WCS field reference

This page lists the fields of each WCS module. You can learn how the schema is organized in How WCS works, how Wazuh fills the fields in How Wazuh uses WCS fields, and which fields to use first in Key WCS fields.

Table columns

Every table on this page describes one field per row. Each field set table lists its fields with the following columns:

Field: The full name of the field as it appears in an event, including its field set prefix. For example, file.path or wazuh.agent.id.
Type: The data type the Wazuh indexer uses to store the field's value. For example, keyword for text such as user.name, long for whole numbers such as file.size, date for timestamps such as @timestamp, and ip for IP addresses.
Level: Where the field comes from. core and extended fields come from ECS. core fields are the most widely used, such as @timestamp and user.name, and extended fields cover more specific cases. custom fields are added by WCS, such as agent.groups.
Normalization: array means the field is expected to hold a list of values, for example, process.args. An empty cell means the schema sets no expectation. Any field can still hold a list of values of its type; for example, gen_ai.response.finish_reasons.
Indexed: Whether the Wazuh indexer indexes the field so you can search on it. Almost all fields are true. Fields marked false, such as event.original, are stored in the event, but you can't search or filter on them.
Example: A sample value for the field, as it would appear in an event. For example, /home/alice/example.png for file.path.
Description: A short explanation of what the field contains. For example, the description of file.size is "File size in bytes."

Event fields

Event fields describe the normalized events that Wazuh stores in the wazuh-events-v5-<CATEGORY> data streams. The following tables show the WCS field reference, grouped by field set.

Each field set table starts with a one-sentence description of the field set. ECS field sets use their short description from ECS 9.1.0. The field sets that WCS adds use the following descriptions:

wazuh: Fields Wazuh adds to describe how it collected and processed the event.
check: The results of Security Configuration Assessment (SCA) checks, including the condition, the result, the rationale, and the remediation.
policy: The SCA policies that group the checks.
compliance: The compliance requirements an event relates to.
mitre: The MITRE ATT&CK tactics, techniques, and subtechniques an event relates to.

agent

Fields about the monitoring agent.

Field	Type	Level	Normalization	Indexed	Example	Description
`agent.build.original`	`keyword`	`core`		`true`	`metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]`	Extended build information for the agent.
`agent.ephemeral_id`	`keyword`	`extended`		`true`	`8a4f500f`	Ephemeral identifier of this agent.
`agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`agent.type`	`keyword`	`core`		`true`	`filebeat`	Type of the agent.
`agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.

base

All fields defined directly at the root of the events.

Field	Type	Level	Normalization	Indexed	Example	Description
`@timestamp`	`date_nanos`	`core`		`true`	`2026-10-16T15:53:03.843123456Z`	Time the Wazuh Engine received the event, in UTC. The time in the original log is in `event.start`.
`labels`	`object`	`core`		`true`	`{"application": "foo-bar", "env": "production"}`	Custom key/value pairs.
`message`	`keyword`	`core`		`true`	`pam_unix(sshd:session): session opened for user vagrant(uid=1000) by (uid=0)`	Human-readable message extracted by the decoder. The complete raw log is in `event.original`.
`tags`	`keyword`	`core`	`array`	`true`	`["production", "env2"]`	List of keywords used to tag each event.

check

The results of Security Configuration Assessment (SCA) checks, including the condition, the result, the rationale, and the remediation.

Field	Type	Level	Normalization	Indexed	Example	Description
`check.compliance.cmmc`	`keyword`	`custom`	`array`	`true`	`["AC.1.001", "AU.L2-3.3.1"]`	CMMC requirements.
`check.compliance.fedramp`	`keyword`	`custom`	`array`	`true`	`["AC-2", "SC-7"]`	FedRAMP requirements.
`check.compliance.gdpr`	`keyword`	`custom`	`array`	`true`	`["Art. 32", "Art. 25"]`	GDPR requirements.
`check.compliance.hipaa`	`keyword`	`custom`	`array`	`true`	`["164.312(a)(1)", "164.308(a)(5)(ii)(C)"]`	HIPAA requirements.
`check.compliance.iso_27001`	`keyword`	`custom`	`array`	`true`	`["A.9.4.1", "A.8.8"]`	ISO 27001 requirements.
`check.compliance.nis2`	`keyword`	`custom`	`array`	`true`	`["Art. 21", "Art. 23"]`	NIS2 requirements.
`check.compliance.nist_800_171`	`keyword`	`custom`	`array`	`true`	`["3.1.1", "3.3.1"]`	NIST 800-171 requirements.
`check.compliance.nist_800_53`	`keyword`	`custom`	`array`	`true`	`["AC-3", "AU-2"]`	NIST 800-53 requirements.
`check.compliance.pci_dss`	`keyword`	`custom`	`array`	`true`	`["2.2.1", "6.3.3"]`	PCI DSS requirements.
`check.compliance.tsc`	`keyword`	`custom`	`array`	`true`	`["CC6.1", "CC7.1"]`	TSC requirements.
`check.condition`	`keyword`	`custom`		`true`	`all`	Relationship between the rules.
`check.description`	`keyword`	`custom`		`true`	`"The password history setting determines the number of unique new passwords a user must use before an old password can be reused."`	Extended description of the check.
`check.id`	`keyword`	`custom`		`true`	`26000`	The ID of the SCA policy check.
`check.mitre.subtechnique`	`object`	`custom`		`true`		MITRE ATT&CK subtechniques.
`check.mitre.subtechnique.id`	`keyword`	`custom`	`array`	`true`	`["T1059.001", "T1078.001"]`	MITRE ATT&CK subtechnique identifiers.
`check.mitre.subtechnique.name`	`keyword`	`custom`	`array`	`true`	`["Command and Scripting Interpreter: PowerShell", "Valid Accounts: Default Accounts"]`	MITRE ATT&CK subtechnique names.
`check.mitre.tactic`	`object`	`custom`		`true`		MITRE ATT&CK tactics.
`check.mitre.tactic.id`	`keyword`	`custom`	`array`	`true`	`["TA0002", "TA0005"]`	MITRE ATT&CK tactic identifiers.
`check.mitre.tactic.name`	`keyword`	`custom`	`array`	`true`	`["Execution", "Defense Evasion"]`	MITRE ATT&CK tactic names.
`check.mitre.technique`	`object`	`custom`		`true`		MITRE ATT&CK techniques.
`check.mitre.technique.id`	`keyword`	`custom`	`array`	`true`	`["T1059", "T1562"]`	MITRE ATT&CK technique identifiers.
`check.mitre.technique.name`	`keyword`	`custom`	`array`	`true`	`["Command and Scripting Interpreter", "Impair Defenses"]`	MITRE ATT&CK technique names.
`check.name`	`keyword`	`custom`		`true`	`Ensure 'Enforce password history' is set to '24 or more password(s)'.`	The name of the SCA policy check.
`check.rationale`	`keyword`	`custom`		`true`	`"The longer a user uses the same password, the more likely it is that the password will be compromised."`	The reason for the check. Why it is important.
`check.reason`	`keyword`	`custom`		`true`	`"The password history setting is not set to 24 or more password(s)."`	Reason for the check result.
`check.references`	`keyword`	`custom`	`array`	`true`	`["https://workbench.cisecurity.org"]`	References for the check.
`check.remediation`	`keyword`	`custom`		`true`	`"To establish the recommended configuration, set the following registry value to 24 or more password(s):"`	Actions to take to remediate the check.
`check.result`	`keyword`	`custom`		`true`	`failed`	Result of the check.
`check.rules`	`keyword`	`custom`	`array`	`true`	`"[\"c:net.exe accounts -> n:Maximum password age $days$:\s+(\d+) compare > 0\"," > "\"c:net.exe accounts -> n:Length of password history maintained:\s+(\d+) compare >= 24\"]"`	Rules to be evaluated.

client

Fields about the client side of a network connection, used with server.

Field	Type	Level	Normalization	Indexed	Example	Description
`client.address`	`keyword`	`extended`		`true`		Client network address.
`client.as.number`	`long`	`extended`		`true`	`15169`	Unique number allocated to the autonomous system.
`client.as.organization.name`	`keyword`	`extended`		`true`	`Google LLC`	Organization name.
`client.bytes`	`long`	`core`		`true`	`184`	Bytes sent from the client to the server.
`client.domain`	`keyword`	`core`		`true`	`foo.example.com`	The domain name of the client.
`client.geo.city_name`	`keyword`	`core`		`true`	`Montreal`	City name.
`client.geo.continent_code`	`keyword`	`core`		`true`	`NA`	Continent code.
`client.geo.continent_name`	`keyword`	`core`		`true`	`North America`	Name of the continent.
`client.geo.country_iso_code`	`keyword`	`core`		`true`	`CA`	Country ISO code.
`client.geo.country_name`	`keyword`	`core`		`true`	`Canada`	Country name.
`client.geo.location`	`geo_point`	`core`		`true`	`{ "lon": -73.614830, "lat": 45.505918 }`	Longitude and latitude.
`client.geo.name`	`keyword`	`extended`		`true`	`boston-dc`	User-defined description of a location.
`client.geo.postal_code`	`keyword`	`core`		`true`	`94040`	Postal code.
`client.geo.region_iso_code`	`keyword`	`core`		`true`	`CA-QC`	Region ISO code.
`client.geo.region_name`	`keyword`	`core`		`true`	`Quebec`	Region name.
`client.geo.timezone`	`keyword`	`core`		`true`	`America/Argentina/Buenos_Aires`	Time zone.
`client.ip`	`ip`	`core`		`true`		IP address of the client.
`client.mac`	`keyword`	`core`		`true`	`00-00-5E-00-53-23`	MAC address of the client.
`client.nat.ip`	`ip`	`extended`		`true`		Client NAT ip address
`client.nat.port`	`long`	`extended`		`true`		Client NAT port
`client.packets`	`long`	`core`		`true`	`12`	Packets sent from the client to the server.
`client.port`	`long`	`core`		`true`		Port of the client.
`client.registered_domain`	`keyword`	`extended`		`true`	`example.com`	The highest registered client domain, stripped of the subdomain.
`client.subdomain`	`keyword`	`extended`		`true`	`east`	The subdomain of the domain.
`client.top_level_domain`	`keyword`	`extended`		`true`	`co.uk`	The effective top level domain (com, org, net, co.uk).
`client.user.domain`	`keyword`	`extended`		`true`		Name of the directory the user is a member of.
`client.user.email`	`keyword`	`extended`		`true`		User email address.
`client.user.full_name`	`keyword`	`extended`		`true`	`Albert Einstein`	User's full name, if available.
`client.user.group.domain`	`keyword`	`extended`		`true`		Name of the directory the group is a member of.
`client.user.group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`client.user.group.name`	`keyword`	`extended`		`true`		Name of the group.
`client.user.hash`	`keyword`	`extended`		`true`		Unique user hash to correlate information for a user in anonymized form.
`client.user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`client.user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`client.user.roles`	`keyword`	`extended`	`array`	`true`	`["kibana_admin", "reporting_user"]`	Array of user roles at the time of the event.

cloud

Fields about the cloud resource.

Field	Type	Level	Indexed	Example	Description
`cloud.account.id`	`keyword`	`extended`	`true`	`666777888999`	The cloud account or organization id.
`cloud.account.name`	`keyword`	`extended`	`true`	`elastic-dev`	The cloud account name.
`cloud.availability_zone`	`keyword`	`extended`	`true`	`us-east-1c`	Availability zone in which this host, resource, or service is located.
`cloud.instance.id`	`keyword`	`extended`	`true`	`i-1234567890abcdef0`	Instance ID of the host machine.
`cloud.instance.name`	`keyword`	`extended`	`true`		Instance name of the host machine.
`cloud.machine.type`	`keyword`	`extended`	`true`	`t2.medium`	Machine type of the host machine.
`cloud.origin.account.id`	`keyword`	`extended`	`true`	`666777888999`	The cloud account or organization id.
`cloud.origin.account.name`	`keyword`	`extended`	`true`	`elastic-dev`	The cloud account name.
`cloud.origin.availability_zone`	`keyword`	`extended`	`true`	`us-east-1c`	Availability zone in which this host, resource, or service is located.
`cloud.origin.instance.id`	`keyword`	`extended`	`true`	`i-1234567890abcdef0`	Instance ID of the host machine.
`cloud.origin.instance.name`	`keyword`	`extended`	`true`		Instance name of the host machine.
`cloud.origin.machine.type`	`keyword`	`extended`	`true`	`t2.medium`	Machine type of the host machine.
`cloud.origin.project.id`	`keyword`	`extended`	`true`	`my-project`	The cloud project id.
`cloud.origin.project.name`	`keyword`	`extended`	`true`	`my project`	The cloud project name.
`cloud.origin.provider`	`keyword`	`extended`	`true`	`aws`	Name of the cloud provider.
`cloud.origin.region`	`keyword`	`extended`	`true`	`us-east-1`	Region in which this host, resource, or service is located.
`cloud.origin.service.name`	`keyword`	`extended`	`true`	`lambda`	The cloud service name.
`cloud.project.id`	`keyword`	`extended`	`true`	`my-project`	The cloud project id.
`cloud.project.name`	`keyword`	`extended`	`true`	`my project`	The cloud project name.
`cloud.provider`	`keyword`	`extended`	`true`	`aws`	Name of the cloud provider.
`cloud.region`	`keyword`	`extended`	`true`	`us-east-1`	Region in which this host, resource, or service is located.
`cloud.service.name`	`keyword`	`extended`	`true`	`lambda`	The cloud service name.
`cloud.target.account.id`	`keyword`	`extended`	`true`	`666777888999`	The cloud account or organization id.
`cloud.target.account.name`	`keyword`	`extended`	`true`	`elastic-dev`	The cloud account name.
`cloud.target.availability_zone`	`keyword`	`extended`	`true`	`us-east-1c`	Availability zone in which this host, resource, or service is located.
`cloud.target.instance.id`	`keyword`	`extended`	`true`	`i-1234567890abcdef0`	Instance ID of the host machine.
`cloud.target.instance.name`	`keyword`	`extended`	`true`		Instance name of the host machine.
`cloud.target.machine.type`	`keyword`	`extended`	`true`	`t2.medium`	Machine type of the host machine.
`cloud.target.project.id`	`keyword`	`extended`	`true`	`my-project`	The cloud project id.
`cloud.target.project.name`	`keyword`	`extended`	`true`	`my project`	The cloud project name.
`cloud.target.provider`	`keyword`	`extended`	`true`	`aws`	Name of the cloud provider.
`cloud.target.region`	`keyword`	`extended`	`true`	`us-east-1`	Region in which this host, resource, or service is located.
`cloud.target.service.name`	`keyword`	`extended`	`true`	`lambda`	The cloud service name.

compliance

The compliance requirements an event relates to.

Field	Type	Level	Normalization	Indexed	Example	Description
`compliance.cmmc`	`keyword`	`custom`	`array`	`true`	`["AC.1.001", "AU.L2-3.3.1"]`	CMMC requirements.
`compliance.fedramp`	`keyword`	`custom`	`array`	`true`	`["AC-2", "SC-7"]`	FedRAMP requirements.
`compliance.gdpr`	`keyword`	`custom`	`array`	`true`	`["Art. 32", "Art. 25"]`	GDPR requirements.
`compliance.hipaa`	`keyword`	`custom`	`array`	`true`	`["164.312(a)(1)", "164.308(a)(5)(ii)(C)"]`	HIPAA requirements.
`compliance.iso_27001`	`keyword`	`custom`	`array`	`true`	`["A.9.4.1", "A.8.8"]`	ISO 27001 requirements.
`compliance.nis2`	`keyword`	`custom`	`array`	`true`	`["Art. 21", "Art. 23"]`	NIS2 requirements.
`compliance.nist_800_171`	`keyword`	`custom`	`array`	`true`	`["3.1.1", "3.3.1"]`	NIST 800-171 requirements.
`compliance.nist_800_53`	`keyword`	`custom`	`array`	`true`	`["AC-3", "AU-2"]`	NIST 800-53 requirements.
`compliance.pci_dss`	`keyword`	`custom`	`array`	`true`	`["2.2.1", "6.3.3"]`	PCI DSS requirements.
`compliance.tsc`	`keyword`	`custom`	`array`	`true`	`["CC6.1", "CC7.1"]`	TSC requirements.

container

Fields describing the container that generated this event.

Field	Type	Level	Normalization	Indexed	Example	Description
`container.cpu.usage`	`scaled_float`	`extended`		`true`		Percent CPU used, between 0 and 1.
`container.disk.read.bytes`	`long`	`extended`		`true`		The number of bytes read by all disks.
`container.disk.write.bytes`	`long`	`extended`		`true`		The number of bytes written on all disks.
`container.id`	`keyword`	`core`		`true`		Unique container id.
`container.image.hash.all`	`keyword`	`extended`	`array`	`true`	`[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]`	An array of digests of the image the container was built on.
`container.image.name`	`keyword`	`extended`		`true`		Name of the image the container was built on.
`container.image.tag`	`keyword`	`extended`	`array`	`true`		Container image tags.
`container.labels`	`object`	`extended`		`true`		Image labels.
`container.memory.usage`	`scaled_float`	`extended`		`true`		Percent memory used, between 0 and 1.
`container.name`	`keyword`	`extended`		`true`		Container name.
`container.network.egress.bytes`	`long`	`extended`		`true`		The number of bytes sent on all network interfaces.
`container.network.ingress.bytes`	`long`	`extended`		`true`		The number of bytes received on all network interfaces.
`container.runtime`	`keyword`	`extended`		`true`	`docker`	Runtime managing this container.
`container.security_context.privileged`	`boolean`	`extended`		`true`		Indicates whether the container is running in privileged mode.

data_stream

The data_stream fields take part in defining the new data stream naming scheme.

Field	Type	Level	Indexed	Example	Description
`data_stream.dataset`	`keyword`	`extended`	`true`	`nginx.access`	The field can contain anything that makes sense to signify the source of the data.
`data_stream.namespace`	`keyword`	`extended`	`true`	`production`	A user defined namespace. Namespaces are useful to allow grouping of data.
`data_stream.type`	`keyword`	`extended`	`true`	`logs`	An overarching type for the data stream.

destination

Fields about the destination side of a network connection, used with source.

Field	Type	Level	Normalization	Indexed	Example	Description
`destination.address`	`keyword`	`extended`		`true`		Destination network address.
`destination.as.number`	`long`	`extended`		`true`	`15169`	Unique number allocated to the autonomous system.
`destination.as.organization.name`	`keyword`	`extended`		`true`	`Google LLC`	Organization name.
`destination.bytes`	`long`	`core`		`true`	`184`	Bytes sent from the destination to the source.
`destination.domain`	`keyword`	`core`		`true`	`foo.example.com`	The domain name of the destination.
`destination.geo.city_name`	`keyword`	`core`		`true`	`Montreal`	City name.
`destination.geo.continent_code`	`keyword`	`core`		`true`	`NA`	Continent code.
`destination.geo.continent_name`	`keyword`	`core`		`true`	`North America`	Name of the continent.
`destination.geo.country_iso_code`	`keyword`	`core`		`true`	`CA`	Country ISO code.
`destination.geo.country_name`	`keyword`	`core`		`true`	`Canada`	Country name.
`destination.geo.location`	`geo_point`	`core`		`true`	`{ "lon": -73.614830, "lat": 45.505918 }`	Longitude and latitude.
`destination.geo.name`	`keyword`	`extended`		`true`	`boston-dc`	User-defined description of a location.
`destination.geo.postal_code`	`keyword`	`core`		`true`	`94040`	Postal code.
`destination.geo.region_iso_code`	`keyword`	`core`		`true`	`CA-QC`	Region ISO code.
`destination.geo.region_name`	`keyword`	`core`		`true`	`Quebec`	Region name.
`destination.geo.timezone`	`keyword`	`core`		`true`	`America/Argentina/Buenos_Aires`	Time zone.
`destination.ip`	`ip`	`core`		`true`		IP address of the destination.
`destination.mac`	`keyword`	`core`		`true`	`00-00-5E-00-53-23`	MAC address of the destination.
`destination.nat.ip`	`ip`	`extended`		`true`		Destination NAT ip
`destination.nat.port`	`long`	`extended`		`true`		Destination NAT Port
`destination.packets`	`long`	`core`		`true`	`12`	Packets sent from the destination to the source.
`destination.port`	`long`	`core`		`true`		Port of the destination.
`destination.registered_domain`	`keyword`	`extended`		`true`	`example.com`	The highest registered destination domain, stripped of the subdomain.
`destination.subdomain`	`keyword`	`extended`		`true`	`east`	The subdomain of the domain.
`destination.top_level_domain`	`keyword`	`extended`		`true`	`co.uk`	The effective top level domain (com, org, net, co.uk).
`destination.user.domain`	`keyword`	`extended`		`true`		Name of the directory the user is a member of.
`destination.user.email`	`keyword`	`extended`		`true`		User email address.
`destination.user.full_name`	`keyword`	`extended`		`true`	`Albert Einstein`	User's full name, if available.
`destination.user.group.domain`	`keyword`	`extended`		`true`		Name of the directory the group is a member of.
`destination.user.group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`destination.user.group.name`	`keyword`	`extended`		`true`		Name of the group.
`destination.user.hash`	`keyword`	`extended`		`true`		Unique user hash to correlate information for a user in anonymized form.
`destination.user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`destination.user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`destination.user.roles`	`keyword`	`extended`	`array`	`true`	`["kibana_admin", "reporting_user"]`	Array of user roles at the time of the event.

device

Fields characterizing a (mobile) device a process or application is running on.

Field	Type	Level	Indexed	Example	Description
`device.id`	`keyword`	`extended`	`true`	`00000000-54b3-e7c7-0000-000046bffd97`	The unique identifier of a device.
`device.manufacturer`	`keyword`	`extended`	`true`	`Samsung`	The vendor name of the device manufacturer.
`device.model.identifier`	`keyword`	`extended`	`true`	`SM-G920F`	The machine readable identifier of the device model.
`device.model.name`	`keyword`	`extended`	`true`	`Samsung Galaxy S6`	The human readable marketing name of the device model.
`device.serial_number`	`keyword`	`core`	`true`	`DJGAQS4CW5`	Serial Number of the device

dll

These fields contain information about code libraries dynamically loaded into processes.

Field	Type	Level	Normalization	Indexed	Example	Description
`dll.code_signature.digest_algorithm`	`keyword`	`extended`		`true`	`sha256`	Hashing algorithm used to sign the process.
`dll.code_signature.exists`	`boolean`	`core`		`true`	`true`	Boolean to capture if a signature is present.
`dll.code_signature.flags`	`keyword`	`extended`		`true`	`570522385`	Code signing flags of the process
`dll.code_signature.signing_id`	`keyword`	`extended`		`true`	`com.apple.xpc.proxy`	The identifier used to sign the process.
`dll.code_signature.status`	`keyword`	`extended`		`true`	`ERROR_UNTRUSTED_ROOT`	Additional information about the certificate status.
`dll.code_signature.subject_name`	`keyword`	`core`		`true`	`Microsoft Corporation`	Subject name of the code signer
`dll.code_signature.team_id`	`keyword`	`extended`		`true`	`EQHXZ8M8AV`	The team identifier used to sign the process.
`dll.code_signature.thumbprint_sha256`	`keyword`	`extended`		`true`	`c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b`	SHA256 hash of the certificate.
`dll.code_signature.timestamp`	`date`	`extended`		`true`	`2021-01-01T12:10:30Z`	When the signature was generated and signed.
`dll.code_signature.trusted`	`boolean`	`extended`		`true`	`true`	Stores the trust status of the certificate chain.
`dll.code_signature.valid`	`boolean`	`extended`		`true`	`true`	Boolean to capture if the digital signature is verified against the binary content.
`dll.hash.cdhash`	`keyword`	`extended`		`true`	`3783b4052fd474dbe30676b45c329e7a6d44acd9`	The Code Directory (CD) hash of an executable.
`dll.hash.md5`	`keyword`	`extended`		`true`		MD5 hash.
`dll.hash.sha1`	`keyword`	`extended`		`true`		SHA1 hash.
`dll.hash.sha256`	`keyword`	`extended`		`true`		SHA256 hash.
`dll.hash.sha384`	`keyword`	`extended`		`true`		SHA384 hash.
`dll.hash.sha512`	`keyword`	`extended`		`true`		SHA512 hash.
`dll.hash.ssdeep`	`keyword`	`extended`		`true`		SSDEEP hash.
`dll.hash.tlsh`	`keyword`	`extended`		`true`		TLSH hash.
`dll.name`	`keyword`	`core`		`true`	`kernel32.dll`	Name of the library.
`dll.origin_referrer_url`	`keyword`	`extended`		`true`	`http://example.com/article1.html`	The URL of the webpage that linked to the dll file.
`dll.origin_url`	`keyword`	`extended`		`true`	`http://example.com/files/example.dll`	The URL where the dll file is hosted.
`dll.path`	`keyword`	`extended`		`true`	`C:\Windows\System32\kernel32.dll`	Full file path of the library.
`dll.pe.architecture`	`keyword`	`extended`		`true`	`x64`	CPU architecture target for the file.
`dll.pe.company`	`keyword`	`extended`		`true`	`Microsoft Corporation`	Internal company name of the file, provided at compile-time.
`dll.pe.description`	`keyword`	`extended`		`true`	`Paint`	Internal description of the file, provided at compile-time.
`dll.pe.file_version`	`keyword`	`extended`		`true`	`6.3.9600.17415`	Process name.
`dll.pe.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in a PE file.
`dll.pe.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`dll.pe.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`dll.pe.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`dll.pe.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`dll.pe.imphash`	`keyword`	`extended`		`true`	`0c6803c4e922103c4dca5963aad36ddf`	A hash of the imports in a PE file.
`dll.pe.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in a PE file.
`dll.pe.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`dll.pe.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`dll.pe.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`dll.pe.original_file_name`	`keyword`	`extended`		`true`	`MSPAINT.EXE`	Internal name of the file, provided at compile-time.
`dll.pe.pehash`	`keyword`	`extended`		`true`	`73ff189b63cd6be375a7ff25179a38d347651975`	A hash of the PE header and data from one or more PE sections.
`dll.pe.product`	`keyword`	`extended`		`true`	`Microsoft® Windows® Operating System`	Internal product name of the file, provided at compile-time.
`dll.pe.sections`	`nested`	`extended`	`array`	`true`		Section information of the PE file.
`dll.pe.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`dll.pe.sections.name`	`keyword`	`extended`		`true`		PE Section List name.
`dll.pe.sections.physical_size`	`long`	`extended`		`true`		PE Section List physical size.
`dll.pe.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`dll.pe.sections.virtual_size`	`long`	`extended`		`true`		PE Section List virtual size. This is always the same as `physical_size`.

dns

Fields describing DNS queries and answers.

Field	Type	Level	Normalization	Indexed	Example	Description
`dns.answers`	`object`	`extended`	`array`	`true`		Array of DNS answers.
`dns.answers.class`	`keyword`	`extended`		`true`	`IN`	The class of DNS data contained in this resource record.
`dns.answers.data`	`keyword`	`extended`		`true`	`10.10.10.10`	The data describing the resource.
`dns.answers.name`	`keyword`	`extended`		`true`	`www.example.com`	The domain name to which this resource record pertains.
`dns.answers.ttl`	`long`	`extended`		`true`	`180`	The time interval in seconds that this resource record may be cached before it should be discarded.
`dns.answers.type`	`keyword`	`extended`		`true`	`CNAME`	The type of data contained in this resource record.
`dns.header_flags`	`keyword`	`extended`	`array`	`true`	`["RD", "RA"]`	Array of DNS header flags.
`dns.id`	`keyword`	`extended`		`true`	`62111`	The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.
`dns.op_code`	`keyword`	`extended`		`true`	`QUERY`	The DNS operation code that specifies the kind of query in the message.
`dns.question.class`	`keyword`	`extended`		`true`	`IN`	The class of records being queried.
`dns.question.name`	`keyword`	`extended`		`true`	`www.example.com`	The name being queried.
`dns.question.registered_domain`	`keyword`	`extended`		`true`	`example.com`	The highest registered domain, stripped of the subdomain.
`dns.question.subdomain`	`keyword`	`extended`		`true`	`www`	The subdomain of the domain.
`dns.question.top_level_domain`	`keyword`	`extended`		`true`	`co.uk`	The effective top level domain (com, org, net, co.uk).
`dns.question.type`	`keyword`	`extended`		`true`	`AAAA`	The type of record being queried.
`dns.resolved_ip`	`ip`	`extended`	`array`	`true`	`["10.10.10.10", "10.10.10.11"]`	Array containing all IPs seen in answers.data
`dns.response_code`	`keyword`	`extended`		`true`	`NOERROR`	The DNS response code.
`dns.type`	`keyword`	`extended`		`true`	`answer`	The type of DNS event captured, query or answer.

email

Describes an email transaction.

Field	Type	Level	Normalization	Indexed	Example	Description
`email.attachments`	`nested`	`extended`	`array`	`true`		List of objects describing the attachments.
`email.attachments.file.extension`	`keyword`	`extended`		`true`	`txt`	Attachment file extension.
`email.attachments.file.hash.cdhash`	`keyword`	`extended`		`true`	`3783b4052fd474dbe30676b45c329e7a6d44acd9`	The Code Directory (CD) hash of an executable.
`email.attachments.file.hash.md5`	`keyword`	`extended`		`true`		MD5 hash.
`email.attachments.file.hash.sha1`	`keyword`	`extended`		`true`		SHA1 hash.
`email.attachments.file.hash.sha256`	`keyword`	`extended`		`true`		SHA256 hash.
`email.attachments.file.hash.sha384`	`keyword`	`extended`		`true`		SHA384 hash.
`email.attachments.file.hash.sha512`	`keyword`	`extended`		`true`		SHA512 hash.
`email.attachments.file.hash.ssdeep`	`keyword`	`extended`		`true`		SSDEEP hash.
`email.attachments.file.hash.tlsh`	`keyword`	`extended`		`true`		TLSH hash.
`email.attachments.file.mime_type`	`keyword`	`extended`		`true`	`text/plain`	MIME type of the attachment file.
`email.attachments.file.name`	`keyword`	`extended`		`true`	`attachment.txt`	Name of the attachment file.
`email.attachments.file.size`	`long`	`extended`		`true`	`64329`	Attachment file size.
`email.bcc.address`	`keyword`	`extended`	`array`	`true`	`bcc.user1@example.com`	Email address of BCC recipient
`email.cc.address`	`keyword`	`extended`	`array`	`true`	`cc.user1@example.com`	Email address of CC recipient
`email.content_type`	`keyword`	`extended`		`true`	`text/plain`	MIME type of the email message.
`email.delivery_timestamp`	`date`	`extended`		`true`	`2020-11-10T22:12:34.8196921Z`	Date and time when message was delivered.
`email.direction`	`keyword`	`extended`		`true`	`inbound`	Direction of the message.
`email.from.address`	`keyword`	`extended`	`array`	`true`	`sender@example.com`	The sender's email address.
`email.local_id`	`keyword`	`extended`		`true`	`c26dbea0-80d5-463b-b93c-4e8b708219ce`	Unique identifier given by the source.
`email.message_id`	`keyword`	`extended`		`true`	`81ce15$8r2j59@mail01.example.com`	Value from the Message-ID header.
`email.origination_timestamp`	`date`	`extended`		`true`	`2020-11-10T22:12:34.8196921Z`	Date and time the email was composed.
`email.reply_to.address`	`keyword`	`extended`	`array`	`true`	`reply.here@example.com`	Address replies should be delivered to.
`email.sender.address`	`keyword`	`extended`		`true`		Address of the message sender.
`email.subject`	`keyword`	`extended`		`true`	`Please see this important message.`	The subject of the email message.
`email.to.address`	`keyword`	`extended`	`array`	`true`	`user1@example.com`	Email address of recipient
`email.x_mailer`	`keyword`	`extended`		`true`	`Spambot v2.5`	Application that drafted email.

error

Fields about errors of any kind.

Field	Type	Level	Indexed	Example	Description
`error.code`	`keyword`	`core`	`true`		Error code describing the error.
`error.id`	`keyword`	`core`	`true`		Unique identifier for the error.
`error.message`	`keyword`	`core`	`true`		Error message.
`error.stack_trace`	`keyword`	`extended`	`true`		The stack trace of this error in plain text.
`error.type`	`keyword`	`extended`	`true`	`java.lang.NullPointerException`	The type of the error, for example the class name of the exception.

event

Fields breaking down the event details.

Field	Type	Level	Normalization	Indexed	Example	Description
`event.action`	`keyword`	`core`		`true`	`user-password-change`	The action captured by the event.
`event.agent_id_status`	`keyword`	`extended`		`true`	`verified`	Validation status of the event's agent.id field.
`event.category`	`keyword`	`core`	`array`	`true`	`authentication`	Event category. The second categorization field in the hierarchy.
`event.changed_fields`	`keyword`	`custom`	`array`	`true`	`["foo", "bar"]`	Fields that were updated since last scan.
`event.code`	`keyword`	`extended`		`true`	`4648`	Identification code for this event.
`event.collector`	`keyword`	`custom`		`true`	`file`	Collector used to retrieve the event.
`event.created`	`date`	`core`		`true`	`2026-10-16T15:53:00.000Z`	Time the source says the event was first read. Not set by Wazuh and not used by the ruleset.
`event.dataset`	`keyword`	`core`		`true`	`apache.access`	Name of the dataset.
`event.duration`	`long`	`core`		`true`		Duration of the event in nanoseconds.
`event.end`	`date`	`extended`		`true`		Time the logged activity ended or was last observed, as found in the original log.
`event.hash`	`keyword`	`extended`		`true`	`123456789012345678901234567890ABCD`	Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.
`event.id`	`keyword`	`core`		`true`	`8a4f500d`	ID the source gave the event, when the log has one. Wazuh's own ID is `wazuh.event.id`.
`event.ingested`	`date`	`core`		`true`	`2026-10-16T15:53:01.000Z`	Time the source says the event reached a data store. Not set by Wazuh and not used by the ruleset.
`event.kind`	`keyword`	`core`		`true`	`alert`	The kind of the event. The highest categorization field in the hierarchy.
`event.module`	`keyword`	`core`		`true`	`apache`	Name of the module this data is coming from.
`event.original`	`keyword`	`core`		`false`	`Oct 13 13:00:57 wazuh-aio sshd[9538]: pam_unix(sshd:session): session opened for user vagrant(uid=1000) by (uid=0)`	Raw log as received by the Wazuh Engine. Not searchable; read it from `_source`.
`event.outcome`	`keyword`	`core`		`true`	`success`	The outcome of the event. The lowest level categorization field in the hierarchy.
`event.provider`	`keyword`	`extended`		`true`	`kernel`	Source of the event.
`event.reason`	`keyword`	`extended`		`true`	`Terminated an unexpected process`	Reason why this event happened, according to the source
`event.reference`	`keyword`	`extended`		`true`	`https://system.example.com/event/#0001234`	Event reference URL
`event.risk_score`	`float`	`core`		`true`		Risk score or priority of the event (e.g. security solutions). Use your system's original value here.
`event.risk_score_norm`	`float`	`extended`		`true`		Normalized risk score or priority of the event (0-100).
`event.sequence`	`long`	`extended`		`true`		Sequence number of the event.
`event.severity`	`long`	`core`		`true`	`7`	Numeric severity of the event.
`event.start`	`date`	`extended`		`true`	`2026-10-13T13:00:57.000Z`	Time the logged activity happened or started, as found in the original log.
`event.timezone`	`keyword`	`extended`		`true`		Event time zone.
`event.type`	`keyword`	`core`	`array`	`true`		Event type. The third categorization field in the hierarchy.
`event.url`	`keyword`	`extended`		`true`	`https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe`	Event investigation URL

faas

Fields describing functions as a service.

Field	Type	Level	Indexed	Example	Description
`faas.coldstart`	`boolean`	`extended`	`true`		Boolean value indicating a cold start of a function.
`faas.execution`	`keyword`	`extended`	`true`	`af9d5aa4-a685-4c5f-a22b-444f80b3cc28`	The execution ID of the current function execution.
`faas.id`	`keyword`	`extended`	`true`	`arn:aws:lambda:us-west-2:123456789012:function:my-function`	The unique identifier of a serverless function.
`faas.name`	`keyword`	`extended`	`true`	`my-function`	The name of a serverless function.
`faas.trigger.request_id`	`keyword`	`extended`	`true`	`123456789`	The ID of the trigger request , message, event, etc.
`faas.trigger.type`	`keyword`	`extended`	`true`	`http`	The trigger for the function execution.
`faas.version`	`keyword`	`extended`	`true`	`123`	The version of a serverless function.

file

Fields describing files.

