OCSF Findings Schema
The Findings class captures security detections, alerts, and findings from security monitoring tools. This includes vulnerability detections, threat intelligence matches, compliance violations, anomaly detections, and security alerts from EDR, SIEM, and other security platforms. This schema is part of the OCSF (Open Cybersecurity Schema Framework) standard. For general OCSF guidance and field naming conventions, see OCSF Schema Overview.
For more information on the OCSF Version 1.2 standard, see OCSF v1.2 Documentation.
Note: For OCSF schema fields, array indexes start at array[1] and not array[0].
| Field | Description | Value Type |
|---|---|---|
| action | Optional: The normalized caption of 'action_id' or the source-specific action. | string |
| action_id | Required: The normalized action taken by a control or other policy-based system leading to an outcome or disposition. | integer |
| activity_id | Required: The normalized identifier of the activity that triggered the event. | integer |
| activity_name | Optional: The event activity name, as defined by the activity_id. | string |
| actor | Optional: The actor object describes details about the user/role/process that was the source of the activity. | object |
| actor.app_uid | Optional: The unique identifier of the client application or service that initiated the activity. | string |
| actor.idp | Optional: This object describes details about the Identity Provider used. | object |
| actor.idp.name | Recommended: The name of the identity provider. | string |
| actor.idp.uid | Recommended: The unique identifier of the identity provider. | string |
| actor.invoked_by | Optional: The name of the service that invoked the activity as described in the event. | string |
| actor.process | Recommended: The process that initiated the activity. | object |
| actor.process.cmd_line | Recommended: The full command line used to launch an application, service, process, or job. | string |
| actor.process.container | Recommended: The information describing an instance of a container. | object |
| actor.process.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b.... |
object |
| actor.process.container.hash.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| actor.process.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| actor.process.container.hash.value | Required: The digital fingerprint value. | string |
| actor.process.container.image | Recommended: The container image used as a template to run the container. | object |
| actor.process.container.image.name | Recommended: The image name. For example: elixir. |
string |
| actor.process.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| actor.process.container.name | Recommended: The container name. | string |
| actor.process.container.size | Recommended: The size of the container image. | long |
| actor.process.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc.... |
string |
| actor.process.created_time | Recommended: The time when the process was created/started. | long |
| actor.process.file | Recommended: The process file object. | object |
| actor.process.file.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| actor.process.file.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| actor.process.file.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| actor.process.file.hashes | Recommended: An array of hash attributes. | array of objects |
| actor.process.file.hashes.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| actor.process.file.hashes.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| actor.process.file.hashes.value | Required: The digital fingerprint value. | string |
| actor.process.file.name | Required: The name of the file. | string |
| actor.process.file.parent_folder | Optional: The parent folder in which the file resides. | string |
| actor.process.file.path | Recommended: The full path to the file. . | string |
| actor.process.file.size | Optional: The size of data, in bytes. | long |
| actor.process.file.type | Optional: The file type. | string |
| actor.process.file.type_id | Required: The file type ID. | integer |
| actor.process.integrity | Optional: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). | string |
| actor.process.integrity_id | Optional: The normalized identifier of the process integrity level (Windows only). | integer |
| actor.process.name | Recommended: The friendly name of the process, for example: Notepad++. |
string |
| actor.process.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| actor.process.parent_process | Recommended: The parent process of this process object. | object |
| actor.process.parent_process.cmd_line | Recommended: The full command line used to launch an application, service, process, or job. | string |
| actor.process.parent_process.container | Recommended: The information describing an instance of a container. | object |
| actor.process.parent_process.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e.... |
object |
| actor.process.parent_process.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| actor.process.parent_process.container.hash.value | Required: The digital fingerprint value. | string |
| actor.process.parent_process.container.image | Recommended: The container image used as a template to run the container. | object |
| actor.process.parent_process.container.image.name | Recommended: The image name. For example: elixir. |
string |
| actor.process.parent_process.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| actor.process.parent_process.container.name | Recommended: The container name. | string |
| actor.process.parent_process.container.size | Recommended: The size of the container image. | long |
| actor.process.parent_process.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc8... |
string |
| actor.process.parent_process.created_time | Recommended: The time when the process was created/started. | long |
| actor.process.parent_process.file | Recommended: The process file object. | object |
| actor.process.parent_process.file.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| actor.process.parent_process.file.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| actor.process.parent_process.file.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| actor.process.parent_process.file.hashes | Recommended: An array of hash attributes. | array of objects |
| actor.process.parent_process.file.hashes.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| actor.process.parent_process.file.hashes.value | Required: The digital fingerprint value. | string |
| actor.process.parent_process.file.name | Required: The name of the file. | string |
| actor.process.parent_process.file.path | Recommended: The full path to the file. . | string |
| actor.process.parent_process.file.type | Optional: The file type. | string |
| actor.process.parent_process.file.type_id | Required: The file type ID. | integer |
| actor.process.parent_process.integrity | Optional: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). | string |
| actor.process.parent_process.integrity_id | Optional: The normalized identifier of the process integrity level (Windows only). | integer |
| actor.process.parent_process.name | Recommended: The friendly name of the process, for example: Notepad++. |
string |
| actor.process.parent_process.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| actor.process.parent_process.parent_process | Recommended: The parent process of this process object. | object |
| actor.process.parent_process.parent_process.cmd_line | Recommended: The full command line used to launch an application, service, process, or job. | string |
| actor.process.parent_process.parent_process.container | Recommended: The information describing an instance of a container. | object |
| actor.process.parent_process.parent_process.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5.... |
object |
| actor.process.parent_process.parent_process.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| actor.process.parent_process.parent_process.container.hash.value | Required: The digital fingerprint value. | string |
| actor.process.parent_process.parent_process.container.image | Recommended: The container image used as a template to run the container. | object |
| actor.process.parent_process.parent_process.container.image.name | Recommended: The image name. For example: elixir. |
string |
| actor.process.parent_process.parent_process.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| actor.process.parent_process.parent_process.container.name | Recommended: The container name. | string |
| actor.process.parent_process.parent_process.container.size | Recommended: The size of the container image. | long |
| actor.process.parent_process.parent_process.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82f.... |
string |
| actor.process.parent_process.parent_process.created_time | Recommended: The time when the process was created/started. | long |
| actor.process.parent_process.parent_process.file | Recommended: The process file object. | object |
| actor.process.parent_process.parent_process.file.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| actor.process.parent_process.parent_process.file.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| actor.process.parent_process.parent_process.file.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| actor.process.parent_process.parent_process.file.hashes | Recommended: An array of hash attributes. | array of objects |
| actor.process.parent_process.parent_process.file.hashes.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| actor.process.parent_process.parent_process.file.hashes.value | Required: The digital fingerprint value. | string |
| actor.process.parent_process.parent_process.file.name | Required: The name of the file. | string |
| actor.process.parent_process.parent_process.file.path | Recommended: The full path to the file. . | string |
| actor.process.parent_process.parent_process.file.type_id | Required: The file type ID. | integer |
| actor.process.parent_process.parent_process.name | Recommended: The friendly name of the process, for example: Notepad++. |
string |
| actor.process.parent_process.parent_process.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| actor.process.parent_process.parent_process.pid | Recommended: The process identifier, as reported by the operating system. | integer |
| actor.process.parent_process.parent_process.uid | Recommended: A unique identifier for this process assigned by the producer (tool). | string |
| actor.process.parent_process.parent_process.user | Recommended: The user under which this process is running. | object |
| actor.process.parent_process.parent_process.user.name | Recommended: The username. For example, janedoe1. |
string |
| actor.process.parent_process.parent_process.user.type_id | Recommended: The account type identifier. | integer |
| actor.process.parent_process.parent_process.user.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| actor.process.parent_process.pid | Recommended: The process identifier, as reported by the operating system. | integer |
| actor.process.parent_process.session | Optional: The user session under which this process is running. | object |
| actor.process.parent_process.session.created_time | Recommended: The time when the session was created. | long |
| actor.process.parent_process.session.is_remote | Recommended: The indication of whether the session is remote. | boolean |
| actor.process.parent_process.session.issuer | Recommended: The identifier of the session issuer. | string |
| actor.process.parent_process.session.uid | Recommended: The unique identifier of the session. | string |
| actor.process.parent_process.uid | Recommended: A unique identifier for this process assigned by the producer (tool). | string |
| actor.process.parent_process.user | Recommended: The user under which this process is running. | object |
| actor.process.parent_process.user.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| actor.process.parent_process.user.name | Recommended: The username. For example, janedoe1. |
string |
| actor.process.parent_process.user.type_id | Recommended: The account type identifier. | integer |
| actor.process.parent_process.user.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| actor.process.pid | Recommended: The process identifier, as reported by the operating system. | integer |
| actor.process.session | Optional: The user session under which this process is running. | object |
| actor.process.session.created_time | Recommended: The time when the session was created. | long |
| actor.process.session.is_remote | Recommended: The indication of whether the session is remote. | boolean |
| actor.process.session.issuer | Recommended: The identifier of the session issuer. | string |
| actor.process.session.uid | Recommended: The unique identifier of the session. | string |
| actor.process.session.uuid | Optional: The universally unique identifier of the session. | string |
| actor.process.uid | Recommended: A unique identifier for this process assigned by the producer (tool). | string |
| actor.process.user | Recommended: The user under which this process is running. | object |
| actor.process.user.account | Optional: The user's account or the account associated with the user. | object |
| actor.process.user.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| actor.process.user.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| actor.process.user.account.type_id | Recommended: The normalized account type identifier. | integer |
| actor.process.user.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| actor.process.user.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| actor.process.user.email_addr | Optional: The user's primary email address. | string |
| actor.process.user.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| actor.process.user.name | Recommended: The username. For example, janedoe1. |
string |
| actor.process.user.org | Optional: Organization and org unit related to the user. | object |
| actor.process.user.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| actor.process.user.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| actor.process.user.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| actor.process.user.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| actor.process.user.type | Optional: The type of the user. For example, System, AWS IAM User, | string |
| actor.process.user.type_id | Recommended: The account type identifier. | integer |
| actor.process.user.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| actor.session | Optional: The user session from which the activity was initiated. | object |
