eventlog

Event log fields from multiple log sources are normalized to the Anomali Security Analytics eventlog schema. See Supported Log Sources to get the complete list of supported sources.

Alternatively, Anomali Search also supports the OCSF schema. See OCSF Schema Overview for more information.

Field Value Type Description Example
access_key_id string Identifier for the access key used to sign the request. AKIAEXAMPLEKEYID
account_id string Unique identifier of the cloud provider account. 123456789012
action string Action captured by the event. allowed, blocked
action_detail string Detail about the activity that triggered the finding in JSON format. {"actionType": "AWS_API_CALL", "awsApiCallAction": {"api": "ConsoleLogin", "serviceName": "signin.amazonaws.com", "callerType": "RemoteIp", "remoteIpDetails": {"ipAddressV4": "192.0.2.1", "organization": {"asn": "12345", "asnOrg": "ExampleISP", "isp": "ExampleISP", "org": "ExampleOrg"}, "country": {"countryName": "United States"}, "geoLocation": {"lat": 37.7749, "lon": -122.4194}}, "userAgent": "Mozilla/5.0", "errorCode": "Failure", "awsRegion": "us-west-2"}}
additional_info string Additional information about the finding in JSON format. {"threatListName": "KnownMaliciousIPs", "threatIntelIndicators": [{"type": "IPV4_ADDRESS", "value": "198.51.100.1", "category": "Reconnaissance", "lastObservedAt": "2023-06-08T12:34:56Z", "source": "GuardDuty"}], "sample": true}
answer string Answers for the DNS query. [ "10.10.10.10", "10.10.10.11" ]
app string Application detected. Slack, Google Gmail, LinkedIn
bytes_in long Bytes this device or interface received. 347
bytes_out long Bytes this device or interface transmitted. 665
category string Category of alert (azure security alert). credentialTheft, ransomware
cl_parsing string Internal field to track parsing issues. {"parse_error": "JSON is corrupted"}
command_line string Complete command string of the spawned process. C:\Windows\system32\WerFault.exe -pss -s 572 -p 3208 -ip 3208
dest string Destination of network traffic. 52.233.72.222 or www.google.com
dest_country string Specific nation or geographical region to which data, materials, or information is being directed or delivered. us
dest_ip string IP address of the destination. 52.233.72.222
dest_port integer Destination port of network traffic. 80, 443, 8080
ds_id string Optional. Unique ID of a data source in a registered link. 5
ds_type string Optional. Type of a data source in a registered link. qradar, sumo or az_sentinel, syslog
dvc_action string Action or operation performed by a device. passthrough, log-only, allow
dvc_name string Name or identifier of a particular device or system. FTG37D46138
dvc_type string Type of a particular device or system. firewall
end_time long Timestamp when a network flow ended, in seconds. 1713430144
event_id string A Windows identification number that specifies the event type. 4624
event_name string Name of an event. DnsRequest, ProcessRollup2
event_tags string Labels or identifiers used to categorize, sort, and filter events. network,dns,proxy
evt_level string Classification or categorization of log messages or events based on their significance or priority. information, notice, alert
evt_msg string Textual content or description associated with a long entry or event. applications3: Multiple.Routers
evt_severity string Degree of impact or criticality associated with an event or log message. low, medium, high
evt_type string Descriptive string that indicates the specific action or operation that was performed. AwsApiCall, AwsCloudTrailInsight
ext_index string Splunk index name from which the event data was ingested. fortinet
ext_source string Origin or path of the file or data stream from which the event data was ingested. cribl:USEAPP1234
ext_sourcetype string Specific type or format of data as it was initially received or ingested. pan:traffic
failed_logon_account string Account related to a failed logon attempt, in JSON format. {"sid": "NULL SID", "account_name":"PCGroup", "account_domain":"ODMH-B9HRG04"}
file_hash string Cryptographic identifier assigned to the file object affected by the event. ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
file_hash2 string Cryptographic identifier assigned to the file object affected by the event. 56857cfc709d3996f057252c16ec4656f5292802
file_hash3 string Cryptographic identifier assigned to the file object affected by the event. e0d123e5f316bef78bfdf5a008837577
file_name string Name of the file. nodepad.exe
file_path string Folder containing the file. C:\Program Files (x86)\VMware\VMware Workstation
host string Hostname or IP address where link is deployed. 172.18.16.43
http_method string HTTP method used in the request. get, post, delete, patch
http_referrer string HTTP referrer used in the request. https://example.com/
image string Executable name of the process. svchost.exe
instance_detail string Detail of an Amazon EC2 instance in JSON format. {"instanceId": "i-1234567890abcdef0", "instanceType": "t2.micro", "launchTime": "2024-05-030T12:34:56Z", "platform": "Linux", "tags": [{"key": "Name", "value": "MyEC2Instance"}]}
logon_account string The account used to authenticate during a logon attempt. AS2SOASECP32E
logon_type string Type of logon session that occurred. 2 (interactive), 3 (network)
managed_customer_id string