Field	Type	Level	Normalization	Indexed	Example	Description
`file.accessed`	`date`	`extended`		`true`		Last time the file was accessed.
`file.attributes`	`keyword`	`extended`	`array`	`true`	`["readonly", "system"]`	Array of file attributes.
`file.code_signature.digest_algorithm`	`keyword`	`extended`		`true`	`sha256`	Hashing algorithm used to sign the process.
`file.code_signature.exists`	`boolean`	`core`		`true`	`true`	Boolean to capture if a signature is present.
`file.code_signature.flags`	`keyword`	`extended`		`true`	`570522385`	Code signing flags of the process
`file.code_signature.signing_id`	`keyword`	`extended`		`true`	`com.apple.xpc.proxy`	The identifier used to sign the process.
`file.code_signature.status`	`keyword`	`extended`		`true`	`ERROR_UNTRUSTED_ROOT`	Additional information about the certificate status.
`file.code_signature.subject_name`	`keyword`	`core`		`true`	`Microsoft Corporation`	Subject name of the code signer
`file.code_signature.team_id`	`keyword`	`extended`		`true`	`EQHXZ8M8AV`	The team identifier used to sign the process.
`file.code_signature.thumbprint_sha256`	`keyword`	`extended`		`true`	`c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b`	SHA256 hash of the certificate.
`file.code_signature.timestamp`	`date`	`extended`		`true`	`2021-01-01T12:10:30Z`	When the signature was generated and signed.
`file.code_signature.trusted`	`boolean`	`extended`		`true`	`true`	Stores the trust status of the certificate chain.
`file.code_signature.valid`	`boolean`	`extended`		`true`	`true`	Boolean to capture if the digital signature is verified against the binary content.
`file.created`	`date`	`extended`		`true`		File creation time.
`file.ctime`	`date`	`extended`		`true`		Last time the file attributes or metadata changed.
`file.device`	`keyword`	`extended`		`true`	`sda`	Device that is the source of the file.
`file.diff`	`match_only_text`	`custom`		`true`	`10a11 > 192.168.32.5`	Unified diff of the file's content changes.
`file.directory`	`keyword`	`extended`		`true`	`/home/alice`	Directory where the file is located.
`file.drive_letter`	`keyword`	`extended`		`true`	`C`	Drive letter where the file is located.
`file.elf.architecture`	`keyword`	`extended`		`true`	`x86-64`	Machine architecture of the ELF file.
`file.elf.byte_order`	`keyword`	`extended`		`true`	`Little Endian`	Byte sequence of ELF file.
`file.elf.cpu_type`	`keyword`	`extended`		`true`	`Intel`	CPU type of the ELF file.
`file.elf.creation_date`	`date`	`extended`		`true`		Build or compile date.
`file.elf.exports`	`flat_object`	`extended`	`array`	`true`		List of exported element names and types.
`file.elf.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in an ELF file.
`file.elf.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`file.elf.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`file.elf.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`file.elf.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`file.elf.header.abi_version`	`keyword`	`extended`		`true`		Version of the ELF Application Binary Interface (ABI).
`file.elf.header.class`	`keyword`	`extended`		`true`		Header class of the ELF file.
`file.elf.header.data`	`keyword`	`extended`		`true`		Data table of the ELF header.
`file.elf.header.entrypoint`	`long`	`extended`		`true`		Header entrypoint of the ELF file.
`file.elf.header.object_version`	`keyword`	`extended`		`true`		"0x1" for original ELF files.
`file.elf.header.os_abi`	`keyword`	`extended`		`true`		Application Binary Interface (ABI) of the Linux OS.
`file.elf.header.type`	`keyword`	`extended`		`true`		Header type of the ELF file.
`file.elf.header.version`	`keyword`	`extended`		`true`		Version of the ELF header.
`file.elf.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in an ELF file.
`file.elf.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`file.elf.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`file.elf.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`file.elf.sections`	`nested`	`extended`	`array`	`true`		Section information of the ELF file.
`file.elf.sections.chi2`	`long`	`extended`		`true`		Chi-square probability distribution of the section.
`file.elf.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`file.elf.sections.flags`	`keyword`	`extended`		`true`		ELF Section List flags.
`file.elf.sections.name`	`keyword`	`extended`		`true`		ELF Section List name.
`file.elf.sections.physical_offset`	`keyword`	`extended`		`true`		ELF Section List offset.
`file.elf.sections.physical_size`	`long`	`extended`		`true`		ELF Section List physical size.
`file.elf.sections.type`	`keyword`	`extended`		`true`		ELF Section List type.
`file.elf.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`file.elf.sections.virtual_address`	`long`	`extended`		`true`		ELF Section List virtual address.
`file.elf.sections.virtual_size`	`long`	`extended`		`true`		ELF Section List virtual size.
`file.elf.segments`	`nested`	`extended`	`array`	`true`		ELF object segment list.
`file.elf.segments.sections`	`keyword`	`extended`		`true`		ELF object segment sections.
`file.elf.segments.type`	`keyword`	`extended`		`true`		ELF object segment type.
`file.elf.shared_libraries`	`keyword`	`extended`	`array`	`true`		List of shared libraries used by this ELF object.
`file.elf.telfhash`	`keyword`	`extended`		`true`		telfhash hash for ELF file.
`file.extension`	`keyword`	`extended`		`true`	`png`	File extension, excluding the leading dot.
`file.fork_name`	`keyword`	`extended`		`true`	`Zone.Identifer`	A fork is additional data associated with a filesystem object.
`file.gid`	`keyword`	`extended`		`true`	`1001`	Primary group ID (GID) of the file.
`file.group`	`keyword`	`extended`		`true`	`alice`	Primary group name of the file.
`file.hash.cdhash`	`keyword`	`extended`		`true`	`3783b4052fd474dbe30676b45c329e7a6d44acd9`	The Code Directory (CD) hash of an executable.
`file.hash.md5`	`keyword`	`extended`		`true`		MD5 hash.
`file.hash.sha1`	`keyword`	`extended`		`true`		SHA1 hash.
`file.hash.sha256`	`keyword`	`extended`		`true`		SHA256 hash.
`file.hash.sha384`	`keyword`	`extended`		`true`		SHA384 hash.
`file.hash.sha512`	`keyword`	`extended`		`true`		SHA512 hash.
`file.hash.ssdeep`	`keyword`	`extended`		`true`		SSDEEP hash.
`file.hash.tlsh`	`keyword`	`extended`		`true`		TLSH hash.
`file.inode`	`keyword`	`extended`		`true`	`256383`	Inode representing the file in the filesystem.
`file.macho.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in a Mach-O file.
`file.macho.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`file.macho.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`file.macho.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`file.macho.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`file.macho.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in a Mach-O file.
`file.macho.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`file.macho.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`file.macho.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`file.macho.sections`	`nested`	`extended`	`array`	`true`		Section information of the Mach-O file.
`file.macho.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`file.macho.sections.name`	`keyword`	`extended`		`true`		Mach-O Section List name.
`file.macho.sections.physical_size`	`long`	`extended`		`true`		Mach-O Section List physical size.
`file.macho.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`file.macho.sections.virtual_size`	`long`	`extended`		`true`		Mach-O Section List virtual size. This is always the same as `physical_size`.
`file.macho.symhash`	`keyword`	`extended`		`true`	`d3ccf195b62a9279c3c19af1080497ec`	A hash of the imports in a Mach-O file.
`file.mime_type`	`keyword`	`extended`		`true`		Media type of file, document, or arrangement of bytes.
`file.mode`	`keyword`	`extended`		`true`	`0640`	Mode of the file in octal representation.
`file.mtime`	`date`	`extended`		`true`		Last time the file content was modified.
`file.name`	`keyword`	`extended`		`true`	`example.png`	Name of the file including the extension, without the directory.
`file.origin_referrer_url`	`keyword`	`extended`		`true`	`http://example.com/article1.html`	The URL of the webpage that linked to the file.
`file.origin_url`	`keyword`	`extended`		`true`	`http://example.com/imgs/article1_img1.jpg`	The URL where the file is hosted.
`file.owner`	`keyword`	`extended`		`true`	`alice`	File owner's username.
`file.path`	`keyword`	`extended`		`true`	`/home/alice/example.png`	Full path to the file, including the file name.
`file.pe.architecture`	`keyword`	`extended`		`true`	`x64`	CPU architecture target for the file.
`file.pe.company`	`keyword`	`extended`		`true`	`Microsoft Corporation`	Internal company name of the file, provided at compile-time.
`file.pe.description`	`keyword`	`extended`		`true`	`Paint`	Internal description of the file, provided at compile-time.
`file.pe.file_version`	`keyword`	`extended`		`true`	`6.3.9600.17415`	Process name.
`file.pe.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in a PE file.
`file.pe.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`file.pe.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`file.pe.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`file.pe.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`file.pe.imphash`	`keyword`	`extended`		`true`	`0c6803c4e922103c4dca5963aad36ddf`	A hash of the imports in a PE file.
`file.pe.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in a PE file.
`file.pe.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`file.pe.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`file.pe.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`file.pe.original_file_name`	`keyword`	`extended`		`true`	`MSPAINT.EXE`	Internal name of the file, provided at compile-time.
`file.pe.pehash`	`keyword`	`extended`		`true`	`73ff189b63cd6be375a7ff25179a38d347651975`	A hash of the PE header and data from one or more PE sections.
`file.pe.product`	`keyword`	`extended`		`true`	`Microsoft® Windows® Operating System`	Internal product name of the file, provided at compile-time.
`file.pe.sections`	`nested`	`extended`	`array`	`true`		Section information of the PE file.
`file.pe.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`file.pe.sections.name`	`keyword`	`extended`		`true`		PE Section List name.
`file.pe.sections.physical_size`	`long`	`extended`		`true`		PE Section List physical size.
`file.pe.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`file.pe.sections.virtual_size`	`long`	`extended`		`true`		PE Section List virtual size. This is always the same as `physical_size`.
`file.size`	`long`	`extended`		`true`	`16384`	File size in bytes.
`file.target_path`	`keyword`	`extended`		`true`		Target path for symlinks.
`file.type`	`keyword`	`extended`		`true`	`file`	File type (file, dir, or symlink).
`file.uid`	`keyword`	`extended`		`true`	`1001`	The user ID (UID) or security identifier (SID) of the file owner.
`file.x509.alternative_names`	`keyword`	`extended`	`array`	`true`	`*.elastic.co`	List of subject alternative names (SAN).
`file.x509.issuer.common_name`	`keyword`	`extended`	`array`	`true`	`Example SHA2 High Assurance Server CA`	List of common name (CN) of issuing certificate authority.
`file.x509.issuer.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) codes
`file.x509.issuer.distinguished_name`	`keyword`	`extended`		`true`	`C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA`	Distinguished name (DN) of issuing certificate authority.
`file.x509.issuer.locality`	`keyword`	`extended`	`array`	`true`	`Mountain View`	List of locality names (L)
`file.x509.issuer.organization`	`keyword`	`extended`	`array`	`true`	`Example Inc`	List of organizations (O) of issuing certificate authority.
`file.x509.issuer.organizational_unit`	`keyword`	`extended`	`array`	`true`	`www.example.com`	List of organizational units (OU) of issuing certificate authority.
`file.x509.issuer.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`file.x509.not_after`	`date`	`extended`		`true`	`2020-07-16T03:15:39Z`	Time at which the certificate is no longer considered valid.
`file.x509.not_before`	`date`	`extended`		`true`	`2019-08-16T01:40:25Z`	Time at which the certificate is first considered valid.
`file.x509.public_key_algorithm`	`keyword`	`extended`		`true`	`RSA`	Algorithm used to generate the public key.
`file.x509.public_key_curve`	`keyword`	`extended`		`true`	`nistp521`	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
`file.x509.public_key_exponent`	`long`	`extended`		`false`	`65537`	Exponent used to derive the public key. This is algorithm specific.
`file.x509.public_key_size`	`long`	`extended`		`true`	`2048`	The size of the public key space in bits.
`file.x509.serial_number`	`keyword`	`extended`		`true`	`55FBB9C7DEBF09809D12CCAA`	Unique serial number issued by the certificate authority.
`file.x509.signature_algorithm`	`keyword`	`extended`		`true`	`SHA256-RSA`	Identifier for certificate signature algorithm.
`file.x509.subject.common_name`	`keyword`	`extended`	`array`	`true`	`shared.global.example.net`	List of common names (CN) of subject.
`file.x509.subject.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) code
`file.x509.subject.distinguished_name`	`keyword`	`extended`		`true`	`C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net`	Distinguished name (DN) of the certificate subject entity.
`file.x509.subject.locality`	`keyword`	`extended`	`array`	`true`	`San Francisco`	List of locality names (L)
`file.x509.subject.organization`	`keyword`	`extended`	`array`	`true`	`Example, Inc.`	List of organizations (O) of subject.
`file.x509.subject.organizational_unit`	`keyword`	`extended`	`array`	`true`		List of organizational units (OU) of subject.
`file.x509.subject.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`file.x509.version_number`	`keyword`	`extended`		`true`	`3`	Version of x509 format.

gen_ai

Fields on Generative Artificial Intelligence (GenAI) Models requests and responses

Field	Type	Level	Indexed	Example	Description
`gen_ai.agent.description`	`keyword`	`extended`	`false`	`Helps with math problems; Generates fiction stories`	Free-form description of the GenAI agent provided by the application.
`gen_ai.agent.id`	`keyword`	`extended`	`true`	`asst_5j66UpCpwteGg4YSxUnt7lPY`	The unique identifier of the GenAI agent.
`gen_ai.agent.name`	`keyword`	`extended`	`true`	`Math Tutor; Fiction Writer`	Human-readable name of the GenAI agent provided by the application.
`gen_ai.operation.name`	`keyword`	`extended`	`true`	`chat; text_completion; embeddings`	The name of the operation being performed.
`gen_ai.output.type`	`keyword`	`extended`	`true`	`text; json; image`	Represents the content type requested by the client.
`gen_ai.request.choice.count`	`integer`	`extended`	`true`	`3`	The target number of candidate completions to return.
`gen_ai.request.encoding_formats`	`keyword`	`extended`	`true`	`["float", "binary"]`	The encoding formats requested in an embeddings operation, if specified.
`gen_ai.request.frequency_penalty`	`double`	`extended`	`true`	`0.1`	The frequency penalty setting for the GenAI request.
`gen_ai.request.max_tokens`	`integer`	`extended`	`true`	`100`	The maximum number of tokens the model generates for a request.
`gen_ai.request.model`	`keyword`	`extended`	`true`	`gpt-4`	The name of the GenAI model a request is being made to.
`gen_ai.request.presence_penalty`	`double`	`extended`	`true`	`0.1`	The presence penalty setting for the GenAI request.
`gen_ai.request.seed`	`integer`	`extended`	`true`	`100`	Requests with same seed value more likely to return same result.
`gen_ai.request.stop_sequences`	`keyword`	`extended`	`true`	`["forest", "lived"]`	List of sequences that the model will use to stop generating further tokens.
`gen_ai.request.temperature`	`double`	`extended`	`true`	`0.0`	The temperature setting for the GenAI request.
`gen_ai.request.top_k`	`double`	`extended`	`true`	`1.0`	The top_k sampling setting for the GenAI request.
`gen_ai.request.top_p`	`double`	`extended`	`true`	`1.0`	The top_p sampling setting for the GenAI request.
`gen_ai.response.finish_reasons`	`keyword`	`extended`	`true`	`["stop", "length"]`	Array of reasons the model stopped generating tokens, corresponding to each generation received.
`gen_ai.response.id`	`keyword`	`extended`	`true`	`chatcmpl-123`	The unique identifier for the completion.
`gen_ai.response.model`	`keyword`	`extended`	`true`	`gpt-4-0613`	The name of the model that generated the response.
`gen_ai.system`	`keyword`	`extended`	`true`	`openai`	The Generative AI product as identified by the client or server instrumentation.
`gen_ai.token.type`	`keyword`	`extended`	`true`	`input; output`	The type of token being counted.
`gen_ai.tool.call.id`	`keyword`	`extended`	`true`	`call_mszuSIzqtI65i1wAUOE8w5H4`	The tool call identifier.
`gen_ai.tool.name`	`keyword`	`extended`	`true`	`Flights`	Name of the tool utilized by the agent.
`gen_ai.tool.type`	`keyword`	`extended`	`true`	`function; extension; datastore`	Type of the tool utilized by the agent
`gen_ai.usage.input_tokens`	`integer`	`extended`	`true`	`100`	The number of tokens used in the GenAI input (prompt).
`gen_ai.usage.output_tokens`	`integer`	`extended`	`true`	`180`	The number of tokens used in the GenAI response (completion).

group

User's group relevant to the event.

Field	Type	Level	Indexed	Description
`group.domain`	`keyword`	`extended`	`true`	Name of the directory the group is a member of.
`group.id`	`keyword`	`extended`	`true`	Unique identifier for the group on the system/platform.
`group.name`	`keyword`	`extended`	`true`	Name of the group.

host

Fields describing the relevant computing instance.

Field	Type	Level	Normalization	Indexed	Example	Description
`host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`host.boot.id`	`keyword`	`extended`		`true`	`88a1f0ed-5ae5-41ee-af6b-41921c311872`	Linux boot uuid taken from /proc/sys/kernel/random/boot_id
`host.cpu`	`object`	`custom`		`true`	`"name": "Intel(R) Core(TM) i7-7700HQ CPU", "cores": 4, "speed": 2800`	CPU-related data.
`host.cpu.cores`	`long`	`custom`		`true`	`4`	Number of CPU cores.
`host.cpu.name`	`keyword`	`custom`		`true`	`Intel(R) Core(TM) i7-7700HQ CPU`	CPU Model name.
`host.cpu.speed`	`long`	`custom`		`true`	`2800`	CPU clock speed.
`host.cpu.usage`	`scaled_float`	`extended`		`true`		Percent CPU used, between 0 and 1.
`host.disk.read.bytes`	`long`	`extended`		`true`		The number of bytes read by all disks.
`host.disk.write.bytes`	`long`	`extended`		`true`		The number of bytes written on all disks.
`host.domain`	`keyword`	`extended`		`true`	`CONTOSO`	Name of the directory the group is a member of.
`host.geo.city_name`	`keyword`	`core`		`true`	`Montreal`	City name.
`host.geo.continent_code`	`keyword`	`core`		`true`	`NA`	Continent code.
`host.geo.continent_name`	`keyword`	`core`		`true`	`North America`	Name of the continent.
`host.geo.country_iso_code`	`keyword`	`core`		`true`	`CA`	Country ISO code.
`host.geo.country_name`	`keyword`	`core`		`true`	`Canada`	Country name.
`host.geo.location`	`geo_point`	`core`		`true`	`{ "lon": -73.614830, "lat": 45.505918 }`	Longitude and latitude.
`host.geo.name`	`keyword`	`extended`		`true`	`boston-dc`	User-defined description of a location.
`host.geo.postal_code`	`keyword`	`core`		`true`	`94040`	Postal code.
`host.geo.region_iso_code`	`keyword`	`core`		`true`	`CA-QC`	Region ISO code.
`host.geo.region_name`	`keyword`	`core`		`true`	`Quebec`	Region name.
`host.geo.timezone`	`keyword`	`core`		`true`	`America/Argentina/Buenos_Aires`	Time zone.
`host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`host.id`	`keyword`	`core`		`true`		Unique host id.
`host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`host.mac`	`keyword`	`core`	`array`	`true`	`["00-00-5E-00-53-23", "00-00-5E-00-53-24"]`	Host MAC addresses.
`host.memory`	`object`	`custom`		`true`	`"total": 100000, "free": 90000, "used": {"percentage": 10}`	Memory-related data.
`host.memory.free`	`long`	`custom`		`true`	`1024`	Free memory in MB.
`host.memory.total`	`long`	`custom`		`true`	`1024`	Total memory in MB.
`host.memory.used`	`object`	`custom`		`true`	`"percentage": 10`	Used memory-related data.
`host.memory.used.percentage`	`long`	`custom`		`true`	`10`	Used memory percentage.
`host.name`	`keyword`	`core`		`true`		Name of the host.
`host.network.egress.bytes`	`long`	`extended`		`true`		The number of bytes sent on all network interfaces.
`host.network.egress.drops`	`long`	`custom`		`true`	`10`	Number of dropped transmitted packets.
`host.network.egress.errors`	`long`	`custom`		`true`	`10`	Number of transmission errors.
`host.network.egress.packets`	`long`	`extended`		`true`		The number of packets sent on all network interfaces.
`host.network.egress.queue`	`long`	`custom`		`true`	`10`	Transmit queue length.
`host.network.ingress.bytes`	`long`	`extended`		`true`		The number of bytes received on all network interfaces.
`host.network.ingress.drops`	`long`	`custom`		`true`	`10`	Number of dropped received packets.
`host.network.ingress.errors`	`long`	`custom`		`true`	`10`	Number of reception errors.
`host.network.ingress.packets`	`long`	`extended`		`true`		The number of packets received on all network interfaces.
`host.network.ingress.queue`	`long`	`custom`		`true`	`10`	Receive queue length.
`host.os.family`	`keyword`	`extended`		`true`	`debian`	OS family (such as redhat, debian, freebsd, windows).
`host.os.full`	`keyword`	`extended`		`true`	`Mac OS Mojave`	Operating system name, including the version or code name.
`host.os.kernel`	`keyword`	`extended`		`true`	`4.4.0-112-generic`	Operating system kernel version as a raw string.
`host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`host.pid_ns_ino`	`keyword`	`extended`		`true`	`256383`	Pid namespace inode
`host.risk.calculated_level`	`keyword`	`extended`		`true`	`High`	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
`host.risk.calculated_score`	`float`	`extended`		`true`	`880.73`	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
`host.risk.calculated_score_norm`	`float`	`extended`		`true`	`88.73`	A normalized risk score calculated by an internal system.
`host.risk.static_level`	`keyword`	`extended`		`true`	`High`	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
`host.risk.static_score`	`float`	`extended`		`true`	`830.0`	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
`host.risk.static_score_norm`	`float`	`extended`		`true`	`83.0`	A normalized risk score calculated by an external system.
`host.type`	`keyword`	`core`		`true`		Type of host.
`host.uptime`	`long`	`extended`		`true`	`1325`	Seconds the host has been up.

http

Fields describing an HTTP request.

Field	Type	Level	Indexed	Example	Description
`http.request.body.bytes`	`long`	`extended`	`true`	`887`	Size in bytes of the request body.
`http.request.body.content`	`keyword`	`extended`	`true`	`Hello world`	The full HTTP request body.
`http.request.bytes`	`long`	`extended`	`true`	`1437`	Total size in bytes of the request (body and headers).
`http.request.id`	`keyword`	`extended`	`true`	`123e4567-e89b-12d3-a456-426614174000`	HTTP request ID.
`http.request.method`	`keyword`	`extended`	`true`	`POST`	HTTP request method.
`http.request.mime_type`	`keyword`	`extended`	`true`	`image/gif`	Mime type of the body of the request.
`http.request.referrer`	`keyword`	`extended`	`true`	`https://blog.example.com/`	Referrer for this HTTP request.
`http.response.body.bytes`	`long`	`extended`	`true`	`887`	Size in bytes of the response body.
`http.response.body.content`	`keyword`	`extended`	`true`	`Hello world`	The full HTTP response body.
`http.response.bytes`	`long`	`extended`	`true`	`1437`	Total size in bytes of the response (body and headers).
`http.response.mime_type`	`keyword`	`extended`	`true`	`image/gif`	Mime type of the body of the response.
`http.response.status_code`	`long`	`extended`	`true`	`404`	HTTP response status code.
`http.version`	`keyword`	`extended`	`true`	`1.1`	HTTP version.

interface

Fields to describe observer interface information.

Field	Type	Level	Indexed	Example	Description
`interface.alias`	`keyword`	`extended`	`true`	`outside`	Interface alias
`interface.id`	`keyword`	`extended`	`true`	`10`	Interface ID
`interface.mtu`	`long`	`custom`	`true`	`1500`	Maximum transmission unit size.
`interface.name`	`keyword`	`extended`	`true`	`eth0`	Interface name
`interface.state`	`keyword`	`custom`	`true`	`up`	State of the network interface.
`interface.type`	`keyword`	`custom`	`true`	`ethernet`	Interface type.

log

Details about the event's logging mechanism.

Field	Type	Level	Indexed	Example	Description
`log.file.path`	`keyword`	`extended`	`true`	`/var/log/fun-times.log`	Full path to the log file this event came from.
`log.level`	`keyword`	`core`	`true`	`error`	Log level of the log event.
`log.logger`	`keyword`	`core`	`true`	`org.elasticsearch.bootstrap.Bootstrap`	Name of the logger.
`log.origin.file.line`	`long`	`extended`	`true`	`42`	The line number of the file which originated the log event.
`log.origin.file.name`	`keyword`	`extended`	`true`	`Bootstrap.java`	The code file which originated the log event.
`log.origin.function`	`keyword`	`extended`	`true`	`init`	The function which originated the log event.
`log.syslog`	`object`	`extended`	`true`		Syslog metadata
`log.syslog.appname`	`keyword`	`extended`	`true`	`sshd`	The device or application that originated the Syslog message.
`log.syslog.facility.code`	`long`	`extended`	`true`	`23`	Syslog numeric facility of the event.
`log.syslog.facility.name`	`keyword`	`extended`	`true`	`local7`	Syslog text-based facility of the event.
`log.syslog.hostname`	`keyword`	`extended`	`true`	`example-host`	The host that originated the Syslog message.
`log.syslog.msgid`	`keyword`	`extended`	`true`	`ID47`	An identifier for the type of Syslog message.
`log.syslog.priority`	`long`	`extended`	`true`	`135`	Syslog priority of the event.
`log.syslog.procid`	`keyword`	`extended`	`true`	`12345`	The process name or ID that originated the Syslog message.
`log.syslog.severity.code`	`long`	`extended`	`true`	`3`	Syslog numeric severity of the event.
`log.syslog.severity.name`	`keyword`	`extended`	`true`	`Error`	Syslog text-based severity of the event.
`log.syslog.structured_data`	`flat_object`	`extended`	`true`		Structured data expressed in RFC 5424 messages.
`log.syslog.version`	`keyword`	`extended`	`true`	`1`	Syslog protocol version.

mitre

The MITRE ATT&CK tactics, techniques, and subtechniques an event relates to.

Field	Type	Level	Normalization	Indexed	Example	Description
`mitre.subtechnique`	`object`	`custom`		`true`		MITRE ATT&CK subtechniques.
`mitre.subtechnique.id`	`keyword`	`custom`	`array`	`true`	`["T1059.001", "T1078.001"]`	MITRE ATT&CK subtechnique identifiers.
`mitre.subtechnique.name`	`keyword`	`custom`	`array`	`true`	`["Command and Scripting Interpreter: PowerShell", "Valid Accounts: Default Accounts"]`	MITRE ATT&CK subtechnique names.
`mitre.tactic`	`object`	`custom`		`true`		MITRE ATT&CK tactics.
`mitre.tactic.id`	`keyword`	`custom`	`array`	`true`	`["TA0002", "TA0005"]`	MITRE ATT&CK tactic identifiers.
`mitre.tactic.name`	`keyword`	`custom`	`array`	`true`	`["Execution", "Defense Evasion"]`	MITRE ATT&CK tactic names.
`mitre.technique`	`object`	`custom`		`true`		MITRE ATT&CK techniques.
`mitre.technique.id`	`keyword`	`custom`	`array`	`true`	`["T1059", "T1562"]`	MITRE ATT&CK technique identifiers.
`mitre.technique.name`	`keyword`	`custom`	`array`	`true`	`["Command and Scripting Interpreter", "Impair Defenses"]`	MITRE ATT&CK technique names.

network

Fields describing the communication path over which the event happened.

Field	Type	Level	Indexed	Example	Description
`network.application`	`keyword`	`extended`	`true`	`aim`	Application level protocol name.
`network.broadcast`	`ip`	`custom`	`true`	`192.168.0.255`	Broadcast address.
`network.bytes`	`long`	`core`	`true`	`368`	Total bytes transferred in both directions.
`network.community_id`	`keyword`	`extended`	`true`	`1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=`	A hash of source and destination IPs and ports.
`network.dhcp`	`keyword`	`custom`	`true`	`enabled`	DHCP status (enabled, disabled, unknown, BOOTP).
`network.direction`	`keyword`	`core`	`true`	`inbound`	Direction of the network traffic.
`network.forwarded_ip`	`ip`	`core`	`true`	`192.1.1.2`	Host IP address when the source IP address is the proxy.
`network.gateway`	`ip`	`custom`	`true`	`192.168.0.1`	Gateway address.
`network.iana_number`	`keyword`	`extended`	`true`	`6`	IANA Protocol Number.
`network.inner`	`object`	`extended`	`true`		Inner VLAN tag information
`network.inner.vlan.id`	`keyword`	`extended`	`true`	`10`	VLAN ID as reported by the observer.
`network.inner.vlan.name`	`keyword`	`extended`	`true`	`outside`	Optional VLAN name as reported by the observer.
`network.metric`	`long`	`custom`	`true`	`15`	Metric of the network protocol.
`network.name`	`keyword`	`extended`	`true`	`Guest Wifi`	Name given by operators to sections of their network.
`network.netmask`	`ip`	`custom`	`true`	`255.255.255.0`	Network mask
`network.packets`	`long`	`core`	`true`	`24`	Total packets transferred in both directions.
`network.protocol`	`keyword`	`core`	`true`	`http`	Application protocol name.
`network.transport`	`keyword`	`core`	`true`	`tcp`	Protocol Name corresponding to the field `iana_number`.
`network.type`	`keyword`	`core`	`true`	`ipv4`	In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
`network.vlan.id`	`keyword`	`extended`	`true`	`10`	VLAN ID as reported by the observer.
`network.vlan.name`	`keyword`	`extended`	`true`	`outside`	Optional VLAN name as reported by the observer.

observer

Fields describing an entity observing the event from outside the host.

Field	Type	Level	Normalization	Indexed	Example	Description
`observer.egress`	`object`	`extended`		`true`		Object field for egress information
`observer.egress.interface.alias`	`keyword`	`extended`		`true`	`outside`	Interface alias
`observer.egress.interface.id`	`keyword`	`extended`		`true`	`10`	Interface ID
`observer.egress.interface.mtu`	`long`	`custom`		`true`	`1500`	Maximum transmission unit size.
`observer.egress.interface.name`	`keyword`	`extended`		`true`	`eth0`	Interface name
`observer.egress.interface.observer.ingress.interface.alias`	`keyword`	`extended`		`true`	`outside`	Interface alias
`observer.egress.interface.observer.ingress.interface.id`	`keyword`	`extended`		`true`	`10`	Interface ID
`observer.egress.interface.observer.ingress.interface.mtu`	`long`	`custom`		`true`	`1500`	Maximum transmission unit size.
`observer.egress.interface.observer.ingress.interface.name`	`keyword`	`extended`		`true`	`eth0`	Interface name
`observer.egress.interface.observer.ingress.interface.state`	`keyword`	`custom`		`true`	`up`	State of the network interface.
`observer.egress.interface.observer.ingress.interface.type`	`keyword`	`custom`		`true`	`ethernet`	Interface type.
`observer.egress.interface.state`	`keyword`	`custom`		`true`	`up`	State of the network interface.
`observer.egress.interface.type`	`keyword`	`custom`		`true`	`ethernet`	Interface type.
`observer.egress.vlan.id`	`keyword`	`extended`		`true`	`10`	VLAN ID as reported by the observer.
`observer.egress.vlan.name`	`keyword`	`extended`		`true`	`outside`	Optional VLAN name as reported by the observer.
`observer.egress.zone`	`keyword`	`extended`		`true`	`Public_Internet`	Observer Egress zone
`observer.geo.city_name`	`keyword`	`core`		`true`	`Montreal`	City name.
`observer.geo.continent_code`	`keyword`	`core`		`true`	`NA`	Continent code.
`observer.geo.continent_name`	`keyword`	`core`		`true`	`North America`	Name of the continent.
`observer.geo.country_iso_code`	`keyword`	`core`		`true`	`CA`	Country ISO code.
`observer.geo.country_name`	`keyword`	`core`		`true`	`Canada`	Country name.
`observer.geo.location`	`geo_point`	`core`		`true`	`{ "lon": -73.614830, "lat": 45.505918 }`	Longitude and latitude.
`observer.geo.name`	`keyword`	`extended`		`true`	`boston-dc`	User-defined description of a location.
`observer.geo.postal_code`	`keyword`	`core`		`true`	`94040`	Postal code.
`observer.geo.region_iso_code`	`keyword`	`core`		`true`	`CA-QC`	Region ISO code.
`observer.geo.region_name`	`keyword`	`core`		`true`	`Quebec`	Region name.
`observer.geo.timezone`	`keyword`	`core`		`true`	`America/Argentina/Buenos_Aires`	Time zone.
`observer.hostname`	`keyword`	`core`		`true`		Hostname of the observer.
`observer.ingress`	`object`	`extended`		`true`		Object field for ingress information
`observer.ingress.interface.alias`	`keyword`	`extended`		`true`	`outside`	Interface alias
`observer.ingress.interface.id`	`keyword`	`extended`		`true`	`10`	Interface ID
`observer.ingress.interface.mtu`	`long`	`custom`		`true`	`1500`	Maximum transmission unit size.
`observer.ingress.interface.name`	`keyword`	`extended`		`true`	`eth0`	Interface name
`observer.ingress.interface.state`	`keyword`	`custom`		`true`	`up`	State of the network interface.
`observer.ingress.interface.type`	`keyword`	`custom`		`true`	`ethernet`	Interface type.
`observer.ingress.vlan.id`	`keyword`	`extended`		`true`	`10`	VLAN ID as reported by the observer.
`observer.ingress.vlan.name`	`keyword`	`extended`		`true`	`outside`	Optional VLAN name as reported by the observer.
`observer.ingress.zone`	`keyword`	`extended`		`true`	`DMZ`	Observer ingress zone
`observer.ip`	`ip`	`core`	`array`	`true`		IP addresses of the observer.
`observer.mac`	`keyword`	`core`	`array`	`true`	`["00-00-5E-00-53-23", "00-00-5E-00-53-24"]`	MAC addresses of the observer.
`observer.name`	`keyword`	`extended`		`true`	`1_proxySG`	Custom name of the observer.
`observer.os.family`	`keyword`	`extended`		`true`	`debian`	OS family (such as redhat, debian, freebsd, windows).
`observer.os.full`	`keyword`	`extended`		`true`	`Mac OS Mojave`	Operating system name, including the version or code name.
`observer.os.kernel`	`keyword`	`extended`		`true`	`4.4.0-112-generic`	Operating system kernel version as a raw string.
`observer.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`observer.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`observer.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`observer.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`observer.product`	`keyword`	`extended`		`true`	`s200`	The product name of the observer.
`observer.serial_number`	`keyword`	`extended`		`true`		Observer serial number.
`observer.type`	`keyword`	`core`		`true`	`firewall`	The type of the observer the data is coming from.
`observer.vendor`	`keyword`	`core`		`true`	`Symantec`	Vendor name of the observer.
`observer.version`	`keyword`	`core`		`true`		Observer version.

orchestrator

Fields relevant to container orchestrators.

Field	Type	Level	Normalization	Indexed	Example	Description
`orchestrator.api_version`	`keyword`	`extended`		`true`	`v1beta1`	API version being used to carry out the action
`orchestrator.cluster.id`	`keyword`	`extended`		`true`		Unique ID of the cluster.
`orchestrator.cluster.name`	`keyword`	`extended`		`true`		Name of the cluster.
`orchestrator.cluster.url`	`keyword`	`extended`		`true`		URL of the API used to manage the cluster.
`orchestrator.cluster.version`	`keyword`	`extended`		`true`		The version of the cluster.
`orchestrator.namespace`	`keyword`	`extended`		`true`	`kube-system`	Namespace in which the action is taking place.
`orchestrator.organization`	`keyword`	`extended`		`true`	`elastic`	Organization affected by the event (for multi-tenant orchestrator setups).
`orchestrator.resource.annotation`	`keyword`	`extended`	`array`	`true`	`['key1:value1', 'key2:value2', 'key3:value3']`	The list of annotations added to the resource.
`orchestrator.resource.id`	`keyword`	`extended`		`true`		Unique ID of the resource being acted upon.
`orchestrator.resource.ip`	`ip`	`extended`	`array`	`true`		IP address assigned to the resource associated with the event being observed.
`orchestrator.resource.label`	`keyword`	`extended`	`array`	`true`	`['key1:value1', 'key2:value2', 'key3:value3']`	The list of labels added to the resource.
`orchestrator.resource.name`	`keyword`	`extended`		`true`	`test-pod-cdcws`	Name of the resource being acted upon.
`orchestrator.resource.parent.type`	`keyword`	`extended`		`true`	`DaemonSet`	Type or kind of the parent resource associated with the event being observed.
`orchestrator.resource.type`	`keyword`	`extended`		`true`	`service`	Type of resource being acted upon.
`orchestrator.type`	`keyword`	`extended`		`true`	`kubernetes`	Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).

organization

Fields describing the organization or company the event is associated with.

Field	Type	Level	Normalization	Indexed	Example	Description
`organization.id`	`keyword`	`extended`		`true`		Unique identifier for the organization.
`organization.name`	`keyword`	`extended`		`true`		Organization name.

package

These fields contain information about an installed software package.

Field	Type	Level	Indexed	Example	Description
`package.architecture`	`keyword`	`extended`	`true`	`x86_64`	Package architecture.
`package.build_version`	`keyword`	`extended`	`true`	`36f4f7e89dd61b0988b12ee000b98966867710cd`	Build version information
`package.checksum`	`keyword`	`extended`	`true`	`68b329da9893e34099c7d8ad5cb9c940`	Checksum of the installed package for verification.
`package.description`	`keyword`	`extended`	`true`	`Open source programming language to build simple/reliable/efficient software.`	Description of the package.
`package.install_scope`	`keyword`	`extended`	`true`	`global`	Indicating how the package was installed, e.g. user-local, global.
`package.installed`	`date`	`extended`	`true`		Time when package was installed.
`package.license`	`keyword`	`extended`	`true`	`Apache License 2.0`	Package license
`package.name`	`keyword`	`extended`	`true`	`go`	Package name
`package.path`	`keyword`	`extended`	`true`	`/usr/local/Cellar/go/1.12.9/`	Path where the package is installed.
`package.previous.installed`	`date`	`custom`	`true`	`2026-07-01T10:00:00.000Z`	Installation date before it changed.
`package.reference`	`keyword`	`extended`	`true`	`https://golang.org`	Package home page or reference URL
`package.size`	`long`	`extended`	`true`	`62231`	Package size in bytes.
`package.type`	`keyword`	`extended`	`true`	`rpm`	Package type
`package.version`	`keyword`	`extended`	`true`	`1.12.9`	Package version

policy

The SCA policies that group the checks.

Field	Type	Level	Normalization	Indexed	Example	Description
`policy.description`	`keyword`	`custom`		`true`	`"The CIS Microsoft Windows 11 Enterprise Benchmark v1.0.0 is a comprehensive security configuration guide that provides prescriptive guidance for establishing a secure baseline configuration for Microsoft Windows 11 Enterprise."`	Extended description of the policy.
`policy.file`	`keyword`	`custom`		`true`	`cis_win11_enterprise.yml`	The file name of the SCA policy.
`policy.id`	`keyword`	`custom`		`true`	`cis_win11_enterprise_21H2`	The ID of the SCA policy.
`policy.name`	`keyword`	`custom`		`true`	`CIS Microsoft Windows 11 Enterprise Benchmark v1.0.0`	The name of the SCA policy.
`policy.references`	`keyword`	`custom`	`array`	`true`	`["https://www.cisecurity.org/cis-benchmarks/"]`	References for the policy.

process

These fields contain information about a process.