| actor.session.created_time | Recommended: The time when the session was created. | long |
| actor.session.is_remote | Recommended: The indication of whether the session is remote. | boolean |
| actor.session.issuer | Recommended: The identifier of the session issuer. | string |
| actor.session.uid | Recommended: The unique identifier of the session. | string |
| actor.session.uuid | Optional: The universally unique identifier of the session. | string |
| actor.user | Recommended: The user that initiated the activity or the user context from which the activity was initiated. | object |
| actor.user.account | Optional: The user's account or the account associated with the user. | object |
| actor.user.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| actor.user.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| actor.user.account.type_id | Recommended: The normalized account type identifier. | integer |
| actor.user.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| actor.user.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| actor.user.email_addr | Optional: The user's primary email address. | string |
| actor.user.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| actor.user.name | Recommended: The username. For example, janedoe1. |
string |
| actor.user.org | Optional: Organization and org unit related to the user. | object |
| actor.user.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| actor.user.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| actor.user.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| actor.user.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| actor.user.type | Optional: The type of the user. For example, System, AWS IAM User, | string |
| actor.user.type_id | Recommended: The account type identifier. | integer |
| actor.user.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| api | Optional: Describes details about a typical API (Application Programming Interface) call. | object |
| api.operation | Required: Verb/Operation associated with the request | string |
| api.request | Recommended: Details pertaining to the API request. | object |
| api.request.uid | Required: The unique request identifier. | string |
| api.response | Recommended: Details pertaining to the API response. | object |
| api.response.code | Recommended: The numeric response sent to a request. | integer |
| api.response.error | Recommended: Error Code | string |
| api.response.error_message | Recommended: Error Message | string |
| api.response.message | Recommended: The description of the event/finding, as defined by the source. | string |
| api.service | Optional: The information pertaining to the API service. | object |
| api.service.name | Recommended: The name of the service. | string |
| api.service.uid | Recommended: The unique identifier of the service. | string |
| api.service.version | Recommended: The version of the service. | string |
| category_name | Optional: The event category name, as defined by category_uid value. | string |
| category_uid | Required: The category unique identifier of the event. | integer |
| class_name | Optional: The event class name, as defined by the class_uid. | string |
| class_uid | Required: The unique identifier of a class. | integer |
| cloud | Required: Describes details about the Cloud environment where the event was originally created or logged. | object |
| cloud.account | Optional: The account object describes details about the account that was the source or target of the activity. | object |
| cloud.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| cloud.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| cloud.account.type_id | Recommended: The normalized account type identifier. | integer |
| cloud.account.uid | Recommended: The unique identifier of the account. | string |
| cloud.org | Optional: Organization and org unit relevant to the event or object. | object |
| cloud.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| cloud.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| cloud.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| cloud.provider | Required: The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, | string |
| cloud.region | Recommended: The name of the cloud region, as defined by the cloud provider. | string |
| compliance | Required: The compliance object provides context to compliance findings and contains compliance related details. | object |
| compliance.control | Recommended: A Control is prescriptive, prioritized, and simplified set of best practices that one can use to strengthen their cybersecurity posture. | string |
| compliance.standards | Required: Security standards are a set of criteria organizations can follow to protect sensitive and confidential information. | array of strings |
| compliance.status | Recommended: The resultant status of the compliance check normalized to the caption of the status_id value. |
string |
| compliance.status_id | Recommended: The normalized status identifier of the compliance check. | integer |
| confidence | Optional: The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source. | string |
| confidence_id | Recommended: The normalized confidence refers to the accuracy of the rule that created the finding. | integer |
| count | Optional: The number of times that events in the same logical group occurred during the event Start Time to End Time period. | integer |
| data_security | Recommended: The Data Security object describes the characteristics, techniques and content of a Data Loss Prevention (DLP), Data Loss Detection (DLD), Data Classification, or similar tools' finding, alert, or detection mechanism(s). | object |
| data_security.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| data_security.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| data_security.data_lifecycle_state_id | Recommended: The stage or state that the data was in when it was assessed or scanned by a data security tool. | integer |
| data_security.detection_pattern | Recommended: Specific pattern, algorithm, fingerpint, or model used for detection. | string |
| data_security.detection_system_id | Recommended: The type of data security tool or system that the finding, detection, or alert originated from. | integer |
| data_security.policy | Recommended: Details about the policy that triggered the finding. | object |
| data_security.policy.name | Recommended: The policy name. For example: IAM Policy. |
string |
| data_security.policy.uid | Recommended: A unique identifier of the policy instance. | string |
| data_security.policy.version | Recommended: The policy version number. | string |
| database | Recommended: Describes the database where classified or sensitive data is stored in, or was accessed from. | object |
| database.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| database.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| database.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| database.name | Recommended: The database name, ordinarily as assigned by a database administrator. | string |
| database.type | Recommended: The database type. | string |
| database.type_id | Required: The normalized identifier of the database type. | integer |
| database.uid | Recommended: The unique identifier of the database. | string |
| databucket | Recommended: Describes the databucket where classified or sensitive data is stored in, or was accessed from. | object |
| databucket.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| databucket.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| databucket.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| databucket.name | Recommended: The databucket name. | string |
| databucket.type | Recommended: The databucket type. | string |
| databucket.type_id | Required: The normalized identifier of the databucket type. | integer |
| databucket.uid | Recommended: The unique identifier of the databucket. | string |
| desc | Recommended: The short description of the Incident. | string |
| device | Recommended: An addressable device, computer system or host. | object |
| device.container | Recommended: The information describing an instance of a container. | object |
| device.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b.... |
object |
| device.container.hash.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| device.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| device.container.hash.value | Required: The digital fingerprint value. | string |
| device.container.image | Recommended: The container image used as a template to run the container. | object |
| device.container.image.name | Recommended: The image name. For example: elixir. |
string |
| device.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| device.container.name | Recommended: The container name. | string |
| device.container.size | Recommended: The size of the container image. | long |
| device.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82.... |
string |
| device.domain | Optional: The network domain where the device resides. For example: work.example.com. |
string |
| device.groups | Optional: The group names to which the device belongs. For example: ["Windows Laptops", "Engineering"]. |
array of objects |
| device.groups.desc | Optional: The group description. | string |
| device.groups.domain | Optional: The domain where the group is defined. For example: the LDAP or Active Directory domain. | string |
| device.groups.name | Recommended: The group name. | string |
| device.groups.type | Optional: The type of the group or account. | string |
| device.groups.uid | Recommended: The unique identifier of the group. | string |
| device.hostname | Recommended: The device hostname. | string |
| device.instance_uid | Recommended: The unique identifier of a VM instance. | string |
| device.interface_name | Recommended: The name of the network interface (for example eth2). | string |
| device.interface_uid | Recommended: The unique identifier of the network interface. | string |
| device.ip | Recommended: The device IP address, in either IPv4 or IPv6 format. | string |
| device.is_compliant | Optional: The event occurred on a compliant device. | boolean |
| device.is_managed | Optional: The event occurred on a managed device. | boolean |
| device.name | Recommended: The alternate device name, ordinarily as assigned by an administrator. | string |
| device.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| device.os | Optional: The endpoint operating system. | object |
| device.os.name | Required: The operating system name. | string |
| device.os.type | Optional: The type of the operating system. | string |
| device.os.type_id | Required: The type identifier of the operating system. | integer |
| device.owner | Recommended: The identity of the service or user account that owns the endpoint or was last logged into it. | object |
| device.owner.account | Optional: The user's account or the account associated with the user. | object |
| device.owner.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| device.owner.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| device.owner.account.type_id | Recommended: The normalized account type identifier. | integer |
| device.owner.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| device.owner.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| device.owner.email_addr | Optional: The user's primary email address. | string |
| device.owner.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| device.owner.name | Recommended: The username. For example, janedoe1. |
string |
| device.owner.org | Optional: Organization and org unit related to the user. | object |
| device.owner.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| device.owner.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| device.owner.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| device.owner.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| device.owner.type | Optional: The type of the user. For example, System, AWS IAM User. | string |
| device.owner.type_id | Recommended: The account type identifier. | integer |
| device.owner.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| device.region | Recommended: The region where the virtual machine is located. For example, an AWS Region. | string |
| device.type | Optional: The device type. For example: unknown, server, desktop, laptop, tablet, mobile, virtual, browser, or other. |
string |
| device.type_id | Required: The device type ID. | integer |
| device.uid | Recommended: The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN. | string |
| dst_endpoint | Recommended: Describes the endpoint where classified or sensitive data is stored in, or was accessed from. | object |
| dst_endpoint.container | Recommended: The information describing an instance of a container. | object |
| dst_endpoint.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b440.... |
object |
| dst_endpoint.container.hash.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| dst_endpoint.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| dst_endpoint.container.hash.value | Required: The digital fingerprint value. | string |
| dst_endpoint.container.image | Recommended: The container image used as a template to run the container. | object |
| dst_endpoint.container.image.name | Recommended: The image name. For example: elixir. |
string |
| dst_endpoint.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| dst_endpoint.container.name | Recommended: The container name. | string |
| dst_endpoint.container.size | Recommended: The size of the container image. | long |
| dst_endpoint.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff3.... |
string |
| dst_endpoint.domain | Optional: The name of the domain. | string |
| dst_endpoint.hostname | Recommended: The fully qualified name of the endpoint. | string |
| dst_endpoint.instance_uid | Recommended: The unique identifier of a VM instance. | string |
| dst_endpoint.interface_name | Recommended: The name of the network interface. | string |
| dst_endpoint.interface_uid | Recommended: The unique identifier of the network interface. | string |
| dst_endpoint.ip | Recommended: The IP address of the endpoint, in either IPv4 or IPv6 format. | string |
| dst_endpoint.location | Optional: The geographical location of the endpoint. | object |
| dst_endpoint.location.city | Recommended: The name of the city. | string |
| dst_endpoint.location.continent | Recommended: The name of the continent. | string |
| dst_endpoint.location.country | Recommended: The ISO 3166-1 Alpha-2 country code. | string |
| dst_endpoint.location.lat | Optional: The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: 42.361145. |
float |
| dst_endpoint.location.long | Optional: The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: -71.057083. |
