Available inventory fields

The Wazuh server stores the data collected by the Wazuh agents in separate databases for each agent. Each database contains tables with distinct inventory information types, such as hardware, software, and network data. This inventory information is then forwarded to the Wazuh indexer, where it is consolidated for querying, visualization, and deeper analysis. The following section details the structure of the tables within the Wazuh server database and the corresponding indices in the Wazuh indexer. The data in these tables depends directly on the scan configuration defined for the Syscollector module.

Hardware

This scan collects baseline hardware information from monitored endpoints, including CPU, memory, and serial number. The data is stored in the sys_hwinfo table on the Wazuh server and is indexed in the Wazuh indexer under the wazuh-states-inventory-hardware-* indices.

The table below maps the fields from the sys_hwinfo table on the Wazuh server to their corresponding fields in the wazuh-states-inventory-hardware-* index on the Wazuh indexer.

Syscollector field

Wazuh indexer field

Type

Description

Example

Available

scan_id

N/A

N/A

Identifier for the last syscollector scan

573872577

All

scan_time

N/A

N/A

Scan date

2018/07/31 15:31:26

All

architecture

agent.host.architecture

keyword

Operating system architecture

x86_64

All

agent_ip

agent.host.ip

ip

IP address of the agent

192.168.33.1

All

agent_name

agent.name

keyword

Name of the agent

wazuh

All

agent_version

agent.version

keyword

Agent version

v4.14.0

All

agent_id

agent.id

keyword

Unique ID of the agent

001

All

board_serial

host.serial_number

keyword

Motherboard serial number

XDR840TUGM65E03171

All

cpu_name

host.cpu.name

keyword

CPU name

Intel(R) Core(TM) i7-7700HQ CPU @ 2.80GHz

All

cpu_cores

host.cpu.cores

short

Number of cores of the CPU

4

All

cpu_mhz

host.cpu.speed

long

Current processor frequency

2,420

All

ram_total

host.memory.total

long

Total RAM

3.9GB

All

ram_free

host.memory.free

long

Free RAM

2.5GB

All

N/A

host.memory.used

long

Used memory, in Bytes

1.4GB

All

ram_usage

host.memory.usage

scaled_float

Percentage of RAM in use

87

All

checksum

N/A

N/A

Integrity synchronization value

503709147600c8e0023cf2b9995772280eee30

All

cluster_name

wazuh.cluster.name

keyword

Wazuh cluster name

wazuh

All

cluster_node

wazuh.cluster.node

keyword

Wazuh cluster node

node01

All

schema_version

wazuh.schema.version

keyword

Wazuh schema version

1.0

All

Operating system

This scan collects system-level details about each monitored endpoint, including the operating system, version, hostname, and architecture. This data is stored in the sys_osinfo table on the Wazuh server and is indexed in the Wazuh indexer under the wazuh-states-inventory-system-* indices.

The table below maps the fields from the sys_osinfo table on the Wazuh server to their corresponding fields in the wazuh-states-inventory-system-* index on the Wazuh indexer.

Syscollector field

Wazuh indexer field

Type

Description

Example

Available

scan_id

N/A

N/A

Identifier for the last syscollector scan

468455719

All

scan_time

N/A

N/A

Scan date

2018/07/31 15:31:26

All

architecture

agent.host.architecture

keyword

Operating system architecture.

x86_64

All

agent_ip

agent.host.ip

ip

IP address of the agent

192.168.33.1

All

agent_name

agent.name

keyword

Name of the agent

wazuh

All

agent_version

agent.version

keyword

Agent version

v4.14.0

All

agent_id

agent.id

keyword

Unique ID of the agent

001

All

hostname

host.hostname

keyword

Hostname of the machine

ag-ubuntu-16

All

architecture

host.architecture

keyword

OS architecture

x86_64

All

os_name

host.os.name

keyword

OS name

Ubuntu

All

os_version

host.os.version

keyword

OS version

16.04.5 LTS (Xenial Xerus)

All

os_codename

host.os.codename

keyword

OS version codename

Xenial Xerus

All

os_major

host.os.major

keyword

Major release version

16

All

os_minor

host.os.minor

keyword

Minor release version

04

All

os_patch

host.os.patch

keyword

Patch release version

5

macOS

os_build

host.os.build

keyword

Optional build-specific

14393

Windows

os_release

host.os.distribution.release

keyword

Windows Release ID

SP2

Windows

os_display_version

host.os.full

keyword

Windows display version

20H2

Windows

os_platform

host.os.platform

keyword

OS platform

ubuntu

All

sysname

host.os.kernel.name

keyword

System name

Linux

Linux

release

host.os.kernel.release

keyword

Release name

4.15.0-29-generic

Linux

version

host.os.kernel.version

keyword

Release version

#31~16.04.1-Ubuntu SMP Wed Jul 18 08:54:04 UTC 2018

All

checksum

N/A

keyword

Integrity synchronization value

503709147600c8e0023cf2b9995772280eee30

All

N/A

host.os.type

keyword

Which commercial OS family (one of: linux, macos, unix, windows, ios or android)