Field	Type	Level	Normalization	Indexed	Example	Description
`process.args`	`keyword`	`extended`	`array`	`true`	`["/usr/bin/ssh", "-l", "user", "10.0.0.16"]`	Array of process arguments.
`process.args_count`	`long`	`extended`		`true`	`4`	Length of the process.args array.
`process.code_signature.digest_algorithm`	`keyword`	`extended`		`true`	`sha256`	Hashing algorithm used to sign the process.
`process.code_signature.exists`	`boolean`	`core`		`true`	`true`	Boolean to capture if a signature is present.
`process.code_signature.flags`	`keyword`	`extended`		`true`	`570522385`	Code signing flags of the process
`process.code_signature.signing_id`	`keyword`	`extended`		`true`	`com.apple.xpc.proxy`	The identifier used to sign the process.
`process.code_signature.status`	`keyword`	`extended`		`true`	`ERROR_UNTRUSTED_ROOT`	Additional information about the certificate status.
`process.code_signature.subject_name`	`keyword`	`core`		`true`	`Microsoft Corporation`	Subject name of the code signer
`process.code_signature.team_id`	`keyword`	`extended`		`true`	`EQHXZ8M8AV`	The team identifier used to sign the process.
`process.code_signature.thumbprint_sha256`	`keyword`	`extended`		`true`	`c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b`	SHA256 hash of the certificate.
`process.code_signature.timestamp`	`date`	`extended`		`true`	`2021-01-01T12:10:30Z`	When the signature was generated and signed.
`process.code_signature.trusted`	`boolean`	`extended`		`true`	`true`	Stores the trust status of the certificate chain.
`process.code_signature.valid`	`boolean`	`extended`		`true`	`true`	Boolean to capture if the digital signature is verified against the binary content.
`process.command_line`	`keyword`	`extended`		`true`	`/usr/bin/ssh -l user 10.0.0.16`	Full command line that started the process.
`process.elf.architecture`	`keyword`	`extended`		`true`	`x86-64`	Machine architecture of the ELF file.
`process.elf.byte_order`	`keyword`	`extended`		`true`	`Little Endian`	Byte sequence of ELF file.
`process.elf.cpu_type`	`keyword`	`extended`		`true`	`Intel`	CPU type of the ELF file.
`process.elf.creation_date`	`date`	`extended`		`true`		Build or compile date.
`process.elf.exports`	`flat_object`	`extended`	`array`	`true`		List of exported element names and types.
`process.elf.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in an ELF file.
`process.elf.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`process.elf.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`process.elf.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`process.elf.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`process.elf.header.abi_version`	`keyword`	`extended`		`true`		Version of the ELF Application Binary Interface (ABI).
`process.elf.header.class`	`keyword`	`extended`		`true`		Header class of the ELF file.
`process.elf.header.data`	`keyword`	`extended`		`true`		Data table of the ELF header.
`process.elf.header.entrypoint`	`long`	`extended`		`true`		Header entrypoint of the ELF file.
`process.elf.header.object_version`	`keyword`	`extended`		`true`		"0x1" for original ELF files.
`process.elf.header.os_abi`	`keyword`	`extended`		`true`		Application Binary Interface (ABI) of the Linux OS.
`process.elf.header.type`	`keyword`	`extended`		`true`		Header type of the ELF file.
`process.elf.header.version`	`keyword`	`extended`		`true`		Version of the ELF header.
`process.elf.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in an ELF file.
`process.elf.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`process.elf.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`process.elf.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`process.elf.sections`	`nested`	`extended`	`array`	`true`		Section information of the ELF file.
`process.elf.sections.chi2`	`long`	`extended`		`true`		Chi-square probability distribution of the section.
`process.elf.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`process.elf.sections.flags`	`keyword`	`extended`		`true`		ELF Section List flags.
`process.elf.sections.name`	`keyword`	`extended`		`true`		ELF Section List name.
`process.elf.sections.physical_offset`	`keyword`	`extended`		`true`		ELF Section List offset.
`process.elf.sections.physical_size`	`long`	`extended`		`true`		ELF Section List physical size.
`process.elf.sections.type`	`keyword`	`extended`		`true`		ELF Section List type.
`process.elf.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`process.elf.sections.virtual_address`	`long`	`extended`		`true`		ELF Section List virtual address.
`process.elf.sections.virtual_size`	`long`	`extended`		`true`		ELF Section List virtual size.
`process.elf.segments`	`nested`	`extended`	`array`	`true`		ELF object segment list.
`process.elf.segments.sections`	`keyword`	`extended`		`true`		ELF object segment sections.
`process.elf.segments.type`	`keyword`	`extended`		`true`		ELF object segment type.
`process.elf.shared_libraries`	`keyword`	`extended`	`array`	`true`		List of shared libraries used by this ELF object.
`process.elf.telfhash`	`keyword`	`extended`		`true`		telfhash hash for ELF file.
`process.end`	`date`	`extended`		`true`	`2016-05-23T08:05:34.853Z`	The time the process ended.
`process.entity_id`	`keyword`	`extended`		`true`	`c2c455d9f99375d`	Unique identifier for the process.
`process.entry_leader.args`	`keyword`	`extended`	`array`	`true`	`["/usr/bin/ssh", "-l", "user", "10.0.0.16"]`	Array of process arguments.
`process.entry_leader.args_count`	`long`	`extended`		`true`	`4`	Length of the process.args array.
`process.entry_leader.attested_groups.name`	`keyword`	`extended`		`true`		Name of the group.
`process.entry_leader.attested_user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.entry_leader.attested_user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.entry_leader.command_line`	`keyword`	`extended`		`true`	`/usr/bin/ssh -l user 10.0.0.16`	Full command line that started the process.
`process.entry_leader.entity_id`	`keyword`	`extended`		`true`	`c2c455d9f99375d`	Unique identifier for the process.
`process.entry_leader.entry_meta.source.ip`	`ip`	`core`		`true`		IP address of the source.
`process.entry_leader.entry_meta.type`	`keyword`	`extended`		`true`		The entry type for the entry session leader.
`process.entry_leader.executable`	`keyword`	`extended`		`true`	`/usr/bin/ssh`	Absolute path to the process executable.
`process.entry_leader.group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.entry_leader.group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.entry_leader.interactive`	`boolean`	`extended`		`true`	`True`	Whether the process is connected to an interactive shell.
`process.entry_leader.name`	`keyword`	`extended`		`true`	`ssh`	Process name.
`process.entry_leader.parent.entity_id`	`keyword`	`extended`		`true`	`c2c455d9f99375d`	Unique identifier for the process.
`process.entry_leader.parent.pid`	`long`	`core`		`true`	`4242`	Process id.
`process.entry_leader.parent.session_leader.entity_id`	`keyword`	`extended`		`true`	`c2c455d9f99375d`	Unique identifier for the process.
`process.entry_leader.parent.session_leader.pid`	`long`	`core`		`true`	`4242`	Process id.
`process.entry_leader.parent.session_leader.start`	`date`	`extended`		`true`	`2016-05-23T08:05:34.853Z`	The time the process started.
`process.entry_leader.parent.session_leader.vpid`	`long`	`core`		`true`	`4242`	Virtual process id.
`process.entry_leader.parent.start`	`date`	`extended`		`true`	`2016-05-23T08:05:34.853Z`	The time the process started.
`process.entry_leader.parent.vpid`	`long`	`core`		`true`	`4242`	Virtual process id.
`process.entry_leader.pid`	`long`	`core`		`true`	`4242`	Process id.
`process.entry_leader.real_group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.entry_leader.real_group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.entry_leader.real_user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.entry_leader.real_user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.entry_leader.same_as_process`	`boolean`	`extended`		`true`	`True`	This boolean is used to identify if a leader process is the same as the top level process.
`process.entry_leader.saved_group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.entry_leader.saved_group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.entry_leader.saved_user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.entry_leader.saved_user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.entry_leader.start`	`date`	`extended`		`true`	`2016-05-23T08:05:34.853Z`	The time the process started.
`process.entry_leader.supplemental_groups.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.entry_leader.supplemental_groups.name`	`keyword`	`extended`		`true`		Name of the group.
`process.entry_leader.tty`	`object`	`extended`		`true`		Information about the controlling TTY device.
`process.entry_leader.tty.char_device.major`	`long`	`extended`		`true`	`4`	The TTY character device's major number.
`process.entry_leader.tty.char_device.minor`	`long`	`extended`		`true`	`1`	The TTY character device's minor number.
`process.entry_leader.user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.entry_leader.user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.entry_leader.vpid`	`long`	`core`		`true`	`4242`	Virtual process id.
`process.entry_leader.working_directory`	`keyword`	`extended`		`true`	`/home/alice`	The working directory of the process.
`process.env_vars`	`keyword`	`extended`	`array`	`true`	`["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]`	Array of environment variable bindings.
`process.executable`	`keyword`	`extended`		`true`	`/usr/bin/ssh`	Absolute path to the process executable.
`process.exit_code`	`long`	`extended`		`true`	`137`	The exit code of the process.
`process.group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.group_leader.args`	`keyword`	`extended`	`array`	`true`	`["/usr/bin/ssh", "-l", "user", "10.0.0.16"]`	Array of process arguments.
`process.group_leader.args_count`	`long`	`extended`		`true`	`4`	Length of the process.args array.
`process.group_leader.command_line`	`keyword`	`extended`		`true`	`/usr/bin/ssh -l user 10.0.0.16`	Full command line that started the process.
`process.group_leader.entity_id`	`keyword`	`extended`		`true`	`c2c455d9f99375d`	Unique identifier for the process.
`process.group_leader.executable`	`keyword`	`extended`		`true`	`/usr/bin/ssh`	Absolute path to the process executable.
`process.group_leader.group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.group_leader.group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.group_leader.interactive`	`boolean`	`extended`		`true`	`True`	Whether the process is connected to an interactive shell.
`process.group_leader.name`	`keyword`	`extended`		`true`	`ssh`	Process name.
`process.group_leader.pid`	`long`	`core`		`true`	`4242`	Process id.
`process.group_leader.real_group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.group_leader.real_group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.group_leader.real_user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.group_leader.real_user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.group_leader.same_as_process`	`boolean`	`extended`		`true`	`True`	This boolean is used to identify if a leader process is the same as the top level process.
`process.group_leader.saved_group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.group_leader.saved_group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.group_leader.saved_user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.group_leader.saved_user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.group_leader.start`	`date`	`extended`		`true`	`2016-05-23T08:05:34.853Z`	The time the process started.
`process.group_leader.supplemental_groups.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.group_leader.supplemental_groups.name`	`keyword`	`extended`		`true`		Name of the group.
`process.group_leader.tty`	`object`	`extended`		`true`		Information about the controlling TTY device.
`process.group_leader.tty.char_device.major`	`long`	`extended`		`true`	`4`	The TTY character device's major number.
`process.group_leader.tty.char_device.minor`	`long`	`extended`		`true`	`1`	The TTY character device's minor number.
`process.group_leader.user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.group_leader.user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.group_leader.vpid`	`long`	`core`		`true`	`4242`	Virtual process id.
`process.group_leader.working_directory`	`keyword`	`extended`		`true`	`/home/alice`	The working directory of the process.
`process.hash.cdhash`	`keyword`	`extended`		`true`	`3783b4052fd474dbe30676b45c329e7a6d44acd9`	The Code Directory (CD) hash of an executable.
`process.hash.md5`	`keyword`	`extended`		`true`		MD5 hash.
`process.hash.sha1`	`keyword`	`extended`		`true`		SHA1 hash.
`process.hash.sha256`	`keyword`	`extended`		`true`		SHA256 hash.
`process.hash.sha384`	`keyword`	`extended`		`true`		SHA384 hash.
`process.hash.sha512`	`keyword`	`extended`		`true`		SHA512 hash.
`process.hash.ssdeep`	`keyword`	`extended`		`true`		SSDEEP hash.
`process.hash.tlsh`	`keyword`	`extended`		`true`		TLSH hash.
`process.interactive`	`boolean`	`extended`		`true`	`True`	Whether the process is connected to an interactive shell.
`process.io`	`object`	`extended`		`true`		A chunk of input or output (IO) from a single process.
`process.io.bytes_skipped`	`object`	`extended`	`array`	`true`		An array of byte offsets and lengths denoting where IO data has been skipped.
`process.io.bytes_skipped.length`	`long`	`extended`		`true`		The length of bytes skipped.
`process.io.bytes_skipped.offset`	`long`	`extended`		`true`		The byte offset into this event's io.text (or io.bytes in the future) where length bytes were skipped.
`process.io.max_bytes_per_process_exceeded`	`boolean`	`extended`		`true`		If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.
`process.io.text`	`keyword`	`extended`		`true`		A chunk of output or input sanitized to UTF-8.
`process.io.total_bytes_captured`	`long`	`extended`		`true`		The total number of bytes captured in this event.
`process.io.total_bytes_skipped`	`long`	`extended`		`true`		The total number of bytes that were not captured due to implementation restrictions such as buffer size limits.
`process.io.type`	`keyword`	`extended`		`true`		The type of object on which the IO action (read or write) was taken.
`process.macho.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in a Mach-O file.
`process.macho.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`process.macho.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`process.macho.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`process.macho.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`process.macho.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in a Mach-O file.
`process.macho.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`process.macho.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`process.macho.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`process.macho.sections`	`nested`	`extended`	`array`	`true`		Section information of the Mach-O file.
`process.macho.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`process.macho.sections.name`	`keyword`	`extended`		`true`		Mach-O Section List name.
`process.macho.sections.physical_size`	`long`	`extended`		`true`		Mach-O Section List physical size.
`process.macho.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`process.macho.sections.virtual_size`	`long`	`extended`		`true`		Mach-O Section List virtual size. This is always the same as `physical_size`.
`process.macho.symhash`	`keyword`	`extended`		`true`	`d3ccf195b62a9279c3c19af1080497ec`	A hash of the imports in a Mach-O file.
`process.name`	`keyword`	`extended`		`true`	`ssh`	Process name.
`process.parent.args`	`keyword`	`extended`	`array`	`true`	`["/usr/bin/ssh", "-l", "user", "10.0.0.16"]`	Array of process arguments.
`process.parent.args_count`	`long`	`extended`		`true`	`4`	Length of the process.args array.
`process.parent.code_signature.digest_algorithm`	`keyword`	`extended`		`true`	`sha256`	Hashing algorithm used to sign the process.
`process.parent.code_signature.exists`	`boolean`	`core`		`true`	`true`	Boolean to capture if a signature is present.
`process.parent.code_signature.flags`	`keyword`	`extended`		`true`	`570522385`	Code signing flags of the process
`process.parent.code_signature.signing_id`	`keyword`	`extended`		`true`	`com.apple.xpc.proxy`	The identifier used to sign the process.
`process.parent.code_signature.status`	`keyword`	`extended`		`true`	`ERROR_UNTRUSTED_ROOT`	Additional information about the certificate status.
`process.parent.code_signature.subject_name`	`keyword`	`core`		`true`	`Microsoft Corporation`	Subject name of the code signer
`process.parent.code_signature.team_id`	`keyword`	`extended`		`true`	`EQHXZ8M8AV`	The team identifier used to sign the process.
`process.parent.code_signature.thumbprint_sha256`	`keyword`	`extended`		`true`	`c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b`	SHA256 hash of the certificate.
`process.parent.code_signature.timestamp`	`date`	`extended`		`true`	`2021-01-01T12:10:30Z`	When the signature was generated and signed.
`process.parent.code_signature.trusted`	`boolean`	`extended`		`true`	`true`	Stores the trust status of the certificate chain.
`process.parent.code_signature.valid`	`boolean`	`extended`		`true`	`true`	Boolean to capture if the digital signature is verified against the binary content.
`process.parent.command_line`	`keyword`	`extended`		`true`	`/usr/bin/ssh -l user 10.0.0.16`	Full command line that started the process.
`process.parent.elf.architecture`	`keyword`	`extended`		`true`	`x86-64`	Machine architecture of the ELF file.
`process.parent.elf.byte_order`	`keyword`	`extended`		`true`	`Little Endian`	Byte sequence of ELF file.
`process.parent.elf.cpu_type`	`keyword`	`extended`		`true`	`Intel`	CPU type of the ELF file.
`process.parent.elf.creation_date`	`date`	`extended`		`true`		Build or compile date.
`process.parent.elf.exports`	`flat_object`	`extended`	`array`	`true`		List of exported element names and types.
`process.parent.elf.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in an ELF file.
`process.parent.elf.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`process.parent.elf.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`process.parent.elf.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`process.parent.elf.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`process.parent.elf.header.abi_version`	`keyword`	`extended`		`true`		Version of the ELF Application Binary Interface (ABI).
`process.parent.elf.header.class`	`keyword`	`extended`		`true`		Header class of the ELF file.
`process.parent.elf.header.data`	`keyword`	`extended`		`true`		Data table of the ELF header.
`process.parent.elf.header.entrypoint`	`long`	`extended`		`true`		Header entrypoint of the ELF file.
`process.parent.elf.header.object_version`	`keyword`	`extended`		`true`		"0x1" for original ELF files.
`process.parent.elf.header.os_abi`	`keyword`	`extended`		`true`		Application Binary Interface (ABI) of the Linux OS.
`process.parent.elf.header.type`	`keyword`	`extended`		`true`		Header type of the ELF file.
`process.parent.elf.header.version`	`keyword`	`extended`		`true`		Version of the ELF header.
`process.parent.elf.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in an ELF file.
`process.parent.elf.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`process.parent.elf.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`process.parent.elf.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`process.parent.elf.sections`	`nested`	`extended`	`array`	`true`		Section information of the ELF file.
`process.parent.elf.sections.chi2`	`long`	`extended`		`true`		Chi-square probability distribution of the section.
`process.parent.elf.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`process.parent.elf.sections.flags`	`keyword`	`extended`		`true`		ELF Section List flags.
`process.parent.elf.sections.name`	`keyword`	`extended`		`true`		ELF Section List name.
`process.parent.elf.sections.physical_offset`	`keyword`	`extended`		`true`		ELF Section List offset.
`process.parent.elf.sections.physical_size`	`long`	`extended`		`true`		ELF Section List physical size.
`process.parent.elf.sections.type`	`keyword`	`extended`		`true`		ELF Section List type.
`process.parent.elf.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`process.parent.elf.sections.virtual_address`	`long`	`extended`		`true`		ELF Section List virtual address.
`process.parent.elf.sections.virtual_size`	`long`	`extended`		`true`		ELF Section List virtual size.
`process.parent.elf.segments`	`nested`	`extended`	`array`	`true`		ELF object segment list.
`process.parent.elf.segments.sections`	`keyword`	`extended`		`true`		ELF object segment sections.
`process.parent.elf.segments.type`	`keyword`	`extended`		`true`		ELF object segment type.
`process.parent.elf.shared_libraries`	`keyword`	`extended`	`array`	`true`		List of shared libraries used by this ELF object.
`process.parent.elf.telfhash`	`keyword`	`extended`		`true`		telfhash hash for ELF file.
`process.parent.end`	`date`	`extended`		`true`	`2016-05-23T08:05:34.853Z`	The time the process ended.
`process.parent.entity_id`	`keyword`	`extended`		`true`	`c2c455d9f99375d`	Unique identifier for the process.
`process.parent.executable`	`keyword`	`extended`		`true`	`/usr/bin/ssh`	Absolute path to the process executable.
`process.parent.exit_code`	`long`	`extended`		`true`	`137`	The exit code of the process.
`process.parent.group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.parent.group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.parent.group_leader.entity_id`	`keyword`	`extended`		`true`	`c2c455d9f99375d`	Unique identifier for the process.
`process.parent.group_leader.pid`	`long`	`core`		`true`	`4242`	Process id.
`process.parent.group_leader.start`	`date`	`extended`		`true`	`2016-05-23T08:05:34.853Z`	The time the process started.
`process.parent.group_leader.vpid`	`long`	`core`		`true`	`4242`	Virtual process id.
`process.parent.hash.cdhash`	`keyword`	`extended`		`true`	`3783b4052fd474dbe30676b45c329e7a6d44acd9`	The Code Directory (CD) hash of an executable.
`process.parent.hash.md5`	`keyword`	`extended`		`true`		MD5 hash.
`process.parent.hash.sha1`	`keyword`	`extended`		`true`		SHA1 hash.
`process.parent.hash.sha256`	`keyword`	`extended`		`true`		SHA256 hash.
`process.parent.hash.sha384`	`keyword`	`extended`		`true`		SHA384 hash.
`process.parent.hash.sha512`	`keyword`	`extended`		`true`		SHA512 hash.
`process.parent.hash.ssdeep`	`keyword`	`extended`		`true`		SSDEEP hash.
`process.parent.hash.tlsh`	`keyword`	`extended`		`true`		TLSH hash.
`process.parent.interactive`	`boolean`	`extended`		`true`	`True`	Whether the process is connected to an interactive shell.
`process.parent.macho.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in a Mach-O file.
`process.parent.macho.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`process.parent.macho.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`process.parent.macho.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`process.parent.macho.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`process.parent.macho.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in a Mach-O file.
`process.parent.macho.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`process.parent.macho.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`process.parent.macho.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`process.parent.macho.sections`	`nested`	`extended`	`array`	`true`		Section information of the Mach-O file.
`process.parent.macho.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`process.parent.macho.sections.name`	`keyword`	`extended`		`true`		Mach-O Section List name.
`process.parent.macho.sections.physical_size`	`long`	`extended`		`true`		Mach-O Section List physical size.
`process.parent.macho.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`process.parent.macho.sections.virtual_size`	`long`	`extended`		`true`		Mach-O Section List virtual size. This is always the same as `physical_size`.
`process.parent.macho.symhash`	`keyword`	`extended`		`true`	`d3ccf195b62a9279c3c19af1080497ec`	A hash of the imports in a Mach-O file.
`process.parent.name`	`keyword`	`extended`		`true`	`ssh`	Process name.
`process.parent.pe.architecture`	`keyword`	`extended`		`true`	`x64`	CPU architecture target for the file.
`process.parent.pe.company`	`keyword`	`extended`		`true`	`Microsoft Corporation`	Internal company name of the file, provided at compile-time.
`process.parent.pe.description`	`keyword`	`extended`		`true`	`Paint`	Internal description of the file, provided at compile-time.
`process.parent.pe.file_version`	`keyword`	`extended`		`true`	`6.3.9600.17415`	Process name.
`process.parent.pe.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in a PE file.
`process.parent.pe.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`process.parent.pe.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`process.parent.pe.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`process.parent.pe.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`process.parent.pe.imphash`	`keyword`	`extended`		`true`	`0c6803c4e922103c4dca5963aad36ddf`	A hash of the imports in a PE file.
`process.parent.pe.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in a PE file.
`process.parent.pe.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`process.parent.pe.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`process.parent.pe.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`process.parent.pe.original_file_name`	`keyword`	`extended`		`true`	`MSPAINT.EXE`	Internal name of the file, provided at compile-time.
`process.parent.pe.pehash`	`keyword`	`extended`		`true`	`73ff189b63cd6be375a7ff25179a38d347651975`	A hash of the PE header and data from one or more PE sections.
`process.parent.pe.product`	`keyword`	`extended`		`true`	`Microsoft® Windows® Operating System`	Internal product name of the file, provided at compile-time.
`process.parent.pe.sections`	`nested`	`extended`	`array`	`true`		Section information of the PE file.
`process.parent.pe.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`process.parent.pe.sections.name`	`keyword`	`extended`		`true`		PE Section List name.
`process.parent.pe.sections.physical_size`	`long`	`extended`		`true`		PE Section List physical size.
`process.parent.pe.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`process.parent.pe.sections.virtual_size`	`long`	`extended`		`true`		PE Section List virtual size. This is always the same as `physical_size`.
`process.parent.pid`	`long`	`core`		`true`	`4242`	Process id.
`process.parent.real_group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.parent.real_group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.parent.real_user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.parent.real_user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.parent.saved_group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.parent.saved_group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.parent.saved_user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.parent.saved_user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.parent.start`	`date`	`extended`		`true`	`2016-05-23T08:05:34.853Z`	The time the process started.
`process.parent.supplemental_groups.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.parent.supplemental_groups.name`	`keyword`	`extended`		`true`		Name of the group.
`process.parent.thread.capabilities.effective`	`keyword`	`extended`	`array`	`true`	`["CAP_BPF", "CAP_SYS_ADMIN"]`	Array of capabilities used for permission checks.
`process.parent.thread.capabilities.permitted`	`keyword`	`extended`	`array`	`true`	`["CAP_BPF", "CAP_SYS_ADMIN"]`	Array of capabilities a thread could assume.
`process.parent.thread.id`	`long`	`extended`		`true`	`4242`	Thread ID.
`process.parent.thread.name`	`keyword`	`extended`		`true`	`thread-0`	Thread name.
`process.parent.title`	`keyword`	`extended`		`true`		Process title.
`process.parent.tty`	`object`	`extended`		`true`		Information about the controlling TTY device.
`process.parent.tty.char_device.major`	`long`	`extended`		`true`	`4`	The TTY character device's major number.
`process.parent.tty.char_device.minor`	`long`	`extended`		`true`	`1`	The TTY character device's minor number.
`process.parent.uptime`	`long`	`extended`		`true`	`1325`	Seconds the process has been up.
`process.parent.user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.parent.user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.parent.vpid`	`long`	`core`		`true`	`4242`	Virtual process id.
`process.parent.working_directory`	`keyword`	`extended`		`true`	`/home/alice`	The working directory of the process.
`process.pe.architecture`	`keyword`	`extended`		`true`	`x64`	CPU architecture target for the file.
`process.pe.company`	`keyword`	`extended`		`true`	`Microsoft Corporation`	Internal company name of the file, provided at compile-time.
`process.pe.description`	`keyword`	`extended`		`true`	`Paint`	Internal description of the file, provided at compile-time.
`process.pe.file_version`	`keyword`	`extended`		`true`	`6.3.9600.17415`	Process name.
`process.pe.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in a PE file.
`process.pe.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`process.pe.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`process.pe.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`process.pe.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`process.pe.imphash`	`keyword`	`extended`		`true`	`0c6803c4e922103c4dca5963aad36ddf`	A hash of the imports in a PE file.
`process.pe.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in a PE file.
`process.pe.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`process.pe.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`process.pe.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`process.pe.original_file_name`	`keyword`	`extended`		`true`	`MSPAINT.EXE`	Internal name of the file, provided at compile-time.
`process.pe.pehash`	`keyword`	`extended`		`true`	`73ff189b63cd6be375a7ff25179a38d347651975`	A hash of the PE header and data from one or more PE sections.
`process.pe.product`	`keyword`	`extended`		`true`	`Microsoft® Windows® Operating System`	Internal product name of the file, provided at compile-time.
`process.pe.sections`	`nested`	`extended`	`array`	`true`		Section information of the PE file.
`process.pe.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`process.pe.sections.name`	`keyword`	`extended`		`true`		PE Section List name.
`process.pe.sections.physical_size`	`long`	`extended`		`true`		PE Section List physical size.
`process.pe.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`process.pe.sections.virtual_size`	`long`	`extended`		`true`		PE Section List virtual size. This is always the same as `physical_size`.
`process.pid`	`long`	`core`		`true`	`4242`	Process id.
`process.previous.args`	`keyword`	`extended`	`array`	`true`	`["/usr/bin/ssh", "-l", "user", "10.0.0.16"]`	Array of process arguments.
`process.previous.args_count`	`long`	`extended`		`true`	`4`	Length of the process.args array.
`process.previous.command_line`	`keyword`	`extended`		`true`	`/usr/bin/ssh -l user 10.0.0.16`	Full command line that started the process.
`process.previous.executable`	`keyword`	`extended`		`true`	`/usr/bin/ssh`	Absolute path to the process executable.
`process.previous.name`	`keyword`	`extended`		`true`	`ssh`	Process name.
`process.previous.parent.pid`	`long`	`custom`		`true`	`1`	PID of the parent process.
`process.previous.pid`	`long`	`core`		`true`	`4242`	Process id.
`process.previous.state`	`keyword`	`custom`		`true`	`S`	Current state of the process, as reported by the collector.
`process.real_group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.real_group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.real_user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.real_user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.saved_group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.saved_group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.saved_user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.saved_user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.session_leader.args`	`keyword`	`extended`	`array`	`true`	`["/usr/bin/ssh", "-l", "user", "10.0.0.16"]`	Array of process arguments.
`process.session_leader.args_count`	`long`	`extended`		`true`	`4`	Length of the process.args array.
`process.session_leader.command_line`	`keyword`	`extended`		`true`	`/usr/bin/ssh -l user 10.0.0.16`	Full command line that started the process.
`process.session_leader.entity_id`	`keyword`	`extended`		`true`	`c2c455d9f99375d`	Unique identifier for the process.
`process.session_leader.executable`	`keyword`	`extended`		`true`	`/usr/bin/ssh`	Absolute path to the process executable.
`process.session_leader.group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.session_leader.group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.session_leader.interactive`	`boolean`	`extended`		`true`	`True`	Whether the process is connected to an interactive shell.
`process.session_leader.name`	`keyword`	`extended`		`true`	`ssh`	Process name.
`process.session_leader.parent.entity_id`	`keyword`	`extended`		`true`	`c2c455d9f99375d`	Unique identifier for the process.
`process.session_leader.parent.pid`	`long`	`core`		`true`	`4242`	Process id.
`process.session_leader.parent.session_leader.entity_id`	`keyword`	`extended`		`true`	`c2c455d9f99375d`	Unique identifier for the process.
`process.session_leader.parent.session_leader.pid`	`long`	`core`		`true`	`4242`	Process id.
`process.session_leader.parent.session_leader.start`	`date`	`extended`		`true`	`2016-05-23T08:05:34.853Z`	The time the process started.
`process.session_leader.parent.session_leader.vpid`	`long`	`core`		`true`	`4242`	Virtual process id.
`process.session_leader.parent.start`	`date`	`extended`		`true`	`2016-05-23T08:05:34.853Z`	The time the process started.
`process.session_leader.parent.vpid`	`long`	`core`		`true`	`4242`	Virtual process id.
`process.session_leader.pid`	`long`	`core`		`true`	`4242`	Process id.
`process.session_leader.real_group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.session_leader.real_group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.session_leader.real_user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.session_leader.real_user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.session_leader.same_as_process`	`boolean`	`extended`		`true`	`True`	This boolean is used to identify if a leader process is the same as the top level process.
`process.session_leader.saved_group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.session_leader.saved_group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.session_leader.saved_user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.session_leader.saved_user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.session_leader.start`	`date`	`extended`		`true`	`2016-05-23T08:05:34.853Z`	The time the process started.
`process.session_leader.supplemental_groups.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.session_leader.supplemental_groups.name`	`keyword`	`extended`		`true`		Name of the group.
`process.session_leader.tty`	`object`	`extended`		`true`		Information about the controlling TTY device.
`process.session_leader.tty.char_device.major`	`long`	`extended`		`true`	`4`	The TTY character device's major number.
`process.session_leader.tty.char_device.minor`	`long`	`extended`		`true`	`1`	The TTY character device's minor number.
`process.session_leader.user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.session_leader.user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.session_leader.vpid`	`long`	`core`		`true`	`4242`	Virtual process id.
`process.session_leader.working_directory`	`keyword`	`extended`		`true`	`/home/alice`	The working directory of the process.
`process.start`	`date`	`extended`		`true`	`2016-05-23T08:05:34.853Z`	The time the process started.
`process.state`	`keyword`	`custom`		`true`	`S`	Current state of the process, as reported by the collector.
`process.supplemental_groups.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`process.supplemental_groups.name`	`keyword`	`extended`		`true`		Name of the group.
`process.thread.capabilities.effective`	`keyword`	`extended`	`array`	`true`	`["CAP_BPF", "CAP_SYS_ADMIN"]`	Array of capabilities used for permission checks.
`process.thread.capabilities.permitted`	`keyword`	`extended`	`array`	`true`	`["CAP_BPF", "CAP_SYS_ADMIN"]`	Array of capabilities a thread could assume.
`process.thread.id`	`long`	`extended`		`true`	`4242`	Thread ID.
`process.thread.name`	`keyword`	`extended`		`true`	`thread-0`	Thread name.
`process.title`	`keyword`	`extended`		`true`		Process title.
`process.tty`	`object`	`extended`		`true`		Information about the controlling TTY device.
`process.tty.char_device.major`	`long`	`extended`		`true`	`4`	The TTY character device's major number.
`process.tty.char_device.minor`	`long`	`extended`		`true`	`1`	The TTY character device's minor number.
`process.tty.columns`	`long`	`extended`		`true`	`80`	The number of character columns per line. e.g terminal width
`process.tty.rows`	`long`	`extended`		`true`	`24`	The number of character rows in the terminal. e.g terminal height
`process.uptime`	`long`	`extended`		`true`	`1325`	Seconds the process has been up.
`process.user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`process.user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.vpid`	`long`	`core`		`true`	`4242`	Virtual process id.
`process.working_directory`	`keyword`	`extended`		`true`	`/home/alice`	The working directory of the process.

registry

Fields related to Windows Registry operations.

Field	Type	Level	Normalization	Indexed	Example	Description
`registry.data.bytes`	`keyword`	`extended`		`true`	`ZQBuAC0AVQBTAAAAZQBuAAAAAAA=`	Original bytes written with base64 encoding.
`registry.data.strings`	`keyword`	`core`	`array`	`true`	`["C:\rta\red_ttp\bin\myapp.exe"]`	List of strings representing what was written to the registry.
`registry.data.type`	`keyword`	`core`		`true`	`REG_SZ`	Standard registry type for encoding contents
`registry.hive`	`keyword`	`core`		`true`	`HKLM`	Abbreviated name for the hive.
`registry.key`	`keyword`	`core`		`true`	`SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe`	Hive-relative path of keys.
`registry.path`	`keyword`	`core`		`true`	`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger`	Full path, including hive, key and value
`registry.value`	`keyword`	`core`		`true`	`Debugger`	Name of the value written.

Fields meant to facilitate pivoting around a piece of data.

Field	Type	Level	Normalization	Indexed	Description
`related.hash`	`keyword`	`extended`	`array`	`true`	All the hashes seen on your event.
`related.hosts`	`keyword`	`extended`	`array`	`true`	All the host identifiers seen on your event.
`related.ip`	`ip`	`extended`	`array`	`true`	All of the IPs seen on your event.
`related.user`	`keyword`	`extended`	`array`	`true`	All the user names or other user identifiers seen on the event.

rule

Fields to capture details about rules used to generate alerts or other notable events.

Field	Type	Level	Normalization	Indexed	Example	Description
`rule.author`	`keyword`	`extended`	`array`	`true`	`["Star-Lord"]`	Rule author
`rule.category`	`keyword`	`extended`		`true`	`Attempted Information Leak`	Rule category
`rule.compliance.cmmc`	`keyword`	`custom`	`array`	`true`	`["AC.1.001", "AU.L2-3.3.1"]`	CMMC requirements.
`rule.compliance.fedramp`	`keyword`	`custom`	`array`	`true`	`["AC-2", "SC-7"]`	FedRAMP requirements.
`rule.compliance.gdpr`	`keyword`	`custom`	`array`	`true`	`["Art. 32", "Art. 25"]`	GDPR requirements.
`rule.compliance.hipaa`	`keyword`	`custom`	`array`	`true`	`["164.312(a)(1)", "164.308(a)(5)(ii)(C)"]`	HIPAA requirements.
`rule.compliance.iso_27001`	`keyword`	`custom`	`array`	`true`	`["A.9.4.1", "A.8.8"]`	ISO 27001 requirements.
`rule.compliance.nis2`	`keyword`	`custom`	`array`	`true`	`["Art. 21", "Art. 23"]`	NIS2 requirements.
`rule.compliance.nist_800_171`	`keyword`	`custom`	`array`	`true`	`["3.1.1", "3.3.1"]`	NIST 800-171 requirements.
`rule.compliance.nist_800_53`	`keyword`	`custom`	`array`	`true`	`["AC-3", "AU-2"]`	NIST 800-53 requirements.
`rule.compliance.pci_dss`	`keyword`	`custom`	`array`	`true`	`["2.2.1", "6.3.3"]`	PCI DSS requirements.
`rule.compliance.tsc`	`keyword`	`custom`	`array`	`true`	`["CC6.1", "CC7.1"]`	TSC requirements.
`rule.description`	`keyword`	`extended`		`true`	`Block requests to public DNS over HTTPS / TLS protocols`	Rule description
`rule.id`	`keyword`	`extended`		`true`	`8784f095-729a-5912-9315-119722b444ed`	Rule ID. Under `wazuh.rule`, the ID of the Wazuh rule that matched.
`rule.level`	`keyword`	`custom`		`true`	`high`	Severity level of the rule: `informational`, `low`, `medium`, `high` or `critical`.
`rule.license`	`keyword`	`extended`		`true`	`Apache 2.0`	Rule license
`rule.mitre.subtechnique`	`object`	`custom`		`true`		MITRE ATT&CK subtechniques.
`rule.mitre.subtechnique.id`	`keyword`	`custom`	`array`	`true`	`["T1059.001", "T1078.001"]`	MITRE ATT&CK subtechnique identifiers.
`rule.mitre.subtechnique.name`	`keyword`	`custom`	`array`	`true`	`["Command and Scripting Interpreter: PowerShell", "Valid Accounts: Default Accounts"]`	MITRE ATT&CK subtechnique names.
`rule.mitre.tactic`	`object`	`custom`		`true`		MITRE ATT&CK tactics.
`rule.mitre.tactic.id`	`keyword`	`custom`	`array`	`true`	`["TA0002", "TA0005"]`	MITRE ATT&CK tactic identifiers.
`rule.mitre.tactic.name`	`keyword`	`custom`	`array`	`true`	`["Execution", "Defense Evasion"]`	MITRE ATT&CK tactic names.
`rule.mitre.technique`	`object`	`custom`		`true`		MITRE ATT&CK techniques.
`rule.mitre.technique.id`	`keyword`	`custom`	`array`	`true`	`["T1059", "T1562"]`	MITRE ATT&CK technique identifiers.
`rule.mitre.technique.name`	`keyword`	`custom`	`array`	`true`	`["Command and Scripting Interpreter", "Impair Defenses"]`	MITRE ATT&CK technique names.
`rule.name`	`keyword`	`extended`		`true`	`BLOCK_DNS_over_TLS`	Rule name
`rule.reference`	`keyword`	`extended`		`true`	`https://en.wikipedia.org/wiki/DNS_over_TLS`	Rule reference URL
`rule.ruleset`	`keyword`	`extended`		`true`	`Standard_Protocol_Filters`	Rule ruleset
`rule.sigma_id`	`keyword`	`custom`		`true`	`5af54681-df95-4c26-854f-2565e13cfab0`	Identifier of the Sigma rule the rule was imported from, when it has one.
`rule.status`	`keyword`	`custom`		`true`	`stable`	Maturity status of the rule: `stable`, `experimental`, `test`, `deprecated` or `unsupported`.
`rule.tags`	`keyword`	`custom`	`array`	`true`	`["low", "wazuh-generic-1", "attack.privilege-escalation", "attack.t1548"]`	Tags of the rule. Under `wazuh.rule`, the level, the integration and then the rule tags.
`rule.title`	`keyword`	`custom`		`true`	`Sudo command executed - vagrant`	Title of the rule. Under `wazuh.rule`, placeholders are filled with event values.
`rule.uuid`	`keyword`	`extended`		`true`	`1100110011`	Rule UUID
`rule.version`	`keyword`	`extended`		`true`	`1.1`	Rule version

server

Fields about the server side of a network connection, used with client.

Field	Type	Level	Normalization	Indexed	Example	Description
`server.address`	`keyword`	`extended`		`true`		Server network address.
`server.as.number`	`long`	`extended`		`true`	`15169`	Unique number allocated to the autonomous system.
`server.as.organization.name`	`keyword`	`extended`		`true`	`Google LLC`	Organization name.
`server.bytes`	`long`	`core`		`true`	`184`	Bytes sent from the server to the client.
`server.domain`	`keyword`	`core`		`true`	`foo.example.com`	The domain name of the server.
`server.geo.city_name`	`keyword`	`core`		`true`	`Montreal`	City name.
`server.geo.continent_code`	`keyword`	`core`		`true`	`NA`	Continent code.
`server.geo.continent_name`	`keyword`	`core`		`true`	`North America`	Name of the continent.
`server.geo.country_iso_code`	`keyword`	`core`		`true`	`CA`	Country ISO code.
`server.geo.country_name`	`keyword`	`core`		`true`	`Canada`	Country name.
`server.geo.location`	`geo_point`	`core`		`true`	`{ "lon": -73.614830, "lat": 45.505918 }`	Longitude and latitude.
`server.geo.name`	`keyword`	`extended`		`true`	`boston-dc`	User-defined description of a location.
`server.geo.postal_code`	`keyword`	`core`		`true`	`94040`	Postal code.
`server.geo.region_iso_code`	`keyword`	`core`		`true`	`CA-QC`	Region ISO code.
`server.geo.region_name`	`keyword`	`core`		`true`	`Quebec`	Region name.
`server.geo.timezone`	`keyword`	`core`		`true`	`America/Argentina/Buenos_Aires`	Time zone.
`server.ip`	`ip`	`core`		`true`		IP address of the server.
`server.mac`	`keyword`	`core`		`true`	`00-00-5E-00-53-23`	MAC address of the server.
`server.nat.ip`	`ip`	`extended`		`true`		Server NAT ip
`server.nat.port`	`long`	`extended`		`true`		Server NAT port
`server.packets`	`long`	`core`		`true`	`12`	Packets sent from the server to the client.
`server.port`	`long`	`core`		`true`		Port of the server.
`server.registered_domain`	`keyword`	`extended`		`true`	`example.com`	The highest registered server domain, stripped of the subdomain.
`server.subdomain`	`keyword`	`extended`		`true`	`east`	The subdomain of the domain.
`server.top_level_domain`	`keyword`	`extended`		`true`	`co.uk`	The effective top level domain (com, org, net, co.uk).
`server.user.domain`	`keyword`	`extended`		`true`		Name of the directory the user is a member of.
`server.user.email`	`keyword`	`extended`		`true`		User email address.
`server.user.full_name`	`keyword`	`extended`		`true`	`Albert Einstein`	User's full name, if available.
`server.user.group.domain`	`keyword`	`extended`		`true`		Name of the directory the group is a member of.
`server.user.group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`server.user.group.name`	`keyword`	`extended`		`true`		Name of the group.
`server.user.hash`	`keyword`	`extended`		`true`		Unique user hash to correlate information for a user in anonymized form.
`server.user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`server.user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`server.user.roles`	`keyword`	`extended`	`array`	`true`	`["kibana_admin", "reporting_user"]`	Array of user roles at the time of the event.

service

Fields describing the service for or from which the data was collected.