float |
| dst_endpoint.location.region | Optional: The alphanumeric code that identifies the principal subdivision (for example province or state) of the country. | string |
| dst_endpoint.mac | Optional: The Media Access Control (MAC) address of the endpoint. | string |
| dst_endpoint.name | Recommended: The short name of the endpoint. | string |
| dst_endpoint.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| dst_endpoint.owner | Recommended: The identity of the service or user account that owns the endpoint or was last logged into it. | object |
| dst_endpoint.owner.account | Optional: The user's account or the account associated with the user. | object |
| dst_endpoint.owner.account.name | Recommended: The name of the account (for example, GCP Account Name). | string |
| dst_endpoint.owner.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| dst_endpoint.owner.account.type_id | Recommended: The normalized account type identifier. | integer |
| dst_endpoint.owner.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| dst_endpoint.owner.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| dst_endpoint.owner.email_addr | Optional: The user's primary email address. | string |
| dst_endpoint.owner.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| dst_endpoint.owner.name | Recommended: The username. For example, janedoe1. |
string |
| dst_endpoint.owner.org | Optional: Organization and org unit related to the user. | object |
| dst_endpoint.owner.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| dst_endpoint.owner.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| dst_endpoint.owner.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| dst_endpoint.owner.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| dst_endpoint.owner.type | Optional: The type of the user. For example, System, AWS IAM User, | string |
| dst_endpoint.owner.type_id | Recommended: The account type identifier. | integer |
| dst_endpoint.owner.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| dst_endpoint.port | Recommended: The port used for communication within the network connection. | integer |
| dst_endpoint.proxy_endpoint | Optional: The network proxy information pertaining to a specific endpoint. | object |
| dst_endpoint.proxy_endpoint.container | Recommended: The information describing an instance of a container. | object |
| dst_endpoint.proxy_endpoint.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b4.... |
object |
| dst_endpoint.proxy_endpoint.container.hash.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| dst_endpoint.proxy_endpoint.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| dst_endpoint.proxy_endpoint.container.hash.value | Required: The digital fingerprint value. | string |
| dst_endpoint.proxy_endpoint.container.image | Recommended: The container image used as a template to run the container. | object |
| dst_endpoint.proxy_endpoint.container.image.name | Recommended: The image name. For example: elixir. |
string |
| dst_endpoint.proxy_endpoint.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| dst_endpoint.proxy_endpoint.container.name | Recommended: The container name. | string |
| dst_endpoint.proxy_endpoint.container.size | Recommended: The size of the container image. | long |
| dst_endpoint.proxy_endpoint.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff.... |
string |
| dst_endpoint.proxy_endpoint.hostname | Recommended: The fully qualified name of the endpoint. | string |
| dst_endpoint.proxy_endpoint.instance_uid | Recommended: The unique identifier of a VM instance. | string |
| dst_endpoint.proxy_endpoint.interface_name | Recommended: The name of the network interface (for example eth2). | string |
| dst_endpoint.proxy_endpoint.interface_uid | Recommended: The unique identifier of the network interface. | string |
| dst_endpoint.proxy_endpoint.ip | Recommended: The IP address of the endpoint, in either IPv4 or IPv6 format. | string |
| dst_endpoint.proxy_endpoint.name | Recommended: The short name of the endpoint. | string |
| dst_endpoint.proxy_endpoint.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| dst_endpoint.proxy_endpoint.owner | Recommended: The identity of the service or user account that owns the endpoint or was last logged into it. | object |
| dst_endpoint.proxy_endpoint.owner.account | Optional: The user's account or the account associated with the user. | object |
| dst_endpoint.proxy_endpoint.owner.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| dst_endpoint.proxy_endpoint.owner.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| dst_endpoint.proxy_endpoint.owner.account.type_id | Recommended: The normalized account type identifier. | integer |
| dst_endpoint.proxy_endpoint.owner.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| dst_endpoint.proxy_endpoint.owner.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| dst_endpoint.proxy_endpoint.owner.email_addr | Optional: The user's primary email address. | string |
| dst_endpoint.proxy_endpoint.owner.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| dst_endpoint.proxy_endpoint.owner.name | Recommended: The username. For example, janedoe1. |
string |
| dst_endpoint.proxy_endpoint.owner.org | Optional: Organization and org unit related to the user. | object |
| dst_endpoint.proxy_endpoint.owner.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| dst_endpoint.proxy_endpoint.owner.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| dst_endpoint.proxy_endpoint.owner.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| dst_endpoint.proxy_endpoint.owner.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| dst_endpoint.proxy_endpoint.owner.type | Optional: The type of the user. For example, System, AWS IAM User, | string |
| dst_endpoint.proxy_endpoint.owner.type_id | Recommended: The account type identifier. | integer |
| dst_endpoint.proxy_endpoint.owner.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| dst_endpoint.proxy_endpoint.port | Recommended: The port used for communication within the network connection. | integer |
| dst_endpoint.proxy_endpoint.svc_name | Recommended: The service name in service-to-service connections. | string |
| dst_endpoint.proxy_endpoint.type_id | Recommended: The network endpoint type ID. | integer |
| dst_endpoint.proxy_endpoint.uid | Recommended: The unique identifier of the endpoint. | string |
| dst_endpoint.svc_name | Recommended: The service name in service-to-service connections. | string |
| dst_endpoint.type_id | Recommended: The network endpoint type ID. | integer |
| dst_endpoint.uid | Recommended: The unique identifier of the endpoint. | string |
| dst_endpoint.zone | Optional: The network zone or LAN segment. | string |
| duration | Optional: The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds. |
integer |
| end_time | Optional: The end time of a time period, or the time of the most recent event included in the aggregate event. | long |
| event_seq_id | Required: The sequence identifier for the event. | long |
| event_size | Required: The size of the event in bytes. | long |
| event_time | Required: The normalized event occurrence time or the finding creation time. | long |
| evidences | Recommended: Describes various evidence artifacts associated to the activity/activities that triggered a security detection. | array of objects |
| evidences.actor | Recommended: Describes details about the user/role/process that was the source of the activity that triggered the detection. | object |
| evidences.actor.app_uid | Optional: The unique identifier of the client application or service that initiated the activity. | string |
| evidences.actor.idp | Optional: This object describes details about the Identity Provider used. | object |
| evidences.actor.idp.name | Recommended: The name of the identity provider. | string |
| evidences.actor.idp.uid | Recommended: The unique identifier of the identity provider. | string |
| evidences.actor.invoked_by | Optional: The name of the service that invoked the activity as described in the event. | string |
| evidences.actor.process | Recommended: The process that initiated the activity. | object |
| evidences.actor.process.cmd_line | Recommended: The full command line used to launch an application, service, process, or job. | string |
| evidences.actor.process.container | Recommended: The information describing an instance of a container. | object |
| evidences.actor.process.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b.... |
object |
| evidences.actor.process.container.hash.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| evidences.actor.process.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.actor.process.container.hash.value | Required: The digital fingerprint value. | string |
| evidences.actor.process.container.image | Recommended: The container image used as a template to run the container. | object |
| evidences.actor.process.container.image.name | Recommended: The image name. For example: elixir. |
string |
| evidences.actor.process.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| evidences.actor.process.container.name | Recommended: The container name. | string |
| evidences.actor.process.container.size | Recommended: The size of the container image. | long |
| evidences.actor.process.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff... |
string |
| evidences.actor.process.created_time | Recommended: The time when the process was created/started. | long |
| evidences.actor.process.file | Recommended: The process file object. | object |
| evidences.actor.process.file.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| evidences.actor.process.file.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| evidences.actor.process.file.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| evidences.actor.process.file.hashes | Recommended: An array of hash attributes. | array of objects |
| evidences.actor.process.file.hashes.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| evidences.actor.process.file.hashes.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.actor.process.file.hashes.value | Required: The digital fingerprint value. | string |
| evidences.actor.process.file.name | Required: The name of the file. | string |
| evidences.actor.process.file.parent_folder | Optional: The parent folder in which the file resides. | string |
| evidences.actor.process.file.path | Recommended: The full path to the file. . | string |
| evidences.actor.process.file.size | Optional: The size of data, in bytes. | long |
| evidences.actor.process.file.type | Optional: The file type. | string |
| evidences.actor.process.file.type_id | Required: The file type ID. | integer |
| evidences.actor.process.integrity | Optional: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). | string |
| evidences.actor.process.integrity_id | Optional: The normalized identifier of the process integrity level (Windows only). | integer |
| evidences.actor.process.name | Recommended: The friendly name of the process, for example: Notepad++. |
string |
| evidences.actor.process.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| evidences.actor.process.parent_process | Recommended: The parent process of this process object. | object |
| evidences.actor.process.parent_process.cmd_line | Recommended: The full command line used to launch an application, service, process, or job. | string |
| evidences.actor.process.parent_process.container | Recommended: The information describing an instance of a container. | object |
| evidences.actor.process.parent_process.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5.... |
object |
| evidences.actor.process.parent_process.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.actor.process.parent_process.container.hash.value | Required: The digital fingerprint value. | string |
| evidences.actor.process.parent_process.container.image | Recommended: The container image used as a template to run the container. | object |
| evidences.actor.process.parent_process.container.image.name | Recommended: The image name. For example: elixir. |
string |
| evidences.actor.process.parent_process.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| evidences.actor.process.parent_process.container.name | Recommended: The container name. | string |
| evidences.actor.process.parent_process.container.size | Recommended: The size of the container image. | long |
| evidences.actor.process.parent_process.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff.... |
string |
| evidences.actor.process.parent_process.created_time | Recommended: The time when the process was created/started. | long |
| evidences.actor.process.parent_process.file | Recommended: The process file object. | object |
| evidences.actor.process.parent_process.file.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| evidences.actor.process.parent_process.file.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| evidences.actor.process.parent_process.file.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| evidences.actor.process.parent_process.file.hashes | Recommended: An array of hash attributes. | array of objects |
| evidences.actor.process.parent_process.file.hashes.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.actor.process.parent_process.file.hashes.value | Required: The digital fingerprint value. | string |
| evidences.actor.process.parent_process.file.name | Required: The name of the file. | string |
| evidences.actor.process.parent_process.file.path | Recommended: The full path to the file. . | string |
| evidences.actor.process.parent_process.file.type | Optional: The file type. | string |
| evidences.actor.process.parent_process.file.type_id | Required: The file type ID. | integer |
| evidences.actor.process.parent_process.integrity | Optional: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). | string |
| evidences.actor.process.parent_process.integrity_id | Optional: The normalized identifier of the process integrity level (Windows only). | integer |
| evidences.actor.process.parent_process.name | Recommended: The friendly name of the process, for example: Notepad++. |
string |
| evidences.actor.process.parent_process.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| evidences.actor.process.parent_process.parent_process | Recommended: The parent process of this process object. | object |
| evidences.actor.process.parent_process.parent_process.cmd_line | Recommended: The full command line used to launch an application, service, process, or job. | string |
| evidences.actor.process.parent_process.parent_process.container | Recommended: The information describing an instance of a container. | object |
| evidences.actor.process.parent_process.parent_process.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b4.... |