All

reference

N/A

keyword

Unified primary key

94b6f7b3c1d905aae22a652448df6372da98e5b8

All

cluster_name

wazuh.cluster.name

keyword

Wazuh cluster name

wazuh

All

cluster_node

wazuh.cluster.node

keyword

Wazuh cluster node

node01

All

schema_version

wazuh.schema.version

keyword

Wazuh schema version

1.0

All

Packages

This scan collects details about the currently installed software on a monitored endpoint, including the package name, installation date, and version. The Vulnerability Detector module uses information from this table to scan and detect vulnerable software. On Linux systems, retrieved packages can be deb, pacman, or rpm. This data is stored in the sys_programs table on the Wazuh server and is indexed in the Wazuh indexer under the wazuh-states-inventory-packages-* indices.

The table below maps the fields from the sys_programs table on the Wazuh server database to their corresponding fields in the wazuh-states-inventory-packages-* index on the Wazuh indexer.

Syscollector field

Wazuh indexer field

Type

Description

Example

Available

scan_id

N/A

N/A

Identifier for the last syscollector scan

1454946158

All

scan_time

N/A

N/A

Scan date

2018/07/27 07:27:14

All

architecture

agent.host.architecture

keyword

Operating system architecture

x86_64

All

agent_ip

agent.host.ip

ip

IP address of the agent

192.168.33.1

All

agent_name

agent.name

keyword

Name of the agent

wazuh

All

agent_version

agent.version

keyword

Agent version

v4.14.0

All

agent_id

agent.id

keyword

Unique ID of the agent

001

All

format

package.type

keyword

Format of the package

deb

All

name

package.name

keyword

Name of the package

linux-headers-generic

All

priority

package.priority

keyword

Priority of the package

optional

Linux (deb)

section

N/A

N/A

Section of the package

kernel

Linux (deb/rpm) and macOS (pkg)

size

package.size

long

Size of the installed package in bytes

14

Linux (deb/rpm/pacman)

vendor

package.vendor

keyword

Vendor name

Ubuntu Kernel Team

All

install_time

package.installed

date

Install date and time of the package

2018/02/08 18:45:48

Linux (rpm/pacman)

version

package.version

keyword

Version of the package

4.4.0.130.136

All

architecture

package.architecture

keyword

Architecture of the package

amd64

All

multiarch

package.multiarch

keyword

Multiarchitecture support

same

Linux (deb)

source

package.source

keyword

Source of the package

linux-meta

Linux (deb/rpm) and macOS (pkg)

description

package.description

keyword

Description of the package

Generic Linux kernel headers

Linux (deb/rpm/pacman) and macOS (pkg)

location

package.path

keyword

Location of the package

C:\Program Files\VMware\VMware Tools\

Windows and macOS (pkg)

checksum

N/A

N/A

Integrity synchronization value

78503709147600c8e0023cf2b9995772280eee30

All

item_id

N/A

N/A

Unified primary key

4323709147600c8e0023cf2b9995772280eef451

All

cluster_name

wazuh.cluster.name

keyword

Wazuh cluster name

wazuh

All

cluster_node

wazuh.cluster.node

keyword

Wazuh cluster node

node01

All

schema_version

wazuh.schema.version

keyword

Wazuh schema version

1.0

All

Networks

The network scan retrieves information about the network configuration of a monitored endpoint. It includes details about the existing network interfaces (up and down interfaces), IP addresses, and the routing configuration. The information is organized into three categories of network scans, ensuring the data is structured and easy to interpret.

Network interfaces

This scan collects details about the network interfaces on monitored endpoints. This information is stored in the sys_netiface table on the Wazuh server and indexed in the Wazuh indexer under the wazuh-states-inventory-interfaces-* indices.

The table below maps the fields from the sys_netiface table on the Wazuh server database to their corresponding fields in the wazuh-states-inventory-interfaces-* index on the Wazuh indexer.