Field	Type	Level	Normalization	Indexed	Example	Description
`service.address`	`keyword`	`extended`		`true`	`172.26.0.2:5432`	Address of this service.
`service.environment`	`keyword`	`extended`		`true`	`production`	Environment of the service.
`service.ephemeral_id`	`keyword`	`extended`		`true`	`8a4f500f`	Ephemeral identifier of this service.
`service.id`	`keyword`	`core`		`true`	`d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6`	Unique identifier of the running service.
`service.name`	`keyword`	`core`		`true`	`elasticsearch-metrics`	Name of the service.
`service.node.name`	`keyword`	`extended`		`true`	`instance-0000000016`	Name of the service node.
`service.node.role`	`keyword`	`extended`		`true`	`background_tasks`	Deprecated role (singular) of the service node.
`service.node.roles`	`keyword`	`extended`	`array`	`true`	`["ui", "background_tasks"]`	Roles of the service node.
`service.origin.address`	`keyword`	`extended`		`true`	`172.26.0.2:5432`	Address of this service.
`service.origin.environment`	`keyword`	`extended`		`true`	`production`	Environment of the service.
`service.origin.ephemeral_id`	`keyword`	`extended`		`true`	`8a4f500f`	Ephemeral identifier of this service.
`service.origin.id`	`keyword`	`core`		`true`	`d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6`	Unique identifier of the running service.
`service.origin.name`	`keyword`	`core`		`true`	`elasticsearch-metrics`	Name of the service.
`service.origin.node.name`	`keyword`	`extended`		`true`	`instance-0000000016`	Name of the service node.
`service.origin.node.role`	`keyword`	`extended`		`true`	`background_tasks`	Deprecated role (singular) of the service node.
`service.origin.node.roles`	`keyword`	`extended`	`array`	`true`	`["ui", "background_tasks"]`	Roles of the service node.
`service.origin.previous.state`	`keyword`	`custom`		`true`	`activating`	Service state before it changed, e.g. `RUNNING` before a restart.
`service.origin.state`	`keyword`	`core`		`true`		Current state of the service.
`service.origin.type`	`keyword`	`core`		`true`	`elasticsearch`	The type of the service.
`service.origin.version`	`keyword`	`core`		`true`	`3.2.4`	Version of the service.
`service.previous.state`	`keyword`	`custom`		`true`	`activating`	Service state before it changed, e.g. `RUNNING` before a restart.
`service.state`	`keyword`	`core`		`true`		Current state of the service.
`service.target.address`	`keyword`	`extended`		`true`	`172.26.0.2:5432`	Address of this service.
`service.target.environment`	`keyword`	`extended`		`true`	`production`	Environment of the service.
`service.target.ephemeral_id`	`keyword`	`extended`		`true`	`8a4f500f`	Ephemeral identifier of this service.
`service.target.id`	`keyword`	`core`		`true`	`d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6`	Unique identifier of the running service.
`service.target.name`	`keyword`	`core`		`true`	`elasticsearch-metrics`	Name of the service.
`service.target.node.name`	`keyword`	`extended`		`true`	`instance-0000000016`	Name of the service node.
`service.target.node.role`	`keyword`	`extended`		`true`	`background_tasks`	Deprecated role (singular) of the service node.
`service.target.node.roles`	`keyword`	`extended`	`array`	`true`	`["ui", "background_tasks"]`	Roles of the service node.
`service.target.previous.state`	`keyword`	`custom`		`true`	`activating`	Service state before it changed, e.g. `RUNNING` before a restart.
`service.target.state`	`keyword`	`core`		`true`		Current state of the service.
`service.target.type`	`keyword`	`core`		`true`	`elasticsearch`	The type of the service.
`service.target.version`	`keyword`	`core`		`true`	`3.2.4`	Version of the service.
`service.type`	`keyword`	`core`		`true`	`elasticsearch`	The type of the service.
`service.version`	`keyword`	`core`		`true`	`3.2.4`	Version of the service.

source

Fields about the source side of a network connection, used with destination.

Field	Type	Level	Normalization	Indexed	Example	Description
`source.address`	`keyword`	`extended`		`true`		Source network address.
`source.as.number`	`long`	`extended`		`true`	`15169`	Unique number allocated to the autonomous system.
`source.as.organization.name`	`keyword`	`extended`		`true`	`Google LLC`	Organization name.
`source.bytes`	`long`	`core`		`true`	`184`	Bytes sent from the source to the destination.
`source.domain`	`keyword`	`core`		`true`	`foo.example.com`	The domain name of the source.
`source.geo.city_name`	`keyword`	`core`		`true`	`Montreal`	City name.
`source.geo.continent_code`	`keyword`	`core`		`true`	`NA`	Continent code.
`source.geo.continent_name`	`keyword`	`core`		`true`	`North America`	Name of the continent.
`source.geo.country_iso_code`	`keyword`	`core`		`true`	`CA`	Country ISO code.
`source.geo.country_name`	`keyword`	`core`		`true`	`Canada`	Country name.
`source.geo.location`	`geo_point`	`core`		`true`	`{ "lon": -73.614830, "lat": 45.505918 }`	Longitude and latitude.
`source.geo.name`	`keyword`	`extended`		`true`	`boston-dc`	User-defined description of a location.
`source.geo.postal_code`	`keyword`	`core`		`true`	`94040`	Postal code.
`source.geo.region_iso_code`	`keyword`	`core`		`true`	`CA-QC`	Region ISO code.
`source.geo.region_name`	`keyword`	`core`		`true`	`Quebec`	Region name.
`source.geo.timezone`	`keyword`	`core`		`true`	`America/Argentina/Buenos_Aires`	Time zone.
`source.ip`	`ip`	`core`		`true`		IP address of the source.
`source.mac`	`keyword`	`core`		`true`	`00-00-5E-00-53-23`	MAC address of the source.
`source.nat.ip`	`ip`	`extended`		`true`		Source NAT ip
`source.nat.port`	`long`	`extended`		`true`		Source NAT port
`source.packets`	`long`	`core`		`true`	`12`	Packets sent from the source to the destination.
`source.port`	`long`	`core`		`true`		Port of the source.
`source.registered_domain`	`keyword`	`extended`		`true`	`example.com`	The highest registered source domain, stripped of the subdomain.
`source.subdomain`	`keyword`	`extended`		`true`	`east`	The subdomain of the domain.
`source.top_level_domain`	`keyword`	`extended`		`true`	`co.uk`	The effective top level domain (com, org, net, co.uk).
`source.user.domain`	`keyword`	`extended`		`true`		Name of the directory the user is a member of.
`source.user.email`	`keyword`	`extended`		`true`		User email address.
`source.user.full_name`	`keyword`	`extended`		`true`	`Albert Einstein`	User's full name, if available.
`source.user.group.domain`	`keyword`	`extended`		`true`		Name of the directory the group is a member of.
`source.user.group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`source.user.group.name`	`keyword`	`extended`		`true`		Name of the group.
`source.user.hash`	`keyword`	`extended`		`true`		Unique user hash to correlate information for a user in anonymized form.
`source.user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`source.user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`source.user.roles`	`keyword`	`extended`	`array`	`true`	`["kibana_admin", "reporting_user"]`	Array of user roles at the time of the event.

span

Fields related to distributed tracing.

Field	Type	Level	Normalization	Indexed	Example	Description
`span.id`	`keyword`	`extended`		`true`	`3ff9a8981b7ccd5a`	Unique identifier of the span within the scope of its trace.

threat

Fields to classify events and alerts according to a threat taxonomy.

Field	Type	Level	Normalization	Indexed	Example	Description
`threat.enrichments`	`object`	`extended`	`array`	`true`		List of objects containing indicators enriching the event.
`threat.enrichments.indicator`	`object`	`extended`		`true`		Object containing indicators enriching the event.
`threat.enrichments.indicator.as.number`	`long`	`extended`		`true`	`15169`	Unique number allocated to the autonomous system.
`threat.enrichments.indicator.as.organization.name`	`keyword`	`extended`		`true`	`Google LLC`	Organization name.
`threat.enrichments.indicator.confidence`	`keyword`	`extended`		`true`	`Medium`	Indicator confidence rating
`threat.enrichments.indicator.description`	`keyword`	`extended`		`true`	`IP x.x.x.x was observed delivering the Angler EK.`	Indicator description
`threat.enrichments.indicator.email.address`	`keyword`	`extended`		`true`	`phish@example.com`	Indicator email address
`threat.enrichments.indicator.feed.name`	`keyword`	`custom`		`true`		Name of the feed that supplied the indicator.
`threat.enrichments.indicator.file.accessed`	`date`	`extended`		`true`		Last time the file was accessed.
`threat.enrichments.indicator.file.attributes`	`keyword`	`extended`	`array`	`true`	`["readonly", "system"]`	Array of file attributes.
`threat.enrichments.indicator.file.code_signature.digest_algorithm`	`keyword`	`extended`		`true`	`sha256`	Hashing algorithm used to sign the process.
`threat.enrichments.indicator.file.code_signature.exists`	`boolean`	`core`		`true`	`true`	Boolean to capture if a signature is present.
`threat.enrichments.indicator.file.code_signature.flags`	`keyword`	`extended`		`true`	`570522385`	Code signing flags of the process
`threat.enrichments.indicator.file.code_signature.signing_id`	`keyword`	`extended`		`true`	`com.apple.xpc.proxy`	The identifier used to sign the process.
`threat.enrichments.indicator.file.code_signature.status`	`keyword`	`extended`		`true`	`ERROR_UNTRUSTED_ROOT`	Additional information about the certificate status.
`threat.enrichments.indicator.file.code_signature.subject_name`	`keyword`	`core`		`true`	`Microsoft Corporation`	Subject name of the code signer
`threat.enrichments.indicator.file.code_signature.team_id`	`keyword`	`extended`		`true`	`EQHXZ8M8AV`	The team identifier used to sign the process.
`threat.enrichments.indicator.file.code_signature.thumbprint_sha256`	`keyword`	`extended`		`true`	`c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b`	SHA256 hash of the certificate.
`threat.enrichments.indicator.file.code_signature.timestamp`	`date`	`extended`		`true`	`2021-01-01T12:10:30Z`	When the signature was generated and signed.
`threat.enrichments.indicator.file.code_signature.trusted`	`boolean`	`extended`		`true`	`true`	Stores the trust status of the certificate chain.
`threat.enrichments.indicator.file.code_signature.valid`	`boolean`	`extended`		`true`	`true`	Boolean to capture if the digital signature is verified against the binary content.
`threat.enrichments.indicator.file.created`	`date`	`extended`		`true`		File creation time.
`threat.enrichments.indicator.file.ctime`	`date`	`extended`		`true`		Last time the file attributes or metadata changed.
`threat.enrichments.indicator.file.device`	`keyword`	`extended`		`true`	`sda`	Device that is the source of the file.
`threat.enrichments.indicator.file.directory`	`keyword`	`extended`		`true`	`/home/alice`	Directory where the file is located.
`threat.enrichments.indicator.file.drive_letter`	`keyword`	`extended`		`true`	`C`	Drive letter where the file is located.
`threat.enrichments.indicator.file.elf.architecture`	`keyword`	`extended`		`true`	`x86-64`	Machine architecture of the ELF file.
`threat.enrichments.indicator.file.elf.byte_order`	`keyword`	`extended`		`true`	`Little Endian`	Byte sequence of ELF file.
`threat.enrichments.indicator.file.elf.cpu_type`	`keyword`	`extended`		`true`	`Intel`	CPU type of the ELF file.
`threat.enrichments.indicator.file.elf.creation_date`	`date`	`extended`		`true`		Build or compile date.
`threat.enrichments.indicator.file.elf.exports`	`flat_object`	`extended`	`array`	`true`		List of exported element names and types.
`threat.enrichments.indicator.file.elf.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in an ELF file.
`threat.enrichments.indicator.file.elf.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`threat.enrichments.indicator.file.elf.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`threat.enrichments.indicator.file.elf.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`threat.enrichments.indicator.file.elf.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`threat.enrichments.indicator.file.elf.header.abi_version`	`keyword`	`extended`		`true`		Version of the ELF Application Binary Interface (ABI).
`threat.enrichments.indicator.file.elf.header.class`	`keyword`	`extended`		`true`		Header class of the ELF file.
`threat.enrichments.indicator.file.elf.header.data`	`keyword`	`extended`		`true`		Data table of the ELF header.
`threat.enrichments.indicator.file.elf.header.entrypoint`	`long`	`extended`		`true`		Header entrypoint of the ELF file.
`threat.enrichments.indicator.file.elf.header.object_version`	`keyword`	`extended`		`true`		"0x1" for original ELF files.
`threat.enrichments.indicator.file.elf.header.os_abi`	`keyword`	`extended`		`true`		Application Binary Interface (ABI) of the Linux OS.
`threat.enrichments.indicator.file.elf.header.type`	`keyword`	`extended`		`true`		Header type of the ELF file.
`threat.enrichments.indicator.file.elf.header.version`	`keyword`	`extended`		`true`		Version of the ELF header.
`threat.enrichments.indicator.file.elf.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in an ELF file.
`threat.enrichments.indicator.file.elf.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`threat.enrichments.indicator.file.elf.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`threat.enrichments.indicator.file.elf.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`threat.enrichments.indicator.file.elf.sections`	`nested`	`extended`	`array`	`true`		Section information of the ELF file.
`threat.enrichments.indicator.file.elf.sections.chi2`	`long`	`extended`		`true`		Chi-square probability distribution of the section.
`threat.enrichments.indicator.file.elf.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`threat.enrichments.indicator.file.elf.sections.flags`	`keyword`	`extended`		`true`		ELF Section List flags.
`threat.enrichments.indicator.file.elf.sections.name`	`keyword`	`extended`		`true`		ELF Section List name.
`threat.enrichments.indicator.file.elf.sections.physical_offset`	`keyword`	`extended`		`true`		ELF Section List offset.
`threat.enrichments.indicator.file.elf.sections.physical_size`	`long`	`extended`		`true`		ELF Section List physical size.
`threat.enrichments.indicator.file.elf.sections.type`	`keyword`	`extended`		`true`		ELF Section List type.
`threat.enrichments.indicator.file.elf.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`threat.enrichments.indicator.file.elf.sections.virtual_address`	`long`	`extended`		`true`		ELF Section List virtual address.
`threat.enrichments.indicator.file.elf.sections.virtual_size`	`long`	`extended`		`true`		ELF Section List virtual size.
`threat.enrichments.indicator.file.elf.segments`	`nested`	`extended`	`array`	`true`		ELF object segment list.
`threat.enrichments.indicator.file.elf.segments.sections`	`keyword`	`extended`		`true`		ELF object segment sections.
`threat.enrichments.indicator.file.elf.segments.type`	`keyword`	`extended`		`true`		ELF object segment type.
`threat.enrichments.indicator.file.elf.shared_libraries`	`keyword`	`extended`	`array`	`true`		List of shared libraries used by this ELF object.
`threat.enrichments.indicator.file.elf.telfhash`	`keyword`	`extended`		`true`		telfhash hash for ELF file.
`threat.enrichments.indicator.file.extension`	`keyword`	`extended`		`true`	`png`	File extension, excluding the leading dot.
`threat.enrichments.indicator.file.fork_name`	`keyword`	`extended`		`true`	`Zone.Identifer`	A fork is additional data associated with a filesystem object.
`threat.enrichments.indicator.file.gid`	`keyword`	`extended`		`true`	`1001`	Primary group ID (GID) of the file.
`threat.enrichments.indicator.file.group`	`keyword`	`extended`		`true`	`alice`	Primary group name of the file.
`threat.enrichments.indicator.file.hash.cdhash`	`keyword`	`extended`		`true`	`3783b4052fd474dbe30676b45c329e7a6d44acd9`	The Code Directory (CD) hash of an executable.
`threat.enrichments.indicator.file.hash.md5`	`keyword`	`extended`		`true`		MD5 hash.
`threat.enrichments.indicator.file.hash.sha1`	`keyword`	`extended`		`true`		SHA1 hash.
`threat.enrichments.indicator.file.hash.sha256`	`keyword`	`extended`		`true`		SHA256 hash.
`threat.enrichments.indicator.file.hash.sha384`	`keyword`	`extended`		`true`		SHA384 hash.
`threat.enrichments.indicator.file.hash.sha512`	`keyword`	`extended`		`true`		SHA512 hash.
`threat.enrichments.indicator.file.hash.ssdeep`	`keyword`	`extended`		`true`		SSDEEP hash.
`threat.enrichments.indicator.file.hash.tlsh`	`keyword`	`extended`		`true`		TLSH hash.
`threat.enrichments.indicator.file.inode`	`keyword`	`extended`		`true`	`256383`	Inode representing the file in the filesystem.
`threat.enrichments.indicator.file.mime_type`	`keyword`	`extended`		`true`		Media type of file, document, or arrangement of bytes.
`threat.enrichments.indicator.file.mode`	`keyword`	`extended`		`true`	`0640`	Mode of the file in octal representation.
`threat.enrichments.indicator.file.mtime`	`date`	`extended`		`true`		Last time the file content was modified.
`threat.enrichments.indicator.file.name`	`keyword`	`extended`		`true`	`example.png`	Name of the file including the extension, without the directory.
`threat.enrichments.indicator.file.origin_referrer_url`	`keyword`	`extended`		`true`	`http://example.com/article1.html`	The URL of the webpage that linked to the file.
`threat.enrichments.indicator.file.origin_url`	`keyword`	`extended`		`true`	`http://example.com/imgs/article1_img1.jpg`	The URL where the file is hosted.
`threat.enrichments.indicator.file.owner`	`keyword`	`extended`		`true`	`alice`	File owner's username.
`threat.enrichments.indicator.file.path`	`keyword`	`extended`		`true`	`/home/alice/example.png`	Full path to the file, including the file name.
`threat.enrichments.indicator.file.pe.architecture`	`keyword`	`extended`		`true`	`x64`	CPU architecture target for the file.
`threat.enrichments.indicator.file.pe.company`	`keyword`	`extended`		`true`	`Microsoft Corporation`	Internal company name of the file, provided at compile-time.
`threat.enrichments.indicator.file.pe.description`	`keyword`	`extended`		`true`	`Paint`	Internal description of the file, provided at compile-time.
`threat.enrichments.indicator.file.pe.file_version`	`keyword`	`extended`		`true`	`6.3.9600.17415`	Process name.
`threat.enrichments.indicator.file.pe.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in a PE file.
`threat.enrichments.indicator.file.pe.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`threat.enrichments.indicator.file.pe.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`threat.enrichments.indicator.file.pe.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`threat.enrichments.indicator.file.pe.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`threat.enrichments.indicator.file.pe.imphash`	`keyword`	`extended`		`true`	`0c6803c4e922103c4dca5963aad36ddf`	A hash of the imports in a PE file.
`threat.enrichments.indicator.file.pe.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in a PE file.
`threat.enrichments.indicator.file.pe.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`threat.enrichments.indicator.file.pe.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`threat.enrichments.indicator.file.pe.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`threat.enrichments.indicator.file.pe.original_file_name`	`keyword`	`extended`		`true`	`MSPAINT.EXE`	Internal name of the file, provided at compile-time.
`threat.enrichments.indicator.file.pe.pehash`	`keyword`	`extended`		`true`	`73ff189b63cd6be375a7ff25179a38d347651975`	A hash of the PE header and data from one or more PE sections.
`threat.enrichments.indicator.file.pe.product`	`keyword`	`extended`		`true`	`Microsoft® Windows® Operating System`	Internal product name of the file, provided at compile-time.
`threat.enrichments.indicator.file.pe.sections`	`nested`	`extended`	`array`	`true`		Section information of the PE file.
`threat.enrichments.indicator.file.pe.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`threat.enrichments.indicator.file.pe.sections.name`	`keyword`	`extended`		`true`		PE Section List name.
`threat.enrichments.indicator.file.pe.sections.physical_size`	`long`	`extended`		`true`		PE Section List physical size.
`threat.enrichments.indicator.file.pe.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`threat.enrichments.indicator.file.pe.sections.virtual_size`	`long`	`extended`		`true`		PE Section List virtual size. This is always the same as `physical_size`.
`threat.enrichments.indicator.file.size`	`long`	`extended`		`true`	`16384`	File size in bytes.
`threat.enrichments.indicator.file.target_path`	`keyword`	`extended`		`true`		Target path for symlinks.
`threat.enrichments.indicator.file.type`	`keyword`	`extended`		`true`	`file`	File type (file, dir, or symlink).
`threat.enrichments.indicator.file.uid`	`keyword`	`extended`		`true`	`1001`	The user ID (UID) or security identifier (SID) of the file owner.
`threat.enrichments.indicator.file.x509.alternative_names`	`keyword`	`extended`	`array`	`true`	`*.elastic.co`	List of subject alternative names (SAN).
`threat.enrichments.indicator.file.x509.issuer.common_name`	`keyword`	`extended`	`array`	`true`	`Example SHA2 High Assurance Server CA`	List of common name (CN) of issuing certificate authority.
`threat.enrichments.indicator.file.x509.issuer.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) codes
`threat.enrichments.indicator.file.x509.issuer.distinguished_name`	`keyword`	`extended`		`true`	`C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA`	Distinguished name (DN) of issuing certificate authority.
`threat.enrichments.indicator.file.x509.issuer.locality`	`keyword`	`extended`	`array`	`true`	`Mountain View`	List of locality names (L)
`threat.enrichments.indicator.file.x509.issuer.organization`	`keyword`	`extended`	`array`	`true`	`Example Inc`	List of organizations (O) of issuing certificate authority.
`threat.enrichments.indicator.file.x509.issuer.organizational_unit`	`keyword`	`extended`	`array`	`true`	`www.example.com`	List of organizational units (OU) of issuing certificate authority.
`threat.enrichments.indicator.file.x509.issuer.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`threat.enrichments.indicator.file.x509.not_after`	`date`	`extended`		`true`	`2020-07-16T03:15:39Z`	Time at which the certificate is no longer considered valid.
`threat.enrichments.indicator.file.x509.not_before`	`date`	`extended`		`true`	`2019-08-16T01:40:25Z`	Time at which the certificate is first considered valid.
`threat.enrichments.indicator.file.x509.public_key_algorithm`	`keyword`	`extended`		`true`	`RSA`	Algorithm used to generate the public key.
`threat.enrichments.indicator.file.x509.public_key_curve`	`keyword`	`extended`		`true`	`nistp521`	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
`threat.enrichments.indicator.file.x509.public_key_exponent`	`long`	`extended`		`false`	`65537`	Exponent used to derive the public key. This is algorithm specific.
`threat.enrichments.indicator.file.x509.public_key_size`	`long`	`extended`		`true`	`2048`	The size of the public key space in bits.
`threat.enrichments.indicator.file.x509.serial_number`	`keyword`	`extended`		`true`	`55FBB9C7DEBF09809D12CCAA`	Unique serial number issued by the certificate authority.
`threat.enrichments.indicator.file.x509.signature_algorithm`	`keyword`	`extended`		`true`	`SHA256-RSA`	Identifier for certificate signature algorithm.
`threat.enrichments.indicator.file.x509.subject.common_name`	`keyword`	`extended`	`array`	`true`	`shared.global.example.net`	List of common names (CN) of subject.
`threat.enrichments.indicator.file.x509.subject.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) code
`threat.enrichments.indicator.file.x509.subject.distinguished_name`	`keyword`	`extended`		`true`	`C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net`	Distinguished name (DN) of the certificate subject entity.
`threat.enrichments.indicator.file.x509.subject.locality`	`keyword`	`extended`	`array`	`true`	`San Francisco`	List of locality names (L)
`threat.enrichments.indicator.file.x509.subject.organization`	`keyword`	`extended`	`array`	`true`	`Example, Inc.`	List of organizations (O) of subject.
`threat.enrichments.indicator.file.x509.subject.organizational_unit`	`keyword`	`extended`	`array`	`true`		List of organizational units (OU) of subject.
`threat.enrichments.indicator.file.x509.subject.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`threat.enrichments.indicator.file.x509.version_number`	`keyword`	`extended`		`true`	`3`	Version of x509 format.
`threat.enrichments.indicator.first_seen`	`date`	`extended`		`true`	`2020-11-05T17:25:47.000Z`	Date/time indicator was first reported.
`threat.enrichments.indicator.geo.city_name`	`keyword`	`core`		`true`	`Montreal`	City name.
`threat.enrichments.indicator.geo.continent_code`	`keyword`	`core`		`true`	`NA`	Continent code.
`threat.enrichments.indicator.geo.continent_name`	`keyword`	`core`		`true`	`North America`	Name of the continent.
`threat.enrichments.indicator.geo.country_iso_code`	`keyword`	`core`		`true`	`CA`	Country ISO code.
`threat.enrichments.indicator.geo.country_name`	`keyword`	`core`		`true`	`Canada`	Country name.
`threat.enrichments.indicator.geo.location`	`geo_point`	`core`		`true`	`{ "lon": -73.614830, "lat": 45.505918 }`	Longitude and latitude.
`threat.enrichments.indicator.geo.name`	`keyword`	`extended`		`true`	`boston-dc`	User-defined description of a location.
`threat.enrichments.indicator.geo.postal_code`	`keyword`	`core`		`true`	`94040`	Postal code.
`threat.enrichments.indicator.geo.region_iso_code`	`keyword`	`core`		`true`	`CA-QC`	Region ISO code.
`threat.enrichments.indicator.geo.region_name`	`keyword`	`core`		`true`	`Quebec`	Region name.
`threat.enrichments.indicator.geo.timezone`	`keyword`	`core`		`true`	`America/Argentina/Buenos_Aires`	Time zone.
`threat.enrichments.indicator.id`	`keyword`	`custom`		`true`		Unique identifier for the enrichment data, such as a hash of the indicator data or a unique ID from the provider.
`threat.enrichments.indicator.ip`	`ip`	`extended`		`true`	`1.2.3.4`	Indicator IP address
`threat.enrichments.indicator.last_seen`	`date`	`extended`		`true`	`2020-11-05T17:25:47.000Z`	Date/time indicator was last reported.
`threat.enrichments.indicator.marking.tlp`	`keyword`	`extended`		`true`	`CLEAR`	Indicator TLP marking
`threat.enrichments.indicator.marking.tlp_version`	`keyword`	`extended`		`true`	`2.0`	Indicator TLP version
`threat.enrichments.indicator.modified_at`	`date`	`extended`		`true`	`2020-11-05T17:25:47.000Z`	Date/time indicator was last updated.
`threat.enrichments.indicator.name`	`keyword`	`extended`		`true`	`5.2.75.227`	Indicator display name
`threat.enrichments.indicator.port`	`long`	`extended`		`true`	`443`	Indicator port
`threat.enrichments.indicator.provider`	`keyword`	`extended`		`true`	`lrz_urlhaus`	Indicator provider
`threat.enrichments.indicator.reference`	`keyword`	`extended`		`true`	`https://system.example.com/indicator/0001234`	Indicator reference URL
`threat.enrichments.indicator.registry.data.bytes`	`keyword`	`extended`		`true`	`ZQBuAC0AVQBTAAAAZQBuAAAAAAA=`	Original bytes written with base64 encoding.
`threat.enrichments.indicator.registry.data.strings`	`keyword`	`core`	`array`	`true`	`["C:\rta\red_ttp\bin\myapp.exe"]`	List of strings representing what was written to the registry.
`threat.enrichments.indicator.registry.data.type`	`keyword`	`core`		`true`	`REG_SZ`	Standard registry type for encoding contents
`threat.enrichments.indicator.registry.hive`	`keyword`	`core`		`true`	`HKLM`	Abbreviated name for the hive.
`threat.enrichments.indicator.registry.key`	`keyword`	`core`		`true`	`SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe`	Hive-relative path of keys.
`threat.enrichments.indicator.registry.path`	`keyword`	`core`		`true`	`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger`	Full path, including hive, key and value
`threat.enrichments.indicator.registry.value`	`keyword`	`core`		`true`	`Debugger`	Name of the value written.
`threat.enrichments.indicator.scanner_stats`	`long`	`extended`		`true`	`4`	Scanner statistics
`threat.enrichments.indicator.sightings`	`long`	`extended`		`true`	`20`	Number of times indicator observed
`threat.enrichments.indicator.software`	`object`	`custom`		`true`		Name of the software associated with the indicator, such as malware or attack framework.
`threat.enrichments.indicator.software.alias`	`keyword`	`custom`	`array`	`true`		Alias or alternative names for the software associated with the indicator.
`threat.enrichments.indicator.software.name`	`keyword`	`custom`		`true`		Name of the software associated with the indicator.
`threat.enrichments.indicator.software.type`	`keyword`	`custom`		`true`		Type of software associated with the indicator, such as malware, attack framework, or tool.
`threat.enrichments.indicator.tags`	`keyword`	`custom`	`array`	`true`		List of tags associated with the indicator.
`threat.enrichments.indicator.type`	`keyword`	`extended`		`true`	`ipv4-addr`	Type of indicator
`threat.enrichments.indicator.url.domain`	`keyword`	`extended`		`true`	`www.elastic.co`	Domain of the url.
`threat.enrichments.indicator.url.extension`	`keyword`	`extended`		`true`	`png`	File extension from the request url, excluding the leading dot.
`threat.enrichments.indicator.url.fragment`	`keyword`	`extended`		`true`		Portion of the url after the `#`.
`threat.enrichments.indicator.url.full`	`keyword`	`extended`		`true`	`https://www.elastic.co:443/search?q=elasticsearch#top`	Full unparsed URL.
`threat.enrichments.indicator.url.original`	`keyword`	`extended`		`true`	`https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch`	Unmodified original url as seen in the event source.
`threat.enrichments.indicator.url.password`	`keyword`	`extended`		`true`		Password of the request.
`threat.enrichments.indicator.url.path`	`keyword`	`extended`		`true`		Path of the request, such as "/search".
`threat.enrichments.indicator.url.port`	`long`	`extended`		`true`	`443`	Port of the request, such as 443.
`threat.enrichments.indicator.url.query`	`keyword`	`extended`		`true`		Query string of the request.
`threat.enrichments.indicator.url.registered_domain`	`keyword`	`extended`		`true`	`example.com`	The highest registered url domain, stripped of the subdomain.
`threat.enrichments.indicator.url.scheme`	`keyword`	`extended`		`true`	`https`	Scheme of the url.
`threat.enrichments.indicator.url.subdomain`	`keyword`	`extended`		`true`	`east`	The subdomain of the domain.
`threat.enrichments.indicator.url.top_level_domain`	`keyword`	`extended`		`true`	`co.uk`	The effective top level domain (com, org, net, co.uk).
`threat.enrichments.indicator.url.username`	`keyword`	`extended`		`true`		Username of the request.
`threat.enrichments.indicator.x509.alternative_names`	`keyword`	`extended`	`array`	`true`	`*.elastic.co`	List of subject alternative names (SAN).
`threat.enrichments.indicator.x509.issuer.common_name`	`keyword`	`extended`	`array`	`true`	`Example SHA2 High Assurance Server CA`	List of common name (CN) of issuing certificate authority.
`threat.enrichments.indicator.x509.issuer.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) codes
`threat.enrichments.indicator.x509.issuer.distinguished_name`	`keyword`	`extended`		`true`	`C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA`	Distinguished name (DN) of issuing certificate authority.
`threat.enrichments.indicator.x509.issuer.locality`	`keyword`	`extended`	`array`	`true`	`Mountain View`	List of locality names (L)
`threat.enrichments.indicator.x509.issuer.organization`	`keyword`	`extended`	`array`	`true`	`Example Inc`	List of organizations (O) of issuing certificate authority.
`threat.enrichments.indicator.x509.issuer.organizational_unit`	`keyword`	`extended`	`array`	`true`	`www.example.com`	List of organizational units (OU) of issuing certificate authority.
`threat.enrichments.indicator.x509.issuer.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`threat.enrichments.indicator.x509.not_after`	`date`	`extended`		`true`	`2020-07-16T03:15:39Z`	Time at which the certificate is no longer considered valid.
`threat.enrichments.indicator.x509.not_before`	`date`	`extended`		`true`	`2019-08-16T01:40:25Z`	Time at which the certificate is first considered valid.
`threat.enrichments.indicator.x509.public_key_algorithm`	`keyword`	`extended`		`true`	`RSA`	Algorithm used to generate the public key.
`threat.enrichments.indicator.x509.public_key_curve`	`keyword`	`extended`		`true`	`nistp521`	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
`threat.enrichments.indicator.x509.public_key_exponent`	`long`	`extended`		`false`	`65537`	Exponent used to derive the public key. This is algorithm specific.
`threat.enrichments.indicator.x509.public_key_size`	`long`	`extended`		`true`	`2048`	The size of the public key space in bits.
`threat.enrichments.indicator.x509.serial_number`	`keyword`	`extended`		`true`	`55FBB9C7DEBF09809D12CCAA`	Unique serial number issued by the certificate authority.
`threat.enrichments.indicator.x509.signature_algorithm`	`keyword`	`extended`		`true`	`SHA256-RSA`	Identifier for certificate signature algorithm.
`threat.enrichments.indicator.x509.subject.common_name`	`keyword`	`extended`	`array`	`true`	`shared.global.example.net`	List of common names (CN) of subject.
`threat.enrichments.indicator.x509.subject.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) code
`threat.enrichments.indicator.x509.subject.distinguished_name`	`keyword`	`extended`		`true`	`C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net`	Distinguished name (DN) of the certificate subject entity.
`threat.enrichments.indicator.x509.subject.locality`	`keyword`	`extended`	`array`	`true`	`San Francisco`	List of locality names (L)
`threat.enrichments.indicator.x509.subject.organization`	`keyword`	`extended`	`array`	`true`	`Example, Inc.`	List of organizations (O) of subject.
`threat.enrichments.indicator.x509.subject.organizational_unit`	`keyword`	`extended`	`array`	`true`		List of organizational units (OU) of subject.
`threat.enrichments.indicator.x509.subject.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`threat.enrichments.indicator.x509.version_number`	`keyword`	`extended`		`true`	`3`	Version of x509 format.
`threat.enrichments.matched.atomic`	`keyword`	`extended`		`true`	`bad-domain.com`	Matched indicator value
`threat.enrichments.matched.field`	`keyword`	`extended`		`true`	`file.hash.sha256`	Matched indicator field
`threat.enrichments.matched.id`	`keyword`	`extended`		`true`	`ff93aee5-86a1-4a61-b0e6-0cdc313d01b5`	Matched indicator identifier
`threat.enrichments.matched.index`	`keyword`	`extended`		`true`	`filebeat-8.0.0-2021.05.23-000011`	Matched indicator index
`threat.enrichments.matched.occurred`	`date`	`extended`		`true`	`2021-10-05T17:00:58.326Z`	Date of match
`threat.enrichments.matched.type`	`keyword`	`extended`		`true`	`indicator_match_rule`	Type of indicator match
`threat.feed.dashboard_id`	`keyword`	`extended`		`true`	`5ba16340-72e6-11eb-a3e3-b3cc7c78a70f`	Feed dashboard ID.
`threat.feed.description`	`keyword`	`extended`		`true`	`Threat feed from the AlienVault Open Threat eXchange network.`	Description of the threat feed.
`threat.feed.name`	`keyword`	`extended`		`true`	`AlienVault OTX`	Name of the threat feed.
`threat.feed.reference`	`keyword`	`extended`		`true`	`https://otx.alienvault.com`	Reference for the threat feed.
`threat.framework`	`keyword`	`extended`		`true`	`MITRE ATT&CK`	Threat classification framework.
`threat.group.alias`	`keyword`	`extended`	`array`	`true`	`[ "Magecart Group 6" ]`	Alias of the group.
`threat.group.id`	`keyword`	`extended`		`true`	`G0037`	ID of the group.
`threat.group.name`	`keyword`	`extended`		`true`	`FIN6`	Name of the group.
`threat.group.reference`	`keyword`	`extended`		`true`	`https://attack.mitre.org/groups/G0037/`	Reference URL of the group.
`threat.indicator.as.number`	`long`	`extended`		`true`	`15169`	Unique number allocated to the autonomous system.
`threat.indicator.as.organization.name`	`keyword`	`extended`		`true`	`Google LLC`	Organization name.
`threat.indicator.confidence`	`short`	`custom`		`true`	`Medium`	Indicator confidence rating
`threat.indicator.description`	`keyword`	`extended`		`true`	`IP x.x.x.x was observed delivering the Angler EK.`	Indicator description
`threat.indicator.email.address`	`keyword`	`extended`		`true`	`phish@example.com`	Indicator email address
`threat.indicator.file.accessed`	`date`	`extended`		`true`		Last time the file was accessed.
`threat.indicator.file.attributes`	`keyword`	`extended`	`array`	`true`	`["readonly", "system"]`	Array of file attributes.
`threat.indicator.file.code_signature.digest_algorithm`	`keyword`	`extended`		`true`	`sha256`	Hashing algorithm used to sign the process.
`threat.indicator.file.code_signature.exists`	`boolean`	`core`		`true`	`true`	Boolean to capture if a signature is present.
`threat.indicator.file.code_signature.flags`	`keyword`	`extended`		`true`	`570522385`	Code signing flags of the process
`threat.indicator.file.code_signature.signing_id`	`keyword`	`extended`		`true`	`com.apple.xpc.proxy`	The identifier used to sign the process.
`threat.indicator.file.code_signature.status`	`keyword`	`extended`		`true`	`ERROR_UNTRUSTED_ROOT`	Additional information about the certificate status.
`threat.indicator.file.code_signature.subject_name`	`keyword`	`core`		`true`	`Microsoft Corporation`	Subject name of the code signer
`threat.indicator.file.code_signature.team_id`	`keyword`	`extended`		`true`	`EQHXZ8M8AV`	The team identifier used to sign the process.
`threat.indicator.file.code_signature.thumbprint_sha256`	`keyword`	`extended`		`true`	`c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b`	SHA256 hash of the certificate.
`threat.indicator.file.code_signature.timestamp`	`date`	`extended`		`true`	`2021-01-01T12:10:30Z`	When the signature was generated and signed.
`threat.indicator.file.code_signature.trusted`	`boolean`	`extended`		`true`	`true`	Stores the trust status of the certificate chain.
`threat.indicator.file.code_signature.valid`	`boolean`	`extended`		`true`	`true`	Boolean to capture if the digital signature is verified against the binary content.
`threat.indicator.file.created`	`date`	`extended`		`true`		File creation time.
`threat.indicator.file.ctime`	`date`	`extended`		`true`		Last time the file attributes or metadata changed.
`threat.indicator.file.device`	`keyword`	`extended`		`true`	`sda`	Device that is the source of the file.
`threat.indicator.file.directory`	`keyword`	`extended`		`true`	`/home/alice`	Directory where the file is located.
`threat.indicator.file.drive_letter`	`keyword`	`extended`		`true`	`C`	Drive letter where the file is located.
`threat.indicator.file.elf.architecture`	`keyword`	`extended`		`true`	`x86-64`	Machine architecture of the ELF file.
`threat.indicator.file.elf.byte_order`	`keyword`	`extended`		`true`	`Little Endian`	Byte sequence of ELF file.
`threat.indicator.file.elf.cpu_type`	`keyword`	`extended`		`true`	`Intel`	CPU type of the ELF file.
`threat.indicator.file.elf.creation_date`	`date`	`extended`		`true`		Build or compile date.
`threat.indicator.file.elf.exports`	`flat_object`	`extended`	`array`	`true`		List of exported element names and types.
`threat.indicator.file.elf.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in an ELF file.
`threat.indicator.file.elf.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`threat.indicator.file.elf.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`threat.indicator.file.elf.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`threat.indicator.file.elf.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`threat.indicator.file.elf.header.abi_version`	`keyword`	`extended`		`true`		Version of the ELF Application Binary Interface (ABI).
`threat.indicator.file.elf.header.class`	`keyword`	`extended`		`true`		Header class of the ELF file.
`threat.indicator.file.elf.header.data`	`keyword`	`extended`		`true`		Data table of the ELF header.
`threat.indicator.file.elf.header.entrypoint`	`long`	`extended`		`true`		Header entrypoint of the ELF file.
`threat.indicator.file.elf.header.object_version`	`keyword`	`extended`		`true`		"0x1" for original ELF files.
`threat.indicator.file.elf.header.os_abi`	`keyword`	`extended`		`true`		Application Binary Interface (ABI) of the Linux OS.
`threat.indicator.file.elf.header.type`	`keyword`	`extended`		`true`		Header type of the ELF file.
`threat.indicator.file.elf.header.version`	`keyword`	`extended`		`true`		Version of the ELF header.
`threat.indicator.file.elf.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in an ELF file.
`threat.indicator.file.elf.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`threat.indicator.file.elf.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`threat.indicator.file.elf.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`threat.indicator.file.elf.sections`	`nested`	`extended`	`array`	`true`		Section information of the ELF file.
`threat.indicator.file.elf.sections.chi2`	`long`	`extended`		`true`		Chi-square probability distribution of the section.
`threat.indicator.file.elf.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`threat.indicator.file.elf.sections.flags`	`keyword`	`extended`		`true`		ELF Section List flags.
`threat.indicator.file.elf.sections.name`	`keyword`	`extended`		`true`		ELF Section List name.
`threat.indicator.file.elf.sections.physical_offset`	`keyword`	`extended`		`true`		ELF Section List offset.
`threat.indicator.file.elf.sections.physical_size`	`long`	`extended`		`true`		ELF Section List physical size.
`threat.indicator.file.elf.sections.type`	`keyword`	`extended`		`true`		ELF Section List type.
`threat.indicator.file.elf.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`threat.indicator.file.elf.sections.virtual_address`	`long`	`extended`		`true`		ELF Section List virtual address.
`threat.indicator.file.elf.sections.virtual_size`	`long`	`extended`		`true`		ELF Section List virtual size.
`threat.indicator.file.elf.segments`	`nested`	`extended`	`array`	`true`		ELF object segment list.
`threat.indicator.file.elf.segments.sections`	`keyword`	`extended`		`true`		ELF object segment sections.
`threat.indicator.file.elf.segments.type`	`keyword`	`extended`		`true`		ELF object segment type.
`threat.indicator.file.elf.shared_libraries`	`keyword`	`extended`	`array`	`true`		List of shared libraries used by this ELF object.
`threat.indicator.file.elf.telfhash`	`keyword`	`extended`		`true`		telfhash hash for ELF file.
`threat.indicator.file.extension`	`keyword`	`extended`		`true`	`png`	File extension, excluding the leading dot.
`threat.indicator.file.fork_name`	`keyword`	`extended`		`true`	`Zone.Identifer`	A fork is additional data associated with a filesystem object.
`threat.indicator.file.gid`	`keyword`	`extended`		`true`	`1001`	Primary group ID (GID) of the file.
`threat.indicator.file.group`	`keyword`	`extended`		`true`	`alice`	Primary group name of the file.
`threat.indicator.file.hash.cdhash`	`keyword`	`extended`		`true`	`3783b4052fd474dbe30676b45c329e7a6d44acd9`	The Code Directory (CD) hash of an executable.
`threat.indicator.file.hash.md5`	`keyword`	`extended`		`true`		MD5 hash.
`threat.indicator.file.hash.sha1`	`keyword`	`extended`		`true`		SHA1 hash.
`threat.indicator.file.hash.sha256`	`keyword`	`extended`		`true`		SHA256 hash.
`threat.indicator.file.hash.sha384`	`keyword`	`extended`		`true`		SHA384 hash.
`threat.indicator.file.hash.sha512`	`keyword`	`extended`		`true`		SHA512 hash.
`threat.indicator.file.hash.ssdeep`	`keyword`	`extended`		`true`		SSDEEP hash.
`threat.indicator.file.hash.tlsh`	`keyword`	`extended`		`true`		TLSH hash.
`threat.indicator.file.inode`	`keyword`	`extended`		`true`	`256383`	Inode representing the file in the filesystem.
`threat.indicator.file.mime_type`	`keyword`	`extended`		`true`		Media type of file, document, or arrangement of bytes.
`threat.indicator.file.mode`	`keyword`	`extended`		`true`	`0640`	Mode of the file in octal representation.
`threat.indicator.file.mtime`	`date`	`extended`		`true`		Last time the file content was modified.
`threat.indicator.file.name`	`keyword`	`extended`		`true`	`example.png`	Name of the file including the extension, without the directory.
`threat.indicator.file.origin_referrer_url`	`keyword`	`extended`		`true`	`http://example.com/article1.html`	The URL of the webpage that linked to the file.
`threat.indicator.file.origin_url`	`keyword`	`extended`		`true`	`http://example.com/imgs/article1_img1.jpg`	The URL where the file is hosted.
`threat.indicator.file.owner`	`keyword`	`extended`		`true`	`alice`	File owner's username.
`threat.indicator.file.path`	`keyword`	`extended`		`true`	`/home/alice/example.png`	Full path to the file, including the file name.
`threat.indicator.file.pe.architecture`	`keyword`	`extended`		`true`	`x64`	CPU architecture target for the file.
`threat.indicator.file.pe.company`	`keyword`	`extended`		`true`	`Microsoft Corporation`	Internal company name of the file, provided at compile-time.
`threat.indicator.file.pe.description`	`keyword`	`extended`		`true`	`Paint`	Internal description of the file, provided at compile-time.
`threat.indicator.file.pe.file_version`	`keyword`	`extended`		`true`	`6.3.9600.17415`	Process name.
`threat.indicator.file.pe.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in a PE file.
`threat.indicator.file.pe.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`threat.indicator.file.pe.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`threat.indicator.file.pe.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`threat.indicator.file.pe.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`threat.indicator.file.pe.imphash`	`keyword`	`extended`		`true`	`0c6803c4e922103c4dca5963aad36ddf`	A hash of the imports in a PE file.
`threat.indicator.file.pe.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in a PE file.
`threat.indicator.file.pe.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`threat.indicator.file.pe.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`threat.indicator.file.pe.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`threat.indicator.file.pe.original_file_name`	`keyword`	`extended`		`true`	`MSPAINT.EXE`	Internal name of the file, provided at compile-time.
`threat.indicator.file.pe.pehash`	`keyword`	`extended`		`true`	`73ff189b63cd6be375a7ff25179a38d347651975`	A hash of the PE header and data from one or more PE sections.
`threat.indicator.file.pe.product`	`keyword`	`extended`		`true`	`Microsoft® Windows® Operating System`	Internal product name of the file, provided at compile-time.
`threat.indicator.file.pe.sections`	`nested`	`extended`	`array`	`true`		Section information of the PE file.
`threat.indicator.file.pe.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`threat.indicator.file.pe.sections.name`	`keyword`	`extended`		`true`		PE Section List name.
`threat.indicator.file.pe.sections.physical_size`	`long`	`extended`		`true`		PE Section List physical size.
`threat.indicator.file.pe.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`threat.indicator.file.pe.sections.virtual_size`	`long`	`extended`		`true`		PE Section List virtual size. This is always the same as `physical_size`.
`threat.indicator.file.size`	`long`	`extended`		`true`	`16384`	File size in bytes.
`threat.indicator.file.target_path`	`keyword`	`extended`		`true`		Target path for symlinks.
`threat.indicator.file.type`	`keyword`	`extended`		`true`	`file`	File type (file, dir, or symlink).
`threat.indicator.file.uid`	`keyword`	`extended`		`true`	`1001`	The user ID (UID) or security identifier (SID) of the file owner.
`threat.indicator.file.x509.alternative_names`	`keyword`	`extended`	`array`	`true`	`*.elastic.co`	List of subject alternative names (SAN).
`threat.indicator.file.x509.issuer.common_name`	`keyword`	`extended`	`array`	`true`	`Example SHA2 High Assurance Server CA`	List of common name (CN) of issuing certificate authority.
`threat.indicator.file.x509.issuer.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) codes
`threat.indicator.file.x509.issuer.distinguished_name`	`keyword`	`extended`		`true`	`C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA`	Distinguished name (DN) of issuing certificate authority.
`threat.indicator.file.x509.issuer.locality`	`keyword`	`extended`	`array`	`true`	`Mountain View`	List of locality names (L)
`threat.indicator.file.x509.issuer.organization`	`keyword`	`extended`	`array`	`true`	`Example Inc`	List of organizations (O) of issuing certificate authority.
`threat.indicator.file.x509.issuer.organizational_unit`	`keyword`	`extended`	`array`	`true`	`www.example.com`	List of organizational units (OU) of issuing certificate authority.
`threat.indicator.file.x509.issuer.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`threat.indicator.file.x509.not_after`	`date`	`extended`		`true`	`2020-07-16T03:15:39Z`	Time at which the certificate is no longer considered valid.
`threat.indicator.file.x509.not_before`	`date`	`extended`		`true`	`2019-08-16T01:40:25Z`	Time at which the certificate is first considered valid.
`threat.indicator.file.x509.public_key_algorithm`	`keyword`	`extended`		`true`	`RSA`	Algorithm used to generate the public key.
`threat.indicator.file.x509.public_key_curve`	`keyword`	`extended`		`true`	`nistp521`	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
`threat.indicator.file.x509.public_key_exponent`	`long`	`extended`		`false`	`65537`	Exponent used to derive the public key. This is algorithm specific.
`threat.indicator.file.x509.public_key_size`	`long`	`extended`		`true`	`2048`	The size of the public key space in bits.
`threat.indicator.file.x509.serial_number`	`keyword`	`extended`		`true`	`55FBB9C7DEBF09809D12CCAA`	Unique serial number issued by the certificate authority.
`threat.indicator.file.x509.signature_algorithm`	`keyword`	`extended`		`true`	`SHA256-RSA`	Identifier for certificate signature algorithm.
`threat.indicator.file.x509.subject.common_name`	`keyword`	`extended`	`array`	`true`	`shared.global.example.net`	List of common names (CN) of subject.
`threat.indicator.file.x509.subject.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) code
`threat.indicator.file.x509.subject.distinguished_name`	`keyword`	`extended`		`true`	`C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net`	Distinguished name (DN) of the certificate subject entity.
`threat.indicator.file.x509.subject.locality`	`keyword`	`extended`	`array`	`true`	`San Francisco`	List of locality names (L)
`threat.indicator.file.x509.subject.organization`	`keyword`	`extended`	`array`	`true`	`Example, Inc.`	List of organizations (O) of subject.
`threat.indicator.file.x509.subject.organizational_unit`	`keyword`	`extended`	`array`	`true`		List of organizational units (OU) of subject.
`threat.indicator.file.x509.subject.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`threat.indicator.file.x509.version_number`	`keyword`	`extended`		`true`	`3`	Version of x509 format.
`threat.indicator.first_seen`	`date`	`extended`		`true`	`2020-11-05T17:25:47.000Z`	Date/time indicator was first reported.
`threat.indicator.geo.city_name`	`keyword`	`core`		`true`	`Montreal`	City name.
`threat.indicator.geo.continent_code`	`keyword`	`core`		`true`	`NA`	Continent code.
`threat.indicator.geo.continent_name`	`keyword`	`core`		`true`	`North America`	Name of the continent.
`threat.indicator.geo.country_iso_code`	`keyword`	`core`		`true`	`CA`	Country ISO code.
`threat.indicator.geo.country_name`	`keyword`	`core`		`true`	`Canada`	Country name.
`threat.indicator.geo.location`	`geo_point`	`core`		`true`	`{ "lon": -73.614830, "lat": 45.505918 }`	Longitude and latitude.
`threat.indicator.geo.name`	`keyword`	`extended`		`true`	`boston-dc`	User-defined description of a location.
`threat.indicator.geo.postal_code`	`keyword`	`core`		`true`	`94040`	Postal code.
`threat.indicator.geo.region_iso_code`	`keyword`	`core`		`true`	`CA-QC`	Region ISO code.
`threat.indicator.geo.region_name`	`keyword`	`core`		`true`	`Quebec`	Region name.
`threat.indicator.geo.timezone`	`keyword`	`core`		`true`	`America/Argentina/Buenos_Aires`	Time zone.
`threat.indicator.id`	`keyword`	`extended`	`array`	`true`	`[indicator--d7008e06-ab86-415a-9803-3c81ce2d3c37]`	ID of the indicator
`threat.indicator.ip`	`ip`	`extended`		`true`	`1.2.3.4`	Indicator IP address
`threat.indicator.last_seen`	`date`	`extended`		`true`	`2020-11-05T17:25:47.000Z`	Date/time indicator was last reported.
`threat.indicator.marking.tlp`	`keyword`	`extended`		`true`	`CLEAR`	Indicator TLP marking
`threat.indicator.marking.tlp_version`	`keyword`	`extended`		`true`	`2.0`	Indicator TLP version
`threat.indicator.modified_at`	`date`	`extended`		`true`	`2020-11-05T17:25:47.000Z`	Date/time indicator was last updated.
`threat.indicator.name`	`keyword`	`extended`		`true`	`5.2.75.227`	Indicator display name
`threat.indicator.port`	`long`	`extended`		`true`	`443`	Indicator port
`threat.indicator.provider`	`keyword`	`extended`		`true`	`lrz_urlhaus`	Indicator provider
`threat.indicator.reference`	`keyword`	`extended`		`true`	`https://system.example.com/indicator/0001234`	Indicator reference URL
`threat.indicator.registry.data.bytes`	`keyword`	`extended`		`true`	`ZQBuAC0AVQBTAAAAZQBuAAAAAAA=`	Original bytes written with base64 encoding.
`threat.indicator.registry.data.strings`	`keyword`	`core`	`array`	`true`	`["C:\rta\red_ttp\bin\myapp.exe"]`	List of strings representing what was written to the registry.
`threat.indicator.registry.data.type`	`keyword`	`core`		`true`	`REG_SZ`	Standard registry type for encoding contents
`threat.indicator.registry.hive`	`keyword`	`core`		`true`	`HKLM`	Abbreviated name for the hive.
`threat.indicator.registry.key`	`keyword`	`core`		`true`	`SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe`	Hive-relative path of keys.
`threat.indicator.registry.path`	`keyword`	`core`		`true`	`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger`	Full path, including hive, key and value
`threat.indicator.registry.value`	`keyword`	`core`		`true`	`Debugger`	Name of the value written.
`threat.indicator.scanner_stats`	`long`	`extended`		`true`	`4`	Scanner statistics
`threat.indicator.sightings`	`long`	`extended`		`true`	`20`	Number of times indicator observed
`threat.indicator.type`	`keyword`	`extended`		`true`	`ipv4-addr`	Type of indicator
`threat.indicator.url.domain`	`keyword`	`extended`		`true`	`www.elastic.co`	Domain of the url.
`threat.indicator.url.extension`	`keyword`	`extended`		`true`	`png`	File extension from the request url, excluding the leading dot.
`threat.indicator.url.fragment`	`keyword`	`extended`		`true`		Portion of the url after the `#`.
`threat.indicator.url.full`	`keyword`	`extended`		`true`	`https://www.elastic.co:443/search?q=elasticsearch#top`	Full unparsed URL.
`threat.indicator.url.original`	`keyword`	`extended`		`true`	`https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch`	Unmodified original url as seen in the event source.
`threat.indicator.url.password`	`keyword`	`extended`		`true`		Password of the request.
`threat.indicator.url.path`	`keyword`	`extended`		`true`		Path of the request, such as "/search".
`threat.indicator.url.port`	`long`	`extended`		`true`	`443`	Port of the request, such as 443.
`threat.indicator.url.query`	`keyword`	`extended`		`true`		Query string of the request.
`threat.indicator.url.registered_domain`	`keyword`	`extended`		`true`	`example.com`	The highest registered url domain, stripped of the subdomain.
`threat.indicator.url.scheme`	`keyword`	`extended`		`true`	`https`	Scheme of the url.
`threat.indicator.url.subdomain`	`keyword`	`extended`		`true`	`east`	The subdomain of the domain.
`threat.indicator.url.top_level_domain`	`keyword`	`extended`		`true`	`co.uk`	The effective top level domain (com, org, net, co.uk).
`threat.indicator.url.username`	`keyword`	`extended`		`true`		Username of the request.
`threat.indicator.x509.alternative_names`	`keyword`	`extended`	`array`	`true`	`*.elastic.co`	List of subject alternative names (SAN).
`threat.indicator.x509.issuer.common_name`	`keyword`	`extended`	`array`	`true`	`Example SHA2 High Assurance Server CA`	List of common name (CN) of issuing certificate authority.
`threat.indicator.x509.issuer.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) codes
`threat.indicator.x509.issuer.distinguished_name`	`keyword`	`extended`		`true`	`C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA`	Distinguished name (DN) of issuing certificate authority.
`threat.indicator.x509.issuer.locality`	`keyword`	`extended`	`array`	`true`	`Mountain View`	List of locality names (L)
`threat.indicator.x509.issuer.organization`	`keyword`	`extended`	`array`	`true`	`Example Inc`	List of organizations (O) of issuing certificate authority.
`threat.indicator.x509.issuer.organizational_unit`	`keyword`	`extended`	`array`	`true`	`www.example.com`	List of organizational units (OU) of issuing certificate authority.
`threat.indicator.x509.issuer.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`threat.indicator.x509.not_after`	`date`	`extended`		`true`	`2020-07-16T03:15:39Z`	Time at which the certificate is no longer considered valid.
`threat.indicator.x509.not_before`	`date`	`extended`		`true`	`2019-08-16T01:40:25Z`	Time at which the certificate is first considered valid.
`threat.indicator.x509.public_key_algorithm`	`keyword`	`extended`		`true`	`RSA`	Algorithm used to generate the public key.
`threat.indicator.x509.public_key_curve`	`keyword`	`extended`		`true`	`nistp521`	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
`threat.indicator.x509.public_key_exponent`	`long`	`extended`		`false`	`65537`	Exponent used to derive the public key. This is algorithm specific.
`threat.indicator.x509.public_key_size`	`long`	`extended`		`true`	`2048`	The size of the public key space in bits.
`threat.indicator.x509.serial_number`	`keyword`	`extended`		`true`	`55FBB9C7DEBF09809D12CCAA`	Unique serial number issued by the certificate authority.
`threat.indicator.x509.signature_algorithm`	`keyword`	`extended`		`true`	`SHA256-RSA`	Identifier for certificate signature algorithm.
`threat.indicator.x509.subject.common_name`	`keyword`	`extended`	`array`	`true`	`shared.global.example.net`	List of common names (CN) of subject.
`threat.indicator.x509.subject.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) code
`threat.indicator.x509.subject.distinguished_name`	`keyword`	`extended`		`true`	`C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net`	Distinguished name (DN) of the certificate subject entity.
`threat.indicator.x509.subject.locality`	`keyword`	`extended`	`array`	`true`	`San Francisco`	List of locality names (L)
`threat.indicator.x509.subject.organization`	`keyword`	`extended`	`array`	`true`	`Example, Inc.`	List of organizations (O) of subject.
`threat.indicator.x509.subject.organizational_unit`	`keyword`	`extended`	`array`	`true`		List of organizational units (OU) of subject.
`threat.indicator.x509.subject.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`threat.indicator.x509.version_number`	`keyword`	`extended`		`true`	`3`	Version of x509 format.
`threat.software.alias`	`keyword`	`extended`	`array`	`true`	`[ "X-Agent" ]`	Alias of the software
`threat.software.id`	`keyword`	`extended`		`true`	`S0552`	ID of the software
`threat.software.name`	`keyword`	`extended`		`true`	`AdFind`	Name of the software.
`threat.software.platforms`	`keyword`	`extended`	`array`	`true`	`[ "Windows" ]`	Platforms of the software.
`threat.software.reference`	`keyword`	`extended`		`true`	`https://attack.mitre.org/software/S0552/`	Software reference URL.
`threat.software.type`	`keyword`	`extended`		`true`	`Tool`	Software type.
`threat.tactic.id`	`keyword`	`extended`	`array`	`true`	`TA0002`	Threat tactic id.
`threat.tactic.name`	`keyword`	`extended`	`array`	`true`	`Execution`	Threat tactic.
`threat.tactic.reference`	`keyword`	`extended`	`array`	`true`	`https://attack.mitre.org/tactics/TA0002/`	Threat tactic URL reference.
`threat.technique.id`	`keyword`	`extended`	`array`	`true`	`T1059`	Threat technique id.
`threat.technique.name`	`keyword`	`extended`	`array`	`true`	`Command and Scripting Interpreter`	Threat technique name.
`threat.technique.reference`	`keyword`	`extended`	`array`	`true`	`https://attack.mitre.org/techniques/T1059/`	Threat technique URL reference.
`threat.technique.subtechnique.id`	`keyword`	`extended`	`array`	`true`	`T1059.001`	Threat subtechnique id.
`threat.technique.subtechnique.name`	`keyword`	`extended`	`array`	`true`	`PowerShell`	Threat subtechnique name.
`threat.technique.subtechnique.reference`	`keyword`	`extended`	`array`	`true`	`https://attack.mitre.org/techniques/T1059/001/`	Threat subtechnique URL reference.