object |
| evidences.actor.process.parent_process.parent_process.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.actor.process.parent_process.parent_process.container.hash.value | Required: The digital fingerprint value. | string |
| evidences.actor.process.parent_process.parent_process.container.image | Recommended: The container image used as a template to run the container. | object |
| evidences.actor.process.parent_process.parent_process.container.image.name | Recommended: The image name. For example: elixir. |
string |
| evidences.actor.process.parent_process.parent_process.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| evidences.actor.process.parent_process.parent_process.container.name | Recommended: The container name. | string |
| evidences.actor.process.parent_process.parent_process.container.size | Recommended: The size of the container image. | long |
| evidences.actor.process.parent_process.parent_process.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff.... |
string |
| evidences.actor.process.parent_process.parent_process.created_time | Recommended: The time when the process was created/started. | long |
| evidences.actor.process.parent_process.parent_process.file | Recommended: The process file object. | object |
| evidences.actor.process.parent_process.parent_process.file.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| evidences.actor.process.parent_process.parent_process.file.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| evidences.actor.process.parent_process.parent_process.file.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| evidences.actor.process.parent_process.parent_process.file.hashes | Recommended: An array of hash attributes. | array of objects |
| evidences.actor.process.parent_process.parent_process.file.hashes.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.actor.process.parent_process.parent_process.file.hashes.value | Required: The digital fingerprint value. | string |
| evidences.actor.process.parent_process.parent_process.file.name | Required: The name of the file. | string |
| evidences.actor.process.parent_process.parent_process.file.path | Recommended: The full path to the file. | string |
| evidences.actor.process.parent_process.parent_process.file.type_id | Required: The file type ID. | integer |
| evidences.actor.process.parent_process.parent_process.name | Recommended: The friendly name of the process, for example: Notepad++. |
string |
| evidences.actor.process.parent_process.parent_process.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| evidences.actor.process.parent_process.parent_process.pid | Recommended: The process identifier, as reported by the operating system. | integer |
| evidences.actor.process.parent_process.parent_process.uid | Recommended: A unique identifier for this process assigned by the producer (tool). | string |
| evidences.actor.process.parent_process.parent_process.user | Recommended: The user under which this process is running. | object |
| evidences.actor.process.parent_process.parent_process.user.name | Recommended: The username. For example, janedoe1. |
string |
| evidences.actor.process.parent_process.parent_process.user.type_id | Recommended: The account type identifier. | integer |
| evidences.actor.process.parent_process.parent_process.user.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| evidences.actor.process.parent_process.pid | Recommended: The process identifier, as reported by the operating system. | integer |
| evidences.actor.process.parent_process.session | Optional: The user session under which this process is running. | object |
| evidences.actor.process.parent_process.session.created_time | Recommended: The time when the session was created. | long |
| evidences.actor.process.parent_process.session.is_remote | Recommended: The indication of whether the session is remote. | boolean |
| evidences.actor.process.parent_process.session.issuer | Recommended: The identifier of the session issuer. | string |
| evidences.actor.process.parent_process.session.uid | Recommended: The unique identifier of the session. | string |
| evidences.actor.process.parent_process.uid | Recommended: A unique identifier for this process assigned by the producer (tool). | string |
| evidences.actor.process.parent_process.user | Recommended: The user under which this process is running. | object |
| evidences.actor.process.parent_process.user.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| evidences.actor.process.parent_process.user.name | Recommended: The username. For example, janedoe1. |
string |
| evidences.actor.process.parent_process.user.type_id | Recommended: The account type identifier. | integer |
| evidences.actor.process.parent_process.user.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| evidences.actor.process.pid | Recommended: The process identifier, as reported by the operating system. | integer |
| evidences.actor.process.session | Optional: The user session under which this process is running. | object |
| evidences.actor.process.session.created_time | Recommended: The time when the session was created. | long |
| evidences.actor.process.session.is_remote | Recommended: The indication of whether the session is remote. | boolean |
| evidences.actor.process.session.issuer | Recommended: The identifier of the session issuer. | string |
| evidences.actor.process.session.uid | Recommended: The unique identifier of the session. | string |
| evidences.actor.process.session.uuid | Optional: The universally unique identifier of the session. | string |
| evidences.actor.process.uid | Recommended: A unique identifier for this process assigned by the producer (tool). | string |
| evidences.actor.process.user | Recommended: The user under which this process is running. | object |
| evidences.actor.process.user.account | Optional: The user's account or the account associated with the user. | object |
| evidences.actor.process.user.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| evidences.actor.process.user.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| evidences.actor.process.user.account.type_id | Recommended: The normalized account type identifier. | integer |
| evidences.actor.process.user.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| evidences.actor.process.user.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| evidences.actor.process.user.email_addr | Optional: The user's primary email address. | string |
| evidences.actor.process.user.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| evidences.actor.process.user.name | Recommended: The username. For example, janedoe1. |
string |
| evidences.actor.process.user.org | Optional: Organization and org unit related to the user. | object |
| evidences.actor.process.user.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| evidences.actor.process.user.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| evidences.actor.process.user.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| evidences.actor.process.user.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| evidences.actor.process.user.type | Optional: The type of the user. For example, System, AWS IAM User, | string |
| evidences.actor.process.user.type_id | Recommended: The account type identifier. | integer |
| evidences.actor.process.user.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| evidences.actor.session | Optional: The user session from which the activity was initiated. | object |
| evidences.actor.session.created_time | Recommended: The time when the session was created. | long |
| evidences.actor.session.is_remote | Recommended: The indication of whether the session is remote. | boolean |
| evidences.actor.session.issuer | Recommended: The identifier of the session issuer. | string |
| evidences.actor.session.uid | Recommended: The unique identifier of the session. | string |
| evidences.actor.session.uuid | Optional: The universally unique identifier of the session. | string |
| evidences.actor.user | Recommended: The user that initiated the activity or the user context from which the activity was initiated. | object |
| evidences.actor.user.account | Optional: The user's account or the account associated with the user. | object |
| evidences.actor.user.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| evidences.actor.user.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| evidences.actor.user.account.type_id | Recommended: The normalized account type identifier. | integer |
| evidences.actor.user.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| evidences.actor.user.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| evidences.actor.user.email_addr | Optional: The user's primary email address. | string |
| evidences.actor.user.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| evidences.actor.user.name | Recommended: The username. For example, janedoe1. |
string |
| evidences.actor.user.org | Optional: Organization and org unit related to the user. | object |
| evidences.actor.user.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| evidences.actor.user.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| evidences.actor.user.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| evidences.actor.user.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| evidences.actor.user.type | Optional: The type of the user. For example, System, AWS IAM User. | string |
| evidences.actor.user.type_id | Recommended: The account type identifier. | integer |
| evidences.actor.user.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| evidences.api | Recommended: Describes details about the API call associated to the activity that triggered the detection. | object |
| evidences.api.operation | Required: Verb/Operation associated with the request | string |
| evidences.api.request | Recommended: Details pertaining to the API request. | object |
| evidences.api.request.uid | Required: The unique request identifier. | string |
| evidences.api.response | Recommended: Details pertaining to the API response. | object |
| evidences.api.response.code | Recommended: The numeric response sent to a request. | integer |
| evidences.api.response.error | Recommended: Error Code | string |
| evidences.api.response.error_message | Recommended: Error Message | string |
| evidences.api.response.message | Recommended: The description of the event/finding, as defined by the source. | string |
| evidences.api.service | Optional: The information pertaining to the API service. | object |
| evidences.api.service.name | Recommended: The name of the service. | string |
| evidences.api.service.uid | Recommended: The unique identifier of the service. | string |
| evidences.api.service.version | Recommended: The version of the service. | string |
| evidences.connection_info | Recommended: Describes details about the network connection associated to the activity that triggered the detection. | object |
| evidences.connection_info.direction | Optional: The direction of the initiated connection, traffic, or email, normalized to the caption of the direction_id value. | string |
| evidences.connection_info.direction_id | Required: The normalized identifier of the direction of the initiated connection, traffic, or email. | integer |
| evidences.connection_info.protocol_name | Optional: The TCP/IP protocol name in lowercase, as defined by the Internet Assigned Numbers Authority (IANA). | string |
| evidences.connection_info.protocol_num | Recommended: The TCP/IP protocol number, as defined by the Internet Assigned Numbers Authority (IANA). For example: 6 for TCP and 17 for UDP. |
integer |
| evidences.connection_info.session | Optional: The authenticated user or service session. | object |
| evidences.connection_info.session.created_time | Recommended: The time when the session was created. | long |
| evidences.connection_info.session.is_remote | Recommended: The indication of whether the session is remote. | boolean |
| evidences.connection_info.session.issuer | Recommended: The identifier of the session issuer. | string |
| evidences.connection_info.session.uid | Recommended: The unique identifier of the session. | string |
| evidences.connection_info.session.uuid | Optional: The universally unique identifier of the session. | string |
| evidences.connection_info.uid | Optional: The unique identifier of the connection. | string |
| evidences.container | Recommended: Describes details about the container associated to the activity that triggered the detection. | object |
| evidences.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b44.... |
object |
| evidences.container.hash.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| evidences.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.container.hash.value | Required: The digital fingerprint value. | string |
| evidences.container.image | Recommended: The container image used as a template to run the container. | object |
| evidences.container.image.name | Recommended: The image name. For example: elixir. |
string |
| evidences.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| evidences.container.name | Recommended: The container name. | string |
| evidences.container.size | Recommended: The size of the container image. | long |
| evidences.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff.... |
string |
| evidences.database | Recommended: Describes details about the database associated to the activity that triggered the detection. | object |
| evidences.database.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| evidences.database.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| evidences.database.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| evidences.database.name | Recommended: The database name, ordinarily as assigned by a database administrator. | string |
| evidences.database.type | Recommended: The database type. | string |
| evidences.database.type_id | Required: The normalized identifier of the database type. | integer |
| evidences.database.uid | Recommended: The unique identifier of the database. | string |
| evidences.databucket | Recommended: Describes details about the databucket associated to the activity that triggered the detection. | object |
| evidences.databucket.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| evidences.databucket.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| evidences.databucket.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| evidences.databucket.name | Recommended: The databucket name. | string |
| evidences.databucket.type | Recommended: The databucket type. | string |
| evidences.databucket.type_id | Required: The normalized identifier of the databucket type. | integer |
| evidences.databucket.uid | Recommended: The unique identifier of the databucket. | string |