Syscollector Field

Wazuh indexer field

Type

Description

Example

Available

scan_id

N/A

N/A

Identifier for the last syscollector scan

160615720

All

scan_time

N/A

N/A

Scan date

2018/07/31 16:46:20

All

architecture

agent.host.architecture

keyword

Operating system architecture.

x86_64

All

agent_ip

agent.host.ip

ip

IP address of the agent

192.168.33.1

All

agent_name

agent.name

keyword

Name of the agent

wazuh

All

agent_version

agent.version

keyword

Agent version

v4.14.0

All

agent_id

agent.id

keyword

Unique ID of the agent

001

All

name

interface.name

keyword

Interface name

eth0

All

adapter

interface.alias

keyword

Physical adapter name

Intel(R) PRO/1000 MT Desktop Adapter

Windows

type

interface.type

keyword

Network interface adapter

ethernet

All

state

interface.state

keyword

State of the interface

up

All

mtu

interface.mtu

long

Maximum Transmission Unit

1500

All

mac

host.mac

keyword

MAC Address

08:00:27:C0:14:A5

All

tx_packets

host.network.egress.packets

long

Transmitted packets

10034626

All

rx_packets

host.network.ingress.packets

long

Received packets

12754

All

tx_bytes

host.network.egress.bytes

long

Transmitted bytes

10034626

All

rx_bytes

host.network.ingress.bytes

long

Received bytes

1111175

All

tx_errors

host.network.egress.errors

long

Transmission errors

0

All

rx_errors

host.network.ingress.errors

long

Reception errors

0

All

tx_dropped

host.network.egress.drops

long

Dropped transmission packets

0

All

rx_dropped

host.network.ingress.drops

long

Dropped reception packets

0

All

checksum

N/A

N/A

Integrity synchronization value

8503709147600c8e0023cf2b9995772280eee30

All

item_id

N/A

N/A

Unified primary key

4323709147600c8e0023cf2b9995772280eef41

All

cluster_name

wazuh.cluster.name

keyword

Wazuh cluster name

wazuh

All

cluster_node

wazuh.cluster.node

keyword

Wazuh cluster node

node01

All

schema_version

wazuh.schema.version

keyword

Wazuh schema version

1.0

All

Network addresses

Network address scan collects information about the IPv4 and IPv6 addresses assigned to network interfaces on monitored endpoints. This information is stored in the sys_netaddr table on the Wazuh server and indexed in the Wazuh indexer under the wazuh-states-inventory-networks-* indices.

The table below maps the fields from the sys_netaddr table on the Wazuh server database to their corresponding fields in the wazuh-states-inventory-networks-* index on the Wazuh indexer.

Syscollector field

Wazuh indexer field

Type

Description

Example

Available

id

N/A

N/A

Referenced ID from sys_netiface

1

All

scan_id

N/A

N/A

Identifier for the last syscollector scan

160615720

All

architecture

agent.host.architecture

keyword

Operating system architecture

x86_64

All

agent_ip

agent.host.ip

ip

IP address of the agent

192.168.33.1

All

agent_name

agent.name

keyword

Name of the agent

wazuh

All

agent_version

agent.version

keyword

Agent version

v4.14.0

All

agent_id

agent.id

keyword

Unique ID of the agent

001

All

iface

interface.name

keyword

Network interface name

eth0

All

metric

network.metric

long

Interface metric for routing decisions

All

proto

network.type

keyword

Protocol name

ipv4

All

address

network.ip

ip

IPv4/IPv6 address

192.168.1.87

All

netmask

network.netmask

ip

Netmask address

255.255.255.0

All

dhcp

network.dhcp

boolean

Indicates whether DHCP is enabled (yes/no).

All

broadcast

network.broadcast

ip

Broadcast address

192.168.1.255

All

checksum

N/A

N/A

Integrity synchronization value

78503709147600c8e0023cf2b9995772280eee30

All

item_id

N/A

N/A

Unified primary key

4323709147600c8e0023cf2b9995772280eef4

All

cluster_name

wazuh.cluster.name

keyword

Wazuh cluster name

wazuh

All

cluster_node

wazuh.cluster.node

keyword

Wazuh cluster node

node01

All

schema_version

wazuh.schema.version

keyword

Wazuh schema version

1.0

All

Network protocols

This scan stores details about network routing and supported protocols for each interface on monitored endpoints, including protocol types, routing tables, and interface associations. This information is stored in the sys_netproto table on the Wazuh server and indexed in the Wazuh indexer under the wazuh-states-inventory-protocols-* indices.

The table below maps the fields from the sys_netproto table on the Wazuh server database to their corresponding fields in the wazuh-states-inventory-protocols-* index on the Wazuh indexer.