tls

Fields describing a TLS connection.

Field	Type	Level	Normalization	Indexed	Example	Description
`tls.cipher`	`keyword`	`extended`		`true`	`TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`	String indicating the cipher used during the current connection.
`tls.client.certificate`	`keyword`	`extended`		`true`	`MII...`	PEM-encoded stand-alone certificate offered by the client.
`tls.client.certificate_chain`	`keyword`	`extended`	`array`	`true`	`["MII...", "MII..."]`	Array of PEM-encoded certificates that make up the certificate chain offered by the client.
`tls.client.hash.md5`	`keyword`	`extended`		`true`	`0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC`	Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client.
`tls.client.hash.sha1`	`keyword`	`extended`		`true`	`9E393D93138888D288266C2D915214D1D1CCEB2A`	Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client.
`tls.client.hash.sha256`	`keyword`	`extended`		`true`	`0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0`	Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client.
`tls.client.issuer`	`keyword`	`extended`		`true`	`CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com`	Distinguished name of subject of the issuer of the x.509 certificate presented by the client.
`tls.client.ja3`	`keyword`	`extended`		`true`	`d4e5b18d6b55c71272893221c96ba240`	A hash that identifies clients based on how they perform an SSL/TLS handshake.
`tls.client.not_after`	`date`	`extended`		`true`	`2021-01-01T00:00:00.000Z`	Date/Time indicating when client certificate is no longer considered valid.
`tls.client.not_before`	`date`	`extended`		`true`	`1970-01-01T00:00:00.000Z`	Date/Time indicating when client certificate is first considered valid.
`tls.client.server_name`	`keyword`	`extended`		`true`	`www.elastic.co`	Hostname the client is trying to connect to. Also called the SNI.
`tls.client.subject`	`keyword`	`extended`		`true`	`CN=myclient, OU=Documentation Team, DC=example, DC=com`	Distinguished name of subject of the x.509 certificate presented by the client.
`tls.client.supported_ciphers`	`keyword`	`extended`	`array`	`true`	`["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "..."]`	Array of ciphers offered by the client during the client hello.
`tls.client.x509.alternative_names`	`keyword`	`extended`	`array`	`true`	`*.elastic.co`	List of subject alternative names (SAN).
`tls.client.x509.issuer.common_name`	`keyword`	`extended`	`array`	`true`	`Example SHA2 High Assurance Server CA`	List of common name (CN) of issuing certificate authority.
`tls.client.x509.issuer.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) codes
`tls.client.x509.issuer.distinguished_name`	`keyword`	`extended`		`true`	`C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA`	Distinguished name (DN) of issuing certificate authority.
`tls.client.x509.issuer.locality`	`keyword`	`extended`	`array`	`true`	`Mountain View`	List of locality names (L)
`tls.client.x509.issuer.organization`	`keyword`	`extended`	`array`	`true`	`Example Inc`	List of organizations (O) of issuing certificate authority.
`tls.client.x509.issuer.organizational_unit`	`keyword`	`extended`	`array`	`true`	`www.example.com`	List of organizational units (OU) of issuing certificate authority.
`tls.client.x509.issuer.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`tls.client.x509.not_after`	`date`	`extended`		`true`	`2020-07-16T03:15:39Z`	Time at which the certificate is no longer considered valid.
`tls.client.x509.not_before`	`date`	`extended`		`true`	`2019-08-16T01:40:25Z`	Time at which the certificate is first considered valid.
`tls.client.x509.public_key_algorithm`	`keyword`	`extended`		`true`	`RSA`	Algorithm used to generate the public key.
`tls.client.x509.public_key_curve`	`keyword`	`extended`		`true`	`nistp521`	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
`tls.client.x509.public_key_exponent`	`long`	`extended`		`false`	`65537`	Exponent used to derive the public key. This is algorithm specific.
`tls.client.x509.public_key_size`	`long`	`extended`		`true`	`2048`	The size of the public key space in bits.
`tls.client.x509.serial_number`	`keyword`	`extended`		`true`	`55FBB9C7DEBF09809D12CCAA`	Unique serial number issued by the certificate authority.
`tls.client.x509.signature_algorithm`	`keyword`	`extended`		`true`	`SHA256-RSA`	Identifier for certificate signature algorithm.
`tls.client.x509.subject.common_name`	`keyword`	`extended`	`array`	`true`	`shared.global.example.net`	List of common names (CN) of subject.
`tls.client.x509.subject.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) code
`tls.client.x509.subject.distinguished_name`	`keyword`	`extended`		`true`	`C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net`	Distinguished name (DN) of the certificate subject entity.
`tls.client.x509.subject.locality`	`keyword`	`extended`	`array`	`true`	`San Francisco`	List of locality names (L)
`tls.client.x509.subject.organization`	`keyword`	`extended`	`array`	`true`	`Example, Inc.`	List of organizations (O) of subject.
`tls.client.x509.subject.organizational_unit`	`keyword`	`extended`	`array`	`true`		List of organizational units (OU) of subject.
`tls.client.x509.subject.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`tls.client.x509.version_number`	`keyword`	`extended`		`true`	`3`	Version of x509 format.
`tls.curve`	`keyword`	`extended`		`true`	`secp256r1`	String indicating the curve used for the given cipher, when applicable.
`tls.established`	`boolean`	`extended`		`true`		Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel.
`tls.next_protocol`	`keyword`	`extended`		`true`	`http/1.1`	String indicating the protocol being tunneled.
`tls.resumed`	`boolean`	`extended`		`true`		Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation.
`tls.server.certificate`	`keyword`	`extended`		`true`	`MII...`	PEM-encoded stand-alone certificate offered by the server.
`tls.server.certificate_chain`	`keyword`	`extended`	`array`	`true`	`["MII...", "MII..."]`	Array of PEM-encoded certificates that make up the certificate chain offered by the server.
`tls.server.hash.md5`	`keyword`	`extended`		`true`	`0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC`	Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server.
`tls.server.hash.sha1`	`keyword`	`extended`		`true`	`9E393D93138888D288266C2D915214D1D1CCEB2A`	Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server.
`tls.server.hash.sha256`	`keyword`	`extended`		`true`	`0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0`	Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server.
`tls.server.issuer`	`keyword`	`extended`		`true`	`CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com`	Subject of the issuer of the x.509 certificate presented by the server.
`tls.server.ja3s`	`keyword`	`extended`		`true`	`394441ab65754e2207b1e1b457b3641d`	A hash that identifies servers based on how they perform an SSL/TLS handshake.
`tls.server.not_after`	`date`	`extended`		`true`	`2021-01-01T00:00:00.000Z`	Timestamp indicating when server certificate is no longer considered valid.
`tls.server.not_before`	`date`	`extended`		`true`	`1970-01-01T00:00:00.000Z`	Timestamp indicating when server certificate is first considered valid.
`tls.server.subject`	`keyword`	`extended`		`true`	`CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com`	Subject of the x.509 certificate presented by the server.
`tls.server.x509.alternative_names`	`keyword`	`extended`	`array`	`true`	`*.elastic.co`	List of subject alternative names (SAN).
`tls.server.x509.issuer.common_name`	`keyword`	`extended`	`array`	`true`	`Example SHA2 High Assurance Server CA`	List of common name (CN) of issuing certificate authority.
`tls.server.x509.issuer.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) codes
`tls.server.x509.issuer.distinguished_name`	`keyword`	`extended`		`true`	`C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA`	Distinguished name (DN) of issuing certificate authority.
`tls.server.x509.issuer.locality`	`keyword`	`extended`	`array`	`true`	`Mountain View`	List of locality names (L)
`tls.server.x509.issuer.organization`	`keyword`	`extended`	`array`	`true`	`Example Inc`	List of organizations (O) of issuing certificate authority.
`tls.server.x509.issuer.organizational_unit`	`keyword`	`extended`	`array`	`true`	`www.example.com`	List of organizational units (OU) of issuing certificate authority.
`tls.server.x509.issuer.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`tls.server.x509.not_after`	`date`	`extended`		`true`	`2020-07-16T03:15:39Z`	Time at which the certificate is no longer considered valid.
`tls.server.x509.not_before`	`date`	`extended`		`true`	`2019-08-16T01:40:25Z`	Time at which the certificate is first considered valid.
`tls.server.x509.public_key_algorithm`	`keyword`	`extended`		`true`	`RSA`	Algorithm used to generate the public key.
`tls.server.x509.public_key_curve`	`keyword`	`extended`		`true`	`nistp521`	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
`tls.server.x509.public_key_exponent`	`long`	`extended`		`false`	`65537`	Exponent used to derive the public key. This is algorithm specific.
`tls.server.x509.public_key_size`	`long`	`extended`		`true`	`2048`	The size of the public key space in bits.
`tls.server.x509.serial_number`	`keyword`	`extended`		`true`	`55FBB9C7DEBF09809D12CCAA`	Unique serial number issued by the certificate authority.
`tls.server.x509.signature_algorithm`	`keyword`	`extended`		`true`	`SHA256-RSA`	Identifier for certificate signature algorithm.
`tls.server.x509.subject.common_name`	`keyword`	`extended`	`array`	`true`	`shared.global.example.net`	List of common names (CN) of subject.
`tls.server.x509.subject.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) code
`tls.server.x509.subject.distinguished_name`	`keyword`	`extended`		`true`	`C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net`	Distinguished name (DN) of the certificate subject entity.
`tls.server.x509.subject.locality`	`keyword`	`extended`	`array`	`true`	`San Francisco`	List of locality names (L)
`tls.server.x509.subject.organization`	`keyword`	`extended`	`array`	`true`	`Example, Inc.`	List of organizations (O) of subject.
`tls.server.x509.subject.organizational_unit`	`keyword`	`extended`	`array`	`true`		List of organizational units (OU) of subject.
`tls.server.x509.subject.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`tls.server.x509.version_number`	`keyword`	`extended`		`true`	`3`	Version of x509 format.
`tls.version`	`keyword`	`extended`		`true`	`1.2`	Numeric part of the version parsed from the original string.
`tls.version_protocol`	`keyword`	`extended`		`true`	`tls`	Normalized lowercase protocol name parsed from original string.

trace

Fields related to distributed tracing.

Field	Type	Level	Normalization	Indexed	Example	Description
`trace.id`	`keyword`	`extended`		`true`	`4bf92f3577b34da6a3ce929d0e0e4736`	Unique identifier of the trace.

transaction

Fields related to distributed tracing.

Field	Type	Level	Normalization	Indexed	Example	Description
`transaction.id`	`keyword`	`extended`		`true`	`00f067aa0ba902b7`	Unique identifier of the transaction within the scope of its trace.

url

Fields that let you store URLs in various forms.

Field	Type	Level	Indexed	Example	Description
`url.domain`	`keyword`	`extended`	`true`	`www.elastic.co`	Domain of the url.
`url.extension`	`keyword`	`extended`	`true`	`png`	File extension from the request url, excluding the leading dot.
`url.fragment`	`keyword`	`extended`	`true`		Portion of the url after the `#`.
`url.full`	`keyword`	`extended`	`true`	`https://www.elastic.co:443/search?q=elasticsearch#top`	Full unparsed URL.
`url.original`	`keyword`	`extended`	`true`	`https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch`	Unmodified original url as seen in the event source.
`url.password`	`keyword`	`extended`	`true`		Password of the request.
`url.path`	`keyword`	`extended`	`true`		Path of the request, such as "/search".
`url.port`	`long`	`extended`	`true`	`443`	Port of the request, such as 443.
`url.query`	`keyword`	`extended`	`true`		Query string of the request.
`url.registered_domain`	`keyword`	`extended`	`true`	`example.com`	The highest registered url domain, stripped of the subdomain.
`url.scheme`	`keyword`	`extended`	`true`	`https`	Scheme of the url.
`url.subdomain`	`keyword`	`extended`	`true`	`east`	The subdomain of the domain.
`url.top_level_domain`	`keyword`	`extended`	`true`	`co.uk`	The effective top level domain (com, org, net, co.uk).
`url.username`	`keyword`	`extended`	`true`		Username of the request.

user

Fields to describe the user relevant to the event.

Field	Type	Level	Normalization	Indexed	Example	Description
`user.changes.domain`	`keyword`	`extended`		`true`		Name of the directory the user is a member of.
`user.changes.email`	`keyword`	`extended`		`true`		User email address.
`user.changes.full_name`	`keyword`	`extended`		`true`	`Albert Einstein`	User's full name, if available.
`user.changes.group.domain`	`keyword`	`extended`		`true`		Name of the directory the group is a member of.
`user.changes.group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`user.changes.group.name`	`keyword`	`extended`		`true`		Name of the group.
`user.changes.hash`	`keyword`	`extended`		`true`		Unique user hash to correlate information for a user in anonymized form.
`user.changes.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`user.changes.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`user.changes.roles`	`keyword`	`extended`	`array`	`true`	`["kibana_admin", "reporting_user"]`	Array of user roles at the time of the event.
`user.domain`	`keyword`	`extended`		`true`		Name of the directory the user is a member of.
`user.effective.domain`	`keyword`	`extended`		`true`		Name of the directory the user is a member of.
`user.effective.email`	`keyword`	`extended`		`true`		User email address.
`user.effective.full_name`	`keyword`	`extended`		`true`	`Albert Einstein`	User's full name, if available.
`user.effective.group.domain`	`keyword`	`extended`		`true`		Name of the directory the group is a member of.
`user.effective.group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`user.effective.group.name`	`keyword`	`extended`		`true`		Name of the group.
`user.effective.hash`	`keyword`	`extended`		`true`		Unique user hash to correlate information for a user in anonymized form.
`user.effective.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`user.effective.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`user.effective.roles`	`keyword`	`extended`	`array`	`true`	`["kibana_admin", "reporting_user"]`	Array of user roles at the time of the event.
`user.email`	`keyword`	`extended`		`true`		User email address.
`user.full_name`	`keyword`	`extended`		`true`	`Albert Einstein`	User's full name, if available.
`user.group.domain`	`keyword`	`extended`		`true`		Name of the directory the group is a member of.
`user.group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`user.group.name`	`keyword`	`extended`		`true`		Name of the group.
`user.hash`	`keyword`	`extended`		`true`		Unique user hash to correlate information for a user in anonymized form.
`user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`user.risk.calculated_level`	`keyword`	`extended`		`true`	`High`	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
`user.risk.calculated_score`	`float`	`extended`		`true`	`880.73`	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
`user.risk.calculated_score_norm`	`float`	`extended`		`true`	`88.73`	A normalized risk score calculated by an internal system.
`user.risk.static_level`	`keyword`	`extended`		`true`	`High`	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
`user.risk.static_score`	`float`	`extended`		`true`	`830.0`	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
`user.risk.static_score_norm`	`float`	`extended`		`true`	`83.0`	A normalized risk score calculated by an external system.
`user.roles`	`keyword`	`extended`	`array`	`true`	`["kibana_admin", "reporting_user"]`	Array of user roles at the time of the event.
`user.target.domain`	`keyword`	`extended`		`true`		Name of the directory the user is a member of.
`user.target.email`	`keyword`	`extended`		`true`		User email address.
`user.target.full_name`	`keyword`	`extended`		`true`	`Albert Einstein`	User's full name, if available.
`user.target.group.domain`	`keyword`	`extended`		`true`		Name of the directory the group is a member of.
`user.target.group.id`	`keyword`	`extended`		`true`		Unique identifier for the group on the system/platform.
`user.target.group.name`	`keyword`	`extended`		`true`		Name of the group.
`user.target.hash`	`keyword`	`extended`		`true`		Unique user hash to correlate information for a user in anonymized form.
`user.target.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`user.target.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`user.target.roles`	`keyword`	`extended`	`array`	`true`	`["kibana_admin", "reporting_user"]`	Array of user roles at the time of the event.

user_agent

Fields to describe a browser user_agent string.

Field	Type	Level	Indexed	Example	Description
`user_agent.device.name`	`keyword`	`extended`	`true`	`iPhone`	Name of the device.
`user_agent.name`	`keyword`	`extended`	`true`	`Safari`	Name of the user agent.
`user_agent.original`	`keyword`	`extended`	`true`	`Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1`	Unparsed user_agent string.
`user_agent.os.family`	`keyword`	`extended`	`true`	`debian`	OS family (such as redhat, debian, freebsd, windows).
`user_agent.os.full`	`keyword`	`extended`	`true`	`Mac OS Mojave`	Operating system name, including the version or code name.
`user_agent.os.kernel`	`keyword`	`extended`	`true`	`4.4.0-112-generic`	Operating system kernel version as a raw string.
`user_agent.os.name`	`keyword`	`extended`	`true`	`Mac OS X`	Operating system name, without the version.
`user_agent.os.platform`	`keyword`	`extended`	`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`user_agent.os.type`	`keyword`	`extended`	`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`user_agent.os.version`	`keyword`	`extended`	`true`	`10.14.1`	Operating system version as a raw string.
`user_agent.version`	`keyword`	`extended`	`true`	`12.0`	Version of the user agent.

volume

Fields related to storage volume details.

Field	Type	Level	Indexed	Example	Description
`volume.bus_type`	`keyword`	`extended`	`true`	`FileBackedVirtual`	Bus type of the device.
`volume.default_access`	`keyword`	`extended`	`true`		Bus type of the device.
`volume.device_name`	`keyword`	`extended`	`true`		Device name of the volume.
`volume.device_type`	`keyword`	`extended`	`true`	`CD-ROM File System`	Volume device type.
`volume.dos_name`	`keyword`	`extended`	`true`	`E:`	DOS name of the device.
`volume.file_system_type`	`keyword`	`extended`	`true`		Volume device file system type.
`volume.mount_name`	`keyword`	`extended`	`true`		Mount name of the volume.
`volume.nt_name`	`keyword`	`extended`	`true`	`\Device\Cdrom1`	NT name of the device.
`volume.product_id`	`keyword`	`extended`	`true`		ProductID of the device.
`volume.product_name`	`keyword`	`extended`	`true`	`Virtual DVD-ROM`	Produce name of the volume.
`volume.removable`	`boolean`	`extended`	`true`		Indicates if the volume is removable.
`volume.serial_number`	`keyword`	`extended`	`true`		Serial number of the device.
`volume.size`	`long`	`extended`	`true`		Size of the volume device in bytes.
`volume.vendor_id`	`keyword`	`extended`	`true`		VendorID of the device.
`volume.vendor_name`	`keyword`	`extended`	`true`	`Msft`	Vendor name of the device.
`volume.writable`	`boolean`	`extended`	`true`		Indicates if the volume is writable.

vulnerability

Fields to describe the vulnerability relevant to an event.

Field	Type	Level	Normalization	Indexed	Example	Description
`vulnerability.category`	`keyword`	`extended`	`array`	`true`	`["Firewall"]`	Category of a vulnerability.
`vulnerability.classification`	`keyword`	`extended`		`true`	`CVSS`	Classification of the vulnerability.
`vulnerability.description`	`keyword`	`extended`		`true`	`In macOS before 2.12.6, there is a vulnerability in the RPC...`	Description of the vulnerability.
`vulnerability.detected_at`	`date`	`custom`		`true`		Vulnerability's detection date.
`vulnerability.enumeration`	`keyword`	`extended`		`true`	`CVE`	Identifier of the vulnerability.
`vulnerability.id`	`keyword`	`extended`		`true`	`CVE-2019-00001`	ID of the vulnerability.
`vulnerability.published_at`	`date`	`custom`		`true`		Vulnerability's publication date.
`vulnerability.report_id`	`keyword`	`extended`		`true`	`20191018.0001`	Scan identification number.
`vulnerability.scanner.condition`	`keyword`	`custom`		`true`		The condition matched by the package that led the scanner to consider it vulnerable.
`vulnerability.scanner.reference`	`keyword`	`custom`		`true`		Scanner's resource that provides additional information, context, and mitigations for the identified vulnerability.
`vulnerability.scanner.source`	`keyword`	`custom`		`true`		The origin of the decision of the scanner (AKA feed used to detect the vulnerability).
`vulnerability.scanner.vendor`	`keyword`	`extended`		`true`	`Tenable`	Name of the scanner vendor.
`vulnerability.score.base`	`float`	`extended`		`true`	`5.5`	Vulnerability Base score.
`vulnerability.score.environmental`	`float`	`extended`		`true`	`5.5`	Vulnerability Environmental score.
`vulnerability.score.temporal`	`float`	`extended`		`true`		Vulnerability Temporal score.
`vulnerability.score.version`	`keyword`	`extended`		`true`	`2.0`	CVSS version.
`vulnerability.severity`	`keyword`	`extended`		`true`	`Critical`	Severity of the vulnerability.
`vulnerability.under_evaluation`	`boolean`	`custom`		`true`		Indicates if the vulnerability is awaiting analysis by the NVD.

wazuh

Fields Wazuh adds to describe how it collected and processed the event.

