}] |
| original_event_time | number | Original timestamp from the source system, in UNIX timestamp milliseconds. | 1763233459000 |
| query | struct | DNS query details. | {"hostname": "randomdomain123.com", "type": "A"} |
| raw_data | string | Raw event data from the source. | {"_id": "101234567_15600_a1b2c3d4-5678-90ab-cdef-1234567890ab", "appId": 15600, "appName": "Microsoft OneDrive for Business", "classifications": ["file"], "confidenceLevel": 20} |
| raw_data_size | number | Size of the original raw data in bytes. | 4527 |
| session | struct | Authenticated session details. | {"uid": "abc123"} |
| severity | string | Caption of severity_id. | Informational |
| severity_id | number | Normalized severity (lower = less severe). | 1 |
| src_endpoint | struct | Source network endpoint. | {"ip": "192.0.2.15"} |
| start_time | number | Start of an aggregated event window, in UNIX timestamp milliseconds. | 1705557025030 |
| status | string | Caption of status_id. | Success, Failure |
| status_code | string | Source-reported status code. | 200, 404 |
| status_detail | string | Additional outcome details. | Connection established |
| status_id | number | Normalized status identifier. | 1 |
| timezone_offset | number | Source timezone offset in minutes. | -480 |
| type_name | string | Caption of type_uid. | Detection Finding: Allowed |
| type_uid | number | Computed as class_uid × 100 + activity_id. | 600301 |
| unmapped | string | Source-specific attributes not mapped to OCSF. | {'RecordType': NULL, 'rawDataJson': {'Operation': ManagedSyncClientAllowed}, 'tranport': NULL} |
| user | struct | User being discovered or targeted. | {"name": "john.doe", "email": "john.doe@example.com"} |
| volume | number | Allocated event volume in bytes. | 792007342 |