Syscollector Field

Wazuh indexer field

Type

Description

Example

Available

id

N/A

N/A

Referenced ID from sys_netiface

1

All

scan_id

N/A

N/A

Identifier for the last syscollector scan

160615720

All

architecture

agent.host.architecture

keyword

Operating system architecture.

x86_64

All

agent_ip

agent.host.ip

ip

IP address of the agent

192.168.33.1

All

agent_name

agent.name

keyword

Name of the agent

wazuh

All

agent_version

agent.version

keyword

Agent version

v4.14.0

All

agent_id

agent.id

keyword

Unique ID of the agent

001

All

type

network.type

keyword

Protocol of the interface data

ipv4

All

gateway

network.gateway

ip

Default gateway

192.168.1.1

Linux/Windows/macOS

iface

interface.name

keyword

Interface name

eth0

All

dhcp

network.dhcp

boolean

DHCP status

enabled

Linux/Windows

metric

network.metric

long

Routing metric value

All

checksum

N/A

N/A

Integrity synchronization value

78503709147600c8e0023cf2b9995772280eee30

All

item_id

N/A

N/A

Unified primary key

4323709147600c8e0023cf2b9995772280eef4

All

cluster_name

wazuh.cluster.name

keyword

Wazuh cluster name

wazuh

All

cluster_node

wazuh.cluster.node

keyword

Wazuh cluster node

node01

All

schema_version

wazuh.schema.version

keyword

Wazuh schema version

1.0

All

Ports

This scan retrieves information about the open ports on a monitored endpoint, including the port number, port protocol, associated services, and listening states. This information is stored in the sys_ports table on the Wazuh server and indexed in the Wazuh indexer under the wazuh-states-inventory-ports-* indices.

The table below maps the fields from the sys_ports table on the Wazuh server database to their corresponding fields in the wazuh-states-inventory-ports-* index on the Wazuh indexer.

Syscollector Field

Wazuh indexer field

Type

Description

Example

Available

scan_id

N/A

N/A

Identifier for the last syscollector scan

1618114744

All

scan_time

N/A

N/A

Scan date

2018/07/27 07:27:15

All

architecture

agent.host.architecture

keyword

Operating system architecture.

x86_64

All

agent_ip

agent.host.ip

ip

IP address of the agent

192.168.33.1

All

agent_name

agent.name

keyword

Name of the agent

wazuh

All

agent_version

agent.version

keyword

Agent version

v4.14.0

All

agent_id

agent.id

keyword

Unique ID of the agent

001

All

protocol

network.transport

keyword

Protocol of the port

tcp

All

local_ip

destination.ip

ip

Local IP address

0.0.0.0

All

local_port

destination.port

long

Local port

22

All

remote_ip

source.ip

ip

Remote IP address

0.0.0.0

All

remote_port

source.port

long

Remote port

0

All

tx_queue

host.network.egress.queue

long

Packets pending to be transmitted

0

Linux

rx_queue

host.network.ingress.queue

long

Packets at the receiver queue

0

Linux

inode

file.inode

keyword

Inode of the port

16974

Linux

state

interface.state

keyword

State of the port

listening

All

PID

process.pid

long

PID owner of the opened port

4

Windows/macOS

process

process.name

keyword

Name of the process using the port

System

Windows/macOS

checksum

N/A

N/A

Integrity synchronization value

78503709147600c8e0023cf2b9995772280eee30

All

item_id

N/A

N/A

Unified primary key

4323709147600c8e0023cf2b9995772280eef412

All

cluster_name

wazuh.cluster.name

keyword

Wazuh cluster name

wazuh

All

cluster_node

wazuh.cluster.node

keyword

Wazuh cluster node

node01

All

schema_version

wazuh.schema.version

keyword

Wazuh schema version

1.0

All

Processes

The processes scan collects details about processes running on monitored endpoints, including the process name, process ID (PID), and the associated user. This information is stored in the sys_processes table on the Wazuh server and indexed in the Wazuh indexer under the wazuh-states-inventory-processes-* indices.

The table below maps the fields from the sys_processes table on the Wazuh server database to their corresponding fields in the wazuh-states-inventory-processes-* index on the Wazuh indexer.