Unique ID of the managed customer. See Federated Search for more information.

Additionally, see Managed Security Service Provider to understand more about how Anomali enables multi-tenancy.

 12345
managed_customer_name string Name of the managed customer. See Federated Search for more information.

Additionally, see Managed Security Service Provider to understand more about how Anomali enables multi-tenancy.

 Acne Corp
message string Event message available when the "store raw logs" option has been configured. 1.0 2017-12-13T08:16:02.130Z Z123412341234 example.com A NOERROR UDP Region 192.168.1.1 -
message_id string Globally-unique message identifier. 123e4567-e89b-12d3-a456-426655440000
network_direction string Flow of data within a network. outbound, inbound
network_info string A failed logon attempt originated from, in JSON format. {"workstation_name": "ODMH-B9HRG04", "source_address":"10.191.9.76", "source_port":"5324"}
network_source string Network from which traffic originates, which in zscaler corresponds to the location field. us-ny-azure
ocsf_fields string OCSF key-value pairs in JSON format. {\"packets_in\":567, \"packets_out\": 345}
original_file_name string Original name of the file that was renamed. test.pdf
packets_in long Packets received by a network interface. 340
packets_out long Packets transmitted or sent over a network interface. 347
parent_command_line string Complete command string of the parent process. C:\Windows\System32\svchost.exe -k WerSvcGroup
parent_image string Executable name of the parent process. notepad.exe
parent_process_id string Numeric identifier of the process assigned by the operating system. 4834
platform string Operating system of the asset. win, mac, linux
policy_id string Identifier of the security policy rule that applied to the logged traffic. Allow_HTTP_Traffic
policy_name string Name of the security policy rule that applied to the logged traffic. 23
principal_id string Entity (user, role, or service) that initiated the request. AROAJKSDKFJS:sessionName
process_id long Numeric identifier of the process assigned by the operating system. 3683
process_info string Details about the process that initiated or was involved in the event. {"New Process ID": "0x93a4", "New Process Name": "C:\\Windows\\System32\\backgroundTaskHost.exe", "Token Elevation Type": "%%1936"}
protocol string Network or email protocol. http, tcp, udp, smtp
protocol_code string Code representing a protocol. 6
protocol_version string Version of a protocol. IPV4
public_src_ip string Public IP address of the client device. 54.12.4.3
query string Domain to be resolved. www.google.com
_raw string Raw event message.  
raw_msg_size long Size of a message in bytes. 137
receiver string Email address of the message recipient. john.doe@amce.org
record_type string DNS resource record type. A, CNAME, MX, NS, PTR, AAAA
reg_key string Registry key that the recorded action was applied to. HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications
reg_value_data string Data of the registry value that the recorded action was applied to. Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad
reg_value_name string Name of the registry value that the recorded action was applied to. Wordpad
region string Geographical location where data centers are located. us-east-1, us-west-2
resource_id string Unique identifier of a cloud resource, which in cloud trail corresponds to the ARN field. arn:aws:s3:::
resource_role string Role that the resource is playing in the context of the detected finding. TARGET, SOURCE
resource_type string Type of a cloud resource. AWS::S3::Bucket
return_code string HTTP status code or DNS response code. 200, 404, 504, NOERROR, NXDOMAIN
s3_bucket_detail string Detail of an S3 bucket in JSON format. {"arn": "arn:aws:s3:::example-bucket", "name": "example-bucket", "type": "S3", "createdAt": "2024-05-30T12:34:56Z", "owner": {"id": "123456789012", "name": "example-owner"}, "tags": [{"key": "Environment", "value": "Production"}, {"key": "Project", "value": "ExampleProject"}]}
s3_path string Path to an object stored in Amazon S3. s3://my-bucket/path/to/data.tar.gz