Field	Type	Level	Normalization	Indexed	Example	Description
`wazuh.agent.build.original`	`keyword`	`core`		`true`	`metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]`	Extended build information for the agent.
`wazuh.agent.ephemeral_id`	`keyword`	`extended`		`true`	`8a4f500f`	Ephemeral identifier of this agent.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.boot.id`	`keyword`	`extended`		`true`	`88a1f0ed-5ae5-41ee-af6b-41921c311872`	Linux boot uuid taken from /proc/sys/kernel/random/boot_id
`wazuh.agent.host.cpu`	`object`	`custom`		`true`	`"name": "Intel(R) Core(TM) i7-7700HQ CPU", "cores": 4, "speed": 2800`	CPU-related data.
`wazuh.agent.host.cpu.cores`	`long`	`custom`		`true`	`4`	Number of CPU cores.
`wazuh.agent.host.cpu.name`	`keyword`	`custom`		`true`	`Intel(R) Core(TM) i7-7700HQ CPU`	CPU Model name.
`wazuh.agent.host.cpu.speed`	`long`	`custom`		`true`	`2800`	CPU clock speed.
`wazuh.agent.host.cpu.usage`	`scaled_float`	`extended`		`true`		Percent CPU used, between 0 and 1.
`wazuh.agent.host.disk.read.bytes`	`long`	`extended`		`true`		The number of bytes read by all disks.
`wazuh.agent.host.disk.write.bytes`	`long`	`extended`		`true`		The number of bytes written on all disks.
`wazuh.agent.host.domain`	`keyword`	`extended`		`true`	`CONTOSO`	Name of the directory the group is a member of.
`wazuh.agent.host.geo.city_name`	`keyword`	`core`		`true`	`Montreal`	City name.
`wazuh.agent.host.geo.continent_code`	`keyword`	`core`		`true`	`NA`	Continent code.
`wazuh.agent.host.geo.continent_name`	`keyword`	`core`		`true`	`North America`	Name of the continent.
`wazuh.agent.host.geo.country_iso_code`	`keyword`	`core`		`true`	`CA`	Country ISO code.
`wazuh.agent.host.geo.country_name`	`keyword`	`core`		`true`	`Canada`	Country name.
`wazuh.agent.host.geo.location`	`geo_point`	`core`		`true`	`{ "lon": -73.614830, "lat": 45.505918 }`	Longitude and latitude.
`wazuh.agent.host.geo.name`	`keyword`	`extended`		`true`	`boston-dc`	User-defined description of a location.
`wazuh.agent.host.geo.postal_code`	`keyword`	`core`		`true`	`94040`	Postal code.
`wazuh.agent.host.geo.region_iso_code`	`keyword`	`core`		`true`	`CA-QC`	Region ISO code.
`wazuh.agent.host.geo.region_name`	`keyword`	`core`		`true`	`Quebec`	Region name.
`wazuh.agent.host.geo.timezone`	`keyword`	`core`		`true`	`America/Argentina/Buenos_Aires`	Time zone.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.id`	`keyword`	`core`		`true`		Unique host id.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.mac`	`keyword`	`core`	`array`	`true`	`["00-00-5E-00-53-23", "00-00-5E-00-53-24"]`	Host MAC addresses.
`wazuh.agent.host.memory`	`object`	`custom`		`true`	`"total": 100000, "free": 90000, "used": {"percentage": 10}`	Memory-related data.
`wazuh.agent.host.memory.free`	`long`	`custom`		`true`	`1024`	Free memory in MB.
`wazuh.agent.host.memory.total`	`long`	`custom`		`true`	`1024`	Total memory in MB.
`wazuh.agent.host.memory.used`	`object`	`custom`		`true`	`"percentage": 10`	Used memory-related data.
`wazuh.agent.host.memory.used.percentage`	`long`	`custom`		`true`	`10`	Used memory percentage.
`wazuh.agent.host.name`	`keyword`	`core`		`true`		Name of the host.
`wazuh.agent.host.network.egress.bytes`	`long`	`extended`		`true`		The number of bytes sent on all network interfaces.
`wazuh.agent.host.network.egress.drops`	`long`	`custom`		`true`	`10`	Number of dropped transmitted packets.
`wazuh.agent.host.network.egress.errors`	`long`	`custom`		`true`	`10`	Number of transmission errors.
`wazuh.agent.host.network.egress.packets`	`long`	`extended`		`true`		The number of packets sent on all network interfaces.
`wazuh.agent.host.network.egress.queue`	`long`	`custom`		`true`	`10`	Transmit queue length.
`wazuh.agent.host.network.ingress.bytes`	`long`	`extended`		`true`		The number of bytes received on all network interfaces.
`wazuh.agent.host.network.ingress.drops`	`long`	`custom`		`true`	`10`	Number of dropped received packets.
`wazuh.agent.host.network.ingress.errors`	`long`	`custom`		`true`	`10`	Number of reception errors.
`wazuh.agent.host.network.ingress.packets`	`long`	`extended`		`true`		The number of packets received on all network interfaces.
`wazuh.agent.host.network.ingress.queue`	`long`	`custom`		`true`	`10`	Receive queue length.
`wazuh.agent.host.os.family`	`keyword`	`extended`		`true`	`debian`	OS family (such as redhat, debian, freebsd, windows).
`wazuh.agent.host.os.full`	`keyword`	`extended`		`true`	`Mac OS Mojave`	Operating system name, including the version or code name.
`wazuh.agent.host.os.kernel`	`keyword`	`extended`		`true`	`4.4.0-112-generic`	Operating system kernel version as a raw string.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.host.pid_ns_ino`	`keyword`	`extended`		`true`	`256383`	Pid namespace inode
`wazuh.agent.host.risk.calculated_level`	`keyword`	`extended`		`true`	`High`	A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.
`wazuh.agent.host.risk.calculated_score`	`float`	`extended`		`true`	`880.73`	A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.
`wazuh.agent.host.risk.calculated_score_norm`	`float`	`extended`		`true`	`88.73`	A normalized risk score calculated by an internal system.
`wazuh.agent.host.risk.static_level`	`keyword`	`extended`		`true`	`High`	A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.
`wazuh.agent.host.risk.static_score`	`float`	`extended`		`true`	`830.0`	A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.
`wazuh.agent.host.risk.static_score_norm`	`float`	`extended`		`true`	`83.0`	A normalized risk score calculated by an external system.
`wazuh.agent.host.type`	`keyword`	`core`		`true`		Type of host.
`wazuh.agent.host.uptime`	`long`	`extended`		`true`	`1325`	Seconds the host has been up.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.type`	`keyword`	`core`		`true`	`filebeat`	Type of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`	`wazuh`	Name of the Wazuh Manager cluster that processed the event.
`wazuh.cluster.node`	`keyword`	`custom`		`true`	`node01`	Name of the Wazuh Manager node that processed the event. Raw events do not carry it.
`wazuh.event.id`	`keyword`	`custom`		`true`	`a715177a-217c-4103-bc79-37c5766025ac`	ID of the received log, shared by its raw event, normalized event and findings.
`wazuh.integration.category`	`keyword`	`custom`		`true`	`system-activity`	Category of the integration. Selects the data stream, `wazuh-events-v5-<category>`.
`wazuh.integration.decoders`	`keyword`	`custom`	`array`	`true`	`["decoder/core-wazuh-message/0", "decoder/syslog/0", "decoder/system-auth/0"]`	Decoders that matched the event, from the root decoder to the most specific one.
`wazuh.integration.name`	`keyword`	`custom`		`true`	`apache-http`	Name of the integration whose decoder matched the event, set by the Wazuh Engine.
`wazuh.integration.rules`	`keyword`	`custom`	`array`	`true`	`["8784f095-729a-5912-9315-119722b444ed"]`	Currently not populated. A finding identifies the rule that matched in `wazuh.rule`.
`wazuh.protocol.location`	`keyword`	`custom`		`true`	`/var/log/auth.log`	Where the Wazuh agent collected the event, such as a file path, `journald` or a module name.
`wazuh.protocol.queue`	`byte`	`custom`		`true`	`49`	Byte value of the agent queue character the event came through, such as 49 for queue `1`.
`wazuh.schema.version`	`keyword`	`custom`		`true`	`1.0.0`	Version of the schema the document follows. Events and findings do not carry it.
`wazuh.space.event_discarded`	`boolean`	`custom`		`true`	`False`	When `true`, the event would have been discarded.
`wazuh.space.name`	`keyword`	`custom`		`true`	`standard`	Space of the policy that processed the event, `standard` or `custom`.
`wazuh.threat.enrichments`	`object`	`extended`	`array`	`true`		List of objects containing indicators enriching the event.
`wazuh.threat.enrichments.indicator`	`object`	`extended`		`true`		Object containing indicators enriching the event.
`wazuh.threat.enrichments.indicator.as.number`	`long`	`extended`		`true`	`15169`	Unique number allocated to the autonomous system.
`wazuh.threat.enrichments.indicator.as.organization.name`	`keyword`	`extended`		`true`	`Google LLC`	Organization name.
`wazuh.threat.enrichments.indicator.confidence`	`keyword`	`extended`		`true`	`Medium`	Indicator confidence rating
`wazuh.threat.enrichments.indicator.description`	`keyword`	`extended`		`true`	`IP x.x.x.x was observed delivering the Angler EK.`	Indicator description
`wazuh.threat.enrichments.indicator.email.address`	`keyword`	`extended`		`true`	`phish@example.com`	Indicator email address
`wazuh.threat.enrichments.indicator.feed.name`	`keyword`	`custom`		`true`		Name of the feed that supplied the indicator.
`wazuh.threat.enrichments.indicator.file.accessed`	`date`	`extended`		`true`		Last time the file was accessed.
`wazuh.threat.enrichments.indicator.file.attributes`	`keyword`	`extended`	`array`	`true`	`["readonly", "system"]`	Array of file attributes.
`wazuh.threat.enrichments.indicator.file.code_signature.digest_algorithm`	`keyword`	`extended`		`true`	`sha256`	Hashing algorithm used to sign the process.
`wazuh.threat.enrichments.indicator.file.code_signature.exists`	`boolean`	`core`		`true`	`true`	Boolean to capture if a signature is present.
`wazuh.threat.enrichments.indicator.file.code_signature.flags`	`keyword`	`extended`		`true`	`570522385`	Code signing flags of the process
`wazuh.threat.enrichments.indicator.file.code_signature.signing_id`	`keyword`	`extended`		`true`	`com.apple.xpc.proxy`	The identifier used to sign the process.
`wazuh.threat.enrichments.indicator.file.code_signature.status`	`keyword`	`extended`		`true`	`ERROR_UNTRUSTED_ROOT`	Additional information about the certificate status.
`wazuh.threat.enrichments.indicator.file.code_signature.subject_name`	`keyword`	`core`		`true`	`Microsoft Corporation`	Subject name of the code signer
`wazuh.threat.enrichments.indicator.file.code_signature.team_id`	`keyword`	`extended`		`true`	`EQHXZ8M8AV`	The team identifier used to sign the process.
`wazuh.threat.enrichments.indicator.file.code_signature.thumbprint_sha256`	`keyword`	`extended`		`true`	`c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b`	SHA256 hash of the certificate.
`wazuh.threat.enrichments.indicator.file.code_signature.timestamp`	`date`	`extended`		`true`	`2021-01-01T12:10:30Z`	When the signature was generated and signed.
`wazuh.threat.enrichments.indicator.file.code_signature.trusted`	`boolean`	`extended`		`true`	`true`	Stores the trust status of the certificate chain.
`wazuh.threat.enrichments.indicator.file.code_signature.valid`	`boolean`	`extended`		`true`	`true`	Boolean to capture if the digital signature is verified against the binary content.
`wazuh.threat.enrichments.indicator.file.created`	`date`	`extended`		`true`		File creation time.
`wazuh.threat.enrichments.indicator.file.ctime`	`date`	`extended`		`true`		Last time the file attributes or metadata changed.
`wazuh.threat.enrichments.indicator.file.device`	`keyword`	`extended`		`true`	`sda`	Device that is the source of the file.
`wazuh.threat.enrichments.indicator.file.directory`	`keyword`	`extended`		`true`	`/home/alice`	Directory where the file is located.
`wazuh.threat.enrichments.indicator.file.drive_letter`	`keyword`	`extended`		`true`	`C`	Drive letter where the file is located.
`wazuh.threat.enrichments.indicator.file.elf.architecture`	`keyword`	`extended`		`true`	`x86-64`	Machine architecture of the ELF file.
`wazuh.threat.enrichments.indicator.file.elf.byte_order`	`keyword`	`extended`		`true`	`Little Endian`	Byte sequence of ELF file.
`wazuh.threat.enrichments.indicator.file.elf.cpu_type`	`keyword`	`extended`		`true`	`Intel`	CPU type of the ELF file.
`wazuh.threat.enrichments.indicator.file.elf.creation_date`	`date`	`extended`		`true`		Build or compile date.
`wazuh.threat.enrichments.indicator.file.elf.exports`	`flat_object`	`extended`	`array`	`true`		List of exported element names and types.
`wazuh.threat.enrichments.indicator.file.elf.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in an ELF file.
`wazuh.threat.enrichments.indicator.file.elf.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`wazuh.threat.enrichments.indicator.file.elf.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`wazuh.threat.enrichments.indicator.file.elf.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`wazuh.threat.enrichments.indicator.file.elf.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`wazuh.threat.enrichments.indicator.file.elf.header.abi_version`	`keyword`	`extended`		`true`		Version of the ELF Application Binary Interface (ABI).
`wazuh.threat.enrichments.indicator.file.elf.header.class`	`keyword`	`extended`		`true`		Header class of the ELF file.
`wazuh.threat.enrichments.indicator.file.elf.header.data`	`keyword`	`extended`		`true`		Data table of the ELF header.
`wazuh.threat.enrichments.indicator.file.elf.header.entrypoint`	`long`	`extended`		`true`		Header entrypoint of the ELF file.
`wazuh.threat.enrichments.indicator.file.elf.header.object_version`	`keyword`	`extended`		`true`		"0x1" for original ELF files.
`wazuh.threat.enrichments.indicator.file.elf.header.os_abi`	`keyword`	`extended`		`true`		Application Binary Interface (ABI) of the Linux OS.
`wazuh.threat.enrichments.indicator.file.elf.header.type`	`keyword`	`extended`		`true`		Header type of the ELF file.
`wazuh.threat.enrichments.indicator.file.elf.header.version`	`keyword`	`extended`		`true`		Version of the ELF header.
`wazuh.threat.enrichments.indicator.file.elf.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in an ELF file.
`wazuh.threat.enrichments.indicator.file.elf.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`wazuh.threat.enrichments.indicator.file.elf.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`wazuh.threat.enrichments.indicator.file.elf.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`wazuh.threat.enrichments.indicator.file.elf.sections`	`nested`	`extended`	`array`	`true`		Section information of the ELF file.
`wazuh.threat.enrichments.indicator.file.elf.sections.chi2`	`long`	`extended`		`true`		Chi-square probability distribution of the section.
`wazuh.threat.enrichments.indicator.file.elf.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`wazuh.threat.enrichments.indicator.file.elf.sections.flags`	`keyword`	`extended`		`true`		ELF Section List flags.
`wazuh.threat.enrichments.indicator.file.elf.sections.name`	`keyword`	`extended`		`true`		ELF Section List name.
`wazuh.threat.enrichments.indicator.file.elf.sections.physical_offset`	`keyword`	`extended`		`true`		ELF Section List offset.
`wazuh.threat.enrichments.indicator.file.elf.sections.physical_size`	`long`	`extended`		`true`		ELF Section List physical size.
`wazuh.threat.enrichments.indicator.file.elf.sections.type`	`keyword`	`extended`		`true`		ELF Section List type.
`wazuh.threat.enrichments.indicator.file.elf.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`wazuh.threat.enrichments.indicator.file.elf.sections.virtual_address`	`long`	`extended`		`true`		ELF Section List virtual address.
`wazuh.threat.enrichments.indicator.file.elf.sections.virtual_size`	`long`	`extended`		`true`		ELF Section List virtual size.
`wazuh.threat.enrichments.indicator.file.elf.segments`	`nested`	`extended`	`array`	`true`		ELF object segment list.
`wazuh.threat.enrichments.indicator.file.elf.segments.sections`	`keyword`	`extended`		`true`		ELF object segment sections.
`wazuh.threat.enrichments.indicator.file.elf.segments.type`	`keyword`	`extended`		`true`		ELF object segment type.
`wazuh.threat.enrichments.indicator.file.elf.shared_libraries`	`keyword`	`extended`	`array`	`true`		List of shared libraries used by this ELF object.
`wazuh.threat.enrichments.indicator.file.elf.telfhash`	`keyword`	`extended`		`true`		telfhash hash for ELF file.
`wazuh.threat.enrichments.indicator.file.extension`	`keyword`	`extended`		`true`	`png`	File extension, excluding the leading dot.
`wazuh.threat.enrichments.indicator.file.fork_name`	`keyword`	`extended`		`true`	`Zone.Identifer`	A fork is additional data associated with a filesystem object.
`wazuh.threat.enrichments.indicator.file.gid`	`keyword`	`extended`		`true`	`1001`	Primary group ID (GID) of the file.
`wazuh.threat.enrichments.indicator.file.group`	`keyword`	`extended`		`true`	`alice`	Primary group name of the file.
`wazuh.threat.enrichments.indicator.file.hash.cdhash`	`keyword`	`extended`		`true`	`3783b4052fd474dbe30676b45c329e7a6d44acd9`	The Code Directory (CD) hash of an executable.
`wazuh.threat.enrichments.indicator.file.hash.md5`	`keyword`	`extended`		`true`		MD5 hash.
`wazuh.threat.enrichments.indicator.file.hash.sha1`	`keyword`	`extended`		`true`		SHA1 hash.
`wazuh.threat.enrichments.indicator.file.hash.sha256`	`keyword`	`extended`		`true`		SHA256 hash.
`wazuh.threat.enrichments.indicator.file.hash.sha384`	`keyword`	`extended`		`true`		SHA384 hash.
`wazuh.threat.enrichments.indicator.file.hash.sha512`	`keyword`	`extended`		`true`		SHA512 hash.
`wazuh.threat.enrichments.indicator.file.hash.ssdeep`	`keyword`	`extended`		`true`		SSDEEP hash.
`wazuh.threat.enrichments.indicator.file.hash.tlsh`	`keyword`	`extended`		`true`		TLSH hash.
`wazuh.threat.enrichments.indicator.file.inode`	`keyword`	`extended`		`true`	`256383`	Inode representing the file in the filesystem.
`wazuh.threat.enrichments.indicator.file.mime_type`	`keyword`	`extended`		`true`		Media type of file, document, or arrangement of bytes.
`wazuh.threat.enrichments.indicator.file.mode`	`keyword`	`extended`		`true`	`0640`	Mode of the file in octal representation.
`wazuh.threat.enrichments.indicator.file.mtime`	`date`	`extended`		`true`		Last time the file content was modified.
`wazuh.threat.enrichments.indicator.file.name`	`keyword`	`extended`		`true`	`example.png`	Name of the file including the extension, without the directory.
`wazuh.threat.enrichments.indicator.file.origin_referrer_url`	`keyword`	`extended`		`true`	`http://example.com/article1.html`	The URL of the webpage that linked to the file.
`wazuh.threat.enrichments.indicator.file.origin_url`	`keyword`	`extended`		`true`	`http://example.com/imgs/article1_img1.jpg`	The URL where the file is hosted.
`wazuh.threat.enrichments.indicator.file.owner`	`keyword`	`extended`		`true`	`alice`	File owner's username.
`wazuh.threat.enrichments.indicator.file.path`	`keyword`	`extended`		`true`	`/home/alice/example.png`	Full path to the file, including the file name.
`wazuh.threat.enrichments.indicator.file.pe.architecture`	`keyword`	`extended`		`true`	`x64`	CPU architecture target for the file.
`wazuh.threat.enrichments.indicator.file.pe.company`	`keyword`	`extended`		`true`	`Microsoft Corporation`	Internal company name of the file, provided at compile-time.
`wazuh.threat.enrichments.indicator.file.pe.description`	`keyword`	`extended`		`true`	`Paint`	Internal description of the file, provided at compile-time.
`wazuh.threat.enrichments.indicator.file.pe.file_version`	`keyword`	`extended`		`true`	`6.3.9600.17415`	Process name.
`wazuh.threat.enrichments.indicator.file.pe.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in a PE file.
`wazuh.threat.enrichments.indicator.file.pe.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`wazuh.threat.enrichments.indicator.file.pe.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`wazuh.threat.enrichments.indicator.file.pe.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`wazuh.threat.enrichments.indicator.file.pe.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`wazuh.threat.enrichments.indicator.file.pe.imphash`	`keyword`	`extended`		`true`	`0c6803c4e922103c4dca5963aad36ddf`	A hash of the imports in a PE file.
`wazuh.threat.enrichments.indicator.file.pe.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in a PE file.
`wazuh.threat.enrichments.indicator.file.pe.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`wazuh.threat.enrichments.indicator.file.pe.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`wazuh.threat.enrichments.indicator.file.pe.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`wazuh.threat.enrichments.indicator.file.pe.original_file_name`	`keyword`	`extended`		`true`	`MSPAINT.EXE`	Internal name of the file, provided at compile-time.
`wazuh.threat.enrichments.indicator.file.pe.pehash`	`keyword`	`extended`		`true`	`73ff189b63cd6be375a7ff25179a38d347651975`	A hash of the PE header and data from one or more PE sections.
`wazuh.threat.enrichments.indicator.file.pe.product`	`keyword`	`extended`		`true`	`Microsoft® Windows® Operating System`	Internal product name of the file, provided at compile-time.
`wazuh.threat.enrichments.indicator.file.pe.sections`	`nested`	`extended`	`array`	`true`		Section information of the PE file.
`wazuh.threat.enrichments.indicator.file.pe.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`wazuh.threat.enrichments.indicator.file.pe.sections.name`	`keyword`	`extended`		`true`		PE Section List name.
`wazuh.threat.enrichments.indicator.file.pe.sections.physical_size`	`long`	`extended`		`true`		PE Section List physical size.
`wazuh.threat.enrichments.indicator.file.pe.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`wazuh.threat.enrichments.indicator.file.pe.sections.virtual_size`	`long`	`extended`		`true`		PE Section List virtual size. This is always the same as `physical_size`.
`wazuh.threat.enrichments.indicator.file.size`	`long`	`extended`		`true`	`16384`	File size in bytes.
`wazuh.threat.enrichments.indicator.file.target_path`	`keyword`	`extended`		`true`		Target path for symlinks.
`wazuh.threat.enrichments.indicator.file.type`	`keyword`	`extended`		`true`	`file`	File type (file, dir, or symlink).
`wazuh.threat.enrichments.indicator.file.uid`	`keyword`	`extended`		`true`	`1001`	The user ID (UID) or security identifier (SID) of the file owner.
`wazuh.threat.enrichments.indicator.file.x509.alternative_names`	`keyword`	`extended`	`array`	`true`	`*.elastic.co`	List of subject alternative names (SAN).
`wazuh.threat.enrichments.indicator.file.x509.issuer.common_name`	`keyword`	`extended`	`array`	`true`	`Example SHA2 High Assurance Server CA`	List of common name (CN) of issuing certificate authority.
`wazuh.threat.enrichments.indicator.file.x509.issuer.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) codes
`wazuh.threat.enrichments.indicator.file.x509.issuer.distinguished_name`	`keyword`	`extended`		`true`	`C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA`	Distinguished name (DN) of issuing certificate authority.
`wazuh.threat.enrichments.indicator.file.x509.issuer.locality`	`keyword`	`extended`	`array`	`true`	`Mountain View`	List of locality names (L)
`wazuh.threat.enrichments.indicator.file.x509.issuer.organization`	`keyword`	`extended`	`array`	`true`	`Example Inc`	List of organizations (O) of issuing certificate authority.
`wazuh.threat.enrichments.indicator.file.x509.issuer.organizational_unit`	`keyword`	`extended`	`array`	`true`	`www.example.com`	List of organizational units (OU) of issuing certificate authority.
`wazuh.threat.enrichments.indicator.file.x509.issuer.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`wazuh.threat.enrichments.indicator.file.x509.not_after`	`date`	`extended`		`true`	`2020-07-16T03:15:39Z`	Time at which the certificate is no longer considered valid.
`wazuh.threat.enrichments.indicator.file.x509.not_before`	`date`	`extended`		`true`	`2019-08-16T01:40:25Z`	Time at which the certificate is first considered valid.
`wazuh.threat.enrichments.indicator.file.x509.public_key_algorithm`	`keyword`	`extended`		`true`	`RSA`	Algorithm used to generate the public key.
`wazuh.threat.enrichments.indicator.file.x509.public_key_curve`	`keyword`	`extended`		`true`	`nistp521`	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
`wazuh.threat.enrichments.indicator.file.x509.public_key_exponent`	`long`	`extended`		`false`	`65537`	Exponent used to derive the public key. This is algorithm specific.
`wazuh.threat.enrichments.indicator.file.x509.public_key_size`	`long`	`extended`		`true`	`2048`	The size of the public key space in bits.
`wazuh.threat.enrichments.indicator.file.x509.serial_number`	`keyword`	`extended`		`true`	`55FBB9C7DEBF09809D12CCAA`	Unique serial number issued by the certificate authority.
`wazuh.threat.enrichments.indicator.file.x509.signature_algorithm`	`keyword`	`extended`		`true`	`SHA256-RSA`	Identifier for certificate signature algorithm.
`wazuh.threat.enrichments.indicator.file.x509.subject.common_name`	`keyword`	`extended`	`array`	`true`	`shared.global.example.net`	List of common names (CN) of subject.
`wazuh.threat.enrichments.indicator.file.x509.subject.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) code
`wazuh.threat.enrichments.indicator.file.x509.subject.distinguished_name`	`keyword`	`extended`		`true`	`C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net`	Distinguished name (DN) of the certificate subject entity.
`wazuh.threat.enrichments.indicator.file.x509.subject.locality`	`keyword`	`extended`	`array`	`true`	`San Francisco`	List of locality names (L)
`wazuh.threat.enrichments.indicator.file.x509.subject.organization`	`keyword`	`extended`	`array`	`true`	`Example, Inc.`	List of organizations (O) of subject.
`wazuh.threat.enrichments.indicator.file.x509.subject.organizational_unit`	`keyword`	`extended`	`array`	`true`		List of organizational units (OU) of subject.
`wazuh.threat.enrichments.indicator.file.x509.subject.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`wazuh.threat.enrichments.indicator.file.x509.version_number`	`keyword`	`extended`		`true`	`3`	Version of x509 format.
`wazuh.threat.enrichments.indicator.first_seen`	`date`	`extended`		`true`	`2020-11-05T17:25:47.000Z`	Date/time indicator was first reported.
`wazuh.threat.enrichments.indicator.geo.city_name`	`keyword`	`core`		`true`	`Montreal`	City name.
`wazuh.threat.enrichments.indicator.geo.continent_code`	`keyword`	`core`		`true`	`NA`	Continent code.
`wazuh.threat.enrichments.indicator.geo.continent_name`	`keyword`	`core`		`true`	`North America`	Name of the continent.
`wazuh.threat.enrichments.indicator.geo.country_iso_code`	`keyword`	`core`		`true`	`CA`	Country ISO code.
`wazuh.threat.enrichments.indicator.geo.country_name`	`keyword`	`core`		`true`	`Canada`	Country name.
`wazuh.threat.enrichments.indicator.geo.location`	`geo_point`	`core`		`true`	`{ "lon": -73.614830, "lat": 45.505918 }`	Longitude and latitude.
`wazuh.threat.enrichments.indicator.geo.name`	`keyword`	`extended`		`true`	`boston-dc`	User-defined description of a location.
`wazuh.threat.enrichments.indicator.geo.postal_code`	`keyword`	`core`		`true`	`94040`	Postal code.
`wazuh.threat.enrichments.indicator.geo.region_iso_code`	`keyword`	`core`		`true`	`CA-QC`	Region ISO code.
`wazuh.threat.enrichments.indicator.geo.region_name`	`keyword`	`core`		`true`	`Quebec`	Region name.
`wazuh.threat.enrichments.indicator.geo.timezone`	`keyword`	`core`		`true`	`America/Argentina/Buenos_Aires`	Time zone.
`wazuh.threat.enrichments.indicator.id`	`keyword`	`custom`		`true`		Unique identifier for the enrichment data, such as a hash of the indicator data or a unique ID from the provider.
`wazuh.threat.enrichments.indicator.ip`	`ip`	`extended`		`true`	`1.2.3.4`	Indicator IP address
`wazuh.threat.enrichments.indicator.last_seen`	`date`	`extended`		`true`	`2020-11-05T17:25:47.000Z`	Date/time indicator was last reported.
`wazuh.threat.enrichments.indicator.marking.tlp`	`keyword`	`extended`		`true`	`CLEAR`	Indicator TLP marking
`wazuh.threat.enrichments.indicator.marking.tlp_version`	`keyword`	`extended`		`true`	`2.0`	Indicator TLP version
`wazuh.threat.enrichments.indicator.modified_at`	`date`	`extended`		`true`	`2020-11-05T17:25:47.000Z`	Date/time indicator was last updated.
`wazuh.threat.enrichments.indicator.name`	`keyword`	`extended`		`true`	`5.2.75.227`	Indicator display name
`wazuh.threat.enrichments.indicator.port`	`long`	`extended`		`true`	`443`	Indicator port
`wazuh.threat.enrichments.indicator.provider`	`keyword`	`extended`		`true`	`lrz_urlhaus`	Indicator provider
`wazuh.threat.enrichments.indicator.reference`	`keyword`	`extended`		`true`	`https://system.example.com/indicator/0001234`	Indicator reference URL
`wazuh.threat.enrichments.indicator.registry.data.bytes`	`keyword`	`extended`		`true`	`ZQBuAC0AVQBTAAAAZQBuAAAAAAA=`	Original bytes written with base64 encoding.
`wazuh.threat.enrichments.indicator.registry.data.strings`	`keyword`	`core`	`array`	`true`	`["C:\rta\red_ttp\bin\myapp.exe"]`	List of strings representing what was written to the registry.
`wazuh.threat.enrichments.indicator.registry.data.type`	`keyword`	`core`		`true`	`REG_SZ`	Standard registry type for encoding contents
`wazuh.threat.enrichments.indicator.registry.hive`	`keyword`	`core`		`true`	`HKLM`	Abbreviated name for the hive.
`wazuh.threat.enrichments.indicator.registry.key`	`keyword`	`core`		`true`	`SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe`	Hive-relative path of keys.
`wazuh.threat.enrichments.indicator.registry.path`	`keyword`	`core`		`true`	`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger`	Full path, including hive, key and value
`wazuh.threat.enrichments.indicator.registry.value`	`keyword`	`core`		`true`	`Debugger`	Name of the value written.
`wazuh.threat.enrichments.indicator.scanner_stats`	`long`	`extended`		`true`	`4`	Scanner statistics
`wazuh.threat.enrichments.indicator.sightings`	`long`	`extended`		`true`	`20`	Number of times indicator observed
`wazuh.threat.enrichments.indicator.software`	`object`	`custom`		`true`		Name of the software associated with the indicator, such as malware or attack framework.
`wazuh.threat.enrichments.indicator.software.alias`	`keyword`	`custom`	`array`	`true`		Alias or alternative names for the software associated with the indicator.
`wazuh.threat.enrichments.indicator.software.name`	`keyword`	`custom`		`true`		Name of the software associated with the indicator.
`wazuh.threat.enrichments.indicator.software.type`	`keyword`	`custom`		`true`		Type of software associated with the indicator, such as malware, attack framework, or tool.
`wazuh.threat.enrichments.indicator.tags`	`keyword`	`custom`	`array`	`true`		List of tags associated with the indicator.
`wazuh.threat.enrichments.indicator.type`	`keyword`	`extended`		`true`	`ipv4-addr`	Type of indicator
`wazuh.threat.enrichments.indicator.x509.alternative_names`	`keyword`	`extended`	`array`	`true`	`*.elastic.co`	List of subject alternative names (SAN).
`wazuh.threat.enrichments.indicator.x509.issuer.common_name`	`keyword`	`extended`	`array`	`true`	`Example SHA2 High Assurance Server CA`	List of common name (CN) of issuing certificate authority.
`wazuh.threat.enrichments.indicator.x509.issuer.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) codes
`wazuh.threat.enrichments.indicator.x509.issuer.distinguished_name`	`keyword`	`extended`		`true`	`C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA`	Distinguished name (DN) of issuing certificate authority.
`wazuh.threat.enrichments.indicator.x509.issuer.locality`	`keyword`	`extended`	`array`	`true`	`Mountain View`	List of locality names (L)
`wazuh.threat.enrichments.indicator.x509.issuer.organization`	`keyword`	`extended`	`array`	`true`	`Example Inc`	List of organizations (O) of issuing certificate authority.
`wazuh.threat.enrichments.indicator.x509.issuer.organizational_unit`	`keyword`	`extended`	`array`	`true`	`www.example.com`	List of organizational units (OU) of issuing certificate authority.
`wazuh.threat.enrichments.indicator.x509.issuer.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`wazuh.threat.enrichments.indicator.x509.not_after`	`date`	`extended`		`true`	`2020-07-16T03:15:39Z`	Time at which the certificate is no longer considered valid.
`wazuh.threat.enrichments.indicator.x509.not_before`	`date`	`extended`		`true`	`2019-08-16T01:40:25Z`	Time at which the certificate is first considered valid.
`wazuh.threat.enrichments.indicator.x509.public_key_algorithm`	`keyword`	`extended`		`true`	`RSA`	Algorithm used to generate the public key.
`wazuh.threat.enrichments.indicator.x509.public_key_curve`	`keyword`	`extended`		`true`	`nistp521`	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
`wazuh.threat.enrichments.indicator.x509.public_key_exponent`	`long`	`extended`		`false`	`65537`	Exponent used to derive the public key. This is algorithm specific.
`wazuh.threat.enrichments.indicator.x509.public_key_size`	`long`	`extended`		`true`	`2048`	The size of the public key space in bits.
`wazuh.threat.enrichments.indicator.x509.serial_number`	`keyword`	`extended`		`true`	`55FBB9C7DEBF09809D12CCAA`	Unique serial number issued by the certificate authority.
`wazuh.threat.enrichments.indicator.x509.signature_algorithm`	`keyword`	`extended`		`true`	`SHA256-RSA`	Identifier for certificate signature algorithm.
`wazuh.threat.enrichments.indicator.x509.subject.common_name`	`keyword`	`extended`	`array`	`true`	`shared.global.example.net`	List of common names (CN) of subject.
`wazuh.threat.enrichments.indicator.x509.subject.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) code
`wazuh.threat.enrichments.indicator.x509.subject.distinguished_name`	`keyword`	`extended`		`true`	`C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net`	Distinguished name (DN) of the certificate subject entity.
`wazuh.threat.enrichments.indicator.x509.subject.locality`	`keyword`	`extended`	`array`	`true`	`San Francisco`	List of locality names (L)
`wazuh.threat.enrichments.indicator.x509.subject.organization`	`keyword`	`extended`	`array`	`true`	`Example, Inc.`	List of organizations (O) of subject.
`wazuh.threat.enrichments.indicator.x509.subject.organizational_unit`	`keyword`	`extended`	`array`	`true`		List of organizational units (OU) of subject.
`wazuh.threat.enrichments.indicator.x509.subject.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`wazuh.threat.enrichments.indicator.x509.version_number`	`keyword`	`extended`		`true`	`3`	Version of x509 format.
`wazuh.threat.enrichments.matched.atomic`	`keyword`	`extended`		`true`	`bad-domain.com`	Matched indicator value
`wazuh.threat.enrichments.matched.field`	`keyword`	`extended`		`true`	`file.hash.sha256`	Matched indicator field
`wazuh.threat.enrichments.matched.id`	`keyword`	`extended`		`true`	`ff93aee5-86a1-4a61-b0e6-0cdc313d01b5`	Matched indicator identifier
`wazuh.threat.enrichments.matched.index`	`keyword`	`extended`		`true`	`filebeat-8.0.0-2021.05.23-000011`	Matched indicator index
`wazuh.threat.enrichments.matched.occurred`	`date`	`extended`		`true`	`2021-10-05T17:00:58.326Z`	Date of match
`wazuh.threat.enrichments.matched.type`	`keyword`	`extended`		`true`	`indicator_match_rule`	Type of indicator match
`wazuh.threat.feed.dashboard_id`	`keyword`	`extended`		`true`	`5ba16340-72e6-11eb-a3e3-b3cc7c78a70f`	Feed dashboard ID.
`wazuh.threat.feed.description`	`keyword`	`extended`		`true`	`Threat feed from the AlienVault Open Threat eXchange network.`	Description of the threat feed.
`wazuh.threat.feed.name`	`keyword`	`extended`		`true`	`AlienVault OTX`	Name of the threat feed.
`wazuh.threat.feed.reference`	`keyword`	`extended`		`true`	`https://otx.alienvault.com`	Reference for the threat feed.
`wazuh.threat.framework`	`keyword`	`extended`		`true`	`MITRE ATT&CK`	Threat classification framework.
`wazuh.threat.group.alias`	`keyword`	`extended`	`array`	`true`	`[ "Magecart Group 6" ]`	Alias of the group.
`wazuh.threat.group.id`	`keyword`	`extended`		`true`	`G0037`	ID of the group.
`wazuh.threat.group.name`	`keyword`	`extended`		`true`	`FIN6`	Name of the group.
`wazuh.threat.group.reference`	`keyword`	`extended`		`true`	`https://attack.mitre.org/groups/G0037/`	Reference URL of the group.
`wazuh.threat.indicator.as.number`	`long`	`extended`		`true`	`15169`	Unique number allocated to the autonomous system.
`wazuh.threat.indicator.as.organization.name`	`keyword`	`extended`		`true`	`Google LLC`	Organization name.
`wazuh.threat.indicator.confidence`	`short`	`custom`		`true`	`Medium`	Indicator confidence rating
`wazuh.threat.indicator.description`	`keyword`	`extended`		`true`	`IP x.x.x.x was observed delivering the Angler EK.`	Indicator description
`wazuh.threat.indicator.email.address`	`keyword`	`extended`		`true`	`phish@example.com`	Indicator email address
`wazuh.threat.indicator.file.accessed`	`date`	`extended`		`true`		Last time the file was accessed.
`wazuh.threat.indicator.file.attributes`	`keyword`	`extended`	`array`	`true`	`["readonly", "system"]`	Array of file attributes.
`wazuh.threat.indicator.file.code_signature.digest_algorithm`	`keyword`	`extended`		`true`	`sha256`	Hashing algorithm used to sign the process.
`wazuh.threat.indicator.file.code_signature.exists`	`boolean`	`core`		`true`	`true`	Boolean to capture if a signature is present.
`wazuh.threat.indicator.file.code_signature.flags`	`keyword`	`extended`		`true`	`570522385`	Code signing flags of the process
`wazuh.threat.indicator.file.code_signature.signing_id`	`keyword`	`extended`		`true`	`com.apple.xpc.proxy`	The identifier used to sign the process.
`wazuh.threat.indicator.file.code_signature.status`	`keyword`	`extended`		`true`	`ERROR_UNTRUSTED_ROOT`	Additional information about the certificate status.
`wazuh.threat.indicator.file.code_signature.subject_name`	`keyword`	`core`		`true`	`Microsoft Corporation`	Subject name of the code signer
`wazuh.threat.indicator.file.code_signature.team_id`	`keyword`	`extended`		`true`	`EQHXZ8M8AV`	The team identifier used to sign the process.
`wazuh.threat.indicator.file.code_signature.thumbprint_sha256`	`keyword`	`extended`		`true`	`c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b`	SHA256 hash of the certificate.
`wazuh.threat.indicator.file.code_signature.timestamp`	`date`	`extended`		`true`	`2021-01-01T12:10:30Z`	When the signature was generated and signed.
`wazuh.threat.indicator.file.code_signature.trusted`	`boolean`	`extended`		`true`	`true`	Stores the trust status of the certificate chain.
`wazuh.threat.indicator.file.code_signature.valid`	`boolean`	`extended`		`true`	`true`	Boolean to capture if the digital signature is verified against the binary content.
`wazuh.threat.indicator.file.created`	`date`	`extended`		`true`		File creation time.
`wazuh.threat.indicator.file.ctime`	`date`	`extended`		`true`		Last time the file attributes or metadata changed.
`wazuh.threat.indicator.file.device`	`keyword`	`extended`		`true`	`sda`	Device that is the source of the file.
`wazuh.threat.indicator.file.directory`	`keyword`	`extended`		`true`	`/home/alice`	Directory where the file is located.
`wazuh.threat.indicator.file.drive_letter`	`keyword`	`extended`		`true`	`C`	Drive letter where the file is located.
`wazuh.threat.indicator.file.elf.architecture`	`keyword`	`extended`		`true`	`x86-64`	Machine architecture of the ELF file.
`wazuh.threat.indicator.file.elf.byte_order`	`keyword`	`extended`		`true`	`Little Endian`	Byte sequence of ELF file.
`wazuh.threat.indicator.file.elf.cpu_type`	`keyword`	`extended`		`true`	`Intel`	CPU type of the ELF file.
`wazuh.threat.indicator.file.elf.creation_date`	`date`	`extended`		`true`		Build or compile date.
`wazuh.threat.indicator.file.elf.exports`	`flat_object`	`extended`	`array`	`true`		List of exported element names and types.
`wazuh.threat.indicator.file.elf.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in an ELF file.
`wazuh.threat.indicator.file.elf.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`wazuh.threat.indicator.file.elf.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`wazuh.threat.indicator.file.elf.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`wazuh.threat.indicator.file.elf.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`wazuh.threat.indicator.file.elf.header.abi_version`	`keyword`	`extended`		`true`		Version of the ELF Application Binary Interface (ABI).
`wazuh.threat.indicator.file.elf.header.class`	`keyword`	`extended`		`true`		Header class of the ELF file.
`wazuh.threat.indicator.file.elf.header.data`	`keyword`	`extended`		`true`		Data table of the ELF header.
`wazuh.threat.indicator.file.elf.header.entrypoint`	`long`	`extended`		`true`		Header entrypoint of the ELF file.
`wazuh.threat.indicator.file.elf.header.object_version`	`keyword`	`extended`		`true`		"0x1" for original ELF files.
`wazuh.threat.indicator.file.elf.header.os_abi`	`keyword`	`extended`		`true`		Application Binary Interface (ABI) of the Linux OS.
`wazuh.threat.indicator.file.elf.header.type`	`keyword`	`extended`		`true`		Header type of the ELF file.
`wazuh.threat.indicator.file.elf.header.version`	`keyword`	`extended`		`true`		Version of the ELF header.
`wazuh.threat.indicator.file.elf.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in an ELF file.
`wazuh.threat.indicator.file.elf.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`wazuh.threat.indicator.file.elf.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`wazuh.threat.indicator.file.elf.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`wazuh.threat.indicator.file.elf.sections`	`nested`	`extended`	`array`	`true`		Section information of the ELF file.
`wazuh.threat.indicator.file.elf.sections.chi2`	`long`	`extended`		`true`		Chi-square probability distribution of the section.
`wazuh.threat.indicator.file.elf.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`wazuh.threat.indicator.file.elf.sections.flags`	`keyword`	`extended`		`true`		ELF Section List flags.
`wazuh.threat.indicator.file.elf.sections.name`	`keyword`	`extended`		`true`		ELF Section List name.
`wazuh.threat.indicator.file.elf.sections.physical_offset`	`keyword`	`extended`		`true`		ELF Section List offset.
`wazuh.threat.indicator.file.elf.sections.physical_size`	`long`	`extended`		`true`		ELF Section List physical size.
`wazuh.threat.indicator.file.elf.sections.type`	`keyword`	`extended`		`true`		ELF Section List type.
`wazuh.threat.indicator.file.elf.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`wazuh.threat.indicator.file.elf.sections.virtual_address`	`long`	`extended`		`true`		ELF Section List virtual address.
`wazuh.threat.indicator.file.elf.sections.virtual_size`	`long`	`extended`		`true`		ELF Section List virtual size.
`wazuh.threat.indicator.file.elf.segments`	`nested`	`extended`	`array`	`true`		ELF object segment list.
`wazuh.threat.indicator.file.elf.segments.sections`	`keyword`	`extended`		`true`		ELF object segment sections.
`wazuh.threat.indicator.file.elf.segments.type`	`keyword`	`extended`		`true`		ELF object segment type.
`wazuh.threat.indicator.file.elf.shared_libraries`	`keyword`	`extended`	`array`	`true`		List of shared libraries used by this ELF object.
`wazuh.threat.indicator.file.elf.telfhash`	`keyword`	`extended`		`true`		telfhash hash for ELF file.
`wazuh.threat.indicator.file.extension`	`keyword`	`extended`		`true`	`png`	File extension, excluding the leading dot.
`wazuh.threat.indicator.file.fork_name`	`keyword`	`extended`		`true`	`Zone.Identifer`	A fork is additional data associated with a filesystem object.
`wazuh.threat.indicator.file.gid`	`keyword`	`extended`		`true`	`1001`	Primary group ID (GID) of the file.
`wazuh.threat.indicator.file.group`	`keyword`	`extended`		`true`	`alice`	Primary group name of the file.
`wazuh.threat.indicator.file.hash.cdhash`	`keyword`	`extended`		`true`	`3783b4052fd474dbe30676b45c329e7a6d44acd9`	The Code Directory (CD) hash of an executable.
`wazuh.threat.indicator.file.hash.md5`	`keyword`	`extended`		`true`		MD5 hash.
`wazuh.threat.indicator.file.hash.sha1`	`keyword`	`extended`		`true`		SHA1 hash.
`wazuh.threat.indicator.file.hash.sha256`	`keyword`	`extended`		`true`		SHA256 hash.
`wazuh.threat.indicator.file.hash.sha384`	`keyword`	`extended`		`true`		SHA384 hash.
`wazuh.threat.indicator.file.hash.sha512`	`keyword`	`extended`		`true`		SHA512 hash.
`wazuh.threat.indicator.file.hash.ssdeep`	`keyword`	`extended`		`true`		SSDEEP hash.
`wazuh.threat.indicator.file.hash.tlsh`	`keyword`	`extended`		`true`		TLSH hash.
`wazuh.threat.indicator.file.inode`	`keyword`	`extended`		`true`	`256383`	Inode representing the file in the filesystem.
`wazuh.threat.indicator.file.mime_type`	`keyword`	`extended`		`true`		Media type of file, document, or arrangement of bytes.
`wazuh.threat.indicator.file.mode`	`keyword`	`extended`		`true`	`0640`	Mode of the file in octal representation.
`wazuh.threat.indicator.file.mtime`	`date`	`extended`		`true`		Last time the file content was modified.
`wazuh.threat.indicator.file.name`	`keyword`	`extended`		`true`	`example.png`	Name of the file including the extension, without the directory.
`wazuh.threat.indicator.file.origin_referrer_url`	`keyword`	`extended`		`true`	`http://example.com/article1.html`	The URL of the webpage that linked to the file.
`wazuh.threat.indicator.file.origin_url`	`keyword`	`extended`		`true`	`http://example.com/imgs/article1_img1.jpg`	The URL where the file is hosted.
`wazuh.threat.indicator.file.owner`	`keyword`	`extended`		`true`	`alice`	File owner's username.
`wazuh.threat.indicator.file.path`	`keyword`	`extended`		`true`	`/home/alice/example.png`	Full path to the file, including the file name.
`wazuh.threat.indicator.file.pe.architecture`	`keyword`	`extended`		`true`	`x64`	CPU architecture target for the file.
`wazuh.threat.indicator.file.pe.company`	`keyword`	`extended`		`true`	`Microsoft Corporation`	Internal company name of the file, provided at compile-time.
`wazuh.threat.indicator.file.pe.description`	`keyword`	`extended`		`true`	`Paint`	Internal description of the file, provided at compile-time.
`wazuh.threat.indicator.file.pe.file_version`	`keyword`	`extended`		`true`	`6.3.9600.17415`	Process name.
`wazuh.threat.indicator.file.pe.go_import_hash`	`keyword`	`extended`		`true`	`10bddcb4cee42080f76c88d9ff964491`	A hash of the Go language imports in a PE file.
`wazuh.threat.indicator.file.pe.go_imports`	`flat_object`	`extended`		`true`		List of imported Go language element names and types.
`wazuh.threat.indicator.file.pe.go_imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of Go imports.
`wazuh.threat.indicator.file.pe.go_imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of Go imports.
`wazuh.threat.indicator.file.pe.go_stripped`	`boolean`	`extended`		`true`		Whether the file is a stripped or obfuscated Go executable.
`wazuh.threat.indicator.file.pe.imphash`	`keyword`	`extended`		`true`	`0c6803c4e922103c4dca5963aad36ddf`	A hash of the imports in a PE file.
`wazuh.threat.indicator.file.pe.import_hash`	`keyword`	`extended`		`true`	`d41d8cd98f00b204e9800998ecf8427e`	A hash of the imports in a PE file.
`wazuh.threat.indicator.file.pe.imports`	`flat_object`	`extended`	`array`	`true`		List of imported element names and types.
`wazuh.threat.indicator.file.pe.imports_names_entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the list of imported element names and types.
`wazuh.threat.indicator.file.pe.imports_names_var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the list of imported element names and types.
`wazuh.threat.indicator.file.pe.original_file_name`	`keyword`	`extended`		`true`	`MSPAINT.EXE`	Internal name of the file, provided at compile-time.
`wazuh.threat.indicator.file.pe.pehash`	`keyword`	`extended`		`true`	`73ff189b63cd6be375a7ff25179a38d347651975`	A hash of the PE header and data from one or more PE sections.
`wazuh.threat.indicator.file.pe.product`	`keyword`	`extended`		`true`	`Microsoft® Windows® Operating System`	Internal product name of the file, provided at compile-time.
`wazuh.threat.indicator.file.pe.sections`	`nested`	`extended`	`array`	`true`		Section information of the PE file.
`wazuh.threat.indicator.file.pe.sections.entropy`	`long`	`extended`		`true`		Shannon entropy calculation from the section.
`wazuh.threat.indicator.file.pe.sections.name`	`keyword`	`extended`		`true`		PE Section List name.
`wazuh.threat.indicator.file.pe.sections.physical_size`	`long`	`extended`		`true`		PE Section List physical size.
`wazuh.threat.indicator.file.pe.sections.var_entropy`	`long`	`extended`		`true`		Variance for Shannon entropy calculation from the section.
`wazuh.threat.indicator.file.pe.sections.virtual_size`	`long`	`extended`		`true`		PE Section List virtual size. This is always the same as `physical_size`.
`wazuh.threat.indicator.file.size`	`long`	`extended`		`true`	`16384`	File size in bytes.
`wazuh.threat.indicator.file.target_path`	`keyword`	`extended`		`true`		Target path for symlinks.
`wazuh.threat.indicator.file.type`	`keyword`	`extended`		`true`	`file`	File type (file, dir, or symlink).
`wazuh.threat.indicator.file.uid`	`keyword`	`extended`		`true`	`1001`	The user ID (UID) or security identifier (SID) of the file owner.
`wazuh.threat.indicator.file.x509.alternative_names`	`keyword`	`extended`	`array`	`true`	`*.elastic.co`	List of subject alternative names (SAN).
`wazuh.threat.indicator.file.x509.issuer.common_name`	`keyword`	`extended`	`array`	`true`	`Example SHA2 High Assurance Server CA`	List of common name (CN) of issuing certificate authority.
`wazuh.threat.indicator.file.x509.issuer.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) codes
`wazuh.threat.indicator.file.x509.issuer.distinguished_name`	`keyword`	`extended`		`true`	`C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA`	Distinguished name (DN) of issuing certificate authority.
`wazuh.threat.indicator.file.x509.issuer.locality`	`keyword`	`extended`	`array`	`true`	`Mountain View`	List of locality names (L)
`wazuh.threat.indicator.file.x509.issuer.organization`	`keyword`	`extended`	`array`	`true`	`Example Inc`	List of organizations (O) of issuing certificate authority.
`wazuh.threat.indicator.file.x509.issuer.organizational_unit`	`keyword`	`extended`	`array`	`true`	`www.example.com`	List of organizational units (OU) of issuing certificate authority.
`wazuh.threat.indicator.file.x509.issuer.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`wazuh.threat.indicator.file.x509.not_after`	`date`	`extended`		`true`	`2020-07-16T03:15:39Z`	Time at which the certificate is no longer considered valid.
`wazuh.threat.indicator.file.x509.not_before`	`date`	`extended`		`true`	`2019-08-16T01:40:25Z`	Time at which the certificate is first considered valid.
`wazuh.threat.indicator.file.x509.public_key_algorithm`	`keyword`	`extended`		`true`	`RSA`	Algorithm used to generate the public key.
`wazuh.threat.indicator.file.x509.public_key_curve`	`keyword`	`extended`		`true`	`nistp521`	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
`wazuh.threat.indicator.file.x509.public_key_exponent`	`long`	`extended`		`false`	`65537`	Exponent used to derive the public key. This is algorithm specific.
`wazuh.threat.indicator.file.x509.public_key_size`	`long`	`extended`		`true`	`2048`	The size of the public key space in bits.
`wazuh.threat.indicator.file.x509.serial_number`	`keyword`	`extended`		`true`	`55FBB9C7DEBF09809D12CCAA`	Unique serial number issued by the certificate authority.
`wazuh.threat.indicator.file.x509.signature_algorithm`	`keyword`	`extended`		`true`	`SHA256-RSA`	Identifier for certificate signature algorithm.
`wazuh.threat.indicator.file.x509.subject.common_name`	`keyword`	`extended`	`array`	`true`	`shared.global.example.net`	List of common names (CN) of subject.
`wazuh.threat.indicator.file.x509.subject.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) code
`wazuh.threat.indicator.file.x509.subject.distinguished_name`	`keyword`	`extended`		`true`	`C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net`	Distinguished name (DN) of the certificate subject entity.
`wazuh.threat.indicator.file.x509.subject.locality`	`keyword`	`extended`	`array`	`true`	`San Francisco`	List of locality names (L)
`wazuh.threat.indicator.file.x509.subject.organization`	`keyword`	`extended`	`array`	`true`	`Example, Inc.`	List of organizations (O) of subject.
`wazuh.threat.indicator.file.x509.subject.organizational_unit`	`keyword`	`extended`	`array`	`true`		List of organizational units (OU) of subject.
`wazuh.threat.indicator.file.x509.subject.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`wazuh.threat.indicator.file.x509.version_number`	`keyword`	`extended`		`true`	`3`	Version of x509 format.
`wazuh.threat.indicator.first_seen`	`date`	`extended`		`true`	`2020-11-05T17:25:47.000Z`	Date/time indicator was first reported.
`wazuh.threat.indicator.geo.city_name`	`keyword`	`core`		`true`	`Montreal`	City name.
`wazuh.threat.indicator.geo.continent_code`	`keyword`	`core`		`true`	`NA`	Continent code.
`wazuh.threat.indicator.geo.continent_name`	`keyword`	`core`		`true`	`North America`	Name of the continent.
`wazuh.threat.indicator.geo.country_iso_code`	`keyword`	`core`		`true`	`CA`	Country ISO code.
`wazuh.threat.indicator.geo.country_name`	`keyword`	`core`		`true`	`Canada`	Country name.
`wazuh.threat.indicator.geo.location`	`geo_point`	`core`		`true`	`{ "lon": -73.614830, "lat": 45.505918 }`	Longitude and latitude.
`wazuh.threat.indicator.geo.name`	`keyword`	`extended`		`true`	`boston-dc`	User-defined description of a location.
`wazuh.threat.indicator.geo.postal_code`	`keyword`	`core`		`true`	`94040`	Postal code.
`wazuh.threat.indicator.geo.region_iso_code`	`keyword`	`core`		`true`	`CA-QC`	Region ISO code.
`wazuh.threat.indicator.geo.region_name`	`keyword`	`core`		`true`	`Quebec`	Region name.
`wazuh.threat.indicator.geo.timezone`	`keyword`	`core`		`true`	`America/Argentina/Buenos_Aires`	Time zone.
`wazuh.threat.indicator.id`	`keyword`	`extended`	`array`	`true`	`[indicator--d7008e06-ab86-415a-9803-3c81ce2d3c37]`	ID of the indicator
`wazuh.threat.indicator.ip`	`ip`	`extended`		`true`	`1.2.3.4`	Indicator IP address
`wazuh.threat.indicator.last_seen`	`date`	`extended`		`true`	`2020-11-05T17:25:47.000Z`	Date/time indicator was last reported.
`wazuh.threat.indicator.marking.tlp`	`keyword`	`extended`		`true`	`CLEAR`	Indicator TLP marking
`wazuh.threat.indicator.marking.tlp_version`	`keyword`	`extended`		`true`	`2.0`	Indicator TLP version
`wazuh.threat.indicator.modified_at`	`date`	`extended`		`true`	`2020-11-05T17:25:47.000Z`	Date/time indicator was last updated.
`wazuh.threat.indicator.name`	`keyword`	`extended`		`true`	`5.2.75.227`	Indicator display name
`wazuh.threat.indicator.port`	`long`	`extended`		`true`	`443`	Indicator port
`wazuh.threat.indicator.provider`	`keyword`	`extended`		`true`	`lrz_urlhaus`	Indicator provider
`wazuh.threat.indicator.reference`	`keyword`	`extended`		`true`	`https://system.example.com/indicator/0001234`	Indicator reference URL
`wazuh.threat.indicator.registry.data.bytes`	`keyword`	`extended`		`true`	`ZQBuAC0AVQBTAAAAZQBuAAAAAAA=`	Original bytes written with base64 encoding.
`wazuh.threat.indicator.registry.data.strings`	`keyword`	`core`	`array`	`true`	`["C:\rta\red_ttp\bin\myapp.exe"]`	List of strings representing what was written to the registry.
`wazuh.threat.indicator.registry.data.type`	`keyword`	`core`		`true`	`REG_SZ`	Standard registry type for encoding contents
`wazuh.threat.indicator.registry.hive`	`keyword`	`core`		`true`	`HKLM`	Abbreviated name for the hive.
`wazuh.threat.indicator.registry.key`	`keyword`	`core`		`true`	`SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe`	Hive-relative path of keys.
`wazuh.threat.indicator.registry.path`	`keyword`	`core`		`true`	`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger`	Full path, including hive, key and value
`wazuh.threat.indicator.registry.value`	`keyword`	`core`		`true`	`Debugger`	Name of the value written.
`wazuh.threat.indicator.scanner_stats`	`long`	`extended`		`true`	`4`	Scanner statistics
`wazuh.threat.indicator.sightings`	`long`	`extended`		`true`	`20`	Number of times indicator observed
`wazuh.threat.indicator.type`	`keyword`	`extended`		`true`	`ipv4-addr`	Type of indicator
`wazuh.threat.indicator.x509.alternative_names`	`keyword`	`extended`	`array`	`true`	`*.elastic.co`	List of subject alternative names (SAN).
`wazuh.threat.indicator.x509.issuer.common_name`	`keyword`	`extended`	`array`	`true`	`Example SHA2 High Assurance Server CA`	List of common name (CN) of issuing certificate authority.
`wazuh.threat.indicator.x509.issuer.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) codes
`wazuh.threat.indicator.x509.issuer.distinguished_name`	`keyword`	`extended`		`true`	`C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA`	Distinguished name (DN) of issuing certificate authority.
`wazuh.threat.indicator.x509.issuer.locality`	`keyword`	`extended`	`array`	`true`	`Mountain View`	List of locality names (L)
`wazuh.threat.indicator.x509.issuer.organization`	`keyword`	`extended`	`array`	`true`	`Example Inc`	List of organizations (O) of issuing certificate authority.
`wazuh.threat.indicator.x509.issuer.organizational_unit`	`keyword`	`extended`	`array`	`true`	`www.example.com`	List of organizational units (OU) of issuing certificate authority.
`wazuh.threat.indicator.x509.issuer.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`wazuh.threat.indicator.x509.not_after`	`date`	`extended`		`true`	`2020-07-16T03:15:39Z`	Time at which the certificate is no longer considered valid.
`wazuh.threat.indicator.x509.not_before`	`date`	`extended`		`true`	`2019-08-16T01:40:25Z`	Time at which the certificate is first considered valid.
`wazuh.threat.indicator.x509.public_key_algorithm`	`keyword`	`extended`		`true`	`RSA`	Algorithm used to generate the public key.
`wazuh.threat.indicator.x509.public_key_curve`	`keyword`	`extended`		`true`	`nistp521`	The curve used by the elliptic curve public key algorithm. This is algorithm specific.
`wazuh.threat.indicator.x509.public_key_exponent`	`long`	`extended`		`false`	`65537`	Exponent used to derive the public key. This is algorithm specific.
`wazuh.threat.indicator.x509.public_key_size`	`long`	`extended`		`true`	`2048`	The size of the public key space in bits.
`wazuh.threat.indicator.x509.serial_number`	`keyword`	`extended`		`true`	`55FBB9C7DEBF09809D12CCAA`	Unique serial number issued by the certificate authority.
`wazuh.threat.indicator.x509.signature_algorithm`	`keyword`	`extended`		`true`	`SHA256-RSA`	Identifier for certificate signature algorithm.
`wazuh.threat.indicator.x509.subject.common_name`	`keyword`	`extended`	`array`	`true`	`shared.global.example.net`	List of common names (CN) of subject.
`wazuh.threat.indicator.x509.subject.country`	`keyword`	`extended`	`array`	`true`	`US`	List of country \(C) code
`wazuh.threat.indicator.x509.subject.distinguished_name`	`keyword`	`extended`		`true`	`C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net`	Distinguished name (DN) of the certificate subject entity.
`wazuh.threat.indicator.x509.subject.locality`	`keyword`	`extended`	`array`	`true`	`San Francisco`	List of locality names (L)
`wazuh.threat.indicator.x509.subject.organization`	`keyword`	`extended`	`array`	`true`	`Example, Inc.`	List of organizations (O) of subject.
`wazuh.threat.indicator.x509.subject.organizational_unit`	`keyword`	`extended`	`array`	`true`		List of organizational units (OU) of subject.
`wazuh.threat.indicator.x509.subject.state_or_province`	`keyword`	`extended`	`array`	`true`	`California`	List of state or province names (ST, S, or P)
`wazuh.threat.indicator.x509.version_number`	`keyword`	`extended`		`true`	`3`	Version of x509 format.
`wazuh.threat.software.alias`	`keyword`	`extended`	`array`	`true`	`[ "X-Agent" ]`	Alias of the software
`wazuh.threat.software.id`	`keyword`	`extended`		`true`	`S0552`	ID of the software
`wazuh.threat.software.name`	`keyword`	`extended`		`true`	`AdFind`	Name of the software.
`wazuh.threat.software.platforms`	`keyword`	`extended`	`array`	`true`	`[ "Windows" ]`	Platforms of the software.
`wazuh.threat.software.reference`	`keyword`	`extended`		`true`	`https://attack.mitre.org/software/S0552/`	Software reference URL.
`wazuh.threat.software.type`	`keyword`	`extended`		`true`	`Tool`	Software type.
`wazuh.threat.tactic.id`	`keyword`	`extended`	`array`	`true`	`TA0002`	Threat tactic id.
`wazuh.threat.tactic.name`	`keyword`	`extended`	`array`	`true`	`Execution`	Threat tactic.
`wazuh.threat.tactic.reference`	`keyword`	`extended`	`array`	`true`	`https://attack.mitre.org/tactics/TA0002/`	Threat tactic URL reference.
`wazuh.threat.technique.id`	`keyword`	`extended`	`array`	`true`	`T1059`	Threat technique id.
`wazuh.threat.technique.name`	`keyword`	`extended`	`array`	`true`	`Command and Scripting Interpreter`	Threat technique name.
`wazuh.threat.technique.reference`	`keyword`	`extended`	`array`	`true`	`https://attack.mitre.org/techniques/T1059/`	Threat technique URL reference.
`wazuh.threat.technique.subtechnique.id`	`keyword`	`extended`	`array`	`true`	`T1059.001`	Threat subtechnique id.
`wazuh.threat.technique.subtechnique.name`	`keyword`	`extended`	`array`	`true`	`PowerShell`	Threat subtechnique name.
`wazuh.threat.technique.subtechnique.reference`	`keyword`	`extended`	`array`	`true`	`https://attack.mitre.org/techniques/T1059/001/`	Threat subtechnique URL reference.