Syscollector Field

Wazuh indexer field

Type

Description

Example

Available

scan_id

N/A

N/A

Identifier for the last syscollector scan

215303769

All

scan_time

N/A

N/A

Scan date

2018/08/03 12:57:58

All

architecture

agent.host.architecture

keyword

Operating system architecture.

x86_64

All

agent_ip

agent.host.ip

ip

IP address of the agent

192.168.33.1

All

agent_name

agent.name

keyword

Name of the agent

wazuh

All

agent_version

agent.version

keyword

Agent version

v4.14.0

All

agent_id

agent.id

keyword

Unique ID of the agent

001

All

pid

process.pid

long

PID of the process

603

All

name

process.name

keyword

Name of the process

rsyslogd

All

state

process.state

keyword

State of the process

S

Linux/macOS

ppid

process.parent.pid

long

PPID of the process

1

All

utime

process.utime

long

Time spent executing user code

157

Linux

stime

process.stime

long

Time spent executing system code

221

All

cmd

process.command_line

keyword

Command executed

/usr/sbin/rsyslogd

Linux/Windows

argvs

process.args

keyword

Arguments of the process

-n

Linux

euser

N/A

N/A

Effective user

root

Linux/macOS

ruser

N/A

N/A

Real user

root

Linux/macOS

suser

N/A

N/A

Saved-set user

root

Linux

egroup

N/A

N/A

Effective group

root

Linux

rgroup

N/A

N/A

Real group

root

Linux/macOS

sgroup

N/A

N/A

Saved-set group

root

Linux

fgroup

N/A

N/A

Filesystem group name

root

Linux

priority

N/A

N/A

Kernel scheduling priority

20

All

nice

N/A

N/A

Nice value of the process

0

Linux/macOS

size

N/A

N/A

Size of the process

53030

All

vm_size

N/A

N/A

Total VM size (KB)

212120

All

resident

N/A

N/A

Resident set size of the process in bytes

902

Linux

share

N/A

N/A

Shared memory

814

Linux

start_time

process.start

date

Time when the process started

1893

Linux

pgrp

N/A

N/A

Process group

603

Linux

session

N/A

N/A

Session of the process

603

All

nlwp

N/A

N/A

Number of light weight processes

3

All

tgid

N/A

N/A

Thread Group ID

603

Linux

tty

N/A

N/A

Number of TTY of the process

0

Linux

processor

N/A

N/A

Number of the processor

0

Linux

checksum

N/A

N/A

Integrity synchronization value

78503709147600c8e0023cf2b9995772280eee30

All

cluster_name

wazuh.cluster.name

keyword

Wazuh cluster name

wazuh

All

cluster_node

wazuh.cluster.node

keyword

Wazuh cluster node

node01

All

schema_version

wazuh.schema.version

keyword

Wazuh schema version

1.0

All

Windows updates

This scan collects details about the updates installed on Windows endpoints. The Vulnerability Detector module uses the hotfix identifier to discover what vulnerabilities exist on Windows endpoints and the patches you have applied. This information is stored in the sys_hotfixes table on the Wazuh server and indexed in the Wazuh indexer under the wazuh-states-inventory-hotfixes-* indices.

The table below maps the fields from the sys_hotfixes table on the Wazuh server database to their corresponding fields in the wazuh-states-inventory-hotfixes-* index on the Wazuh indexer.

Syscollector Field

Wazuh indexer field

Type

Description

Example

Available

scan_id

N/A

N/A

Identifier for the last syscollector scan

1618114744

Windows

scan_time

N/A

N/A

Scan date

2019/08/22 07:27:15

Windows

architecture

agent.host.architecture

keyword

Operating system architecture.

x86_64

All

agent_ip

agent.host.ip

ip

IP address of the agent

192.168.33.1

All

agent_name

agent.name

keyword

Name of the agent

wazuh

All

agent_version

agent.version

keyword

Agent version

v4.14.0

All

agent_id

agent.id

keyword

Unique ID of the agent

001

All

hotfix

package.hotfix.name

keyword

Name or identifier of the applied hotfix

KB4489899

Windows

checksum

N/A

N/A

Integrity synchronization value

78503709147600c8e0023cf2b9995772280eee30

Windows

cluster_name

wazuh.cluster.name

keyword

Wazuh cluster name

wazuh

All

cluster_node

wazuh.cluster.node

keyword

Wazuh cluster node

node01

All

schema_version

wazuh.schema.version

keyword

Wazuh schema version

1.0

All

Users

This scan collects user account information on monitored endpoints, including username, login status, and ID. The data is stored in the sys_users table on the Wazuh server and is indexed in the Wazuh indexer under the wazuh-states-inventory-users-* indices.

The table below maps the fields from the sys_users table on the Wazuh server to their corresponding fields in the wazuh-states-inventory-users-* index on the Wazuh indexer.