| evidences.dst_endpoint | Recommended: Describes details about the destination of the network activity that triggered the detection. | object |
| evidences.dst_endpoint.container | Recommended: The information describing an instance of a container. | object |
| evidences.dst_endpoint.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b440.... |
object |
| evidences.dst_endpoint.container.hash.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| evidences.dst_endpoint.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.dst_endpoint.container.hash.value | Required: The digital fingerprint value. | string |
| evidences.dst_endpoint.container.image | Recommended: The container image used as a template to run the container. | object |
| evidences.dst_endpoint.container.image.name | Recommended: The image name. For example: elixir. |
string |
| evidences.dst_endpoint.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| evidences.dst_endpoint.container.name | Recommended: The container name. | string |
| evidences.dst_endpoint.container.size | Recommended: The size of the container image. | long |
| evidences.dst_endpoint.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff.... |
string |
| evidences.dst_endpoint.domain | Optional: The name of the domain. | string |
| evidences.dst_endpoint.hostname | Recommended: The fully qualified name of the endpoint. | string |
| evidences.dst_endpoint.instance_uid | Recommended: The unique identifier of a VM instance. | string |
| evidences.dst_endpoint.interface_name | Recommended: The name of the network interface. | string |
| evidences.dst_endpoint.interface_uid | Recommended: The unique identifier of the network interface. | string |
| evidences.dst_endpoint.ip | Recommended: The IP address of the endpoint, in either IPv4 or IPv6 format. | string |
| evidences.dst_endpoint.location | Optional: The geographical location of the endpoint. | object |
| evidences.dst_endpoint.location.city | Recommended: The name of the city. | string |
| evidences.dst_endpoint.location.continent | Recommended: The name of the continent. | string |
| evidences.dst_endpoint.location.country | Recommended: The ISO 3166-1 Alpha-2 country code. | string |
| evidences.dst_endpoint.location.lat | Optional: The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: 42.361145. |
float |
| evidences.dst_endpoint.location.long | Optional: The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: -71.057083. |
float |
| evidences.dst_endpoint.location.region | Optional: The alphanumeric code that identifies the principal subdivision (for example province or state) of the country. | string |
| evidences.dst_endpoint.mac | Optional: The Media Access Control (MAC) address of the endpoint. | string |
| evidences.dst_endpoint.name | Recommended: The short name of the endpoint. | string |
| evidences.dst_endpoint.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| evidences.dst_endpoint.owner | Recommended: The identity of the service or user account that owns the endpoint or was last logged into it. | object |
| evidences.dst_endpoint.owner.account | Optional: The user's account or the account associated with the user. | object |
| evidences.dst_endpoint.owner.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| evidences.dst_endpoint.owner.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| evidences.dst_endpoint.owner.account.type_id | Recommended: The normalized account type identifier. | integer |
| evidences.dst_endpoint.owner.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| evidences.dst_endpoint.owner.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| evidences.dst_endpoint.owner.email_addr | Optional: The user's primary email address. | string |
| evidences.dst_endpoint.owner.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| evidences.dst_endpoint.owner.name | Recommended: The username. For example, janedoe1. |
string |
| evidences.dst_endpoint.owner.org | Optional: Organization and org unit related to the user. | object |
| evidences.dst_endpoint.owner.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| evidences.dst_endpoint.owner.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| evidences.dst_endpoint.owner.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| evidences.dst_endpoint.owner.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| evidences.dst_endpoint.owner.type | Optional: The type of the user. For example, System, AWS IAM User, | string |
| evidences.dst_endpoint.owner.type_id | Recommended: The account type identifier. | integer |
| evidences.dst_endpoint.owner.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| evidences.dst_endpoint.port | Recommended: The port used for communication within the network connection. | integer |
| evidences.dst_endpoint.proxy_endpoint | Optional: The network proxy information pertaining to a specific endpoint. | object |
| evidences.dst_endpoint.proxy_endpoint.container | Recommended: The information describing an instance of a container. | object |
| evidences.dst_endpoint.proxy_endpoint.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b440.... |
object |
| evidences.dst_endpoint.proxy_endpoint.container.hash.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| evidences.dst_endpoint.proxy_endpoint.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.dst_endpoint.proxy_endpoint.container.hash.value | Required: The digital fingerprint value. | string |
| evidences.dst_endpoint.proxy_endpoint.container.image | Recommended: The container image used as a template to run the container. | object |
| evidences.dst_endpoint.proxy_endpoint.container.image.name | Recommended: The image name. For example: elixir. |
string |
| evidences.dst_endpoint.proxy_endpoint.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| evidences.dst_endpoint.proxy_endpoint.container.name | Recommended: The container name. | string |
| evidences.dst_endpoint.proxy_endpoint.container.size | Recommended: The size of the container image. | long |
| evidences.dst_endpoint.proxy_endpoint.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff.... |
string |
| evidences.dst_endpoint.proxy_endpoint.hostname | Recommended: The fully qualified name of the endpoint. | string |
| evidences.dst_endpoint.proxy_endpoint.instance_uid | Recommended: The unique identifier of a VM instance. | string |
| evidences.dst_endpoint.proxy_endpoint.interface_name | Recommended: The name of the network interface (for example eth2). | string |
| evidences.dst_endpoint.proxy_endpoint.interface_uid | Recommended: The unique identifier of the network interface. | string |
| evidences.dst_endpoint.proxy_endpoint.ip | Recommended: The IP address of the endpoint, in either IPv4 or IPv6 format. | string |
| evidences.dst_endpoint.proxy_endpoint.name | Recommended: The short name of the endpoint. | string |
| evidences.dst_endpoint.proxy_endpoint.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| evidences.dst_endpoint.proxy_endpoint.owner | Recommended: The identity of the service or user account that owns the endpoint or was last logged into it. | object |
| evidences.dst_endpoint.proxy_endpoint.owner.account | Optional: The user's account or the account associated with the user. | object |
| evidences.dst_endpoint.proxy_endpoint.owner.account.name | Recommended: The name of the account (for example, GCP Account Name). | string |
| evidences.dst_endpoint.proxy_endpoint.owner.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| evidences.dst_endpoint.proxy_endpoint.owner.account.type_id | Recommended: The normalized account type identifier. | integer |
| evidences.dst_endpoint.proxy_endpoint.owner.account.uid | Recommended: The unique identifier of the account (for example, AWS Account ID). | string |
| evidences.dst_endpoint.proxy_endpoint.owner.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| evidences.dst_endpoint.proxy_endpoint.owner.email_addr | Optional: The user's primary email address. | string |
| evidences.dst_endpoint.proxy_endpoint.owner.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| evidences.dst_endpoint.proxy_endpoint.owner.name | Recommended: The username. For example, janedoe1. |
string |
| evidences.dst_endpoint.proxy_endpoint.owner.org | Optional: Organization and org unit related to the user. | object |
| evidences.dst_endpoint.proxy_endpoint.owner.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| evidences.dst_endpoint.proxy_endpoint.owner.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| evidences.dst_endpoint.proxy_endpoint.owner.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| evidences.dst_endpoint.proxy_endpoint.owner.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| evidences.dst_endpoint.proxy_endpoint.owner.type | Optional: The type of the user. For example, System, AWS IAM User, | string |
| evidences.dst_endpoint.proxy_endpoint.owner.type_id | Recommended: The account type identifier. | integer |
| evidences.dst_endpoint.proxy_endpoint.owner.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| evidences.dst_endpoint.proxy_endpoint.port | Recommended: The port used for communication within the network connection. | integer |
| evidences.dst_endpoint.proxy_endpoint.svc_name | Recommended: The service name in service-to-service connections. | string |
| evidences.dst_endpoint.proxy_endpoint.type_id | Recommended: The network endpoint type ID. | integer |
| evidences.dst_endpoint.proxy_endpoint.uid | Recommended: The unique identifier of the endpoint. | string |
| evidences.dst_endpoint.svc_name | Recommended: The service name in service-to-service connections. | string |
| evidences.dst_endpoint.type_id | Recommended: The network endpoint type ID. | integer |
| evidences.dst_endpoint.uid | Recommended: The unique identifier of the endpoint. | string |
| evidences.dst_endpoint.zone | Optional: The network zone or LAN segment. | string |
| evidences.file | Recommended: Describes details about the file associated to the activity that triggered the detection. | object |
| evidences.file.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| evidences.file.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| evidences.file.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| evidences.file.hashes | Recommended: An array of hash attributes. | array of objects |
| evidences.file.hashes.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| evidences.file.hashes.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.file.hashes.value | Required: The digital fingerprint value. | string |
| evidences.file.name | Required: The name of the file. | string |
| evidences.file.parent_folder | Optional: The parent folder in which the file resides. | string |
| evidences.file.path | Recommended: The full path to the file. . | string |
| evidences.file.size | Optional: The size of data, in bytes. | long |
| evidences.file.type | Optional: The file type. | string |
| evidences.file.type_id | Required: The file type ID. | integer |
| evidences.process | Recommended: Describes details about the process associated to the activity that triggered the detection. | object |
| evidences.process.cmd_line | Recommended: The full command line used to launch an application, service, process, or job. | string |
| evidences.process.container | Recommended: The information describing an instance of a container. | object |
| evidences.process.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b4.... |
object |
| evidences.process.container.hash.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| evidences.process.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.process.container.hash.value | Required: The digital fingerprint value. | string |
| evidences.process.container.image | Recommended: The container image used as a template to run the container. | object |
| evidences.process.container.image.name | Recommended: The image name. For example: elixir. |
string |
| evidences.process.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| evidences.process.container.name | Recommended: The container name. | string |
| evidences.process.container.size | Recommended: The size of the container image. | long |
| evidences.process.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff.... |
string |
| evidences.process.created_time | Recommended: The time when the process was created/started. | long |
| evidences.process.file | Recommended: The process file object. | object |
| evidences.process.file.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| evidences.process.file.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| evidences.process.file.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| evidences.process.file.hashes | Recommended: An array of hash attributes. | array of objects |
| evidences.process.file.hashes.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| evidences.process.file.hashes.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.process.file.hashes.value | Required: The digital fingerprint value. | string |
| evidences.process.file.name | Required: The name of the file. | string |
| evidences.process.file.parent_folder | Optional: The parent folder in which the file resides. | string |
| evidences.process.file.path | Recommended: The full path to the file. . | string |
| evidences.process.file.size | Optional: The size of data, in bytes. | long |
| evidences.process.file.type | Optional: The file type. | string |
| evidences.process.file.type_id | Required: The file type ID. | integer |
| evidences.process.integrity | Optional: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). | string |
| evidences.process.integrity_id | Optional: The normalized identifier of the process integrity level (Windows only). | integer |
| evidences.process.name | Recommended: The friendly name of the process, for example: Notepad++. |
string |
| evidences.process.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| evidences.process.parent_process | Recommended: The parent process of this process object. | object |
| evidences.process.parent_process.cmd_line | Recommended: The full command line used to launch an application, service, process, or job. | string |
| evidences.process.parent_process.container | Recommended: The information describing an instance of a container. | object |
| evidences.process.parent_process.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b4.... |
object |
| evidences.process.parent_process.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.process.parent_process.container.hash.value | Required: The digital fingerprint value. | string |
| evidences.process.parent_process.container.image | Recommended: The container image used as a template to run the container. | object |
| evidences.process.parent_process.container.image.name | Recommended: The image name. For example: elixir. |