sender string Email address of the message sender. bar@amce.org
session_id string Unique identifier assigned to a user's session within a software application or a network connection. SID34534
session_issuer string Entity that issued the temporary security credentials, in JSON format. {"type": "Role", "principalId": "AROAJKSDKFJS", "arn": "arn:aws:iam::123456789012:role/RoleName", "accountId": "123456789012", "userName": "RoleName"}
signature string Identifier for the specific signature used to detect the attack. TP-Link.Archer.AX21.luci.stok.Command.Injection
sourcetype string Device vendor. PAN Traffic, Cisco ASA, Zscaler
src string Source of network traffic. 192.168.134.3 or internaltest.qa.amce.org
src_country string Specific nation or geographical region from which data, materials, or information originates. us
src_ip string IP address of the source. 192.168.34.3
src_port integer Source port of network traffic. 8080
start_time long Timestamp when a network flow started, in seconds. 1713430134
status string Status of the service.  
subject string Subject line of the email message. Your daily Threat Model digest
subtype string Subtype of a particular device or system. sniffer, webfilter
threat_name string Name of threat detected. Trojan:Win32/Emotet
threat_type string Classification or type of threat detected. malware, phising
title string Alert title (azure security alert).  
ttl long Time-to-live of the network packet. 3600
url string Fully qualified URL of the requested HTTP resource. https://www.computerhope.com/cgi-bin/search.cgi?q=example%20search
user string User that requested the traffic flow. john.dole@amce.org
user_id string Identifier of the user account. 356
user_agent string User agent used in the request. Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101
user_role_arn string Unique identifier of IAM role, which in cloud trail corresponds to the arn field of assumedRoleUser. arn:aws:sts::111122223333:assumed-role/Developer_Role/Session_Name
vendor_account string Account name associated with the vendor supplying the service. 123456789012
vendor_product string Product from the vendor that generated the data. Microsoft Defender
win_evt_account_info string Details about the user account involved in a logged event. {"Account Name": "LOV2P2MIMCTX168$@PRD.MKAPP.NET", "Account Domain": "PRD.MKAPP.NET", "Logon GUID": "{BDBDA233-BD14-B47F-AC70-D10B3AB82261}"}
win_evt_additional_info string Extra context or metadata about an event. {"Ticket Options": "0x40810000","Ticket Encryption Type": "0x12","Session Encryption Type": "0x12","Failure Code": "0x0"}
win_evt_failure_info string Information that helps identify the cause of the failure and the context, in JSON format. {"reason":"The user has not been granted the requested logon type at this machine.", "status":"0xc000015b"}
win_evt_group string Details about a security-enabled group, common in events related to group membership changes, in JSON format. {"sid": "NULL SID", "group_name":"PCGroup", "group_domain":"ODMH-B9HRG04"}
win_evt_lockout string Event occurs when a user account is locked due to multiple failed login attempts, in JSON format. {"sid": "NULL SID", "account_name":"PCGroup"}
win_evt_member string User or account that was added to or removed from a security group, in JSON format. {"sid": "NULL SID", "account_name":"PCGroup", "account_domain":"ODMH-B9HRG04"}
win_evt_operation string The specific action recorded in the log. {"Operation Type": "Object Access", "Accesses": "Unknown specific access (bit 0)", "Access Mask": "0x1", "Properties": "-"}
win_evt_service_info string Details about a service involved in a system event, particularly in security, system, and application logs. {"Service Name": "LOV2P2MIMCTX168$", "Service ID": "PRD\\LOV2P2MIMCTX168$"}
win_evt_subject string Account that triggered the event, in JSON format. {"sid": "NULL SID", "account_name":"PCGroup", "account_domain":"ODMH-B9HRG04", "logon_id": "0x64e"}
win_evt_target string Object or account that is the focus of the event action, in JSON format. {"sid": "NULL SID", "account_name":"PCGroup", "account_domain":"ODMH-B9HRG04"}