Syscollector field

Wazuh indexer field

Type

Description

Example

Available

scan_id

N/A

N/A

Identifier for the last syscollector scan

573872577

All

scan_time

N/A

N/A

Scan date

2018/07/31 15:31:26

All

architecture

agent.host.architecture

keyword

Operating system architecture

x86_64

All

agent_ip

agent.host.ip

ip

IP address of the agent

192.168.33.1

All

agent_name

agent.name

keyword

Name of the agent

wazuh

All

agent_version

agent.version

keyword

Agent version

v4.14.0

All

agent_id

agent.id

keyword

Unique ID of the agent

001

All

host_ip

host.ip

ip

Host ip addresses

192.168.1.2

All

login_status

login.status

boolean

Whether the login was successful or the user is currently logged in

true

All

login_tty

login.tty

keyword

Terminal associated with the login session (e.g., pts/1)

pts/1

All

login_type

login.type

keyword

Type of login session. Example values: "user", "system", "remote"

user

All

process_pid

process.pid

long

Process id

4242

All

user_auth_failures.count

user.auth_failures.count

integer

Number of failed authentication attempts

3

macOS

user_auth_failed_timestamp

user.auth_failures.timestamp

date

Timestamp of the last authentication failure

1714067165.0

macOS

user_created

user.created

date

Datetime when the user was created

2024-04-25T10:15:05.707Z

macOS

user_full_name

user.full_name

keyword

User's full name, if available

Albert Einstein

All

user_group_id

user.group.id

unsigned_long

Group ID

1001

All

user_group_id_signed

user.group.id_signed

long

Signed group ID

1001

All

user_groups

user.groups

keyword

List of groups the user belongs to

Test,Default,Sudo

All

user_home

user.home

keyword

Home directory of the user

/home/wazuh

All

user_id

user.id

keyword

Unique identifier of the user

S-1-5-21-202424912787-2692429404-2351956786-1000 | All

user_is_hidden

user.is_hidden

boolean

Whether the user is hidden

false

macOS

user_is_remote

user.is_remote

boolean

Whether the user is remote

true

Linux

user_last_login

user.last_login

date

Date of the last login

2025-05-21T12:10:04Z

All

user_name

user.name

keyword

Short name or login of the user

a.einstein

All

user_password_expiration_date

user.password.expiration_date

date

Password expiration date (epoch)

1

Linux

user_password_hash_algorithm

user.password.hash_algorithm

keyword

Algorithm used to hash the password

6

Linux

user_password_inactive_days

user.password.inactive_days

integer

Number of days of inactivity before disabling the password

1

Linux

user_password_last_change

user.password.last_change

date

Last time the password was changed (Unix epoch)

1714057168.4795

Linux, macOS

user_password_max_days_between_changes

user.password.max_days_between_changes

integer

Maximum days between password changes

99999

Linux

user_password_min_days_between_changes

user.password.min_days_between_changes

integer

Minimum days between password changes

0

Linux

user_password_status

user.password.status

keyword

Password status (e.g., active)

active

Linux

user_password_warning_days_before_expiration

user.password.warning_days_before_expiration

integer

Days before expiration to warn user

7

Linux

user_roles

user.roles

keyword

Roles assigned to the user

sudo

Linux, macOS

user_shell

user.shell

keyword

Shell used by the user

/bin/bash

All

user_type

user.type

keyword

Type of user (e.g., "system", "regular")

local

Windows

user_uid_signed

user.uid_signed

long

Signed user ID

1001

All

user_uuid

user.uuid

keyword

UUID (macOS) or SID (Windows)

D883AD4F-AF58-4BA6-AE07...

macOS, Windows

cluster_name

wazuh.cluster.name

keyword

Wazuh cluster name

wazuh

All

cluster_node

wazuh.cluster.node

keyword

Wazuh cluster node

node01

All

schema_version

wazuh.schema.version

keyword

Wazuh schema version

1.0

All

Groups

The scan collects details about user account groups on monitored endpoints, such as group identifiers, names, associated users. The data is stored in the sys_groups table on the Wazuh server and is indexed in the Wazuh indexer under the wazuh-states-inventory-groups-* indices.

The table below maps the fields from the sys_groups table on the Wazuh server to their corresponding fields in the wazuh-states-inventory-groups-* index on the Wazuh indexer.

Syscollector field

Wazuh indexer field

Type

Description

Example

Available

scan_id

N/A

N/A

Identifier for the last syscollector scan

573872577

All

scan_time

N/A

N/A

Scan date

2018/07/31 15:31:26

All

architecture

agent.host.architecture

keyword

Operating system architecture

x86_64

All

agent_ip

agent.host.ip

ip

IP address of the agent

192.168.33.1

All

agent_name

agent.name

keyword

Name of the agent

wazuh

All

agent_version

agent.version

keyword

Agent version

v4.14.0

All

agent_id

agent.id

keyword

Unique ID of the agent

001

All

group_description

group.description

keyword

Description of the group

Administrative group

macOS, Windows

group_id

group.id

unsigned_long

Unsigned Group ID

80

All

group_id_signed

group.id_signed

long

Signed Group ID

-80

All

group_is_hidden

group.is_hidden

boolean

Whether the group is hidden

false

All

group_name

group.name

keyword

Name of the group

admin

All

group_users

group.users

keyword

List of users that belong to the group

alice

All

group_uuid

group.uuid

keyword

Unique group ID

S-1-5-21-3623811015-...

