Available inventory fields

The Wazuh indexer stores the system inventory data collected by Syscollector from every monitored endpoint in a set of indices, one for each inventory data type, such as hardware, software, and network information. Wazuh agents scan the endpoint and report the results to the Wazuh manager, which forwards the data to the Wazuh indexer for storage. The indexer consolidates this data for querying, visualization, and analysis on the Wazuh dashboard. The following section details the structure of these indices and their corresponding fields. The data available in each index depends on the scan configuration defined for the Syscollector module.

Common fields

Every system inventory index carries the following fields in addition to its data-type fields. They are documented once here and omitted from the per-index tables below.

Field	Type	Description
`checksum.hash.sha1`	keyword	SHA1 hash used as checksum of the data collected by the agent
`message`	text	Log message optimized for viewing in a log viewer.
`state.document_version`	integer	Version of the document
`state.modified_at`	date	Date/time when the state was last modified
`wazuh.agent.groups`	keyword	List of groups the agent belongs to
`wazuh.agent.host.architecture`	keyword	Operating system architecture
`wazuh.agent.host.hostname`	keyword	Hostname of the host
`wazuh.agent.host.ip`	ip	Host IP addresses
`wazuh.agent.host.os.name`	keyword	Operating system name, without the version
`wazuh.agent.host.os.platform`	keyword	Operating system platform (such as centos, ubuntu, windows)
`wazuh.agent.host.os.type`	keyword	Commercial OS family: one of linux, macos, unix, windows, ios, or android
`wazuh.agent.host.os.version`	keyword	Operating system version as a raw string
`wazuh.agent.id`	keyword	Unique identifier of this agent
`wazuh.agent.name`	keyword	Custom name of the agent
`wazuh.agent.version`	keyword	Version of the agent
`wazuh.cluster.name`	keyword	Wazuh cluster name
`wazuh.cluster.node`	keyword	Wazuh cluster node name
`wazuh.schema.version`	keyword	Wazuh schema version

Hardware

This scan collects baseline hardware information from monitored endpoints, including CPU, memory, and serial number. The data is stored in the wazuh-states-inventory-hardware index on the Wazuh indexer.

Field	Type	Description	Example (Windows)	Example (Linux)
`host.cpu.cores`	short	Number of CPU cores	8	4
`host.cpu.name`	keyword	Name/model of the CPU	Intel(R) Core(TM) i5-8365U CPU @ 1.60GHz	Intel(R) Core(TM) i5-8365U CPU @ 1.60GHz
`host.cpu.speed`	long	CPU clock speed in MHz	1896	1897
`host.memory.free`	long	Free memory, in Bytes	3364438016	3641774080
`host.memory.total`	long	Total memory, in Bytes	16976740352	4101619712
`host.memory.usage`	scaled_float	Percent memory used, between 0 and 1
`host.memory.used`	long	Used memory, in Bytes	13612302336	459845632
`host.serial_number`	keyword	Serial number of the device	PHWGH00WBCZ54Q	0

Data-type fields: 8 (plus 18 common fields).

Operating system

This scan collects system-level details about each monitored endpoint, including the operating system, version, hostname, and architecture. The data is stored in the wazuh-states-inventory-system index on the Wazuh indexer.