string |
| evidences.process.parent_process.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| evidences.process.parent_process.container.name | Recommended: The container name. | string |
| evidences.process.parent_process.container.size | Recommended: The size of the container image. | long |
| evidences.process.parent_process.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff.... |
string |
| evidences.process.parent_process.created_time | Recommended: The time when the process was created/started. | long |
| evidences.process.parent_process.file | Recommended: The process file object. | object |
| evidences.process.parent_process.file.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| evidences.process.parent_process.file.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| evidences.process.parent_process.file.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| evidences.process.parent_process.file.hashes | Recommended: An array of hash attributes. | array of objects |
| evidences.process.parent_process.file.hashes.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.process.parent_process.file.hashes.value | Required: The digital fingerprint value. | string |
| evidences.process.parent_process.file.name | Required: The name of the file. | string |
| evidences.process.parent_process.file.path | Recommended: The full path to the file. . | string |
| evidences.process.parent_process.file.type | Optional: The file type. | string |
| evidences.process.parent_process.file.type_id | Required: The file type ID. | integer |
| evidences.process.parent_process.integrity | Optional: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). | string |
| evidences.process.parent_process.integrity_id | Optional: The normalized identifier of the process integrity level (Windows only). | integer |
| evidences.process.parent_process.name | Recommended: The friendly name of the process, for example: Notepad++. |
string |
| evidences.process.parent_process.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| evidences.process.parent_process.parent_process | Recommended: The parent process of this process object. | object |
| evidences.process.parent_process.parent_process.cmd_line | Recommended: The full command line used to launch an application, service, process, or job. | string |
| evidences.process.parent_process.parent_process.container | Recommended: The information describing an instance of a container. | object |
| evidences.process.parent_process.parent_process.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac.... |
object |
| evidences.process.parent_process.parent_process.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.process.parent_process.parent_process.container.hash.value | Required: The digital fingerprint value. | string |
| evidences.process.parent_process.parent_process.container.image | Recommended: The container image used as a template to run the container. | object |
| evidences.process.parent_process.parent_process.container.image.name | Recommended: The image name. For example: elixir. |
string |
| evidences.process.parent_process.parent_process.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| evidences.process.parent_process.parent_process.container.name | Recommended: The container name. | string |
| evidences.process.parent_process.parent_process.container.size | Recommended: The size of the container image. | long |
| evidences.process.parent_process.parent_process.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: 13550340a8681c84c861aa.... |
string |
| evidences.process.parent_process.parent_process.created_time | Recommended: The time when the process was created/started. | long |
| evidences.process.parent_process.parent_process.file | Recommended: The process file object. | object |
| evidences.process.parent_process.parent_process.file.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| evidences.process.parent_process.parent_process.file.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| evidences.process.parent_process.parent_process.file.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| evidences.process.parent_process.parent_process.file.hashes | Recommended: An array of hash attributes. | array of objects |
| evidences.process.parent_process.parent_process.file.hashes.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.process.parent_process.parent_process.file.hashes.value | Required: The digital fingerprint value. | string |
| evidences.process.parent_process.parent_process.file.name | Required: The name of the file. | string |
| evidences.process.parent_process.parent_process.file.path | Recommended: The full path to the file. | string |
| evidences.process.parent_process.parent_process.file.type_id | Required: The file type ID. | integer |
| evidences.process.parent_process.parent_process.name | Recommended: The friendly name of the process, for example: Notepad++. |
string |
| evidences.process.parent_process.parent_process.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| evidences.process.parent_process.parent_process.pid | Recommended: The process identifier, as reported by the operating system. | integer |
| evidences.process.parent_process.parent_process.uid | Recommended: A unique identifier for this process assigned by the producer (tool). | string |
| evidences.process.parent_process.parent_process.user | Recommended: The user under which this process is running. | object |
| evidences.process.parent_process.parent_process.user.name | Recommended: The username. For example, janedoe1. |
string |
| evidences.process.parent_process.parent_process.user.type_id | Recommended: The account type identifier. | integer |
| evidences.process.parent_process.parent_process.user.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| evidences.process.parent_process.pid | Recommended: The process identifier, as reported by the operating system. | integer |
| evidences.process.parent_process.session | Optional: The user session under which this process is running. | object |
| evidences.process.parent_process.session.created_time | Recommended: The time when the session was created. | long |
| evidences.process.parent_process.session.is_remote | Recommended: The indication of whether the session is remote. | boolean |
| evidences.process.parent_process.session.issuer | Recommended: The identifier of the session issuer. | string |
| evidences.process.parent_process.session.uid | Recommended: The unique identifier of the session. | string |
| evidences.process.parent_process.uid | Recommended: A unique identifier for this process assigned by the producer (tool). | string |
| evidences.process.parent_process.user | Recommended: The user under which this process is running. | object |
| evidences.process.parent_process.user.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| evidences.process.parent_process.user.name | Recommended: The username. For example, janedoe1. |
string |
| evidences.process.parent_process.user.type_id | Recommended: The account type identifier. | integer |
| evidences.process.parent_process.user.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| evidences.process.pid | Recommended: The process identifier, as reported by the operating system. | integer |
| evidences.process.session | Optional: The user session under which this process is running. | object |
| evidences.process.session.created_time | Recommended: The time when the session was created. | long |
| evidences.process.session.is_remote | Recommended: The indication of whether the session is remote. | boolean |
| evidences.process.session.issuer | Recommended: The identifier of the session issuer. | string |
| evidences.process.session.uid | Recommended: The unique identifier of the session. | string |
| evidences.process.session.uuid | Optional: The universally unique identifier of the session. | string |
| evidences.process.uid | Recommended: A unique identifier for this process assigned by the producer (tool). | string |
| evidences.process.user | Recommended: The user under which this process is running. | object |
| evidences.process.user.account | Optional: The user's account or the account associated with the user. | object |
| evidences.process.user.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| evidences.process.user.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| evidences.process.user.account.type_id | Recommended: The normalized account type identifier. | integer |
| evidences.process.user.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| evidences.process.user.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| evidences.process.user.email_addr | Optional: The user's primary email address. | string |
| evidences.process.user.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| evidences.process.user.name | Recommended: The username. For example, janedoe1. |
string |
| evidences.process.user.org | Optional: Organization and org unit related to the user. | object |
| evidences.process.user.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| evidences.process.user.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| evidences.process.user.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| evidences.process.user.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| evidences.process.user.type | Optional: The type of the user. For example, System, AWS IAM User, | string |
| evidences.process.user.type_id | Recommended: The account type identifier. | integer |
| evidences.process.user.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| evidences.query | Recommended: Describes details about the DNS query associated to the activity that triggered the detection. | object |
| evidences.query.class | Recommended: The class of resource records being queried. | string |
| evidences.query.hostname | Required: The hostname or domain being queried. For example: www.example.com |
string |
| evidences.query.opcode_id | Recommended: The DNS opcode ID specifies the normalized query message type. | integer |
| evidences.query.packet_uid | Recommended: The DNS packet identifier assigned by the program that generated the query. | integer |
| evidences.query.type | Recommended: The type of resource records being queried. | string |
| evidences.src_endpoint | Recommended: Describes details about the source of the network activity that triggered the detection. | object |
| evidences.src_endpoint.container | Recommended: The information describing an instance of a container. | object |
| evidences.src_endpoint.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c86.... |
object |
| evidences.src_endpoint.container.hash.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| evidences.src_endpoint.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.src_endpoint.container.hash.value | Required: The digital fingerprint value. | string |
| evidences.src_endpoint.container.image | Recommended: The container image used as a template to run the container. | object |
| evidences.src_endpoint.container.image.name | Recommended: The image name. For example: elixir. |
string |
| evidences.src_endpoint.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| evidences.src_endpoint.container.name | Recommended: The container name. | string |
| evidences.src_endpoint.container.size | Recommended: The size of the container image. | long |
| evidences.src_endpoint.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: 13550340a8681c84c861aa.... |
string |
| evidences.src_endpoint.domain | Optional: The name of the domain. | string |
| evidences.src_endpoint.hostname | Recommended: The fully qualified name of the endpoint. | string |
| evidences.src_endpoint.instance_uid | Recommended: The unique identifier of a VM instance. | string |
| evidences.src_endpoint.interface_name | Recommended: The name of the network interface (for example eth2). | string |
| evidences.src_endpoint.interface_uid | Recommended: The unique identifier of the network interface. | string |
| evidences.src_endpoint.ip | Recommended: The IP address of the endpoint, in either IPv4 or IPv6 format. | string |
| evidences.src_endpoint.location | Optional: The geographical location of the endpoint. | object |
| evidences.src_endpoint.location.city | Recommended: The name of the city. | string |
| evidences.src_endpoint.location.continent | Recommended: The name of the continent. | string |
| evidences.src_endpoint.location.country | Recommended: The ISO 3166-1 Alpha-2 country code. | string |
| evidences.src_endpoint.location.lat | Optional: The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: 42.361145. |
float |
| evidences.src_endpoint.location.long | Optional: The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: -71.057083. |
float |
| evidences.src_endpoint.location.region | Optional: The alphanumeric code that identifies the principal subdivision (for example province or state) of the country. | string |
| evidences.src_endpoint.mac | Optional: The Media Access Control (MAC) address of the endpoint. | string |
| evidences.src_endpoint.name | Recommended: The short name of the endpoint. | string |
| evidences.src_endpoint.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| evidences.src_endpoint.owner | Recommended: The identity of the service or user account that owns the endpoint or was last logged into it. | object |
| evidences.src_endpoint.owner.account | Optional: The user's account or the account associated with the user. | object |
| evidences.src_endpoint.owner.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| evidences.src_endpoint.owner.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| evidences.src_endpoint.owner.account.type_id | Recommended: The normalized account type identifier. | integer |
| evidences.src_endpoint.owner.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| evidences.src_endpoint.owner.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| evidences.src_endpoint.owner.email_addr | Optional: The user's primary email address. | string |
| evidences.src_endpoint.owner.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| evidences.src_endpoint.owner.name | Recommended: The username. For example, janedoe1. |
string |
| evidences.src_endpoint.owner.org | Optional: Organization and org unit related to the user. | object |
| evidences.src_endpoint.owner.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| evidences.src_endpoint.owner.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| evidences.src_endpoint.owner.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| evidences.src_endpoint.owner.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| evidences.src_endpoint.owner.type | Optional: The type of the user. For example, System, AWS IAM User, | string |