Windows

cluster_name

wazuh.cluster.name

keyword

Wazuh cluster name

wazuh

All

cluster_node

wazuh.cluster.node

keyword

Wazuh cluster node

node01

All

schema_version

wazuh.schema.version

keyword

Wazuh schema version

1.0

All

Services

This scan collects services information from monitored endpoints, including service name, description and state. The data is stored in the sys_services table on the Wazuh server and is indexed in the Wazuh indexer under the wazuh-states-inventory-services-* indices.

The table below maps the fields from the sys_services table on the Wazuh server to their corresponding fields in the wazuh-states-inventory-services-* index on the Wazuh indexer.

Syscollector field

Wazuh indexer field

Type

Description

Example

Available

scan_id

N/A

N/A

Identifier for the last syscollector scan

573872577

All

scan_time

N/A

N/A

Scan date

2018/07/31 15:31:26

All

architecture

agent.host.architecture

keyword

Operating system architecture

x86_64

All

agent_ip

agent.host.ip

ip

IP address of the agent

192.168.33.1

All

agent_name

agent.name

keyword

Name of the agent

wazuh

All

agent_version

agent.version

keyword

Agent version

v4.14.0

All

agent_id

agent.id

keyword

Unique ID of the agent

001

All

error_log_file_path

error.log.file.path

keyword

Full path to the log file this event came from

/var/log/fun-times.log

All

file_path

file.path

keyword

Full path to the file, including the file name

/home/alice/example.png

Linux / macOS

log_file_path

log.file.path

keyword

Full path to the log file this event came from

/var/log/fun-times.log

macOS

process_args

process.args

keyword

Array of process arguments

["/usr/bin/ssh", "-l", "user", "10.0.0.16"]

macOS

process_executable

process.executable

keyword

Absolute path to the process executable

/usr/bin/ssh

All

process_group_name

process.group.name

keyword

Name of the group

admin

macOS

process_pid

process.pid

long

Process id

4242

All

process_root_directory

process.root_directory

keyword

Chroot directory before execution

macOS

process_user_name

process.user.name

keyword

Short name or login of the user

a.einstein

All

process_working_directory

process.working_directory

keyword

The working directory of the process

/home/alice

macOS

service_address

service.address

keyword

Path to the service DLL (ServiceDll)

172.26.0.2:5432

Windows

service_description

service.description

keyword

Description of the service

Apache HTTP Server

Windows / Linux

service_enabled

service.enabled

keyword

Whether the unit file is enabled, masked, disabled, etc

enabled

Linux / macOS

service_exit_code

service.exit_code

integer

Service-specific exit code on failure

0

Windows

services.win32_exit_code

service.win32_exit_code

integer

Service-specific exit code on failure

0

Windows

service_frequency

service.frequency

long

Frequency in seconds at which the service is run

3600

macOS

service_id

service.id

keyword

Unique identifier of the running service

d37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6

All

service_inetd_compatibility

service.inetd_compatibility

boolean

Run job as if launched from inetd

FALSE

macOS

service_name

service.name

keyword

Name of the service

elasticsearch-metrics

Windows / macOS

service_object_path

service.object_path

keyword

D-Bus object path of the service

/org/freedesktop/systemd1/unit/apache2_2eservice

Linux

service_restart

service.restart

keyword

Restart policy for the service, e.g. always, on-failure, never

on-failure

macOS

service_start_type

service.start_type

keyword

Service start type: BOOT_START, SYSTEM_START, AUTO_START, DEMAND_START, DISABLED

AUTO_START

Windows / macOS

service_starts_on_mount

service.starts.on_mount

boolean

Launches every time a filesystem is mounted

TRUE

macOS

service_starts_on_not_empty_directory

service.starts.on_not_empty_directory

keyword

Launches when directories become non-empty

[/var/spool/mail, /tmp/uploads]

macOS

service_starts_on_path_modified

service.starts.on_path_modified

keyword

Launches on path modification

['/var/log', '/etc/config']

macOS

service_state

service.state

keyword

Current state of the service.