Field	Type	Description	Example (Windows)	Example (Linux)
`host.architecture`	keyword	Operating system architecture.	x86_64	x86_64
`host.hostname`	keyword	Hostname of the host.	user1	vagrant
`host.os.build`	keyword	Build number of the OS.	26100.3775
`host.os.codename`	keyword	OS codename		jammy
`host.os.distribution.release`	keyword	Distribution-specific release information	2009
`host.os.full`	keyword	Operating system name, including the version or code name	24H2
`host.os.kernel.name`	keyword	System kernel name		Linux
`host.os.kernel.release`	keyword	Kernel release version	10.0.26100.3775	5.15.0-83-generic
`host.os.kernel.version`	keyword	Kernel version		#92-Ubuntu SMP Mon Aug 14 09:30:42 UT...
`host.os.major`	keyword	Major version number	10	22
`host.os.minor`	keyword	Minor version number	0	04
`host.os.name`	keyword	Operating system name, without the version	Microsoft Windows 11 Pro	Ubuntu
`host.os.patch`	keyword	Patch level of the OS		3
`host.os.platform`	keyword	Operating system platform (such centos, ubuntu, windows).	windows	ubuntu
`host.os.type`	keyword	Which commercial OS family (one of: linux, macos, unix, windows, ios or android)	windows	linux
`host.os.version`	keyword	Operating system version as a raw string.	10.0.26100.3775	22.04.3 LTS (Jammy Jellyfish)

Data-type fields: 16 (plus 18 common fields).

Packages

This scan collects details about the currently installed software on a monitored endpoint, including the package name, installation date, and version. The Vulnerability Detection module uses information from this data to detect vulnerable software. The data is stored in the wazuh-states-inventory-packages index on the Wazuh indexer.

Field	Type	Description	Example (Windows)	Example (Linux)
`package.architecture`	keyword	Package architecture.	i686	all
`package.category`	keyword	Package category or group.		admin
`package.description`	keyword	Description of the package		add and remove users and groups
`package.installed`	date	Time when package was installed	2023-10-15T23:00:00.000Z
`package.multiarch`	keyword	Whether the package is built for a foreign architecture		foreign
`package.name`	keyword	Package name.	Python Launcher	adduser
`package.path`	keyword	Path where the package is installed
`package.priority`	keyword	Package priority		important
`package.size`	long	Package size in bytes	0	622592
`package.source`	keyword	Package source
`package.type`	keyword	Package type.	win	deb
`package.vendor`	keyword	Vendor or maintainer of the package.	Python Software Foundation	Ubuntu Developers <ubuntu-devel-discu...
`package.version`	keyword	Package version.	3.12.150.0	3.118ubuntu5

Data-type fields: 13 (plus 18 common fields).

Network interfaces

This scan collects details about the network interfaces on monitored endpoints. The data is stored in the wazuh-states-inventory-interfaces index on the Wazuh indexer.

Field	Type	Description	Example (Windows)	Example (Linux)
`host.mac`	keyword	Host MAC addresses.	08:71:90:c9:1a:bc	08:00:27:3b:cf:90
`host.network.egress.bytes`	long	The number of bytes sent on all network interfaces.	432594126	164987
`host.network.egress.drops`	long	Number of dropped transmitted packets.	0	0
`host.network.egress.errors`	long	Number of transmission errors.	0	0
`host.network.egress.packets`	long	The number of packets sent on all network interfaces.	1314567	1205
`host.network.ingress.bytes`	long	The number of bytes received on all network interfaces.	1281173517	14790629
`host.network.ingress.drops`	long	Number of dropped received packets.	0	0
`host.network.ingress.errors`	long	Number of reception errors.	0	0
`host.network.ingress.packets`	long	The number of packets received on all network interfaces	2764421	10797
`interface.alias`	keyword	Interface alias	Intel(R) Wireless-AC 9560 160MHz
`interface.mtu`	long	Maximum transmission unit size.	1472	1500
`interface.name`	keyword	Interface name	Wi-Fi	eth0
`interface.state`	keyword	State of the network interface.	up	up
`interface.type`	keyword	Interface type.	wireless	ethernet

Data-type fields: 14 (plus 18 common fields).

Network addresses

The network address scan collects information about the IPv4 and IPv6 addresses assigned to network interfaces on monitored endpoints. The data is stored in the wazuh-states-inventory-networks index on the Wazuh indexer.