| evidences.src_endpoint.owner.type_id | Recommended: The account type identifier. | integer |
| evidences.src_endpoint.owner.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| evidences.src_endpoint.port | Recommended: The port used for communication within the network connection. | integer |
| evidences.src_endpoint.proxy_endpoint | Optional: The network proxy information pertaining to a specific endpoint. | object |
| evidences.src_endpoint.proxy_endpoint.container | Recommended: The information describing an instance of a container. | object |
| evidences.src_endpoint.proxy_endpoint.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b440.... |
object |
| evidences.src_endpoint.proxy_endpoint.container.hash.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| evidences.src_endpoint.proxy_endpoint.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| evidences.src_endpoint.proxy_endpoint.container.hash.value | Required: The digital fingerprint value. | string |
| evidences.src_endpoint.proxy_endpoint.container.image | Recommended: The container image used as a template to run the container. | object |
| evidences.src_endpoint.proxy_endpoint.container.image.name | Recommended: The image name. For example: elixir. |
string |
| evidences.src_endpoint.proxy_endpoint.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| evidences.src_endpoint.proxy_endpoint.container.name | Recommended: The container name. | string |
| evidences.src_endpoint.proxy_endpoint.container.size | Recommended: The size of the container image. | long |
| evidences.src_endpoint.proxy_endpoint.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: 13550340a8681c84c861aa.... |
string |
| evidences.src_endpoint.proxy_endpoint.hostname | Recommended: The fully qualified name of the endpoint. | string |
| evidences.src_endpoint.proxy_endpoint.instance_uid | Recommended: The unique identifier of a VM instance. | string |
| evidences.src_endpoint.proxy_endpoint.interface_name | Recommended: The name of the network interface (for example eth2). | string |
| evidences.src_endpoint.proxy_endpoint.interface_uid | Recommended: The unique identifier of the network interface. | string |
| evidences.src_endpoint.proxy_endpoint.ip | Recommended: The IP address of the endpoint, in either IPv4 or IPv6 format. | string |
| evidences.src_endpoint.proxy_endpoint.name | Recommended: The short name of the endpoint. | string |
| evidences.src_endpoint.proxy_endpoint.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| evidences.src_endpoint.proxy_endpoint.owner | Recommended: The identity of the service or user account that owns the endpoint or was last logged into it. | object |
| evidences.src_endpoint.proxy_endpoint.owner.account | Optional: The user's account or the account associated with the user. | object |
| evidences.src_endpoint.proxy_endpoint.owner.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| evidences.src_endpoint.proxy_endpoint.owner.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| evidences.src_endpoint.proxy_endpoint.owner.account.type_id | Recommended: The normalized account type identifier. | integer |
| evidences.src_endpoint.proxy_endpoint.owner.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| evidences.src_endpoint.proxy_endpoint.owner.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| evidences.src_endpoint.proxy_endpoint.owner.email_addr | Optional: The user's primary email address. | string |
| evidences.src_endpoint.proxy_endpoint.owner.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| evidences.src_endpoint.proxy_endpoint.owner.name | Recommended: The username. For example, janedoe1. |
string |
| evidences.src_endpoint.proxy_endpoint.owner.org | Optional: Organization and org unit related to the user. | object |
| evidences.src_endpoint.proxy_endpoint.owner.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| evidences.src_endpoint.proxy_endpoint.owner.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| evidences.src_endpoint.proxy_endpoint.owner.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| evidences.src_endpoint.proxy_endpoint.owner.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| evidences.src_endpoint.proxy_endpoint.owner.type | Optional: The type of the user. For example, System, AWS IAM User, | string |
| evidences.src_endpoint.proxy_endpoint.owner.type_id | Recommended: The account type identifier. | integer |
| evidences.src_endpoint.proxy_endpoint.owner.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| evidences.src_endpoint.proxy_endpoint.port | Recommended: The port used for communication within the network connection. | integer |
| evidences.src_endpoint.proxy_endpoint.svc_name | Recommended: The service name in service-to-service connections. | string |
| evidences.src_endpoint.proxy_endpoint.type_id | Recommended: The network endpoint type ID. | integer |
| evidences.src_endpoint.proxy_endpoint.uid | Recommended: The unique identifier of the endpoint. | string |
| evidences.src_endpoint.svc_name | Recommended: The service name in service-to-service connections. | string |
| evidences.src_endpoint.type_id | Recommended: The network endpoint type ID. | integer |
| evidences.src_endpoint.uid | Recommended: The unique identifier of the endpoint. | string |
| evidences.src_endpoint.zone | Optional: The network zone or LAN segment. | string |
| file | Recommended: Describes a file that contains classified or sensitive data. | object |
| file.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| file.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| file.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| file.hashes | Recommended: An array of hash attributes. | array of objects |
| file.hashes.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| file.hashes.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| file.hashes.value | Required: The digital fingerprint value. | string |
| file.name | Required: The name of the file. | string |
| file.parent_folder | Optional: The parent folder in which the file resides. For example: c:\windows\system32 |
string |
| file.path | Recommended: The full path to the file. | string |
| file.size | Optional: The size of data, in bytes. | long |
| file.type | Optional: The file type. | string |
| file.type_id | Required: The file type ID. | integer |
| finding_info | Required: Describes the supporting information about a generated finding. | object |
| finding_info.analytic | Recommended: The analytic technique used to analyze and derive insights from the data or information that led to the finding or conclusion. | object |
| finding_info.analytic.name | Recommended: The name of the analytic that generated the finding. | string |
| finding_info.analytic.type_id | Required: The analytic type ID. | integer |
| finding_info.analytic.uid | Recommended: The unique identifier of the analytic that generated the finding. | string |
| finding_info.desc | Optional: The description of the reported finding. | string |
| finding_info.product_uid | Optional: The unique identifier of the product that reported the finding. | string |
| finding_info.title | Required: A title or a brief phrase summarizing the reported finding. | string |
| finding_info.types | Optional: One or more types of the reported finding. | array of strings |
| finding_info.uid | Required: The unique identifier of the reported finding. | string |
| finding_info_list | Required: A list of finding_info objects associated to an incident. |
array of objects |
| finding_info_list.analytic | Recommended: The analytic technique used to analyze and derive insights from the data or information that led to the finding or conclusion. | object |
| finding_info_list.analytic.name | Recommended: The name of the analytic that generated the finding. | string |
| finding_info_list.analytic.type_id | Required: The analytic type ID. | integer |
| finding_info_list.analytic.uid | Recommended: The unique identifier of the analytic that generated the finding. | string |
| finding_info_list.desc | Optional: The description of the reported finding. | string |
| finding_info_list.product_uid | Optional: The unique identifier of the product that reported the finding. | string |
| finding_info_list.title | Required: A title or a brief phrase summarizing the reported finding. | string |
| finding_info_list.types | Optional: One or more types of the reported finding. | array of strings |
| finding_info_list.uid | Required: The unique identifier of the reported finding. | string |
| impact | Recommended: The impact , normalized to the caption of the impact_id value. | string |
| impact_id | Recommended: The normalized impact of the finding. | integer |
| impact_score | Recommended: The impact of the finding, valid range 0-100. | integer |
| indexed_time | Required: The time when the event was indexed. | long |
| message | Recommended: The description of the event/finding, as defined by the source. | string |
| metadata | Required: The metadata associated with the event or a finding. | object |
| metadata.correlation_uid | Optional: The unique identifier used to correlate events. | string |
| metadata.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| metadata.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| metadata.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| metadata.event_code | Optional: The Event ID or Code that the product uses to describe the event. | string |
| metadata.log_level | Optional: The audit level at which an event was generated. | string |
| metadata.log_name | Recommended: The event log name. For example, syslog file name or Windows logging subsystem: Security. | string |
| metadata.log_provider | Recommended: The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing. | string |
| metadata.original_time | Recommended: The original event time as reported by the event source. | string |
| metadata.product | Required: The product that reported the event. | object |
| metadata.product.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| metadata.product.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| metadata.product.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| metadata.product.feature | Optional: The feature that reported the event. | object |
| metadata.product.feature.name | Recommended: The name of the feature. | string |
| metadata.product.feature.uid | Recommended: The unique identifier of the feature. | string |
| metadata.product.feature.version | Recommended: The version of the feature. | string |
| metadata.product.name | Recommended: The name of the product. | string |
| metadata.product.uid | Recommended: The unique identifier of the product. | string |
| metadata.product.vendor_name | Required: The name of the vendor of the product. | string |
| metadata.product.version | Recommended: The version of the product, as defined by the event source. For example: 2013.1.3-beta. |
string |
| metadata.profiles | Optional: The list of profiles used to create the event. | array of strings |
| metadata.sequence | Optional: Sequence number of the event. | integer |
| metadata.tenant_uid | Recommended: The unique tenant identifier. | string |
| metadata.uid | Optional: The logging system-assigned unique identifier of an event instance. | string |
| metadata.version | Required: The version of the OCSF schema. | string |
| observables | Recommended: The observables associated with the event or a finding. | array of objects |
| observables.name | Required: The full name of the observable attribute. The name is a pointer/reference to an attribute within the event data. For example: file.name. |
string |
| observables.type | Optional: The observable value type name. | string |
| observables.type_id | Required: The observable value type identifier. | integer |
| observables.value | Optional: The value associated with the observable attribute. The meaning of the value depends on the observable type. | string |
| original_event_time | Required: The original event time from the source system. | long |
| priority_id | Recommended: The normalized priority. | integer |
| raw_data | Optional: The raw event/finding data as received from the source. | string |
| raw_data_size | Optional: The size of the raw data which was transformed into an OCSF event, in bytes. | long |
| remediation | Recommended: Describes the recommended remediation steps to address identified issue(s). | object |
| remediation.desc | Required: The description of the remediation strategy. | string |
| resource | Recommended: Describes details about the resource that is the subject of the compliance check. | object |
| resource.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| resource.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| resource.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| resource.owner | Recommended: The identity of the service or user account that owns the resource. | object |
| resource.owner.account | Optional: The user's account or the account associated with the user. | object |
| resource.owner.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| resource.owner.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| resource.owner.account.type_id | Recommended: The normalized account type identifier. | integer |
| resource.owner.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| resource.owner.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| resource.owner.email_addr | Optional: The user's primary email address. | string |
| resource.owner.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| resource.owner.name | Recommended: The username. For example, janedoe1. |
string |
| resource.owner.org | Optional: Organization and org unit related to the user. | object |
| resource.owner.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| resource.owner.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| resource.owner.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| resource.owner.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| resource.owner.type | Optional: The type of the user. For example, System, AWS IAM User, | string |
| resource.owner.type_id | Recommended: The account type identifier. | integer |
| resource.owner.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| resources | Recommended: Describes details about resources that were the target of the activity that triggered the finding. | array of objects |
| resources.data_classification | Recommended: The Data Classification object includes information about data classification levels and data category types. | object |
| resources.data_classification.category_id | Recommended: The normalized identifier of the data classification category. | integer |
| resources.data_classification.confidentiality_id | Recommended: The normalized identifier of the file content confidentiality indicator. | integer |