Findings index

The findings data streams store findings generated by detection rules. Wazuh creates one data stream for each event category, for example wazuh-findings-v5-security and wazuh-findings-v5-system-activity. You can query all of them with the wazuh-findings-v5* index pattern.

Findings include all the fields of the main module, plus fields that describe the rule that matched and the case the finding belongs to:

wazuh.rule.*: The rule that generated the finding, including its ID, title, level, and status, its MITRE ATT&CK mapping (wazuh.rule.mitre.*), its compliance requirements (wazuh.rule.compliance.*), and the Sigma rule it was imported from (wazuh.rule.sigma_id).
wazuh.case.*: The case the finding is attached to, including its title, status, severity, priority, TLP classification, owner, and comments.
event.doc_id and event.index: The ID and the backing index of the event that matched the rule.

The complete list of findings fields is in the fields.csv and wcs_flat.yml files of the stateless/events/findings module.

Field	Type	Level	Normalization	Indexed	Example	Description
`event.doc_id`	`keyword`	`custom`		`true`	`4cgCE6EBJxulUzH6bBKf`	In a finding, the `_id` of the event that matched the rule.
`event.index`	`keyword`	`custom`		`true`	`.ds-wazuh-events-v5-security-000001`	In a finding, the backing index of the event that matched the rule.
`wazuh.case.comments`	`nested`	`custom`	`array`	`true`		Array of comments attached to the case, each authored and timestamped independently.
`wazuh.case.comments.author`	`keyword`	`custom`		`true`	`admin`	Name of the user that authored the comment.
`wazuh.case.comments.comment`	`match_only_text`	`custom`		`true`	`This is a comment for the case.`	Text content of the comment.
`wazuh.case.comments.created_at`	`date`	`custom`		`true`	`1623456789000`	Timestamp when the comment was created.
`wazuh.case.comments.updated_at`	`date`	`custom`		`true`	`1623456789000`	Timestamp when the comment was last updated.
`wazuh.case.created_at`	`date`	`custom`		`true`	`1623456789000`	Timestamp when the case was created.
`wazuh.case.description`	`match_only_text`	`custom`		`true`	`This is a sample description for the case.`	Detailed description of the case.
`wazuh.case.priority`	`keyword`	`custom`		`true`	`medium`	Priority of the case. One of low, medium, high, urgent.
`wazuh.case.severity`	`keyword`	`custom`		`true`	`medium`	Severity of the case. One of informational, low, medium, high, critical.
`wazuh.case.status`	`keyword`	`custom`		`true`	`active`	Current status of the case. One of active, acknowledged, completed, error, deleted, audit.
`wazuh.case.tags`	`keyword`	`custom`	`array`	`true`	`["tag1", "tag2", "tag3"]`	Tags attached to the case for organization.
`wazuh.case.title`	`match_only_text`	`custom`		`true`	`Sample Case Title`	Title summarizing the case.
`wazuh.case.tlp`	`keyword`	`custom`		`true`	`TLP:CLEAR`	Traffic Light Protocol classification of the case. One of TLP:RED, TLP:AMBER, TLP:GREEN, TLP:CLEAR.
`wazuh.case.updated_at`	`date`	`custom`		`true`	`1623456789000`	Timestamp when the case was last updated.
`wazuh.case.user.name`	`keyword`	`custom`		`true`	`admin`	Name of the user that owns the case. Not editable by the user.
`wazuh.rule.author`	`keyword`	`extended`	`array`	`true`	`["Star-Lord"]`	Rule author
`wazuh.rule.category`	`keyword`	`extended`		`true`	`Attempted Information Leak`	Rule category
`wazuh.rule.compliance.cmmc`	`keyword`	`custom`	`array`	`true`	`["AC.1.001", "AU.L2-3.3.1"]`	CMMC requirements.
`wazuh.rule.compliance.fedramp`	`keyword`	`custom`	`array`	`true`	`["AC-2", "SC-7"]`	FedRAMP requirements.
`wazuh.rule.compliance.gdpr`	`keyword`	`custom`	`array`	`true`	`["Art. 32", "Art. 25"]`	GDPR requirements.
`wazuh.rule.compliance.hipaa`	`keyword`	`custom`	`array`	`true`	`["164.312(a)(1)", "164.308(a)(5)(ii)(C)"]`	HIPAA requirements.
`wazuh.rule.compliance.iso_27001`	`keyword`	`custom`	`array`	`true`	`["A.9.4.1", "A.8.8"]`	ISO 27001 requirements.
`wazuh.rule.compliance.nis2`	`keyword`	`custom`	`array`	`true`	`["Art. 21", "Art. 23"]`	NIS2 requirements.
`wazuh.rule.compliance.nist_800_171`	`keyword`	`custom`	`array`	`true`	`["3.1.1", "3.3.1"]`	NIST 800-171 requirements.
`wazuh.rule.compliance.nist_800_53`	`keyword`	`custom`	`array`	`true`	`["AC-3", "AU-2"]`	NIST 800-53 requirements.
`wazuh.rule.compliance.pci_dss`	`keyword`	`custom`	`array`	`true`	`["2.2.1", "6.3.3"]`	PCI DSS requirements.
`wazuh.rule.compliance.tsc`	`keyword`	`custom`	`array`	`true`	`["CC6.1", "CC7.1"]`	TSC requirements.
`wazuh.rule.description`	`keyword`	`extended`		`true`	`Block requests to public DNS over HTTPS / TLS protocols`	Rule description
`wazuh.rule.id`	`keyword`	`extended`		`true`	`8784f095-729a-5912-9315-119722b444ed`	Rule ID. Under `wazuh.rule`, the ID of the Wazuh rule that matched.
`wazuh.rule.level`	`keyword`	`custom`		`true`	`high`	Severity level of the rule: `informational`, `low`, `medium`, `high` or `critical`.
`wazuh.rule.license`	`keyword`	`extended`		`true`	`Apache 2.0`	Rule license
`wazuh.rule.mitre.subtechnique`	`object`	`custom`		`true`		MITRE ATT&CK subtechniques.
`wazuh.rule.mitre.subtechnique.id`	`keyword`	`custom`	`array`	`true`	`["T1059.001", "T1078.001"]`	MITRE ATT&CK subtechnique identifiers.
`wazuh.rule.mitre.subtechnique.name`	`keyword`	`custom`	`array`	`true`	`["Command and Scripting Interpreter: PowerShell", "Valid Accounts: Default Accounts"]`	MITRE ATT&CK subtechnique names.
`wazuh.rule.mitre.tactic`	`object`	`custom`		`true`		MITRE ATT&CK tactics.
`wazuh.rule.mitre.tactic.id`	`keyword`	`custom`	`array`	`true`	`["TA0002", "TA0005"]`	MITRE ATT&CK tactic identifiers.
`wazuh.rule.mitre.tactic.name`	`keyword`	`custom`	`array`	`true`	`["Execution", "Defense Evasion"]`	MITRE ATT&CK tactic names.
`wazuh.rule.mitre.technique`	`object`	`custom`		`true`		MITRE ATT&CK techniques.
`wazuh.rule.mitre.technique.id`	`keyword`	`custom`	`array`	`true`	`["T1059", "T1562"]`	MITRE ATT&CK technique identifiers.
`wazuh.rule.mitre.technique.name`	`keyword`	`custom`	`array`	`true`	`["Command and Scripting Interpreter", "Impair Defenses"]`	MITRE ATT&CK technique names.
`wazuh.rule.name`	`keyword`	`extended`		`true`	`BLOCK_DNS_over_TLS`	Rule name
`wazuh.rule.reference`	`keyword`	`extended`		`true`	`https://en.wikipedia.org/wiki/DNS_over_TLS`	Rule reference URL
`wazuh.rule.ruleset`	`keyword`	`extended`		`true`	`Standard_Protocol_Filters`	Rule ruleset
`wazuh.rule.sigma_id`	`keyword`	`custom`		`true`	`5af54681-df95-4c26-854f-2565e13cfab0`	Identifier of the Sigma rule the rule was imported from, when it has one.
`wazuh.rule.status`	`keyword`	`custom`		`true`	`stable`	Maturity status of the rule: `stable`, `experimental`, `test`, `deprecated` or `unsupported`.
`wazuh.rule.tags`	`keyword`	`custom`	`array`	`true`	`["low", "wazuh-generic-1", "attack.privilege-escalation", "attack.t1548"]`	Tags of the rule. Under `wazuh.rule`, the level, the integration and then the rule tags.
`wazuh.rule.title`	`keyword`	`custom`		`true`	`Sudo command executed - vagrant`	Title of the rule. Under `wazuh.rule`, placeholders are filled with event values.
`wazuh.rule.uuid`	`keyword`	`extended`		`true`	`1100110011`	Rule UUID
`wazuh.rule.version`	`keyword`	`extended`		`true`	`1.1`	Rule version

State indices

State indices store the latest known state of each monitored endpoint. Wazuh agent modules report the state, and the Wazuh manager keeps the indices in sync. Each index has its own module in the stateful folder, with a fields.csv file that lists its fields.

File integrity monitoring

The File Integrity Monitoring (FIM) indices store the monitored files and Windows registry entries, with attributes such as hashes, permissions, and owners.

The following example shows a document from the wazuh-states-fim-files index. It records the attributes of a monitored file on the Ubuntu endpoint:

{
  "_index" : "wazuh-states-fim-files",
  "_id" : "wazuh_003_9a30e2494a7578925cde57179ccce87978f8af3e",
  "_score" : 1.0,
  "_source" : {
    "file" : {
      "inode" : "2886305",
      "owner" : "root",
      "path" : "/etc/grub.d/README",
      "uid" : "0",
      "gid" : "0",
      "size" : 483,
      "permissions" : [
        "rw-r--r--"
      ],
      "mtime" : "2025-03-17T13:20:09.000Z",
      "device" : "64770",
      "hash" : {
        "sha1" : "7330684105b8e3df69f7a7a0af1436610f254f58",
        "sha256" : "cd72738c7dfd3b205e4e91528c0d25169bb3e8e6ebeec11c916662d8d0c3e47c",
        "md5" : "be58f42dfe74feb6eeb98c6a843c743f"
      },
      "group" : "root"
    },
    "checksum" : {
      "hash" : {
        "sha1" : "343e5b87c9be19207c585fc09bcf86877ce4324f"
      }
    },
    "wazuh" : {
      "cluster" : {
        "name" : "wazuh"
      },
      "agent" : {
        "host" : {
          "hostname" : "ubuntu-QEMU-Virtual-Machine",
          "os" : {
            "name" : "Ubuntu",
            "type" : "linux",
            "version" : "24.04.4 LTS (Noble Numbat)",
            "platform" : "ubuntu"
          },
          "architecture" : "aarch64"
        },
        "name" : "Ubuntu",
        "groups" : [
          "default"
        ],
        "id" : "003",
        "version" : "v5.0.0"
      }
    },
    "state" : {
      "document_version" : 298,
      "modified_at" : "2026-10-29T08:01:45.264Z"
    }
  }
}

`wazuh-states-fim-files`

Monitored files.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`file.attributes`	`keyword`	`extended`	`array`	`true`	`["readonly", "system"]`	Array of file attributes.
`file.device`	`keyword`	`extended`		`true`	`sda`	Device that is the source of the file.
`file.gid`	`keyword`	`extended`		`true`	`1001`	Primary group ID (GID) of the file.
`file.group`	`keyword`	`extended`		`true`	`alice`	Primary group name of the file.
`file.hash.md5`	`keyword`	`extended`		`true`		MD5 hash.
`file.hash.sha1`	`keyword`	`extended`		`true`		SHA1 hash.
`file.hash.sha256`	`keyword`	`extended`		`true`		SHA256 hash.
`file.inode`	`keyword`	`extended`		`true`	`256383`	Inode representing the file in the filesystem.
`file.mtime`	`date`	`extended`		`true`		Last time the file content was modified.
`file.owner`	`keyword`	`extended`		`true`	`alice`	File owner's username.
`file.path`	`keyword`	`extended`		`true`	`/home/alice/example.png`	Full path to the file, including the file name.
`file.permissions`	`keyword`	`custom`	`array`	`true`		List of permissions related to the file.
`file.size`	`long`	`extended`		`true`	`16384`	File size in bytes.
`file.uid`	`keyword`	`extended`		`true`	`1001`	The user ID (UID) or security identifier (SID) of the file owner.
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

`wazuh-states-fim-registry-keys`

Monitored Windows registry keys.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`registry.architecture`	`keyword`	`custom`		`true`		Architecture associated with the entity
`registry.gid`	`keyword`	`custom`		`true`		Group ID associated with the entity
`registry.group`	`keyword`	`custom`		`true`		Name of the group that owns the entity
`registry.hive`	`keyword`	`core`		`true`	`HKLM`	Abbreviated name for the hive.
`registry.key`	`keyword`	`core`		`true`	`SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe`	Hive-relative path of keys.
`registry.mtime`	`date`	`custom`		`true`		Last modified timestamp of the entity
`registry.owner`	`keyword`	`custom`		`true`		Name of the owner of the entity (user)
`registry.path`	`keyword`	`core`		`true`	`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger`	Full path, including hive, key and value
`registry.permissions`	`keyword`	`custom`	`array`	`true`		Permissions associated with the registry key.
`registry.uid`	`keyword`	`custom`		`true`		User ID associated with the entity
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

`wazuh-states-fim-registry-values`

Monitored Windows registry values.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`registry.architecture`	`keyword`	`custom`		`true`		Architecture associated with the entity
`registry.data.hash.md5`	`keyword`	`custom`		`true`		MD5 hash of the file or registry value content
`registry.data.hash.sha1`	`keyword`	`custom`		`true`		SHA-1 hash of the file or registry value content
`registry.data.hash.sha256`	`keyword`	`custom`		`true`		SHA-256 hash of the file or registry value content
`registry.data.type`	`keyword`	`core`		`true`	`REG_SZ`	Standard registry type for encoding contents
`registry.hive`	`keyword`	`core`		`true`	`HKLM`	Abbreviated name for the hive.
`registry.key`	`keyword`	`core`		`true`	`SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe`	Hive-relative path of keys.
`registry.path`	`keyword`	`core`		`true`	`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger`	Full path, including hive, key and value
`registry.size`	`long`	`custom`		`true`		Size of the file or registry value (in bytes)
`registry.value`	`keyword`	`core`		`true`	`Debugger`	Name of the value written.
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

System inventory

The system inventory indices store hardware, software, network, and user information for each endpoint, with one index per category.