Field	Type	Description	Example (Windows)	Example (Linux)
`interface.name`	keyword	Interface name.	VMware Network Adapter VMnet1	eth0
`network.broadcast`	ip	Broadcast address	192.168.2.255	10.0.2.255
`network.dhcp`	boolean	DHCP enabled.
`network.ip`	ip	IP address.	192.168.2.1	10.0.2.15
`network.metric`	long	Metric of the network protocol.
`network.netmask`	ip	Network mask.	255.255.255.0	255.255.255.0
`network.type`	keyword	In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc.	0	0

Data-type fields: 7 (plus 18 common fields).

Network protocols

This scan stores details about network routing and supported protocols for each interface on monitored endpoints. The data is stored in the wazuh-states-inventory-protocols index on the Wazuh indexer.

Field	Type	Description	Example (Windows)	Example (Linux)
`interface.name`	keyword	Interface name	Bluetooth Network Connection	eth0
`network.dhcp`	boolean	DHCP enabled	True	False
`network.gateway`	ip	Gateway address		10.0.2.2
`network.metric`	long	Metric of the network protocol.	65	100
`network.type`	keyword	In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc.	ipv4	ipv4

Data-type fields: 5 (plus 18 common fields).

Ports

This scan retrieves information about the open ports on a monitored endpoint, including the port number, protocol, and listening state. The data is stored in the wazuh-states-inventory-ports index on the Wazuh indexer.

Field	Type	Description	Example (Windows)	Example (Linux)
`destination.ip`	ip	Remote IP address	0.0.0.0	127.0.0.53
`destination.port`	long	Remote port	0	53
`file.inode`	keyword	Inode representing the file in the filesystem	0	17975
`host.network.egress.queue`	long	Transmit queue length	0	0
`host.network.ingress.queue`	long	Receive queue length	0	0
`interface.state`	keyword	State of the network interface.	listening
`network.transport`	keyword	Protocol Name corresponding to the field iana_number.	tcp	udp
`process.name`	keyword	Process name	System	systemd-resolve
`process.pid`	long	Process id	4	697
`source.ip`	ip	Local IP address	0.0.0.0	0.0.0.0
`source.port`	long	Local port	2869	53

Data-type fields: 11 (plus 18 common fields).

Processes

The processes scan collects details about processes running on monitored endpoints, including the process name, process ID (PID), and the associated user. The data is stored in the wazuh-states-inventory-processes index on the Wazuh indexer.

Field	Type	Description	Example (Windows)	Example (Linux)
`process.args`	keyword	Array of process arguments	-admin
`process.args_count`	long	Length of the process.args array.	6	0
`process.command_line`	keyword	Full command line that started the process	"C:\WINDOWS\System32\DriverStore\File...
`process.name`	keyword	Process name.	RtkAudUService64.exe	ipv6_addrconf
`process.parent.pid`	long	Process id.	8292	2
`process.pid`	long	Process id.	10272	120
`process.start`	date	The time the process started	2026-07-10T11:03:30.000Z	2026-07-11T13:20:39.000Z
`process.state`	keyword	Current process state		I
`process.stime`	long	System mode CPU time used.	2	0
`process.utime`	long	User mode CPU time used	0	0

Data-type fields: 10 (plus 18 common fields).

Windows updates

This scan collects details about the updates installed on Windows endpoints. The Vulnerability Detection module uses the hotfix identifier to discover what vulnerabilities exist on Windows endpoints and the patches you have applied. The data is stored in the wazuh-states-inventory-hotfixes index on the Wazuh indexer.

Field	Type	Description	Example (Windows)	Example (Linux)
`package.hotfix.name`	keyword	Name of the Hotfix	KB2267602

Data-type fields: 1 (plus 18 common fields).

Users

This scan collects user account information on monitored endpoints, including username, login status, and ID. The data is stored in the wazuh-states-inventory-users index on the Wazuh indexer.