| resources.owner | Recommended: The identity of the service or user account that owns the resource. | object |
| resources.owner.account | Optional: The user's account or the account associated with the user. | object |
| resources.owner.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| resources.owner.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| resources.owner.account.type_id | Recommended: The normalized account type identifier. | integer |
| resources.owner.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| resources.owner.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| resources.owner.email_addr | Optional: The user's primary email address. | string |
| resources.owner.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| resources.owner.name | Recommended: The username. For example, janedoe1. |
string |
| resources.owner.org | Optional: Organization and org unit related to the user. | object |
| resources.owner.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| resources.owner.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| resources.owner.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| resources.owner.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| resources.owner.type | Optional: The type of the user. For example, System, AWS IAM User, | string |
| resources.owner.type_id | Recommended: The account type identifier. | integer |
| resources.owner.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| severity | Optional: The event severity, normalized to the caption of the severity_id value. | string |
| severity_id | Required: <p>The normalized identifier of the event/finding severity.</p>The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events. | integer |
| src_endpoint | Recommended: Details about the source endpoint where classified or sensitive data was accessed from. | object |
| src_endpoint.container | Recommended: The information describing an instance of a container. | object |
| src_endpoint.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac.... |
object |
| src_endpoint.container.hash.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| src_endpoint.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| src_endpoint.container.hash.value | Required: The digital fingerprint value. | string |
| src_endpoint.container.image | Recommended: The container image used as a template to run the container. | object |
| src_endpoint.container.image.name | Recommended: The image name. For example: elixir. |
string |
| src_endpoint.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| src_endpoint.container.name | Recommended: The container name. | string |
| src_endpoint.container.size | Recommended: The size of the container image. | long |
| src_endpoint.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: 13550340a8681c84c861aa.... |
string |
| src_endpoint.domain | Optional: The name of the domain. | string |
| src_endpoint.hostname | Recommended: The fully qualified name of the endpoint. | string |
| src_endpoint.instance_uid | Recommended: The unique identifier of a VM instance. | string |
| src_endpoint.interface_name | Recommended: The name of the network interface (for example eth2). | string |
| src_endpoint.interface_uid | Recommended: The unique identifier of the network interface. | string |
| src_endpoint.ip | Recommended: The IP address of the endpoint, in either IPv4 or IPv6 format. | string |
| src_endpoint.location | Optional: The geographical location of the endpoint. | object |
| src_endpoint.location.city | Recommended: The name of the city. | string |
| src_endpoint.location.continent | Recommended: The name of the continent. | string |
| src_endpoint.location.country | Recommended: The ISO 3166-1 Alpha-2 country code. | string |
| src_endpoint.location.lat | Optional: The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: 42.361145. |
float |
| src_endpoint.location.long | Optional: The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: -71.057083. |
float |
| src_endpoint.location.region | Optional: The alphanumeric code that identifies the principal subdivision (for example province or state) of the country. | string |
| src_endpoint.mac | Optional: The Media Access Control (MAC) address of the endpoint. | string |
| src_endpoint.name | Recommended: The short name of the endpoint. | string |
| src_endpoint.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| src_endpoint.owner | Recommended: The identity of the service or user account that owns the endpoint or was last logged into it. | object |
| src_endpoint.owner.account | Optional: The user's account or the account associated with the user. | object |
| src_endpoint.owner.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| src_endpoint.owner.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| src_endpoint.owner.account.type_id | Recommended: The normalized account type identifier. | integer |
| src_endpoint.owner.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| src_endpoint.owner.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| src_endpoint.owner.email_addr | Optional: The user's primary email address. | string |
| src_endpoint.owner.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| src_endpoint.owner.name | Recommended: The username. For example, janedoe1. |
string |
| src_endpoint.owner.org | Optional: Organization and org unit related to the user. | object |
| src_endpoint.owner.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| src_endpoint.owner.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| src_endpoint.owner.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| src_endpoint.owner.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| src_endpoint.owner.type | Optional: The type of the user. For example, System, AWS IAM User, | string |
| src_endpoint.owner.type_id | Recommended: The account type identifier. | integer |
| src_endpoint.owner.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| src_endpoint.port | Recommended: The port used for communication within the network connection. | integer |
| src_endpoint.proxy_endpoint | Optional: The network proxy information pertaining to a specific endpoint. | object |
| src_endpoint.proxy_endpoint.container | Recommended: The information describing an instance of a container. | object |
| src_endpoint.proxy_endpoint.container.hash | Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac.... |
object |
| src_endpoint.proxy_endpoint.container.hash.algorithm | Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. | string |
| src_endpoint.proxy_endpoint.container.hash.algorithm_id | Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | integer |
| src_endpoint.proxy_endpoint.container.hash.value | Required: The digital fingerprint value. | string |
| src_endpoint.proxy_endpoint.container.image | Recommended: The container image used as a template to run the container. | object |
| src_endpoint.proxy_endpoint.container.image.name | Recommended: The image name. For example: elixir. |
string |
| src_endpoint.proxy_endpoint.container.image.uid | Required: The unique image ID. For example: 77af4d6b9913. |
string |
| src_endpoint.proxy_endpoint.container.name | Recommended: The container name. | string |
| src_endpoint.proxy_endpoint.container.size | Recommended: The size of the container image. | long |
| src_endpoint.proxy_endpoint.container.uid | Recommended: The full container unique identifier for this instantiation of the container. For example: 13550340a8681c84c861aa.... |
string |
| src_endpoint.proxy_endpoint.hostname | Recommended: The fully qualified name of the endpoint. | string |
| src_endpoint.proxy_endpoint.instance_uid | Recommended: The unique identifier of a VM instance. | string |
| src_endpoint.proxy_endpoint.interface_name | Recommended: The name of the network interface (for example eth2). | string |
| src_endpoint.proxy_endpoint.interface_uid | Recommended: The unique identifier of the network interface. | string |
| src_endpoint.proxy_endpoint.ip | Recommended: The IP address of the endpoint, in either IPv4 or IPv6 format. | string |
| src_endpoint.proxy_endpoint.name | Recommended: The short name of the endpoint. | string |
| src_endpoint.proxy_endpoint.namespace_pid | Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. | integer |
| src_endpoint.proxy_endpoint.owner | Recommended: The identity of the service or user account that owns the endpoint or was last logged into it. | object |
| src_endpoint.proxy_endpoint.owner.account | Optional: The user's account or the account associated with the user. | object |
| src_endpoint.proxy_endpoint.owner.account.name | Recommended: The name of the account (for example GCP Account Name). | string |
| src_endpoint.proxy_endpoint.owner.account.type | Optional: The account type, normalized to the caption of 'account_type_id'. | string |
| src_endpoint.proxy_endpoint.owner.account.type_id | Recommended: The normalized account type identifier. | integer |
| src_endpoint.proxy_endpoint.owner.account.uid | Recommended: The unique identifier of the account (for example AWS Account ID). | string |
| src_endpoint.proxy_endpoint.owner.domain | Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. | string |
| src_endpoint.proxy_endpoint.owner.email_addr | Optional: The user's primary email address. | string |
| src_endpoint.proxy_endpoint.owner.full_name | Optional: The full name of the person, as per the LDAP Common Name attribute (cn). | string |
| src_endpoint.proxy_endpoint.owner.name | Recommended: The username. For example, janedoe1. |
string |
| src_endpoint.proxy_endpoint.owner.org | Optional: Organization and org unit related to the user. | object |
| src_endpoint.proxy_endpoint.owner.org.name | Recommended: The name of the organization. For example, Widget, Inc. | string |
| src_endpoint.proxy_endpoint.owner.org.ou_name | Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D | string |
| src_endpoint.proxy_endpoint.owner.org.uid | Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | string |
| src_endpoint.proxy_endpoint.owner.risk_level | Optional: The risk level, normalized to the caption of the risk_level_id value. | string |
| src_endpoint.proxy_endpoint.owner.type | Optional: The type of the user. For example, System, AWS IAM User, | string |
| src_endpoint.proxy_endpoint.owner.type_id | Recommended: The account type identifier. | integer |
| src_endpoint.proxy_endpoint.owner.uid | Recommended: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | string |
| src_endpoint.proxy_endpoint.port | Recommended: The port used for communication within the network connection. | integer |
| src_endpoint.proxy_endpoint.svc_name | Recommended: The service name in service-to-service connections. | string |
| src_endpoint.proxy_endpoint.type_id | Recommended: The network endpoint type ID. | integer |
| src_endpoint.proxy_endpoint.uid | Recommended: The unique identifier of the endpoint. | string |
| src_endpoint.svc_name | Recommended: The service name in service-to-service connections. | string |
| src_endpoint.type_id | Recommended: The network endpoint type ID. | integer |
| src_endpoint.uid | Recommended: The unique identifier of the endpoint. | string |
| src_endpoint.zone | Optional: The network zone or LAN segment. | string |
| src_url | Recommended: A Url link used to access the original incident. | string |
| start_time | Optional: The start time of a time period, or the time of the least recent event included in the aggregate event. | long |
| status | Recommended: The event status, normalized to the caption of the status_id value. | string |
| status_code | Recommended: The event status code, as reported by the event source. | string |
| status_detail | Recommended: The status details contains additional information about the event/finding outcome. | string |
| status_id | Recommended: The normalized identifier of the event status. | integer |
| table | Recommended: Describes the table where classified or sensitive data is stored in, or was accessed from. | object |
| table.name | Recommended: The table name, ordinarily as assigned by a database administrator. | string |
| table.uid | Recommended: The unique identifier of the table. | string |
| timezone_offset | Recommended: The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080. |
integer |
| type_name | Optional: The event type name, as defined by the type_uid. | string |
| type_uid | Required: The event/finding type ID. It identifies the event's semantics and structure. | long |
| unmapped | Optional: The attributes that are not mapped to the event schema. | object |
| verdict | Recommended: The verdict assigned to an Incident finding. | string |
| verdict_id | Recommended: The normalized verdict of an Incident. | integer |
| volume | Required: The allocated event volume for the event in bytes. | long |
| vulnerabilities | Required: This object describes vulnerabilities reported in a security finding. | array of objects |
| vulnerabilities.cve | Recommended: The Common Vulnerabilities and Exposures . | object |
| vulnerabilities.cve.created_time | Recommended: The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. | long |
| vulnerabilities.cve.cvss | Recommended: The CVSS object details Common Vulnerability Scoring System | array of objects |
| vulnerabilities.cve.cvss.base_score | Required: The CVSS base score. For example: 9.1. |
float |
| vulnerabilities.cve.cvss.depth | Recommended: The CVSS depth represents a depth of the equation used to calculate CVSS score. | string |
| vulnerabilities.cve.cvss.overall_score | Recommended: The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: 9.1. |
float |
| vulnerabilities.cve.cvss.version | Required: The CVSS version. For example: 3.1. |
string |
| vulnerabilities.cve.references | Recommended: A list of reference URLs with additional information about the CVE Record. | array of strings |
| vulnerabilities.cve.title | Recommended: A title or a brief phrase summarizing the CVE record. | string |
| vulnerabilities.cve.type | Recommended: <p>The vulnerability type as selected from a large dropdown menu during CVE refinement. | string |
| vulnerabilities.cve.uid | Required: The Common Vulnerabilities and Exposures unique number assigned to a specific computer vulnerability. | string |
| vulnerabilities.cwe | Recommended: The CWE object represents a weakness in a software system that can be exploited by a threat actor to perform an attack. | object |
| vulnerabilities.cwe.uid | Required: The Common Weakness Enumeration unique number assigned to a specific weakness. | string |
| vulnerabilities.references | Recommended: A list of reference URLs with additional information about the vulnerability. | array of strings |