inactive

All

service_sub_state

service.sub_state

keyword

The low-level unit activation state, values depend on unit type

running

All

service_target_address

service.target.address

keyword

Address of this service

/

Linux

service_target_ephemeral_id

service.target.ephemeral_id

keyword

Ephemeral identifier of this service

8a4f500f

Linux

service_target_type

service.target.type

keyword

The type of the service

notify

Linux

service_type

service.type

keyword

The type of the service

SHARE_PROCESS

Windows / macOS

service_win32_exit_code

service.win32_exit_code

integer

Win32 exit code on start/stop

0

Windows

cluster_name

wazuh.cluster.name

keyword

Wazuh cluster name

wazuh

All

cluster_node

wazuh.cluster.node

keyword

Wazuh cluster node name

node01

All

schema_version

wazuh.schema.version

keyword

Wazuh schema version

1.0

All

Browser extensions

This scan collects browser extensions details from monitored endpoints, including browser name, extension description and status. The data is stored in the sys_browser_extensions table on the Wazuh server and is indexed in the Wazuh indexer under the wazuh-states-inventory-browser-extensions-* indices.

The table below maps the fields from the sys_browser_extensions table on the Wazuh server to their corresponding fields in the wazuh-states-inventory-browser-extensions-* index on the Wazuh indexer.

Syscollector field

Wazuh indexer field

Type

Description

Example

Browser / OS

scan_id

N/A

N/A

Identifier for the last syscollector scan

573872577

All

scan_time

N/A

N/A

Scan date

2018/07/31 15:31:26

All

architecture

agent.host.architecture

keyword

Operating system architecture

x86_64

All

agent_ip

agent.host.ip

ip

IP address of the agent

192.168.33.1

All

agent_name

agent.name

keyword

Name of the agent

wazuh

All

agent_version

agent.version

keyword

Agent version

v4.14.0

All

agent_id

agent.id

keyword

Unique ID of the agent

001

All

browser_name

browser.name

keyword

Name of the browser. Valid values: chrome, chromium, opera, yandex, brave, edge, edge_beta.

chrome

All

browser_profile_name

browser.profile.name

keyword

Name of the browser profile

default

Chrome

browser_profile_path

browser.profile.path

keyword

Path to the browser profile

/home/user/.config/google-chrome/Default

Chrome

browser_profile_referenced

browser.profile.referenced

boolean

Indicates if the extension is referenced by the Preferences file of the browser profile

TRUE

Chrome

file_hash_sha256

file.hash.sha256

keyword

SHA256 hash

848f07be3c32aa5a4f23670b99b48ff34e7c9eb51af137d61832feb244ba6132

Chrome

package_autoupdate

package.autoupdate

boolean

Indicates if the browser extension is set to auto-update.

TRUE

Firefox

package_build_version

package.build_version

keyword

Build version information

36f4f7e89dd61b0988b12ee000b98966867710cd

Safari

package_description

package.description

keyword

Description of the package

Open source programming language to build simple/reliable/efficient software

All

package_enabled

package.enabled

boolean

Indicates if the browser extension is enabled

TRUE

Chrome, Firefox

package_from_webstore

package.from_webstore

boolean

Indicates if the browser extension was installed from a webstore

TRUE

Chrome

package_id

package.id

keyword

Unique identifier for the browser extension

com.example.extension

All

package_installed

package.installed

date

Time when package was installed

Oct 22, 2025 @ 18:16:37.000

Chrome

package_name

package.name

keyword

Package name

Data Leak Blocker

All

package_path

package.path

keyword

Path where the package is installed

/usr/local/Cellar/go/1.12.9/

All

package_permissions

package.permissions

keyword

Permissions required by the browser extension

["tabs", "storage"]

Chrome

package_persistent

package.persistent

boolean

Indicates if the browser extension is persistent accross tabs

TRUE

Chrome

package_reference

package.reference

keyword

Package home page or reference URL

https://golang.org

Chrome

package_type

package.type

keyword

Package type

theme

Firefox

package_vendor

package.vendor

keyword

Vendor, author or creator of the browser extension

Example Inc.

Chrome, Firefox, Safari

package_version

package.version

keyword

Package version

1.12.9

All

package_visible

package.visible

boolean

Indicates if the browser extension is visible in the toolbar.

TRUE

Firefox

user_id

user.id

keyword

Unique identifier of the user

S-1-5-21-202424912787-2692429404-2351956786-1000

All except IE

cluster_name

wazuh.cluster.name

keyword

Wazuh cluster name

wazuh

All

cluster_node

wazuh.cluster.node

keyword

Wazuh cluster node name

node01

All

schema_version

wazuh.schema.version

keyword

Wazuh schema version

1.0

All