Field	Type	Description	Example (Windows)	Example (Linux)
`host.ip`	ip	Host ip addresses
`login.status`	boolean	Whether the login was successful or the user is currently logged in	False	False
`login.tty`	keyword	Terminal associated with the login session (e.g., pts/1)
`login.type`	keyword	Type of login session. Example values: "user", "system", "remote"
`process.pid`	long	Process id	0	0
`user.auth_failures.count`	integer	Number of failed authentication attempts	0	0
`user.auth_failures.timestamp`	date	Timestamp of the last authentication failure
`user.created`	date	Datetime when the user was created
`user.full_name`	keyword	User's full name, if available
`user.group.id`	unsigned_long	Group ID	544	65534
`user.group.id_signed`	long	Signed group ID	544	65534
`user.groups`	keyword	List of groups the user belongs to	Administrators:Users	nogroup
`user.home`	keyword	Home directory of the user		/nonexistent
`user.id`	keyword	Unique identifier of the user	1005	100
`user.is_hidden`	boolean	Whether the user is hidden	False	False
`user.is_remote`	boolean	Whether the user is remote	False	True
`user.last_login`	date	Date of the last login
`user.name`	keyword	Short name or login of the user	admin	_apt
`user.password.expiration_date`	date	Password expiration date (epoch)
`user.password.hash_algorithm`	keyword	Algorithm used to hash the password
`user.password.inactive_days`	integer	Number of days of inactivity before disabling the password	0	-1
`user.password.last_change`	integer	Days since epoch when password was last changed	0	1691625600
`user.password.last_set_time`	date	Time the password was last set (epoch)
`user.password.max_days_between_changes`	integer	Maximum days between password changes	0	99999
`user.password.min_days_between_changes`	integer	Minimum days between password changes	0	0
`user.password.status`	keyword	Password status (e.g., active)		locked
`user.password.warning_days_before_expiration`	integer	Days before expiration to warn user	0	7
`user.roles`	keyword	Roles assigned to the user
`user.shell`	keyword	Shell used by the user	C:\Windows\system32\cmd.exe	/usr/sbin/nologin
`user.type`	keyword	Type of user (e.g., "system", "regular")	local
`user.uid_signed`	long	Signed user ID	1005	100
`user.uuid`	keyword	UUID of the user	S-1-5-21-1802346814-1231969593-149649...

Data-type fields: 32 (plus 18 common fields).

Groups

The scan collects details about user account groups on monitored endpoints, such as group identifiers, names, and associated users. The data is stored in the wazuh-states-inventory-groups index on the Wazuh indexer.

Field	Type	Description	Example (Windows)	Example (Linux)
`group.description`	match_only_text	Description of the group	VMware User Group
`group.id`	unsigned_long	Unsigned int64 group ID.	1004	111
`group.id_signed`	long	A signed int64 version of the group's ID.	1004	111
`group.is_hidden`	boolean	IsHidden attribute set in OpenDirectory.	False	False
`group.name`	keyword	Name of the group	__vmware__	_ssh
`group.users`	keyword	List of users that belong to the group
`group.uuid`	keyword	Unique group ID	S-1-5-21-1802346814-1231969593-149649...

Data-type fields: 7 (plus 18 common fields).

Services

This scan collects services information from monitored endpoints, including service name, description, and state. The data is stored in the wazuh-states-inventory-services index on the Wazuh indexer.