The following example shows a document from the wazuh-states-inventory-packages index. It records a Python package installed on the Ubuntu endpoint:

{
  "_index" : "wazuh-states-inventory-packages",
  "_id" : "wazuh_003_2d2113c04ae74123f3ef32f4467d90a4abf2d621",
  "_score" : 1.0,
  "_source" : {
    "package" : {
      "installed" : null,
      "description" : "Database Abstraction Library",
      "source" : "https://www.sqlalchemy.org",
      "priority" : null,
      "type" : "pypi",
      "version" : "2.0.23",
      "path" : "/usr/local/lib/python3.12/dist-packages/SQLAlchemy-2.0.23.dist-info/METADATA",
      "size" : 0,
      "vendor" : "Mike Bayer",
      "name" : "SQLAlchemy",
      "multiarch" : null,
      "category" : null,
      "architecture" : null
    },
    "checksum" : {
      "hash" : {
        "sha1" : "f835ba751bc2db7be30e7db82f09212fbe9657d4"
      }
    },
    "wazuh" : {
      "cluster" : {
        "name" : "wazuh"
      },
      "agent" : {
        "host" : {
          "hostname" : "ubuntu-QEMU-Virtual-Machine",
          "os" : {
            "name" : "Ubuntu",
            "type" : "linux",
            "version" : "24.04.4 LTS (Noble Numbat)",
            "platform" : "ubuntu"
          },
          "architecture" : "aarch64"
        },
        "name" : "Ubuntu",
        "groups" : [
          "default"
        ],
        "id" : "003",
        "version" : "v5.0.0"
      }
    },
    "state" : {
      "document_version" : 298,
      "modified_at" : "2026-10-29T08:02:08.403Z"
    }
  }
}

`wazuh-states-inventory-browser-extensions`

Browser extensions installed in each browser profile.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`browser.name`	`keyword`	`custom`		`true`	`chrome`	Name of the browser. Valid values: chrome, chromium, opera, yandex, brave, edge, edge_beta.
`browser.profile.name`	`keyword`	`custom`		`true`	`default`	Name of the browser profile.
`browser.profile.path`	`keyword`	`custom`		`true`	`/home/user/.config/google-chrome/Default`	Path to the browser profile.
`browser.profile.referenced`	`boolean`	`custom`		`true`	`True`	Indicates if the extension is referenced by the Preferences file of the browser profile.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`file.hash.sha256`	`keyword`	`extended`		`true`		SHA256 hash.
`package.autoupdate`	`boolean`	`custom`		`true`	`True`	Indicates if the browser extension is set to auto-update.
`package.build_version`	`keyword`	`extended`		`true`	`36f4f7e89dd61b0988b12ee000b98966867710cd`	Build version information
`package.description`	`keyword`	`extended`		`true`	`Open source programming language to build simple/reliable/efficient software.`	Description of the package.
`package.enabled`	`boolean`	`custom`		`true`	`True`	Indicates if the browser extension is enabled.
`package.from_webstore`	`boolean`	`custom`		`true`	`True`	Indicates if the browser extension was installed from a webstore.
`package.id`	`keyword`	`custom`		`true`	`com.example.extension`	Unique identifier for the browser extension.
`package.installed`	`date`	`extended`		`true`		Time when package was installed.
`package.name`	`keyword`	`extended`		`true`	`go`	Package name
`package.path`	`keyword`	`extended`		`true`	`/usr/local/Cellar/go/1.12.9/`	Path where the package is installed.
`package.permissions`	`keyword`	`custom`	`array`	`true`	`["tabs", "storage"]`	Permissions required by the browser extension.
`package.persistent`	`boolean`	`custom`		`true`	`True`	Indicates if the browser extension is persistent accross tabs.
`package.reference`	`keyword`	`extended`		`true`	`https://golang.org`	Package home page or reference URL
`package.type`	`keyword`	`extended`		`true`	`rpm`	Package type
`package.vendor`	`keyword`	`custom`		`true`	`Example Inc.`	Vendor, author or creator of the browser extension.
`package.version`	`keyword`	`extended`		`true`	`1.12.9`	Package version
`package.visible`	`boolean`	`custom`		`true`	`True`	Indicates if the browser extension is visible in the toolbar.
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

`wazuh-states-inventory-groups`

Operating system user groups.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`group.description`	`match_only_text`	`custom`		`true`		Description of the group.
`group.id`	`unsigned_long`	`custom`		`true`		Unsigned int64 group ID.
`group.id_signed`	`long`	`custom`		`true`		A signed int64 version of the group's ID.
`group.is_hidden`	`boolean`	`custom`		`true`		IsHidden attribute set in OpenDirectory.
`group.name`	`keyword`	`extended`		`true`		Name of the group.
`group.users`	`keyword`	`custom`	`array`	`true`		List of users that belong to the group.
`group.uuid`	`keyword`	`custom`		`true`		Unique group ID.
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

`wazuh-states-inventory-hardware`

CPU, memory, and serial number of the endpoint.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`host.cpu.cores`	`short`	`custom`		`true`	`8`	Number of CPU cores.
`host.cpu.name`	`keyword`	`custom`		`true`	`Intel(R) Core(TM) i7-9700K CPU @ 3.60GHz`	Name/model of the CPU.
`host.cpu.speed`	`long`	`custom`		`true`	`3600`	CPU clock speed in MHz.
`host.memory.free`	`long`	`custom`		`true`	`87191`	Free memory, in Bytes.
`host.memory.total`	`long`	`custom`		`true`	`52584`	Total memory, in Bytes.
`host.memory.usage`	`scaled_float`	`custom`		`true`	`0.75`	Percent memory used, between 0 and 1.
`host.memory.used`	`long`	`custom`		`true`	`123456`	Used memory, in Bytes.
`host.serial_number`	`keyword`	`custom`		`true`	`DJGAQS4CW5`	Serial Number of the device.
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

`wazuh-states-inventory-hotfixes`

Installed Windows updates (hotfixes).

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`package.hotfix`	`object`	`custom`		`true`		Hotfix related data.
`package.hotfix.name`	`keyword`	`custom`		`true`		Name of the Hotfix.
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

`wazuh-states-inventory-interfaces`

Network interfaces, with their state and traffic counters.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`host.mac`	`keyword`	`core`	`array`	`true`	`["00-00-5E-00-53-23", "00-00-5E-00-53-24"]`	Host MAC addresses.
`host.network.egress.bytes`	`long`	`extended`		`true`		The number of bytes sent on all network interfaces.
`host.network.egress.drops`	`long`	`custom`		`true`		Number of dropped transmitted packets.
`host.network.egress.errors`	`long`	`custom`		`true`		Number of transmission errors.
`host.network.egress.packets`	`long`	`extended`		`true`		The number of packets sent on all network interfaces.
`host.network.ingress.bytes`	`long`	`extended`		`true`		The number of bytes received on all network interfaces.
`host.network.ingress.drops`	`long`	`custom`		`true`		Number of dropped received packets.
`host.network.ingress.errors`	`long`	`custom`		`true`		Number of reception errors.
`host.network.ingress.packets`	`long`	`extended`		`true`		The number of packets received on all network interfaces.
`interface.alias`	`keyword`	`extended`		`true`	`outside`	Interface alias
`interface.mtu`	`long`	`custom`		`true`		Maximum transmission unit size.
`interface.name`	`keyword`	`extended`		`true`	`eth0`	Interface name
`interface.state`	`keyword`	`custom`		`true`		State of the network interface.
`interface.type`	`keyword`	`custom`		`true`		Interface type.
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

`wazuh-states-inventory-networks`

IP addresses, netmasks, and broadcast addresses of the network interfaces.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`interface.name`	`keyword`	`extended`		`true`	`eth0`	Interface name
`network.broadcast`	`ip`	`custom`		`true`		Broadcast address
`network.dhcp`	`boolean`	`custom`		`true`		DHCP enabled
`network.ip`	`ip`	`custom`		`true`		IP address
`network.metric`	`long`	`custom`		`true`		Metric of the network protocol
`network.netmask`	`ip`	`custom`		`true`		Network mask
`network.type`	`keyword`	`core`		`true`	`ipv4`	In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

`wazuh-states-inventory-packages`

Installed packages and applications.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`package.architecture`	`keyword`	`extended`		`true`	`x86_64`	Package architecture.
`package.category`	`keyword`	`custom`		`true`		Package category or group
`package.description`	`keyword`	`extended`		`true`	`Open source programming language to build simple/reliable/efficient software.`	Description of the package.
`package.installed`	`date`	`extended`		`true`		Time when package was installed.
`package.multiarch`	`keyword`	`custom`		`true`		Whether the package is built for a foreign architecture
`package.name`	`keyword`	`extended`		`true`	`go`	Package name
`package.path`	`keyword`	`extended`		`true`	`/usr/local/Cellar/go/1.12.9/`	Path where the package is installed.
`package.priority`	`keyword`	`custom`		`true`		Package priority
`package.size`	`long`	`extended`		`true`	`62231`	Package size in bytes.
`package.source`	`keyword`	`custom`		`true`		Package source
`package.type`	`keyword`	`extended`		`true`	`rpm`	Package type
`package.vendor`	`keyword`	`custom`		`true`		Vendor or maintainer of the package
`package.version`	`keyword`	`extended`		`true`	`1.12.9`	Package version
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

`wazuh-states-inventory-ports`

Open ports and the processes that use them.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`destination.ip`	`ip`	`core`		`true`		IP address of the destination.
`destination.port`	`long`	`core`		`true`		Port of the destination.
`file.inode`	`keyword`	`extended`		`true`	`256383`	Inode representing the file in the filesystem.
`host.network.egress.queue`	`long`	`custom`		`true`		Transmit queue length.
`host.network.ingress.queue`	`long`	`custom`		`true`		Receive queue length.
`interface.state`	`keyword`	`custom`		`true`		State of the network interface.
`network.transport`	`keyword`	`core`		`true`	`tcp`	Protocol Name corresponding to the field `iana_number`.
`process.name`	`keyword`	`extended`		`true`	`ssh`	Process name.
`process.pid`	`long`	`core`		`true`	`4242`	Process id.
`source.ip`	`ip`	`core`		`true`		IP address of the source.
`source.port`	`long`	`core`		`true`		Port of the source.
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

`wazuh-states-inventory-processes`

Running processes.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`process.args`	`keyword`	`extended`	`array`	`true`	`["/usr/bin/ssh", "-l", "user", "10.0.0.16"]`	Array of process arguments.
`process.args_count`	`long`	`extended`		`true`	`4`	Length of the process.args array.
`process.command_line`	`keyword`	`extended`		`true`	`/usr/bin/ssh -l user 10.0.0.16`	Full command line that started the process.
`process.name`	`keyword`	`extended`		`true`	`ssh`	Process name.
`process.parent.pid`	`long`	`core`		`true`	`4242`	Process id.
`process.pid`	`long`	`core`		`true`	`4242`	Process id.
`process.start`	`date`	`extended`		`true`	`2016-05-23T08:05:34.853Z`	The time the process started.
`process.state`	`keyword`	`custom`		`true`		Current process state
`process.stime`	`long`	`custom`		`true`		System mode CPU time used
`process.utime`	`long`	`custom`		`true`		User mode CPU time used
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

`wazuh-states-inventory-protocols`

Network protocol settings of the interfaces, such as DHCP and the gateway.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`interface.name`	`keyword`	`extended`		`true`	`eth0`	Interface name
`network.dhcp`	`boolean`	`custom`		`true`		DHCP enabled
`network.gateway`	`ip`	`custom`		`true`		Gateway address
`network.metric`	`long`	`custom`		`true`		Metric of the network protocol
`network.type`	`keyword`	`core`		`true`	`ipv4`	In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

`wazuh-states-inventory-services`

System services.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`error.log.file.path`	`keyword`	`extended`		`true`	`/var/log/fun-times.log`	Full path to the log file this event came from.
`file.path`	`keyword`	`extended`		`true`	`/home/alice/example.png`	Full path to the file, including the file name.
`log.file.path`	`keyword`	`extended`		`true`	`/var/log/fun-times.log`	Full path to the log file this event came from.
`process.args`	`keyword`	`extended`	`array`	`true`	`["/usr/bin/ssh", "-l", "user", "10.0.0.16"]`	Array of process arguments.
`process.executable`	`keyword`	`extended`		`true`	`/usr/bin/ssh`	Absolute path to the process executable.
`process.group.name`	`keyword`	`extended`		`true`		Name of the group.
`process.pid`	`long`	`core`		`true`	`4242`	Process id.
`process.root_directory`	`keyword`	`custom`		`true`		Chroot directory before execution.
`process.user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`process.working_directory`	`keyword`	`extended`		`true`	`/home/alice`	The working directory of the process.
`service.address`	`keyword`	`extended`		`true`	`172.26.0.2:5432`	Address of this service.
`service.description`	`keyword`	`custom`		`true`	`Apache HTTP Server`	Description of the service.
`service.enabled`	`keyword`	`custom`		`true`	`enabled`	Whether the unit file is enabled, e.g. `enabled`, `masked`, `disabled`, etc.
`service.exit_code`	`integer`	`custom`		`true`	`0`	Service-specific exit code on failure.
`service.following`	`keyword`	`custom`		`true`	`apache2.service`	The name of another unit that this unit follows in state.
`service.frequency`	`long`	`custom`		`true`	`3600`	Frequency in seconds at which the service is run.
`service.id`	`keyword`	`core`		`true`	`d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6`	Unique identifier of the running service.
`service.inetd_compatibility`	`boolean`	`custom`		`true`	`False`	Run job as if launched from inetd.
`service.name`	`keyword`	`core`		`true`	`elasticsearch-metrics`	Name of the service.
`service.object_path`	`keyword`	`custom`		`true`	`/org/freedesktop/systemd1/unit/apache2_2eservice`	D-Bus object path of the service.
`service.restart`	`keyword`	`custom`		`true`	`on-failure`	Restart policy for the service, e.g. `always`, `on-failure`, `never`.
`service.start_type`	`keyword`	`custom`		`true`	`AUTO_START`	Service start type: BOOT_START, SYSTEM_START, AUTO_START, DEMAND_START, DISABLED.
`service.starts.on_mount`	`boolean`	`custom`		`true`	`True`	Launches every time a filesystem is mounted.
`service.starts.on_not_empty_directory`	`keyword`	`custom`	`array`	`true`	`['/var/spool/mail', '/tmp/uploads']`	Launches when directories become non-empty.
`service.starts.on_path_modified`	`keyword`	`custom`	`array`	`true`	`['/var/log', '/etc/config']`	Launches on path modification.
`service.state`	`keyword`	`core`		`true`		Current state of the service.
`service.sub_state`	`keyword`	`custom`		`true`	`running`	The low-level unit activation state, values depend on unit type.
`service.target.address`	`keyword`	`extended`		`true`	`172.26.0.2:5432`	Address of this service.
`service.target.ephemeral_id`	`keyword`	`extended`		`true`	`8a4f500f`	Ephemeral identifier of this service.
`service.target.type`	`keyword`	`core`		`true`	`elasticsearch`	The type of the service.
`service.type`	`keyword`	`core`		`true`	`elasticsearch`	The type of the service.
`service.win32_exit_code`	`integer`	`custom`		`true`	`0`	Win32 exit code on start/stop.
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

`wazuh-states-inventory-system`

Operating system and host details.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`host.os.build`	`keyword`	`custom`		`true`		Build number of the OS
`host.os.codename`	`keyword`	`custom`		`true`		OS codename
`host.os.display_version`	`keyword`	`custom`		`true`	`22H2`	Windows feature update version, such as 22H2 or 1809.
`host.os.full`	`keyword`	`extended`		`true`	`Mac OS Mojave`	Operating system name, including the version or code name.
`host.os.kernel`	`keyword`	`extended`		`true`	`4.4.0-112-generic`	Operating system kernel version as a raw string.
`host.os.major`	`keyword`	`custom`		`true`		Major version number
`host.os.minor`	`keyword`	`custom`		`true`		Minor version number
`host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`host.os.patch`	`keyword`	`custom`		`true`		Patch level of the OS
`host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

`wazuh-states-inventory-users`

Operating system user accounts.

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`login.status`	`boolean`	`custom`		`true`		Whether the login was successful or the user is currently logged in.
`login.tty`	`keyword`	`custom`		`true`		Terminal associated with the login session (e.g., pts/1).
`login.type`	`keyword`	`custom`		`true`		Type of login session. Example values: "user", "system", "remote".
`process.pid`	`long`	`core`		`true`	`4242`	Process id.
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`user.auth_failures.count`	`integer`	`custom`		`true`		Number of failed authentication attempts.
`user.auth_failures.timestamp`	`date`	`custom`		`true`		Timestamp of the last authentication failure.
`user.created`	`date`	`custom`		`true`		Datetime when the user was created.
`user.full_name`	`keyword`	`extended`		`true`	`Albert Einstein`	User's full name, if available.
`user.group.id`	`unsigned_long`	`custom`		`true`		Group ID.
`user.group.id_signed`	`long`	`custom`		`true`		Signed group ID.
`user.groups`	`keyword`	`custom`	`array`	`true`		List of groups the user belongs to.
`user.home`	`keyword`	`custom`		`true`		Home directory of the user.
`user.id`	`keyword`	`core`		`true`	`S-1-5-21-202424912787-2692429404-2351956786-1000`	Unique identifier of the user.
`user.is_hidden`	`boolean`	`custom`		`true`		Whether the user is hidden.
`user.is_remote`	`boolean`	`custom`		`true`		Whether the user is remote.
`user.last_login`	`date`	`custom`		`true`		Date of the last login.
`user.name`	`keyword`	`core`		`true`	`a.einstein`	Short name or login of the user.
`user.password.expiration_date`	`date`	`custom`		`true`		Password expiration date (epoch).
`user.password.hash_algorithm`	`keyword`	`custom`		`true`		Algorithm used to hash the password.
`user.password.inactive_days`	`integer`	`custom`		`true`		Number of days of inactivity before disabling the password.
`user.password.last_change`	`integer`	`custom`		`true`		Days since epoch when password was last changed.
`user.password.last_set_time`	`date`	`custom`		`true`		Time the password was last set (epoch).
`user.password.max_days_between_changes`	`integer`	`custom`		`true`		Maximum days between password changes.
`user.password.min_days_between_changes`	`integer`	`custom`		`true`		Minimum days between password changes.
`user.password.status`	`keyword`	`custom`		`true`		Password status (e.g., active).
`user.password.warning_days_before_expiration`	`integer`	`custom`		`true`		Days before expiration to warn user.
`user.roles`	`keyword`	`custom`	`array, array`	`true`	`["kibana_admin", "reporting_user"]`	Roles assigned to the user.
`user.shell`	`keyword`	`custom`		`true`		Shell used by the user.
`user.type`	`keyword`	`custom`		`true`		Type of user (e.g., "system", "regular").
`user.uid_signed`	`long`	`custom`		`true`		Signed user ID.
`user.uuid`	`keyword`	`custom`		`true`		UUID of the user.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

Security Configuration Assessment

The wazuh-states-sca index stores the results of the Security Configuration Assessment (SCA) checks on each endpoint, with the policy each check belongs to.

The following example shows a document from the wazuh-states-sca index. It records the result of a CIS benchmark check on the Ubuntu endpoint:

{
  "_index" : "wazuh-states-sca",
  "_id" : "wazuh_003_4ac934f2a35158bf04255a96435edf246798aedf",
  "_score" : 1.0,
  "_source" : {
    "checksum" : {
      "hash" : {
        "sha1" : "fed019ea7dfb3d744a4ac23cef96c3f88dc6ff92"
      }
    },
    "wazuh" : {
      "cluster" : {
        "name" : "wazuh"
      },
      "agent" : {
        "host" : {
          "hostname" : "ubuntu-QEMU-Virtual-Machine",
          "os" : {
            "name" : "Ubuntu",
            "type" : "linux",
            "version" : "24.04.4 LTS (Noble Numbat)",
            "platform" : "ubuntu"
          },
          "architecture" : "aarch64"
        },
        "name" : "Ubuntu",
        "groups" : [
          "default"
        ],
        "id" : "003",
        "version" : "v5.0.0"
      }
    },
    "check" : {
      "result" : "Passed",
      "remediation" : "Run the following script to unload and disable the cramfs module: - IF - the cramfs kernel module is available in ANY installed kernel: - Create a file ending in .conf with install cramfs /bin/false in the /etc/modprobe.d/ directory - Create a file ending in .conf with blacklist cramfs in the /etc/modprobe.d/ directory - Run modprobe -r cramfs 2>/dev/null; rmmod cramfs 2>/dev/null to remove cramfs from the kernel - IF - the cramfs kernel module is not available on the system, or pre-compiled into the kernel, no remediation is necessary #!/usr/bin/env bash.",
      "condition" : "any",
      "compliance" : {
        "iso_27001" : [
          "A.5.37",
          "A.8.32",
          "A.8.25"
        ],
        "hipaa" : [
          "164.308.a.1",
          "164.308.a.8"
        ],
        "pci_dss" : [
          "1.2.5",
          "2.2.4",
          "6.4.1"
        ],
        "tsc" : [
          "CC6.3",
          "CC6.6",
          "CC8.1",
          "CC5.1",
          "CC5.2",
          "CC5.3"
        ],
        "nis2" : [
          "21.2.e",
          "21.2.a"
        ],
        "nist_800_171" : [
          "3.4.7",
          "3.4.8",
          "3.13.6"
        ],
        "fedramp" : [
          "CM-2",
          "CM-3",
          "CM-6",
          "CM-7"
        ],
        "nist_800_53" : [
          "CM-2",
          "CM-3",
          "CM-6",
          "CM-7"
        ],
        "cmmc" : [
          "CM.L2-3.4.7",
          "CM.L2-3.4.8",
          "SC.L2-3.13.6"
        ],
        "gdpr" : [
          "IV_32.1.a",
          "IV_32.1.b",
          "IV_32.1.c",
          "IV_32.1.d",
          "IV_32.2",
          "IV_32.3",
          "IV_32.4"
        ]
      },
      "name" : "Ensure mounting of cramfs filesystems is disabled.",
      "description" : "The cramfs filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A cramfs image can be used without having to first decompress the image.",
      "mitre" : {
        "technique" : {
          "name" : [
            "Masquerading",
            "Hide Artifacts"
          ],
          "id" : [
            "T1036",
            "T1564"
          ]
        },
        "tactic" : {
          "name" : [
            "Stealth"
          ],
          "id" : [
            "TA0005"
          ]
        }
      },
      "rules" : [
        "c:modprobe -n -v cramfs -> r:install /bin/false|install /bin/true|Module cramfs not found",
        "not c:lsmod -> r:cramfs",
        "d:/etc/modprobe.d/ -> r:.*\\.conf -> r:^blacklist\\s+cramfs"
      ],
      "id" : "35500",
      "rationale" : "Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it."
    },
    "state" : {
      "document_version" : 298,
      "modified_at" : "2026-10-29T08:02:08.403Z"
    },
    "policy" : {
      "file" : "cis_ubuntu24-04.yml",
      "references" : [
        "https://www.cisecurity.org/cis-benchmarks/"
      ],
      "name" : "CIS Ubuntu Linux 24.04 LTS Benchmark v1.0.0.",
      "description" : "This document provides prescriptive guidance for establishing a secure configuration posture for Ubuntu Linux 24.04 LTS based on CIS benchmark for Ubuntu Linux 24.04 LTS.",
      "id" : "cis_ubuntu24-04"
    }
  }
}

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`check.compliance.cmmc`	`keyword`	`custom`	`array`	`true`	`["AC.1.001", "AU.L2-3.3.1"]`	CMMC requirements.
`check.compliance.fedramp`	`keyword`	`custom`	`array`	`true`	`["AC-2", "SC-7"]`	FedRAMP requirements.
`check.compliance.gdpr`	`keyword`	`custom`	`array`	`true`	`["Art. 32", "Art. 25"]`	GDPR requirements.
`check.compliance.hipaa`	`keyword`	`custom`	`array`	`true`	`["164.312(a)(1)", "164.308(a)(5)(ii)(C)"]`	HIPAA requirements.
`check.compliance.iso_27001`	`keyword`	`custom`	`array`	`true`	`["A.9.4.1", "A.8.8"]`	ISO 27001 requirements.
`check.compliance.nis2`	`keyword`	`custom`	`array`	`true`	`["Art. 21", "Art. 23"]`	NIS2 requirements.
`check.compliance.nist_800_171`	`keyword`	`custom`	`array`	`true`	`["3.1.1", "3.3.1"]`	NIST 800-171 requirements.
`check.compliance.nist_800_53`	`keyword`	`custom`	`array`	`true`	`["AC-3", "AU-2"]`	NIST 800-53 requirements.
`check.compliance.pci_dss`	`keyword`	`custom`	`array`	`true`	`["2.2.1", "6.3.3"]`	PCI DSS requirements.
`check.compliance.tsc`	`keyword`	`custom`	`array`	`true`	`["CC6.1", "CC7.1"]`	TSC requirements.
`check.condition`	`keyword`	`custom`		`true`	`all`	Relationship between the rules.
`check.description`	`keyword`	`custom`		`true`	`"The password history setting determines the number of unique new passwords a user must use before an old password can be reused."`	Extended description of the check.
`check.id`	`keyword`	`custom`		`true`	`26000`	The ID of the SCA policy check.
`check.mitre.subtechnique`	`object`	`custom`		`true`		MITRE ATT&CK subtechniques.
`check.mitre.subtechnique.id`	`keyword`	`custom`	`array`	`true`	`["T1059.001", "T1078.001"]`	MITRE ATT&CK subtechnique identifiers.
`check.mitre.subtechnique.name`	`keyword`	`custom`	`array`	`true`	`["Command and Scripting Interpreter: PowerShell", "Valid Accounts: Default Accounts"]`	MITRE ATT&CK subtechnique names.
`check.mitre.tactic`	`object`	`custom`		`true`		MITRE ATT&CK tactics.
`check.mitre.tactic.id`	`keyword`	`custom`	`array`	`true`	`["TA0002", "TA0005"]`	MITRE ATT&CK tactic identifiers.
`check.mitre.tactic.name`	`keyword`	`custom`	`array`	`true`	`["Execution", "Defense Evasion"]`	MITRE ATT&CK tactic names.
`check.mitre.technique`	`object`	`custom`		`true`		MITRE ATT&CK techniques.
`check.mitre.technique.id`	`keyword`	`custom`	`array`	`true`	`["T1059", "T1562"]`	MITRE ATT&CK technique identifiers.
`check.mitre.technique.name`	`keyword`	`custom`	`array`	`true`	`["Command and Scripting Interpreter", "Impair Defenses"]`	MITRE ATT&CK technique names.
`check.name`	`keyword`	`custom`		`true`	`Ensure 'Enforce password history' is set to '24 or more password(s)'.`	The name of the SCA policy check.
`check.rationale`	`keyword`	`custom`		`true`	`"The longer a user uses the same password, the more likely it is that the password will be compromised."`	The reason for the check. Why it is important.
`check.reason`	`keyword`	`custom`		`true`	`"The password history setting is not set to 24 or more password(s)."`	Reason for the check result.
`check.references`	`keyword`	`custom`	`array`	`true`	`["https://workbench.cisecurity.org"]`	References for the check.
`check.remediation`	`keyword`	`custom`		`true`	`"To establish the recommended configuration, set the following registry value to 24 or more password(s):"`	Actions to take to remediate the check.
`check.result`	`keyword`	`custom`		`true`	`failed`	Result of the check.
`check.rules`	`keyword`	`custom`	`array`	`true`	`"[\"c:net.exe accounts -> n:Maximum password age $days$:\s+(\d+) compare > 0\"," > "\"c:net.exe accounts -> n:Length of password history maintained:\s+(\d+) compare >= 24\"]"`	Rules to be evaluated.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`policy.description`	`keyword`	`custom`		`true`	`"The CIS Microsoft Windows 11 Enterprise Benchmark v1.0.0 is a comprehensive security configuration guide that provides prescriptive guidance for establishing a secure baseline configuration for Microsoft Windows 11 Enterprise."`	Extended description of the policy.
`policy.file`	`keyword`	`custom`		`true`	`cis_win11_enterprise.yml`	The file name of the SCA policy.
`policy.id`	`keyword`	`custom`		`true`	`cis_win11_enterprise_21H2`	The ID of the SCA policy.
`policy.name`	`keyword`	`custom`		`true`	`CIS Microsoft Windows 11 Enterprise Benchmark v1.0.0`	The name of the SCA policy.
`policy.references`	`keyword`	`custom`	`array`	`true`	`["https://www.cisecurity.org/cis-benchmarks/"]`	References for the policy.
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.

Vulnerabilities

The wazuh-states-vulnerabilities index stores the vulnerabilities that Wazuh detects in the packages of each endpoint, with the affected package, the CVE details, and the severity.

The following example shows a document from the wazuh-states-vulnerabilities index. It records a vulnerability in the python3-pip package of the Ubuntu endpoint:

{
  "_index" : "wazuh-states-vulnerabilities",
  "_id" : "003_5b3f27522bf23ee77f1c543392105c99ccc3cde7_CVE-2025-66471",
  "_score" : 1.0,
  "_source" : {
    "package" : {
      "path" : null,
      "size" : 7026688,
      "name" : "python3-pip",
      "description" : "Python package installer",
      "type" : "deb",
      "version" : "24.0+dfsg-1ubuntu1.3",
      "architecture" : "all"
    },
    "host" : {
      "os" : {
        "kernel" : "7.0.0-38-generic",
        "name" : "Ubuntu",
        "type" : "linux",
        "version" : "24.04.4",
        "platform" : "ubuntu",
        "full" : "Ubuntu 24.04.4 LTS (Noble Numbat)"
      }
    },
    "wazuh" : {
      "schema" : {
        "version" : "1.0.0"
      },
      "cluster" : {
        "name" : "wazuh"
      },
      "agent" : {
        "host" : {
          "hostname" : "ubuntu-QEMU-Virtual-Machine",
          "os" : {
            "name" : "Ubuntu",
            "type" : "linux",
            "version" : "24.04.4 LTS (Noble Numbat)",
            "platform" : "ubuntu"
          },
          "architecture" : "aarch64"
        },
        "name" : "Ubuntu",
        "groups" : [
          "default"
        ],
        "id" : "003",
        "version" : "v5.0.0"
      }
    },
    "state" : {
      "document_version" : 298,
      "modified_at" : "2026-10-29T08:02:08.403Z"
    },
    "vulnerability" : {
      "severity" : "High",
      "detected_at" : "2026-10-29T08:01:38.721Z",
      "score" : {
        "version" : "4.0",
        "base" : 8.9
      },
      "scanner" : {
        "reference" : "https://cti.wazuh.com/vulnerabilities/cves/CVE-2025-66471",
        "condition" : "Fixed in 24.0+dfsg-1ubuntu1.3+esm3",
        "vendor" : "Wazuh",
        "source" : "Canonical Security Tracker"
      },
      "id" : "CVE-2025-66471",
      "category" : "Packages",
      "published_at" : "2025-12-05T17:16:04Z",
      "under_evaluation" : false
    }
  }
}

Field	Type	Level	Normalization	Indexed	Example	Description
`message`	`keyword`	`core`		`true`	`Hello World`	Log message optimized for viewing in a log viewer.
`checksum.hash.sha1`	`keyword`	`custom`		`true`		SHA1 hash used as checksum of the data collected by the agent.
`host.os.full`	`keyword`	`extended`		`true`	`Mac OS Mojave`	Operating system name, including the version or code name.
`host.os.kernel`	`keyword`	`extended`		`true`	`4.4.0-112-generic`	Operating system kernel version as a raw string.
`host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`package.architecture`	`keyword`	`extended`		`true`	`x86_64`	Package architecture.
`package.build_version`	`keyword`	`extended`		`true`	`36f4f7e89dd61b0988b12ee000b98966867710cd`	Build version information
`package.checksum`	`keyword`	`extended`		`true`	`68b329da9893e34099c7d8ad5cb9c940`	Checksum of the installed package for verification.
`package.description`	`keyword`	`extended`		`true`	`Open source programming language to build simple/reliable/efficient software.`	Description of the package.
`package.install_scope`	`keyword`	`extended`		`true`	`global`	Indicating how the package was installed, e.g. user-local, global.
`package.installed`	`date`	`extended`		`true`		Time when package was installed.
`package.license`	`keyword`	`extended`		`true`	`Apache License 2.0`	Package license
`package.name`	`keyword`	`extended`		`true`	`go`	Package name
`package.path`	`keyword`	`extended`		`true`	`/usr/local/Cellar/go/1.12.9/`	Path where the package is installed.
`package.reference`	`keyword`	`extended`		`true`	`https://golang.org`	Package home page or reference URL
`package.size`	`long`	`extended`		`true`	`62231`	Package size in bytes.
`package.type`	`keyword`	`extended`		`true`	`rpm`	Package type
`package.version`	`keyword`	`extended`		`true`	`1.12.9`	Package version
`state.document_version`	`integer`	`custom`		`true`		Version of the document.
`state.modified_at`	`date`	`custom`		`true`		Date/time when the state was last modified.
`vulnerability.category`	`keyword`	`extended`	`array`	`true`	`["Firewall"]`	Category of a vulnerability.
`vulnerability.classification`	`keyword`	`extended`		`true`	`CVSS`	Classification of the vulnerability.
`vulnerability.description`	`keyword`	`extended`		`true`	`In macOS before 2.12.6, there is a vulnerability in the RPC...`	Description of the vulnerability.
`vulnerability.detected_at`	`date`	`custom`		`true`		Vulnerability's detection date.
`vulnerability.enumeration`	`keyword`	`extended`		`true`	`CVE`	Identifier of the vulnerability.
`vulnerability.id`	`keyword`	`extended`		`true`	`CVE-2019-00001`	ID of the vulnerability.
`vulnerability.published_at`	`date`	`custom`		`true`		Vulnerability's publication date.
`vulnerability.report_id`	`keyword`	`extended`		`true`	`20191018.0001`	Scan identification number.
`vulnerability.scanner.condition`	`keyword`	`custom`		`true`		The condition matched by the package that led the scanner to consider it vulnerable.
`vulnerability.scanner.reference`	`keyword`	`custom`		`true`		Scanner's resource that provides additional information, context, and mitigations for the identified vulnerability.
`vulnerability.scanner.source`	`keyword`	`custom`		`true`		The origin of the decision of the scanner (AKA feed used to detect the vulnerability).
`vulnerability.scanner.vendor`	`keyword`	`extended`		`true`	`Tenable`	Name of the scanner vendor.
`vulnerability.score.base`	`float`	`extended`		`true`	`5.5`	Vulnerability Base score.
`vulnerability.score.environmental`	`float`	`extended`		`true`	`5.5`	Vulnerability Environmental score.
`vulnerability.score.temporal`	`float`	`extended`		`true`		Vulnerability Temporal score.
`vulnerability.score.version`	`keyword`	`extended`		`true`	`2.0`	CVSS version.
`vulnerability.severity`	`keyword`	`extended`		`true`	`Critical`	Severity of the vulnerability.
`vulnerability.under_evaluation`	`boolean`	`custom`		`true`		Indicates if the vulnerability is awaiting analysis by the NVD.
`wazuh.agent.build.original`	`keyword`	`core`		`true`	`metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]`	Extended build information for the agent.
`wazuh.agent.ephemeral_id`	`keyword`	`extended`		`true`	`8a4f500f`	Ephemeral identifier of this agent.
`wazuh.agent.groups`	`keyword`	`custom`	`array`	`true`	`["group1", "group2"]`	List of groups the agent belongs to.
`wazuh.agent.host.architecture`	`keyword`	`core`		`true`	`x86_64`	Operating system architecture.
`wazuh.agent.host.boot.id`	`keyword`	`extended`		`true`	`88a1f0ed-5ae5-41ee-af6b-41921c311872`	Linux boot uuid taken from /proc/sys/kernel/random/boot_id
`wazuh.agent.host.cpu.usage`	`scaled_float`	`extended`		`true`		Percent CPU used, between 0 and 1.
`wazuh.agent.host.disk.read.bytes`	`long`	`extended`		`true`		The number of bytes read by all disks.
`wazuh.agent.host.disk.write.bytes`	`long`	`extended`		`true`		The number of bytes written on all disks.
`wazuh.agent.host.domain`	`keyword`	`extended`		`true`	`CONTOSO`	Name of the directory the group is a member of.
`wazuh.agent.host.geo.city_name`	`keyword`	`core`		`true`	`Montreal`	City name.
`wazuh.agent.host.geo.continent_code`	`keyword`	`core`		`true`	`NA`	Continent code.
`wazuh.agent.host.geo.continent_name`	`keyword`	`core`		`true`	`North America`	Name of the continent.
`wazuh.agent.host.geo.country_iso_code`	`keyword`	`core`		`true`	`CA`	Country ISO code.
`wazuh.agent.host.geo.country_name`	`keyword`	`core`		`true`	`Canada`	Country name.
`wazuh.agent.host.geo.location`	`geo_point`	`core`		`true`	`{ "lon": -73.614830, "lat": 45.505918 }`	Longitude and latitude.
`wazuh.agent.host.geo.name`	`keyword`	`extended`		`true`	`boston-dc`	User-defined description of a location.
`wazuh.agent.host.geo.postal_code`	`keyword`	`core`		`true`	`94040`	Postal code.
`wazuh.agent.host.geo.region_iso_code`	`keyword`	`core`		`true`	`CA-QC`	Region ISO code.
`wazuh.agent.host.geo.region_name`	`keyword`	`core`		`true`	`Quebec`	Region name.
`wazuh.agent.host.geo.timezone`	`keyword`	`core`		`true`	`America/Argentina/Buenos_Aires`	Time zone.
`wazuh.agent.host.hostname`	`keyword`	`core`		`true`		Hostname of the host.
`wazuh.agent.host.id`	`keyword`	`core`		`true`		Unique host id.
`wazuh.agent.host.ip`	`ip`	`core`	`array`	`true`		Host ip addresses.
`wazuh.agent.host.mac`	`keyword`	`core`	`array`	`true`	`["00-00-5E-00-53-23", "00-00-5E-00-53-24"]`	Host MAC addresses.
`wazuh.agent.host.name`	`keyword`	`core`		`true`		Name of the host.
`wazuh.agent.host.network.egress.bytes`	`long`	`extended`		`true`		The number of bytes sent on all network interfaces.
`wazuh.agent.host.network.egress.packets`	`long`	`extended`		`true`		The number of packets sent on all network interfaces.
`wazuh.agent.host.network.ingress.bytes`	`long`	`extended`		`true`		The number of bytes received on all network interfaces.
`wazuh.agent.host.network.ingress.packets`	`long`	`extended`		`true`		The number of packets received on all network interfaces.
`wazuh.agent.host.os.family`	`keyword`	`extended`		`true`	`debian`	OS family (such as redhat, debian, freebsd, windows).
`wazuh.agent.host.os.full`	`keyword`	`extended`		`true`	`Mac OS Mojave`	Operating system name, including the version or code name.
`wazuh.agent.host.os.kernel`	`keyword`	`extended`		`true`	`4.4.0-112-generic`	Operating system kernel version as a raw string.
`wazuh.agent.host.os.name`	`keyword`	`extended`		`true`	`Mac OS X`	Operating system name, without the version.
`wazuh.agent.host.os.platform`	`keyword`	`extended`		`true`	`darwin`	Operating system platform (such centos, ubuntu, windows).
`wazuh.agent.host.os.type`	`keyword`	`extended`		`true`	`macos`	Which commercial OS family (one of: linux, macos, unix, windows, ios or android).
`wazuh.agent.host.os.version`	`keyword`	`extended`		`true`	`10.14.1`	Operating system version as a raw string.
`wazuh.agent.host.pid_ns_ino`	`keyword`	`extended`		`true`	`256383`	Pid namespace inode
`wazuh.agent.host.type`	`keyword`	`core`		`true`		Type of host.
`wazuh.agent.host.uptime`	`long`	`extended`		`true`	`1325`	Seconds the host has been up.
`wazuh.agent.id`	`keyword`	`core`		`true`	`8a4f500d`	Unique identifier of this agent.
`wazuh.agent.name`	`keyword`	`core`		`true`	`foo`	Custom name of the agent.
`wazuh.agent.type`	`keyword`	`core`		`true`	`filebeat`	Type of the agent.
`wazuh.agent.version`	`keyword`	`core`		`true`	`6.0.0-rc2`	Version of the agent.
`wazuh.cluster.name`	`keyword`	`custom`		`true`		Wazuh cluster name.
`wazuh.cluster.node`	`keyword`	`custom`		`true`		Wazuh cluster node name.
`wazuh.schema.version`	`keyword`	`custom`		`true`		Wazuh schema version.