Field	Type	Description	Example (Windows)	Example (Linux)
`error.log.file.path`	keyword	Path to the file where the service writes its error output, if configured
`file.path`	keyword	Full path to the file, including the file name
`log.file.path`	keyword	Path to the file where the service writes its standard log output
`process.args`	keyword	Array of process arguments
`process.executable`	keyword	Absolute path to the process executable	\SystemRoot\system32\drivers\mrxdav.sys	/lib/systemd/system/apparmor.service
`process.group.name`	keyword	Name of the group
`process.pid`	long	Process id	0	0
`process.root_directory`	keyword	Chroot directory before execution
`process.user.name`	keyword	Short name or login of the user
`process.working_directory`	keyword	The working directory of the process
`service.address`	keyword	Address of this service
`service.description`	keyword	Description of the service	Network Redirector that provides WebD...	Load AppArmor profiles
`service.enabled`	keyword	Whether the unit file is enabled, e.g. enabled, masked, disabled, etc.		enabled
`service.exit_code`	integer	Service-specific exit code on failure.	0	0
`service.following`	keyword	The name of another unit that this unit follows in state.
`service.frequency`	long	Frequency in seconds at which the service is run.	0	0
`service.id`	keyword	Unique identifier of the running service	MRxDAV	apparmor
`service.inetd_compatibility`	boolean	Run job as if launched from inetd	False	False
`service.name`	keyword	Name of the service	WebDav Client Redirector Driver	apparmor
`service.object_path`	keyword	D-Bus object path of the service		/org/freedesktop/systemd1/unit/apparm...
`service.restart`	keyword	Restart policy for the service, e.g. always, on-failure, never.
`service.start_type`	keyword	Service start type: BOOT_START, SYSTEM_START, AUTO_START, DEMAND_START, DISABLED.	DEMAND_START
`service.starts.on_mount`	boolean	Launches every time a filesystem is mounted.	False	False
`service.starts.on_not_empty_directory`	keyword	Launches when directories become non-empty.
`service.starts.on_path_modified`	keyword	Launches on path modification.
`service.state`	keyword	Current state of the service.	STOPPED	active
`service.sub_state`	keyword	The low-level unit activation state, values depend on unit type		exited
`service.target.address`	keyword	Address of this service.		/
`service.target.ephemeral_id`	keyword	Ephemeral identifier of this service.	0	0
`service.target.type`	keyword	The type of the service.
`service.type`	keyword	The type of the service.	FILE_SYSTEM_DRIVER
`service.win32_exit_code`	integer	Win32 exit code on start/stop.	1077	0

Data-type fields: 32 (plus 18 common fields).

Browser extensions

This scan collects browser extension details from monitored endpoints, including browser name, extension description, and status. The data is stored in the wazuh-states-inventory-browser-extensions index on the Wazuh indexer.

Field	Type	Description	Example (Windows)	Example (Linux)
`browser.name`	keyword	Name of the browser. Valid values: chrome, chromium, opera, yandex, brave, edge, edge_beta.	chrome
`browser.profile.name`	keyword	Name of the browser profile.	Person 1
`browser.profile.path`	keyword	Path to the browser profile.	C:\Users\user1\AppData\Local\Google\C...
`browser.profile.referenced`	boolean	Indicates if the extension is referenced by the Preferences file of the browser profile.	True
`file.hash.sha256`	keyword	SHA256 hash.	9def6df5343532a9e09c1b359236397580ee6...
`package.autoupdate`	boolean	Indicates if the browser extension is set to auto-update.	False
`package.build_version`	keyword	Build version information.
`package.description`	keyword	Description of the package	Provides up-to-the-minute access to M...
`package.enabled`	boolean	Indicates if the browser extension is enabled.	True
`package.from_webstore`	boolean	Indicates if the browser extension was installed from a webstore.	True
`package.id`	keyword	Unique identifier for the browser extension	aghmgfkjfbkcockededacdhemkpgdcko
`package.installed`	date	Time when package was installed.	1699606516
`package.name`	keyword	Package name	Mandiant Advantage \	Threat Intelligence
`package.path`	keyword	Path where the package is installed	C:\Users\user1\AppData\Local\Google\C...
`package.permissions`	keyword	Permissions required by the browser extension.	identity, storage, tabs, history
`package.persistent`	boolean	Indicates if the browser extension is persistent across tabs.	False
`package.reference`	keyword	Package home page or reference URL.	https://clients2.google.com/service/u...
`package.type`	keyword	Package type.
`package.vendor`	keyword	Vendor, author or creator of the browser extension.
`package.version`	keyword	Package version	3.2.3
`package.visible`	boolean	Indicates if the browser extension is visible in the toolbar.	False
`user.id`	keyword	Unique identifier of the user.	1003

Data-type fields: 22 (plus 18 common fields).